Builder wget-solaris10-sparc Build #573

Results:

Failed shell shell_1 shell_2 shell_3

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-wget-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 45 secs )
   1. stdio
2. shell 'bash bootstrap' failed ( 47 secs )
   1. stdio
3. shell_1 './configure' failed ( 0 secs )
   1. stdio
   2. src/config.h
   3. config.log
4. shell_2 'gmake' failed ( 0 secs )
   1. stdio
5. shell_3 'gmake check' failed ( 0 secs )
   1. stdio
   2. tests-unit-tests.log
   3. tests-test-suite.log
   4. testenv-test-suite.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Acts1631

   acts1611kjvohnoyoudont@proton.me
2. Acts1631

   acts1631kjvohnoyoudont@proton.me
3. ChenYanpan

   chenyanpanohnoyoudont@xfusion.com
4. Michal Ruprich

   michalruprichohnoyoudont@gmail.com
5. Tim Rühsen

   tim.ruehsenohnoyoudont@gmx.de

Timing:

All Changes:

:

1. Change #273698

   Category	wget
   Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
   Changed at	Thu 02 Jul 2026 13:23:46
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	f76978a51ba9365e7ecaed96c1cfb73197a38ca2

   Comments

   Regression: Fix buffer overflow in html_quote_string()
   The regression has been introduced in commit dd692d9 and
   is not part of any release.
   
   The tests allow the address sanitizer to find the issue.
   
   * src/convert.c: Fix string size calculation.
   * tests/unit-tests.c: Added tests including tests for html_quote_string().
   * tests/unit-tests.h: Add definitions for the test functions.
   
   Reported-by: Trung Nguyen <trungnh@cystack.net>

   Changed files

   • src/convert.c
   • tests/unit-tests.c
   • tests/unit-tests.h

2. Change #274105

   Category	wget
   Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
   Changed at	Sun 05 Jul 2026 18:19:52
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	c4face2b2be86149602aca7fe14af86d41971327

   Comments

   * .gitlab-ci.yml: Set 10m timeout for the MinGW job
   Because the job randomly hangs, and default timeout is 1h.

   Changed files

   • .gitlab-ci.yml

3. Change #274106

   Category	wget
   Changed by	Acts1631 <acts1631kjvohnoyoudont@proton.me>
   Changed at	Sun 05 Jul 2026 18:20:07
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	b9c6ee8a17c82d0546d27d2c6851d9d144899e05

   Comments

   cookies.c: reject cookie instead of discarding jar entry on domain mismatch
   When a Set-Cookie header specifies a domain attribute that fails
   check_domain_match() against the responding host, cookie_handle_set_cookie()
   set cookie->discard_requested = true but continued processing instead of
   rejecting the cookie outright. Since discard_requested causes
   discard_matching_cookie() to be invoked later using the attacker-supplied
   (victim) domain, name, path and port, a malicious server could delete an
   arbitrary cookie belonging to any other domain from wget's cookie jar,
   simply by sending a Set-Cookie header naming that domain along with a
   matching path/name/port.
   
   Fix this by immediately jumping to the cleanup path (as already done for
   the analogous path-mismatch case a few lines below) when the domain check
   fails, so a cookie from an unauthorized domain never reaches the jar
   discard/store logic.
   
   * src/cookies.c (cookie_handle_set_cookie): Goto out.
   
   Copyright-paperwork-exempt: Yes

   Changed files

   • src/cookies.c

4. Change #274348

   Category	wget
   Changed by	ChenYanpan <chenyanpanohnoyoudont@xfusion.com>
   Changed at	Wed 08 Jul 2026 14:16:47
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	7b1cdecc49bc77bde220fc575c8a00386c3f3bcf

   Comments

   * src/metalink.c (clean_metalink_string): Fix inverted trailing-space check
   37a40fcb added an `end > beg' bound guard to prevent a buffer
   underflow, but accidentally flipped the condition from `isspace' to
   `!isspace'. The loop therefore walked back over non-space characters
   instead of trailing whitespace, collapsing any string without a
   trailing newline to "". Every Metalink/HTTP resource URL was wiped,
   so wget could not follow any mirror and
   testenv/Test-metalink-http.py failed ("Expected file test.meta not
   found"). Restore the `isspace' condition.
   
   Copyright-paperwork-exempt: Yes

   Changed files

   • src/metalink.c

5. Change #274392

   Category	wget
   Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
   Changed at	Thu 09 Jul 2026 15:04:20
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	f8c142cfd7998e09db36a04213c368bb651c6583

   Comments

   * gitlab-ci.yml: Build and use libmetalink

   Changed files

   • .gitlab-ci.yml

6. Change #274393

   Category	wget
   Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
   Changed at	Thu 09 Jul 2026 15:04:20
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	82d945ff5dc9942b78b2bf736aac298c24fe00a1

   Comments

   * src/metalink.c: Include ctype.h

   Changed files

   • src/metalink.c

7. Change #274407

   Category	wget
   Changed by	Acts1631 <acts1631kjvohnoyoudont@proton.me>
   Changed at	Thu 09 Jul 2026 19:27:20
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	6b17faf864162e16435c837cec25537b8fa4a61b

   Comments

   http: reject chunk-size values that overflow wgint
   * src/http.c (skip_short_body): Check overflow.
   * src/retr.c (fd_read_body): Check overflow.
   
   Both fd_read_body() (src/retr.c) and skip_short_body() (src/http.c)
   parse the hex chunk-size line of a chunked-encoded HTTP response with
   strtol() and only check the result for being negative.  strtol()
   returns 'long', which silently clamps to LONG_MAX and sets
   errno = ERANGE when the input overflows; that errno was never checked.
   
   A malicious or compromised HTTP server can therefore send a chunk-size
   line such as "FFFFFFFFFFFFFFFF" and have wget treat it as a chunk of
   essentially unbounded size (up to LONG_MAX/INT64_MAX bytes) instead of
   rejecting it as a malformed response.  As long as the server keeps
   trickling bytes (each successful read resets the read-timeout), wget
   will keep reading indefinitely, which is a remote denial of service.
   
   Switch both call sites to str_to_wgint() (strtoll(), matching the
   64-bit wgint type used to store the result on all platforms, including
   those where long is 32-bit) and check errno for ERANGE in addition to
   the existing negative-value check, clearing errno first so a stale
   value cannot cause a false positive.
   
   Verified with a fake HTTP server sending Transfer-Encoding: chunked
   with a first chunk-size line of FFFFFFFFFFFFFFFF followed by a stream
   of data: before the fix wget accepts the bogus size and keeps reading
   everything sent to it as part of that single chunk; after the fix it
   immediately aborts with Read error ... (Numerical result out of
   range) instead of hanging.  Legitimate chunked responses continue to
   be handled correctly, and the existing HTTP test suite (50 tests)
   still passes.
   
   Copyright-paperwork-exempt: Yes

   Changed files

   • src/http.c
   • src/retr.c

8. Change #274408

   Category	wget
   Changed by	Acts1631 <acts1631kjvohnoyoudont@proton.me>
   Changed at	Thu 09 Jul 2026 19:47:42
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	6b5166521a95318648a64d09dbf23b27d979ac4e

   Comments

   ftp: reject unsafe symlink targets in directory listings
   * src/ftp-ls.c: New function ftp_ls_unsafe_symlink_target(),
     (ftp_parse_unix_ls): Reject unsafe symlink targets.
   
   ftp_parse_unix_ls() copied the target of a symlink entry (the text
   after " -> " in a LIST response) verbatim into f->linkto, which is
   later passed straight to symlink() when recreating the remote
   directory tree locally (this only happens when the user has disabled
   the safe default with --retr-symlinks=no; see CVE-2014-4877).  Because
   the target was never validated, a malicious or compromised FTP server
   could use an absolute path or a "../" sequence to make Wget create a
   symlink pointing anywhere on the local filesystem.
   
   Add ftp_ls_unsafe_symlink_target() and reject any symlink entry whose
   target is an absolute path or contains a ".." path component (as an
   exact path component, not merely the substring "..", so names like
   "foo..bar" are unaffected).  The rejected entry is skipped, same as
   any other malformed listing line.
   
   Verified with a fake FTP server returning a LIST response with a
   symlink pointing to /tmp/opencode/evil_target and to
   ../../../../etc/passwd while running with -r --retr-symlinks=no:
   before the fix Wget creates the symlink outside the download tree;
   after the fix the entry is skipped with a debug message.  Legitimate
   relative symlinks (e.g. "somefile.txt", "foo..bar") continue to be
   created as before.
   
   Copyright-paperwork-exempt: Yes

   Changed files

   • src/ftp-ls.c

9. Change #274409

   Category	wget
   Changed by	Acts1631 <acts1631kjvohnoyoudont@proton.me>
   Changed at	Thu 09 Jul 2026 19:47:42
   Repository	https://gitlab.com/gnuwget/wget.git
   Project	wget
   Branch	master
   Revision	4f85853f641863d5915786a8413e1a213726a62b

   Comments

   ftp: validate PASV/LPSV response address against control connection peer
   * src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised
     address,
     (ftp_lpsv): Likewise.
   
   ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in
   the server's 227 response without checking that it matched the peer
   of the control connection.  A malicious or compromised FTP server
   could therefore direct wget's data connection to an arbitrary host and
   port of its choosing (e.g. an internal service unreachable from the
   attacker directly), which is a server-side request forgery.
   
   ftp_epsv() was already safe since it only extracts a port and reuses
   the pre-filled control-connection address.
   
   Fix ftp_pasv() and ftp_lpsv() the same way: capture the control
   connection's peer address via socket_ip_address() before parsing the
   response, and reject the response (FTPINVPASV) if the parsed address
   does not match.
   
   Verified with a fake FTP server that returns a PASV response pointing
   at a different loopback address (127.0.0.2 instead of the real peer
   127.0.0.1): before the fix wget connects to the spoofed address, after
   the fix it rejects the response with "Cannot parse PASV response."
   Legitimate transfers using a correctly-addressed PASV response
   continue to work.
   
   Copyright-paperwork-exempt: Yes

   Changed files

   • src/ftp-basic.c

10. Change #274420

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 20:43:24
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	17d5da075d3d04aa9d72e5e5eda48e824df13b29

    Comments

    * src/wget.h (DO_REALLOC): Avoid -Wpointer-arith warnings

    Changed files

    • src/wget.h

11. Change #274421

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 20:46:48
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	4cbdaa598e817c8e9eacf33b789d18de94ab5457

    Comments

    * src/main.c: Avoid -Wzero-as-null-pointer-constant

    Changed files

    • src/main.c

12. Change #274422

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 20:50:03
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	67d1686ae83a17ff1d81de62ce7d7df78e0274d0

    Comments

    * src/retr.c (retrieve_from_file): Remove unused variable

    Changed files

    • src/retr.c

13. Change #274423

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 20:51:39
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	471f625e05db1de876e41c3a70f22918705b79ce

    Comments

    * src/http.c (establish_connection): Avoid -Wzero-as-null-pointer-constant

    Changed files

    • src/http.c

14. Change #274424

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 21:02:57
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	705e9e3a749f9f0430c1fad9892227c210c66dee

    Comments

    * src/utils.c (xsleep): Avoid -Wfloat-conversion

    Changed files

    • src/utils.c

15. Change #274429

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 22:46:04
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	46531d7d4efc8760ef527b563006bd7aab521aa2

    Comments

    * src/init.h: Increase MAX_LONGOPTION to 27
    Fixes:
    main.c:330:14: warning: initializer-string for array of 'char' truncates NUL
     terminator but destination lacks 'nonstring' attribute (27 chars into 26
     available) [-Wunterminated-string-initialization]
      330 |     IF_SSL ( "ftps-clear-data-connection", 0, OPT_BOOLEAN, "ftpscleardataconnection", -1 )
          |              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Changed files

    • src/init.h

16. Change #274431

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 22:48:11
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	64fc592ad66a1fba5f968721f54c2a03749cd40a

    Comments

    * src/init.c (cleanup): Avoid -Wunterminated-string-initialization

    Changed files

    • src/init.c

17. Change #274432

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 22:58:03
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	600d8fe6bd7e0d4f6b573de529a9591383cfd343

    Comments

    Fix -Wmissing-variable-declarations
    * src/init.c: Remove extern timer and cleaned_up vars.
    * src/main.c: Declare hsts_store as extern.
    * src/wget.h: Declare cleaned_up, ares and timer vars as extern.

    Changed files

    • src/init.c
    • src/main.c
    • src/wget.h

18. Change #274433

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 23:01:51
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	c241000c1a2c9e1a655d940581efd8d802092161

    Comments

    * src/ftp.c (has_insecure_name_p): Avoid -Wzero-as-null-pointer-constant

    Changed files

    • src/ftp.c

19. Change #274434

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 23:23:57
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	c76a8c588ad9102763f0e516d325402a5ab8e771

    Comments

    * src/iri.c (do_conversion): Drop unused variable

    Changed files

    • src/iri.c

20. Change #274435

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 23:26:06
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	b081023a479579b1e34ef3878ab3fce652003f8f

    Comments

    * src/retr.c (fd_read_body): Avoid -Wzero-as-null-pointer-constant

    Changed files

    • src/retr.c

21. Change #274436

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 23:30:26
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	9d5cf9131242db406f3af6a1dbfadc69d995b19d

    Comments

    * tests/unit-tests.c: Avoid -Wzero-as-null-pointer-constant

    Changed files

    • tests/unit-tests.c

22. Change #274437

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Thu 09 Jul 2026 23:31:45
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	d00b2f2761507ba4f0471c84b2c6932bb0853f71

    Comments

    * tests/unit-tests.c: Remove redundant redeclarations

    Changed files

    • tests/unit-tests.c

23. Change #274528

    Category	wget
    Changed by	Acts1631 <acts1611kjvohnoyoudont@proton.me>
    Changed at	Sat 11 Jul 2026 17:51:43
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	bf87865276d3db0b917424dc47f797b7caf8aa36

    Comments

    http: scope cached Basic credentials to the origin
    * src/http.c: New function basic_auth_key(),
      (maybe_send_basic_creds): Make use of basic_auth_key(),
      (register_basic_auth_host): Likewise,
      (register_basic_auth_host): Change param hostname to struct url,
      (initialize_request): Amend calls to maybe_send_basic_creds() and
      register_basic_auth_host().
    
    Wget records completed Basic challenges in basic_authed_hosts using only the
    hostname. A subsequent request to the same hostname on another port
    automatically sends Basic credentials, even though the redirect logic
    correctly treats a port change as a different origin.
    
    An operator of a separately controlled service on an alternate port can obtain
    credentials intended for the first origin when an authenticated flow follows a
    URL to that port.
    
    This patch keys the Basic challenge cache by scheme, host, and port, ensuring
    credentials are not reused across origin boundaries.
    
    Copyright-paperwork-exempt: Yes

    Changed files

    • src/http.c

24. Change #274529

    Category	wget
    Changed by	Acts1631 <acts1611kjvohnoyoudont@proton.me>
    Changed at	Sat 11 Jul 2026 17:53:01
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	d82590289cfa1bc1b772ec5963d869c784189211

    Comments

    http: keep NTLM authorization on its original host
    * src/http.c (persistent_available_p): Check for different hosts on same
      authorized connection.
    
    For cleartext HTTP, Wget's persistent-connection optimization reuses a socket
    for a different hostname when that name resolves to the existing peer address.
    After NTLM authentication succeeds, Wget marks the socket authorized because
    NTLM is connection-bound. A request for the alternate virtual host can
    therefore run on the victim host's authenticated connection.
    
    This patch refuses a different-hostname reuse when the persistent connection
    is NTLM-authorized, forcing a new TCP connection.
    
    Copyright-paperwork-exempt: Yes

    Changed files

    • src/http.c

25. Change #274567

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Sun 12 Jul 2026 11:00:01
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	77b5ad4d25cd33fb24430275c1a8eab7d3c26706

    Comments

    * .gitlab-ci.yml (Tarball-Build): Remove second artifacts section

    Changed files

    • .gitlab-ci.yml

26. Change #274574

    Category	wget
    Changed by	Acts1631 <acts1611kjvohnoyoudont@proton.me>
    Changed at	Sun 12 Jul 2026 11:03:50
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	5a31b8481cf9144acdec71159ade7bba1fa97ee7

    Comments

    http: reject symlink replacement before retry writes
    * src/http.c (open_output_stream): Safely reopen download targets
      after a partial transfer.
    * src/ftp.c (getftp): Likewise.
    * src/utils.c (fopen_nofollow): New function.
    * src/utils.h: Declare it.
    
    After a partial HTTP or FTP transfer, Wget reopens the local target by
    pathname. An attacker who can modify the download directory can replace the
    partially written file with a symlink before that reopen, causing Wget to
    append to or overwrite the symlink target with its own privileges.
    
    Use an inode-checked reopen helper for existing regular files. It uses
    O_NOFOLLOW where available and validates the opened descriptor before writing
    or truncating it. A replacement symlink is rejected, and later pathname
    changes cannot redirect the already-open descriptor.
    
    When --start-pos requests a non-existent target, create it exclusively so the
    normal download path continues to work.
    
    Copyright-paperwork-exempt: Yes

    Changed files

    • src/ftp.c
    • src/http.c
    • src/utils.c
    • src/utils.h

27. Change #274792

    Category	wget
    Changed by	Acts1631 <acts1611kjvohnoyoudont@proton.me>
    Changed at	Mon 13 Jul 2026 02:15:39
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	a579e8617882a85e5920835c32ca7645c9181a61

    Comments

    hsts: normalize trailing-dot hostnames
    * src/hsts.c (hsts_canonical_host): New function.
      (hsts_find_entry, hsts_new_entry_internal, hsts_store_entry): Use
      canonical HSTS host keys.
      (test_hsts_url_rewrite_superdomain,
      test_hsts_url_rewrite_congruent): Test trailing-dot hostnames.
    
    Treat terminal DNS root labels as aliases when applying HSTS policies.
    
    Copyright-paperwork-exempt: Yes

    Changed files

    • src/hsts.c

28. Change #274796

    Category	wget
    Changed by	Acts1631 <acts1611kjvohnoyoudont@proton.me>
    Changed at	Mon 13 Jul 2026 02:15:39
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	66757f66e6ebc25d3e9ea4b79b97c7ac324b0b32

    Comments

    hsts: apply port-zero policies to alternate ports
    * src/hsts.c (hsts_match): Fall back to a port-zero HSTS policy
      after a port-specific lookup fails.
      (test_hsts_url_rewrite_superdomain,
      test_hsts_url_rewrite_congruent): Test alternate-port rewrites.
    
    Apply host-wide HSTS policies to HTTP URLs on non-default ports.
    
    Copyright-paperwork-exempt: Yes

    Changed files

    • src/hsts.c

29. Change #274799

    Category	wget
    Changed by	Acts1631 <acts1611kjvohnoyoudont@proton.me>
    Changed at	Mon 13 Jul 2026 21:22:41
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	402095ad274b0e052ee1932f12844d4dc1a056be

    Comments

    http: filter Proxy-Authorization on cross-host redirects
    * src/http.c (unredirectable_headerline): Filter Proxy-Authorization headers.
    
    A user-provided Proxy-Authorization header is forwarded after a redirect to a
    different hostname or port.  A redirect destination can then obtain a value
    that was intended for the original site.
    
    Drop this header along with Authorization and Cookie on such redirects.
    
    Copyright-paperwork-exempt: Yes

    Changed files

    • src/http.c

30. Change #274908

    Category	wget
    Changed by	Michal Ruprich <michalruprichohnoyoudont@gmail.com>
    Changed at	Tue 14 Jul 2026 21:43:32
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	e1f2559efad5e2733ded804f9f1ba8acd8c4de61

    Comments

    Moving async signal unsafe functions out of signal handler
    There is a very rare race condition in function redirect_output_signal().
    If SIGHUP is received while wget is in malloc() function and a new
    logfile is opened with fopen, another malloc() is called. malloc() is
    not an async signal safe function and should not be called from within a
    signal handler.
    
    * src/main.c (redirect_output_signal): do not call redirect_output(),
    add an atomic flag.
    * src/log.c (check_redirect_output): move redirect_output() here since this
    is not in a signal handler
    
    Copyright-paperwork-exempt: Yes

    Changed files

    • src/log.c
    • src/main.c

31. Change #274916

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Tue 14 Jul 2026 23:12:55
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	fd4487b629edea789fc22baac8a6b641e942bb49

    Comments

    * src/http-ntlm.c: Compile with Nettle 4+

    Changed files

    • src/http-ntlm.c

32. Change #274918

    Category	wget
    Changed by	Tim Rühsen <tim.ruehsenohnoyoudont@gmx.de>
    Changed at	Tue 14 Jul 2026 23:15:57
    Repository	https://gitlab.com/gnuwget/wget.git
    Project	wget
    Branch	master
    Revision	896fcbfcd577c29956a059b9e6ea7c01a109eefc

    Comments

    * .gitlab-ci.yml (ArchLinux): Enable NTLM

    Changed files

    • .gitlab-ci.yml