Builder curl-threaded-solaris11-i386 Build #5072

Results:

Build successful

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-curl-threaded-solaris11-i386' triggered this build

Steps and Logfiles:

1. git update ( 17 secs )
   1. stdio
2. Runtest './tests/testcurl.pl --nogitpull ...' ( 57 mins, 25 secs )
   1. stdio
   2. resultlog
3. Mail result 'cat resultlog ...' ( 9 secs )
   1. stdio

Build Properties:

Forced Build Properties:

Responsible Users:

1. Daniel Stenberg

   danielohnoyoudont@haxx.se
2. Stefan Eissing

   stefanohnoyoudont@eissing.org

Timing:

All Changes:

:

1. Change #266975

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Wed 13 May 2026 13:12:10
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	b2476a07128fc1e83a0b322fe6eb9dfa761db53d

   Comments

   tool_urlglob: check glob use before access
   As this function can now be invoked with only the second glob "active",
   it must avoid accessing the first one if not in use.
   
   Follow-up to 2238f0921cb00b3395847
   
   Spotted by Codex Security
   
   Closes #21586

   Changed files

   • src/tool_urlglob.c

2. Change #266981

   Category	curl
   Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
   Changed at	Wed 13 May 2026 14:04:17
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	5e99b73cf441d9c369768b9cd48b5389b9a2503d

   Comments

   creds: add sasl service name
   The SASL service name, used in authentication, is part of curl's credentials
   when authenticating to a server/proxy. Make it part of `struct Curl_creds`.
   
   Change code to use `creds` to obtain a service name. By tying creds used
   to the connection, connection reuse is also only allowed when the service
   name matches.
   
   Closes #21585

   Changed files

   • lib/creds.c
   • lib/creds.h
   • lib/curl_sasl.c
   • lib/http_negotiate.c
   • lib/http_ntlm.c
   • lib/imap.c
   • lib/netrc.c
   • lib/openldap.c
   • lib/pop3.c
   • lib/socks.c
   • lib/socks.h
   • lib/socks_gssapi.c
   • lib/socks_sspi.c
   • lib/url.c
   • lib/vauth/digest.c
   • lib/vauth/digest_sspi.c
   • lib/vauth/krb5_gssapi.c
   • lib/vauth/krb5_sspi.c
   • lib/vauth/ntlm.c
   • lib/vauth/ntlm_sspi.c
   • lib/vauth/spnego_gssapi.c
   • lib/vauth/spnego_sspi.c
   • lib/vauth/vauth.h
   • tests/unit/unit1304.c

3. Change #266986

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Wed 13 May 2026 14:34:08
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	11df1251e550c5b4b77a4c66bca96cbbc09cdcc4

   Comments

   snpego_sspi: preserve distinction btw policy-only and uncond delegation
   CURLOPT_GSSAPI_DELEGATION exposes distinct modes:
   CURLGSSAPI_DELEGATION_POLICY_FLAG is documented as delegating only when
   OK-AS-DELEGATE policy permits it, while CURLGSSAPI_DELEGATION_FLAG is
   unconditional. The new SSPI implementation checks for either bit and
   sets ISC_REQ_DELEGATE, so a caller requesting policy-limited delegation
   is put on the same SSPI path as unconditional delegation.
   
   In addition, curl's existing protection that avoids reusing a connection
   when the GSS delegation setting differs was guarded only by HAVE_GSSAPI;
   SSPI-only builds now have an effective delegation option, but the
   connection's delegation setting was neither copied nor compared. This
   would cause Windows SSPI Negotiate/Kerberos authentication to delegate
   credentials contrary to the caller's selected policy or reuse an
   already-delegated authenticated connection for a transfer that requested
   no delegation.
   
   Follow-up to cc6777d939976b2f322dcbe5a
   
   Reported by Codex Security
   Closes #21583

   Changed files

   • lib/url.c
   • lib/vauth/spnego_sspi.c

4. Change #266987

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Wed 13 May 2026 14:34:54
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	b079595f2e903b820a027a68ea5c4c1e6697038b

   Comments

   url: keep the question mark for empty queries
   Reported-by: Bill Mill
   Fixes #21544
   
   Verified by test 1721
   
   Closes #21584

   Changed files

   • lib/url.c
   • tests/data/Makefile.am
   • tests/data/test1721