Detected by Coverity.

Error: NULL_RETURNS:
lib/http2.c:1301: returned_null: "strchr" returns null (checked 103 out of 109 times).
lib/http2.c:1301: var_assigned: Assigning: "hdbuf" = null return value from "strchr".
lib/http2.c:1302: dereference: Incrementing a pointer which might be null: "hdbuf".
1300|
1301|     hdbuf = strchr(hdbuf, 0x0a);
1302|->   ++hdbuf;
1303|
1304|     authority_idx = 0;

- Fix the VerifyVersionInfo calls, which we use to test for the OS major
version, to also test for the minor version as well as the service pack
major and minor versions.

MSDN: "If you are testing the major version, you must also test the
minor version and the service pack major and minor versions."

https://msdn.microsoft.com/en-us/library/windows/desktop/ms725492.aspx

Bug: https://github.com/bagder/curl/pull/353#issuecomment-123493098


Reported-by: Marcel Raad <MarcelRaad@users.noreply.github.com>

Addition of new procedures curl_pushheader_bynum and curl_pushheader_byname
requires VERSIONINFO updating.

They should not trigger, but in case of internal problems we at least
avoid crashes this way.

New tool option --ssl-no-revoke.
New value CURLSSLOPT_NO_REVOKE for CURLOPT_SSL_OPTIONS.

Currently this option applies only to WinSSL where we have automatic
certificate revocation checking by default. According to the
ssl-compared chart there are other backends that have automatic checking
(NSS, wolfSSL and DarwinSSL) so we could possibly accommodate them at
some later point.

Bug: https://github.com/bagder/curl/issues/264


Reported-by: zenden2k <zenden2k@gmail.com>

.. also fix some typos in test's FILEFORMAT spec.

Static analysis indicated that my commit 9008f3d5 ("ntlm_wb: Fix
hard-coded limit on NTLM auth packet size") introduced a potential
memory leak on an error path, because we forget to free the buffer
before returning an error.

Fix this.

Although actually, it never happens in practice because we never *get*
here with state == NTLMSTATE_TYPE1. The state is always zero. That
might want cleaning up in a separate patch.

Reported-by: Terri Oda

This prevents valgrind from reporting possibly lost memory that NSPR
uses for file descriptor cache and other globally allocated internal
data structures.

Reported-by: Štefan Kremeň

setup-vms.h: More symbols for SHA256, hacks for older VAX

openssl.h: Use OpenSSL OPENSSL_NO_SHA256 macro to allow building on VAX.

openssl.c: Use OpenSSL version checks and OPENSSL_NO_SHA256 macro to
allow building on VAX and 64 bit VMS.

setup-vms.h: Symbol case fixups submitted by Michael Steve

build_gnv_curl_pcsi_desc.com: VSI aka as VMS Software, is now the
supplier of new versions of VMS.  The install kit needs to accept
VSI as a producer.

This change necessary for binary compatibility.

Prior to this change test 1135 failed due to the order of functions.

Prior to this change test 1119 failed due to the missing symbols.

For security reasons, until there is a fix.

Bug: http://curl.haxx.se/mail/lib-2015-06/0143.html
Reported-by: Gustavo Grieco, Feist Josselin

Just to underscore how we treat each other in this project. Nothing new
really, but could be useful for newcomers and outsiders to see our
values.

Flush the header stream when -D is used so that they are sent off
earlier.

Bug: https://github.com/bagder/curl/issues/324
Reported-by: Cédric Connes

Reported-by: bemoody
Bug: https://github.com/bagder/curl/issues/325

Since we do prefix match using given header by application code
against header name pair in format "NAME:VALUE", and VALUE part can
contain ":", we have to careful about existence of ":" in header
parameter.  ":" should be allowed to match HTTP/2 pseudo-header field,
and other use of ":" in header must be treated as error, and
curl_pushheader_byname should return NULL.  This commit implements
this behaviour.