CVE-2016-5420
Bug: https://curl.haxx.se/docs/adv_20160803B.html

CVE-2016-5419
Bug: https://curl.haxx.se/docs/adv_20160803A.html
Reported-by: Bru Rom
Contributions-by: Eric Rescorla and Ray Satiro

CVE-2016-5421
Bug: https://curl.haxx.se/docs/adv_20160803C.html
Reported-by: Marcelo Echeverria and Fernando Muñoz

Closes #835

Closes #768

Closes #662

Closes #885

This patch is necessary so that curl compiles if MBEDTLS_DEBUG is
defined.

Bug: https://curl.haxx.se/mail/lib-2016-08/0001.html

Apparently due to a broken homebrew install

fixes #934
Closes #939

If a call to GetSystemDirectory fails, the `path` pointer that was
previously allocated would be leaked. This makes sure that `path` is
always freed.

Closes #938

Many applications assume the actual contents of the public types and use
that do for example forward declarations (saving them from including our
public header) which then breaks when we switch from void * to a struct
*.

I'm not convinced we were wrong, but since this practise seems
widespread enough I'm willing to (partly) step down.

Now libcurl uses the struct itself when it is built and it allows
applications to use the struct type if CURL_STRICTER is defined at the
time of the #include.

Reported-by: Peter Frühberger
Fixes #926

The check_library_exists_concat do not check crypt32 library properly.
So include it directly.

Bug: https://github.com/curl/curl/pull/917
Reported-by: Yonggang Luo

Bug: https://github.com/curl/curl/issues/935
Reported-by: Alain Danteny

Didn't work.

This reverts commit 50723585.

CI is failing due to missing libtoolize, so I'm trying this.

merged #931

Do not log compilation informational messages.

Bug: https://curl.haxx.se/mail/lib-2016-07/0070.html
Reported-by: Paul Howarth

As SPNEGO is only defined when these pre-processor variables are defined
there is no need to query them explicitly.

Typo introduced in commit ad5e9bfd.

... and make the distros link a proper link

Embedded manifest option didn't work due to typo.

Reported-by: Stefan Kanthak

This is a follow up to the parent commit dcdd4be3 which fixes one leak
but creates another by failing to free the credentials handle if out of
memory. Also there's a second location a few lines down where we fail to
do same. This commit fixes both of those issues.

This patch allocates memory to "output_token" only when it is required
so that memory is not leaked if function returns.

Follow-up commit to c5098080 to make this test pass.

- Linux TFO + TLS is not implemented yet.

Bug: https://github.com/curl/curl/issues/907

- Curl_ipv6works() is not thread-safe until after the first call, so
call it once during global init to avoid a possible race condition.

Bug: https://github.com/curl/curl/issues/915
PR: https://github.com/curl/curl/pull/918