Builder curl-threaded-solaris10-i386 Build #4303

Results:

Failed runtest

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-curl-threaded-solaris10-i386' triggered this build

Steps and Logfiles:

1. git update ( 3 secs )
   1. stdio
2. Runtest './tests/testcurl.pl --nogitpull ...' failed ( 4 hrs, 59 mins, 28 secs )
   1. stdio
   2. resultlog
3. Mail result 'cat resultlog ...' ( 0 secs )
   1. stdio

Build Properties:

Forced Build Properties:

Responsible Users:

1. Daniel Stenberg

   danielohnoyoudont@haxx.se
2. Stefan Eissing

   stefanohnoyoudont@eissing.org
3. Viktor Szakats

   commitohnoyoudont@vsz.me

Timing:

All Changes:

:

1. Change #262527

   Category	curl
   Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
   Changed at	Fri 27 Mar 2026 14:19:31
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	351e4f956a11bdf419c14f1f69758a15e77e7fea

   Comments

   mk-ca-bundle.pl: drop reproducible timestamp feature
   Mozilla may push to its repo much later than the commit date, which can
   be a source of confusion when using the reproducible timestamp (which is
   determined by the commit date) by default. Example:
   
   https://curl.se/ca/cacert-2026-03-19.pem vs.
   https://github.com/mozilla-firefox/firefox/commits/1a84aee6387d2f9c9531c655edeea4a80aa0fcfa/security/nss/lib/ckfw/builtins/certdata.txt
   
   This feature had no actual user (or a planned one) from within curl at
   the moment, and not requested by curl users. curl-for-win does this on
   its own, which is the more practical way there since everything (not
   just the CA bundle) needs to be reproducible anyway. I surmise this may
   be true for most if not all reproducible use-cases.
   
   Another limitation was that it could bump into GitHub's rate limiting,
   needing further updates.
   
   Also: code had some unintented leftovers.
   
   Reported-by: Daniel Stenberg
   Bug: https://github.com/curl/curl/pull/20528#issuecomment-4140610008
   Follow-up to ca92e20123928e4788d27135cdafdd084d3833d4 #20528
   
   Closes #21116

   Changed files

   • scripts/mk-ca-bundle.pl

2. Change #262528

   Category	curl
   Changed by	Stefan Eissing <stefanohnoyoudont@eissing.org>
   Changed at	Fri 27 Mar 2026 14:23:29
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	2e8c922a89153083227a8f6b737f15bbe9fe1446

   Comments

   http2: prevent secure schemes pushed over insecure connections
   When assembling the URL of a pushed resource over a not-secured
   connection, require the scheme to be known and not secure.
   
   Reported-by: xkilua on hackerone
   
   Closes #21113

   Changed files

   • lib/http2.c

3. Change #262546

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Fri 27 Mar 2026 15:54:22
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	28fbf4a87d81107ef548137b75b4f7ef01c4a75c

   Comments

   multi: fix connection retry for non-http
   non-HTTP protocols no longer retry after connection reuse failures
   because multi_follow() now requires a handler->follow callback that is
   NULL for those protocols. Provide a fallback for plain retries.
   
   Follow-up to 1213c312722f93b7856d2
   
   Spotted by Codex Security
   
   Closes #21121

   Changed files

   • lib/multi.c

4. Change #262547

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Fri 27 Mar 2026 15:56:12
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	86b39c2226d7114c7720230b5662aa352e1e631f

   Comments

   transfer: clear the URL pointer in OOM to avoid UAF
   Since the pointer can be extracted with CURLINFO_EFFECTIVE_URL later it
   must not linger pointing to freed memory.
   
   Found by Codex Security
   
   Closes #21123

   Changed files

   • lib/transfer.c

5. Change #262549

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Fri 27 Mar 2026 16:12:51
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	ff678be69a57ee9809adf37d759f8826507ffe0a

   Comments

   libssh: propagate error back in SFTP function
   The myssh_in_SFTP_READDIR_BOTTOM() function would not store the error
   code correctly thus it could be ignored and missed when an error was
   returned at that particular moment.
   
   Follow-up to 3c26e6a896247ccf872d3f1
   
   Found by Codex Security
   
   Closes #21122

   Changed files

   • lib/vssh/libssh.c

6. Change #262556

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Fri 27 Mar 2026 16:50:28
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	d7d683c3ba3ebfa4c3e31926417f92a64686e1d0

   Comments

   tool_cb_hdr: use the file descriptor instead of calling fileno() again
   Follow-up to 6041b9b11b904c6430
   
   Closes #21126

   Changed files

   • src/tool_cb_hdr.c

7. Change #262557

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Fri 27 Mar 2026 16:51:07
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	4f316230fd7dab9fba2518df2529204302e193eb

   Comments

   tool_util: fix the ftruncate use for DJGPP
   Follow-up to 6041b9b11b904c64305eb6c3f4
   
   Since we define ftruncate as a macro, we can't use the macro within
   the function!
   
   Closes #21125

   Changed files

   • src/tool_util.c