The multiply() function that is used to avoid integer overflows, was
itself reason for a possible division by zero error when passed a
specially formatted glob.

Reported-by: GwanYeong Kim

Don't malloc() the temporary buffer, and use the correct type:
SearchPath() works with TCHAR, but SearchPathA() works with char.
Set the buffer size to MAX_PATH, because the terminating null byte
is already included in MAX_PATH.

Reviewed-by: Daniel Stenberg
Reviewed-by: Marcel Raad

Closes #1548

Closes #1561

Reported-by: Marcel Raad
Bug: https://github.com/curl/curl/commit/cccac4fb2b20d6ed87da7978408c3ecacc464fe4#commitcomment-22453387

... and return error instead of triggering an assert() when being way
out of range.

Previously, one had to set MBEDTLS_INCLUDE_DIR to make CMake find the
headers, but the system complained that mbed TLS wasn't found due to
MBEDTLS_INCLUDE_DIRS (note the trailing s) was not set. This commit
attempts to fix that.

Closes https://github.com/curl/curl/pull/1541

Closes #1557

With the introduction of expire IDs and the fact that existing timers
can be removed now and thus never expire, the concept with adding a
"latest" timer is not working anymore as it risks to not expire at all.

So, to be certain the timers actually are in line and will expire, the
plain Curl_expire() needs to be used. The _latest() function was added
as a sort of shortcut in the past that's quite simply not necessary
anymore.

Follow-up to 31b39c40

Reported-by: Paul Harris

Closes #1555

Bug: https://curl.haxx.se/mail/lib-2017-06/0017.html

... as it would previously just get the "now" timestamp before the
transfer starts and then not update it again.

Closes #1550

typecheck-gcc and other things require optimized builds

Closes #1544

mk-lib1521.pl generates a test program (lib1521.c) that calls
curl_easy_setopt() for every known option with a few typical values to
make sure they work (ignoring the return codes).

Some small changes were necessary to avoid asserts and NULL accesses
when doing this.

The perl script needs to be manually rerun when we add new options.

Closes #1543

These error messages are not displayed with --disable-verbose

This was the only remaining use of toupper in the entire source code.

Suggested-by: Daniel Stenberg

Otherwise, clang on Cygwin64 warns:
curl_ntlm_core.c:525:35: error: array subscript is of type 'char'
[-Werror,-Wchar-subscripts]
    dest[2 * i] = (unsigned char)(toupper(src[i]));
                                  ^~~~~~~~~~~~~~~
/usr/include/ctype.h:152:25: note: expanded from macro 'toupper'
      (void) __CTYPE_PTR[__x]; (toupper) (__x);})
                        ^~~~

Closes https://github.com/curl/curl/pull/1539

Closes #1534

GCC 7 complained:
‘*’ in boolean context, suggest ‘&&’ instead [-Wint-in-bool-context]

This fixes the following warning with CURL_DISABLE_CRYPTO_AUTH,
as seen in the autobuilds:

curl_sasl.c:417:9: warning: unused variable 'serverdata'
[-Wunused-variable]

cyassl/ssl.h needs the macros from cyassl/options.h, so define them
before including cyassl/ssl.h the first time, which happens in
urldata.h.
This broke the build on Ubuntu Xenial, which comes with WolfSSL 3.4.8
and therefore redefines the symbols from cyassl/options.h instead of
including the header.

Closes https://github.com/curl/curl/pull/1536

Closes #1532

Found when updating test 1395, which I did to increase test coverage of
this source file...

Closes #1535

mbedtls_x509_crt_profile_fr is only used locally.
This fixes a missing-variable-declarations warning with clang.