Curl_follow() no longer frees the string. Make sure it happens in the
caller function, like we normally handle allocations.

This bug was introduced with the use of the URL API internally, it has
never been in a release version

Reported-by: Dario Weißer
Closes #3149

Otherwise, closing that handle can still cause surprises!

Reported-by: Martin Ankerl
Fixes #3138
Closes #3147

The Visual Studio builds didn't use IPv6. Add it to all projects since
Visual Studio 2008, which is verified to build via AppVeyor.

Closes https://github.com/curl/curl/pull/3137

As done in the autotools and CMake builds by default.

Closes https://github.com/curl/curl/pull/3137

Closes #3144

Detected by Coverity.

Closes #3140
Reviewed-by: Jay Satiro

... now there's only BountyGraph.

For IP addresses in the subject alternative name field, the length
of the IP address (and hence the number of bytes to perform a
memcmp on) is incorrectly calculated to be zero. The code previously
subtracted q from name.end. where in a successful case q = name.end
and therefore addrlen equalled 0. The change modifies the code to
subtract name.beg from name.end to calculate the length correctly.

The issue only affects libcurl with GSKit SSL, not other SSL backends.
The issue is not a security issue as IP verification would always fail.

Fixes #3102
Closes #3141

Commit 57348eb9

 added support for the
MesaLink vtls backend, but missed updating the TLS section containing
supported backends in the docs.

Closes #3134
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

If USE_BLOCKING_SOCKETS is defined, curlx_nonblock's arguments are not
used.

Closes #3124

Ref: https://rawgit.com/ "RawGit has reached the end of its useful life"
Ref: https://news.ycombinator.com/item?id=18202481
Closes https://github.com/curl/curl/pull/3131

[ci skip]

and remove BOM from projects/wolfssl_override.props

Closes #3126

Accidentally aded in commit 1bb86057.

Reported-by: Viktor Szakats
Ref: https://github.com/curl/curl/pull/3120#issuecomment-428673136

- link TLS 1.2 and TLS 1.3 options
- link proxy and non-proxy options

Closes #3121

Removed in ae762e1a, accidentally added
again in 9f3be567.

As done in the autotools build. This is required for MinGW, which
supports only %I64 for printing 64-bit values, but warns about it.

Closes https://github.com/curl/curl/pull/3120

Also add a unique but common text ('bind via') to make it
easy to grep this specific failure regardless of platform.

Ref: https://github.com/curl/curl/pull/878/files#diff-7a636f08047c4edb53a240f540b4ecf6R468
Closes https://github.com/curl/curl/pull/3118


Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>

Changes s/OSCP/OCSP/ and bumps the copyright year due to the change.

This avoids an ERROR macro clash between <wingdi.h> and <arpa/tftp.h>
on MinGW.

Closes https://github.com/curl/curl/pull/3113

Classic MinGW has neither InitializeCriticalSectionEx nor
GetTickCount64, independent of the target Windows version.

Closes https://github.com/curl/curl/pull/3113

Closes #3112
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

as detected by codespell 1.14.0

Closes https://github.com/curl/curl/pull/3114


Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com>

... when they return NULL we're out of memory and MUST return failure.

closes #3111

Bug bounty explainer. See https://bountygraph.com/programs/curl

Closes #3067

Closes #3110

Now FILE transfers send headers to the header callback like HTTP and
other protocols. Also made curl_easy_getinfo(...CURLINFO_PROTOCOL...)
work for FILE in the callbacks.

Makes "curl -i file://.." and "curl -I file://.." work like before
again. Applied the bold header logic to them too.

Regression from c1c27625 (7.61.0)

Reported-by: Shaun Jackman
Fixes #3083
Closes #3101

In case a very small buffer was passed to the version function, it could
result in the buffer not being NULL-terminated since strncpy() doesn't
guarantee a terminator on an overflowed buffer. Rather than adding code
to terminate (and handle zero-sized buffers), move to using snprintf()
instead like all the other vtls backends.

Closes #3105
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
Reviewed-by: Viktor Szakats <commit@vszakats.net>

Add DYLD_INSERT_LIBRARIES support to the TODO list. Reported in #2394.

The LD_PRELOAD functionality doesn't exist on macOS, so skip any tests
requiring it.

Fixes #2394
Closes #3106
Reported-by: Github user @jakirkham
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

This enables more tests.

Closes https://github.com/curl/curl/pull/3104

Closes https://github.com/curl/curl/pull/3104

Use the oldest and latest Windows SDKs for them.
Also, remove all but one OpenSSL build.

Closes https://github.com/curl/curl/pull/3104

This adds Visual Studio 9 and 10 builds.
There's no 64-bit VC9 compiler on AppVeyor, so use it as the Win32
build. Also, VC9 cannot be used for running the test suite.

Closes https://github.com/curl/curl/pull/3104