                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.61.1 (4 Sep 2018)

Daniel Stenberg (4 Sep 2018)
- THANKS: 7.61.1 status

- RELEASE-NOTES: 7.61.1

- Curl_getoff_all_pipelines: ignore unused return values
  
  Since scan-build would warn on the dead "Dead store/Dead increment"

Viktor Szakats (4 Sep 2018)
- sftp: fix indentation

Daniel Stenberg (4 Sep 2018)
- [Przemysław Tomaszewski brought this change]

  sftp: don't send post-qoute sequence when retrying a connection
  
  Fixes #2939
  Closes #2940

Kamil Dudka (3 Sep 2018)
- url, vtls: make CURLOPT{,_PROXY}_TLS13_CIPHERS work
  
  This is a follow-up to PR #2607 and PR #2926.
  
  Closes #2936

Daniel Stenberg (3 Sep 2018)
- [Jay Satiro brought this change]

  tool_operate: Add http code 408 to transient list for --retry
  
  - Treat 408 request timeout as transient so that curl will retry the
    request if --retry was used.
  
  Closes #2925

- [Jay Satiro brought this change]

  openssl: Fix setting TLS 1.3 cipher suites
  
  The flag indicating TLS 1.3 cipher support in the OpenSSL backend was
  missing.
  
  Bug: https://github.com/curl/curl/pull/2607#issuecomment-417283187
  Reported-by: Kamil Dudka
  
  Closes #2926

- Curl_ntlm_core_mk_nt_hash: return error on too long password
  
  ... since it would cause an integer overflow if longer than (max size_t
  / 2).
  
  This is CVE-2018-14618
  
  Bug: https://curl.haxx.se/docs/CVE-2018-14618.html
  Closes #2756
  Reported-by: Zhaoyang Wu

- [Rikard Falkeborn brought this change]

  http2: Use correct format identifier for stream_id
  
  Closes #2928

Marcel Raad (2 Sep 2018)
- test1148: fix precheck output
  
  "precheck command error" is not very helpful.

Daniel Stenberg (1 Sep 2018)
- all: s/int/size_t cleanup
  
  Assisted-by: Rikard Falkeborn
  
  Closes #2922

- ssh-libssh: use FALLTHROUGH to silence gcc8

Jay Satiro (31 Aug 2018)
- tool_operate: Fix setting proxy TLS 1.3 ciphers

Daniel Stenberg (31 Aug 2018)
- [Daniel Gustafsson brought this change]

  cookies: support creation-time attribute for cookies
  
  According to RFC6265 section 5.4, cookies with equal path lengths
  SHOULD be sorted by creation-time (earlier first). This adds a
  creation-time record to the cookie struct in order to make cookie
  sorting more deterministic. The creation-time is defined as the
  order of the cookies in the jar, the first cookie read fro the
  jar being the oldest. The creation-time is thus not serialized
  into the jar. Also remove the strcmp() matching in the sorting as
  there is no lexicographic ordering in RFC6265. Existing tests are
  updated to match.
  
  Closes #2524

Marcel Raad (31 Aug 2018)
- Don't use Windows path %PWD for SSH tests
  
  All these tests failed on Windows because something like
  sftp://%HOSTIP:%SSHPORT%PWD/
  expanded to
  sftp://127.0.0.1:1234c:/msys64/home/bla/curl
  and then curl complained about the port number ending with a letter.
  
  Use the original POSIX path instead of the Windows path created in
  checksystem to fix this.
  
  Closes https://github.com/curl/curl/pull/2920

Jay Satiro (29 Aug 2018)
- CURLOPT_SSL_CTX_FUNCTION.3: clarify connection reuse warning
  
  Reported-by: Daniel Stenberg
  
  Closes https://github.com/curl/curl/issues/2916

Daniel Stenberg (28 Aug 2018)
- THANKS-filter: dedup Daniel Jeliński

- RELEASE-NOTES: synced

- CURLOPT_ACCEPT_ENCODING.3: list them comma-separated [ci skip]

- CURLOPT_SSL_CTX_FUNCTION.3: might cause unintended connection reuse [ci skip]
  
  Added a warning!
  
  Closes #2915

- curl: fix time-of-check, time-of-use race in dir creation
  
  Patch-by: Jay Satiro
  Detected by Coverity
  Fixes #2739
  Closes #2912

- cmdline-opts/page-footer: fix edit mistake
  
  There was a missing newline.
  
  follow-up to a7ba60bb7250

- docs: clarify NO_PROXY env variable functionality
  
  Reported-by: Kirill Marchuk
  Fixes #2773
  Closes #2911

Marcel Raad (24 Aug 2018)
- lib1522: fix curl_easy_setopt argument type
  
  CURLOPT_POSTFIELDSIZE is a long option.

- curl_threads: silence bad-function-cast warning
  
  As uintptr_t and HANDLE are always the same size, this warning is
  harmless. Just silence it using an intermediate uintptr_t variable.
  
  Closes https://github.com/curl/curl/pull/2908

Daniel Stenberg (24 Aug 2018)
- README: add appveyor build badge [ci skip]
  
  Closes #2913

- [Ihor Karpenko brought this change]

  schannel: client certificate store opening fix
  
  1) Using CERT_STORE_OPEN_EXISTING_FLAG ( or CERT_STORE_READONLY_FLAG )
  while opening certificate store would be sufficient in this scenario and
  less-demanding in sense of required user credentials ( for example,
  IIS_IUSRS will get "Access Denied" 0x05 error for existing CertOpenStore
  call without any of flags mentioned above ),
  
  2) as 'cert_store_name' is a DWORD, attempt to format its value like a
  string ( in "Failed to open cert store" error message ) will throw null
  pointer exception
  
  3) adding GetLastError(), in my opinion, will make error message more
  useful.
  
  Bug: https://curl.haxx.se/mail/lib-2018-08/0198.html
  
  Closes #2909

- [Leonardo Taccari brought this change]

  gopher: Do not translate `?' to `%09'
  
  Since GOPHER support was added in curl `?' character was automatically
  translated to `%09' (`\t').
  
  However, this behaviour does not seems documented in RFC 4266 and for
  search selectors it is documented to directly use `%09' in the URL.
  Apart that several gopher servers in the current gopherspace have CGI
  support where `?' is used as part of the selector and translating it to
  `%09' often leads to surprising results.
  
  Closes #2910

Marcel Raad (23 Aug 2018)
- cookie tests: treat files as text
  
  Fixes test failures because of wrong line endings on Windows.

Daniel Stenberg (23 Aug 2018)
- libcurl-thread.3: expand somewhat on the NO_SIGNAL motivation
  
  Multi-threaded applictions basically MUST set CURLOPT_NO_SIGNAL to 1L to
  avoid the risk of getting a SIGPIPE.
  
  Either way, a multi-threaded application that uses libcurl/openssl needs
  to have a signhandler for or ignore SIGPIPE on its own.
  
  Based on discussions in #2800
  Closes #2904

- RELEASE-NOTES: synced

Marcel Raad (22 Aug 2018)
- Tests: fixes for Windows
  
  - test 1268 requires unix sockets
  - test 2072 must be disabled also for MSYS/MinGW

Daniel Stenberg (22 Aug 2018)
- http2: abort the send_callback if not setup yet
  
  When Curl_http2_done() gets called before the http2 data is setup all
  the way, we cannot send anything and this should just return an error.
  
  Detected by OSS-Fuzz
  Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10012

- http2: remove four unused nghttp2 callbacks
  
  Closes #2903

- x509asn1: use FALLTHROUGH
  
  ... as no other comments are accepted since 014ed7c22f51463

Marcel Raad (21 Aug 2018)
- test1148: disable if decimal separator is not point
  
  Modifying the locale with environment variables doesn't work for native
  Windows applications. Just disable the test in this case if the decimal
  separator is something different than a point. Use a precheck with a
  small C program to achieve that.
  
  Closes https://github.com/curl/curl/pull/2786

- Enable more GCC warnings
  
  This enables the following additional warnings:
  -Wold-style-definition
  -Warray-bounds=2 instead of the default 1
  -Wformat=2, but only for GCC 4.8+ as Wno-format-nonliteral is not
   respected for older versions
  -Wunused-const-variable, which enables level 2 instead of the default 1
  -Warray-bounds also in debug mode through -ftree-vrp
  -Wnull-dereference also in debug mode through
   -fdelete-null-pointer-checks
  
  Closes https://github.com/curl/curl/pull/2747

- curl-compilers: enable -Wimplicit-fallthrough=4 for GCC
  
  This enables level 4 instead of the default level 3, which of the
  currently used comments only allows /* FALLTHROUGH */ to silence the
  warning.
  
  Closes https://github.com/curl/curl/pull/2747

- curl-compilers: enable -Wbad-function-cast on GCC
  
  This warning used to be enabled only for clang as it's a bit stricter
  on GCC. Silence the remaining occurrences and enable it on GCC too.
  
  Closes https://github.com/curl/curl/pull/2747

- configure: conditionally enable pedantic-errors
  
  Enable pedantic-errors for GCC >= 5 with --enable-werror. Before GCC 5,
  pedantic-errors was synonymous to -Werror=pedantic [0], which is still
  the case for clang [1]. With GCC 5, it became complementary [2].
  
  Also fix a resulting error in acinclude.m4 as main's return type was
  missing, which is illegal in C99.
  
  [0] https://gcc.gnu.org/onlinedocs/gcc-4.9.0/gcc/Warning-Options.html
  [1] https://clang.llvm.org/docs/UsersManual.html#options-to-control-error-and-warning-messages
  [2] https://gcc.gnu.org/onlinedocs/gcc-5.1.0/gcc/Warning-Options.html
  
  Closes https://github.com/curl/curl/pull/2747

- Remove unused definitions
  
  Closes https://github.com/curl/curl/pull/2747

Daniel Stenberg (21 Aug 2018)
- x509asn1: make several functions static
  
  and remove the private SIZE_T_MAX define and use the generic one.
  
  Closes #2902

- INTERNALS: require GnuTLS >= 2.11.3
  
  Since the public pinning support was brought in e644866caf4. GnuTLS
  2.11.3 was released in October 2010.
  
  Figured out in #2890

- http2: avoid set_stream_user_data() before stream is assigned
  
  ... before the stream is started, we have it set to -1.
  
  Fixes #2894
  Closes #2898

- SSLCERTS: improve the openssl command line
  
  ... for extracting certs from a live HTTPS server to make a cacerts.pem
  from them.

- docs/SECURITY-PROCESS: now we name the files after the CVE id

- RELEASE-NOTES: synced

- upload: change default UPLOAD_BUFSIZE to 64KB
  
  To make uploads significantly faster in some circumstances.
  
  Part 2 of #2888
  Closes #2892

- upload: allocate upload buffer on-demand
  
  Saves 16KB on the easy handle for operations that don't need that
  buffer.
  
  Part 1 of #2888

- [Laurent Bonnans brought this change]

  vtls: reinstantiate engine on duplicated handles
  
  Handles created with curl_easy_duphandle do not use the SSL engine set
  up in the original handle. This fixes the issue by storing the engine
  name in the internal url state and setting the engine from its name
  inside curl_easy_duphandle.
  
  Reported-by: Anton Gerasimov
  Signed-of-by: Laurent Bonnans
  Fixes #2829
  Closes #2833

- http2: make sure to send after RST_STREAM
  
  If this is the last stream on this connection, the RST_STREAM might not
  get pushed to the wire otherwise.
  
  Fixes #2882
  Closes #2887
  Researched-by: Michael Kaufmann

- test1268: check the stderr output as "text"
  
  Follow-up to 099f37e9c57
  
  Pointed-out-by: Marcel Raad

- urldata: remove unused pipe_broke struct field
  
  This struct field is never set TRUE in any existing code path. This
  change removes the field completely.
  
  Closes #2871

- curl: warn the user if a given file name looks like an option
  
  ... simply because this is usually a sign of the user having omitted the
  file name and the next option is instead "eaten" by the parser as a file
  name.
  
  Add test1268 to verify
  
  Closes #2885

- http2: check nghttp2_session_set_stream_user_data return code
  
  Might help bug #2688 debugging
  
  Closes #2880

- travis: revert back to gcc-7 for coverage builds
  
  ... since the gcc-8 ones seem to fail frequently.
  
  Follow-up from b85207199544ca
  
  Closes #2886

- RELEASE-NOTES: synced
  
  ... and now listed in alphabetical order!

- [Adrien brought this change]

  CMake: CMake config files are defining CURL_STATICLIB for static builds
  
  This change allows to use the CMake config files generated by Curl's
  CMake scripts for static builds of the library.
  The symbol CURL_STATIC lib must be defined to compile downstream,
  thus the config package is the perfect place to do so.
  
  Fixes #2817
  Closes #2823
  Reported-by: adnn on github
  Reviewed-by: Sergei Nikulov

- TODO: host name sections in config files

Kamil Dudka (14 Aug 2018)
- ssh-libssh: fix infinite connect loop on invalid private key
  
  Added test 656 (based on test 604) to verify the fix.
  
  Bug: https://bugzilla.redhat.com/1595135
  
  Closes #2879

- ssh-libssh: reduce excessive verbose output about pubkey auth
  
  The verbose message "Authentication using SSH public key file" was
  printed each time the ssh_userauth_publickey_auto() was called, which
  meant each time a packet was transferred over network because the API
  operates in non-blocking mode.
  
  This patch makes sure that the verbose message is printed just once
  (when the authentication state is entered by the SSH state machine).

Daniel Stenberg (14 Aug 2018)
- travis: disable h2 torture tests for "coverage"
  
  Since they started to fail almost 100% since a few days.
  
  Closes #2876

Marcel Raad (14 Aug 2018)
- travis: update to GCC 8
  
  Closes https://github.com/curl/curl/pull/2869

Daniel Stenberg (13 Aug 2018)
- http: fix for tiny "HTTP/0.9" response
  
  Deal with tiny "HTTP/0.9" (header-less) responses by checking the
  status-line early, even before a full "HTTP/" is received to allow
  detecting 0.9 properly.
  
  Test 1266 and 1267 added to verify.
  
  Fixes #2420
  Closes #2872

Kamil Dudka (13 Aug 2018)
- docs: add disallow-username-in-url.d and haproxy-protocol.d on the list
  
  ... to make make the files appear in distribution tarballs
  
  Closes #2856

- .travis.yml: verify that man pages can be regenerated
  
  ... when curl is built from distribution tarball
  
  Closes #2856

Marcel Raad (11 Aug 2018)
- Split non-portable part off test 1133
  
  Split off testing file names with double quotes into new test 1158.
  Disable it for MSYS using a precheck as it doesn't support file names
  with double quotes (but Cygwin does, for example).
  
  Fixes https://github.com/curl/curl/issues/2796
  Closes https://github.com/curl/curl/pull/2854

Jay Satiro (11 Aug 2018)
- projects: Improve Windows perl detection in batch scripts
  
  - Determine if perl is in the user's PATH by running perl.exe.
  
  Prior to this change detection was done by checking the PATH for perl/
  but that did not work in all cases (eg git install includes perl but
  not in perl/ path).
  
  Bug: https://github.com/curl/curl/pull/2865
  Reported-by: Daniel Jeliński

- [Michael Kaufmann brought this change]

  docs: Improve the manual pages of some callbacks
  
  - CURLOPT_HEADERFUNCTION: add newlines
  - CURLOPT_INTERLEAVEFUNCTION: fix the description of 'userdata'
  - CURLOPT_READDATA: mention crashes, same as in CURLOPT_WRITEDATA
  - CURLOPT_READFUNCTION: rename 'instream' to 'userdata' and explain
    how to set it
  
  Closes https://github.com/curl/curl/pull/2868

Marcel Raad (11 Aug 2018)
- GCC: silence -Wcast-function-type uniformly
  
  Pointed-out-by: Rikard Falkeborn
  Closes https://github.com/curl/curl/pull/2860

- Silence GCC 8 cast-function-type warnings
  
  On Windows, casting between unrelated function types is fine and
  sometimes even necessary, so just use an intermediate cast to
  (void (*) (void)) to silence the warning as described in [0].
  
  [0] https://gcc.gnu.org/onlinedocs/gcc-8.1.0/gcc/Warning-Options.html
  
  Closes https://github.com/curl/curl/pull/2860

Daniel Stenberg (11 Aug 2018)
- CURLINFO_SIZE_UPLOAD: fix missing counter update
  
  Adds test 1522 for verification.
  
  Reported-by: cjmsoregan
  Fixes #2847
  Closes #2864

- [Daniel Jelinski brought this change]

  Documentation: fix CURLOPT_SSH_COMPRESSION copy/paste bug
  
  Closes #2867

- RELEASE-NOTES: synced

- openssl: fix potential NULL pointer deref in is_pkcs11_uri
  
  Follow-up to 298d2565e
  Coverity CID 1438387

Marcel Raad (10 Aug 2018)
- travis: execute "set -eo pipefail" for coverage build
  
  Follow-up to 2de63ab179eb78630ee039ad94fb2a5423df522d and
  0b87c963252d3504552ee0c8cf4402bd65a80af5.
  
  Closes https://github.com/curl/curl/pull/2862

Daniel Stenberg (10 Aug 2018)
- lib1502: fix memory leak in torture test
  
  Reported-by: Marcel Raad
  Fixes #2861
  Closes #2863

- docs: mention NULL is fine input to several functions
  
  Fixes #2837
  Closes #2858
  Reported-by: Markus Elfring

- [Bas van Schaik brought this change]

  README.md: add LGTM.com code quality grade for C/C++
  
  Closes #2857

- [Rikard Falkeborn brought this change]

  test1531: Add timeout
  
  Previously, the macro TEST_HANG_TIMEOUT was unused, but since there is
  looping going on, we might as well add timing instead of removing it.
  
  Closes #2853

- [Rikard Falkeborn brought this change]

  test1540: Remove unused macro TEST_HANG_TIMEOUT
  
  The macro has never been used, and it there is not really any place
  where it would make sense to add timing checks.
  
  Closes #2852

- [Rikard Falkeborn brought this change]

  asyn-thread: Remove unused macro
  
  The macro seems to never have been used.
  
  Closes #2852

- [Rikard Falkeborn brought this change]

  http_proxy: Remove unused macro SELECT_TIMEOUT
  
  Usage was removed in 5113ad0424044458ac497fa1458ebe0101356b22.
  
  Closes #2852

- [Rikard Falkeborn brought this change]

  formdata: Remove unused macro HTTPPOST_CONTENTTYPE_DEFAULT
  
  Its usage was removed in
  84ad1fd3047815f9c6e78728bb351b828eac10b1.
  
  Closes #2852

- [Rikard Falkeborn brought this change]

  telnet: Remove unused macros TELOPTS and TELCMDS
  
  Their usage was removed in 3a145180cc754a5959ca971ef3cd243c5c83fc51.
  
  Closes #2852

- [Daniel Jelinski brought this change]

  openssl: fix debug messages
  
  Fixes #2806
  Closes #2843

- configure: fix for -lpthread detection with OpenSSL and pkg-config
  
  ... by making sure it uses the -I provided by pkg-config!
  
  Reported-by: pszemus on github
  Fixes #2848
  Closes #2850

- RELEASE-NOTES: synced

- windows: follow up to the buffer-tuning 1ba1dba7
  
  Somehow I didn't include the amended version of the previous fix. This
  is the missing piece.
  
  Pointed-out-by: Viktor Szakats

- [Daniel Jelinski brought this change]

  windows: implement send buffer tuning
  
  Significantly enhances upload performance on modern Windows versions.
  
  Bug: https://curl.haxx.se/mail/lib-2018-07/0080.html
  Closes #2762
  Fixes #2224

- [Anderson Toshiyuki Sasaki brought this change]

  ssl: set engine implicitly when a PKCS#11 URI is provided
  
  This allows the use of PKCS#11 URI for certificates and keys without
  setting the corresponding type as "ENG" and the engine as "pkcs11"
  explicitly. If a PKCS#11 URI is provided for certificate, key,
  proxy_certificate or proxy_key, the corresponding type is set as "ENG"
  if not provided and the engine is set to "pkcs11" if not provided.
  
  Acked-by: Nikos Mavrogiannopoulos
  Closes #2333

- [Ruslan Baratov brought this change]

  CMake: Respect BUILD_SHARED_LIBS
  
  Use standard CMake variable BUILD_SHARED_LIBS instead of introducing
  custom option CURL_STATICLIB.
  
  Use '-DBUILD_SHARED_LIBS=%SHARED%' in appveyor.yml.
  
  Reviewed-by: Sergei Nikulov
  Closes #2755

- [John Butterfield brought this change]

  cmake: bumped minimum version to 3.4
  
  Closes #2753

- [John Butterfield brought this change]

  cmake: link curl to the OpenSSL targets instead of lib absolute paths
  
  Reviewed-by: Jakub Zakrzewski
  Reviewed-by: Sergei Nikulov
  Closes #2753

- travis: build darwinssl on macos 10.12
  
  ... as building on 10.13.x before 10.13.4 leads to link errors.
  
  Assisted-by: Nick Zitzmann
  Fixes #2835
  Closes #2845

- DEPRECATE: remove release date from 7.62.0
  
  Since it will slip and the version is the important part there, not the
  date.

- lib/Makefile: only do symbol hiding if told to
  
  This restores the ability to build a static lib with
  --disable-symbol-hiding to keep non-curl_ symbols.
  
  Researched-by: Dan Fandrich
  Reported-by: Ran Mozes
  Fixes #2830
  Closes #2831

Marcel Raad (2 Aug 2018)
- hostip: fix unused variable warning
  
  addresses is only used in an infof call, which is a macro expanding to
  nothing if CURL_DISABLE_VERBOSE_STRINGS is set.

Daniel Stenberg (2 Aug 2018)
- test1307: disabled
  
  Turns out that since we're using the native fnmatch function now when
  available, and they simply disagree on a huge number of test patterns
  that make it hard to test this function like this...
  
  Fixes #2825

- smb: don't mark it done in smb_do
  
  Follow-up to 09e401e01bf9. The SMB protocol handler needs to use its
  doing function too, which requires smb_do() to not mark itself as
  done...
  
  Closes #2822

- [Rikard Falkeborn brought this change]

  general: fix printf specifiers
  
  Closes #2818

- RELEASE-NOTES: synced

- mailmap: Daniel Jelinski

- [Harry Sintonen brought this change]

  HTTP: Don't attempt to needlessly decompress redirect body
  
  This change fixes a regression where redirect body would needlessly be
  decompressed even though it was to be ignored anyway. As it happens this
  causes secondary issues since there appears to be a bug in apache2 that
  it in certain conditions generates a corrupt zlib response. The
  regression was created by commit:
  dbcced8e32b50c068ac297106f0502ee200a1ebd
  
  Discovered-by: Harry Sintonen
  Closes #2798

- curl: use Content-Disposition before the "URL end" for -OJ
  
  Regression introduced in 7.61.0
  
  Reported-by: Thomas Klausner
  Fixes #2783
  Closes #2813

- [Daniel Jelinski brought this change]

  retry: return error if rewind was necessary but didn't happen
  
  Fixes #2801
  Closes #2812

- http2: clear the drain counter in Curl_http2_done
  
  Reported-by: Andrei Virtosu
  Fixes #2800
  Closes #2809

- smb: fix memory leak on early failure
  
  ... by making sure connection related data (->share) is stored in the
  connection and not in the easy handle.
  
  Detected by OSS-fuzz
  Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9369
  Fixes #2769
  Closes #2810

- travis: run a 'make checksrc' too
  
  ... to make sure the examples are all checked.
  
  Closes #2811

Jay Satiro (29 Jul 2018)
- examples/ephiperfifo: checksrc compliance

- [Michael Kaufmann brought this change]

  sws: handle EINTR when calling select()
  
  Closes https://github.com/curl/curl/pull/2808

Daniel Stenberg (29 Jul 2018)
- test1157: follow-up to 35ecffb9
  
  Ignore the user-agent line.
  Pointed-out-by: Marcel Raad

Michael Kaufmann (29 Jul 2018)
- tests/http_pipe.py: Use /usr/bin/env to find python

Daniel Stenberg (28 Jul 2018)
- TODO: Support Authority Information Access certificate extension (AIA)
  
  Closes #2793

- conn_free: updated comment to clarify
  
  Let's call it disassociate instead of disconnect since the latter term
  is used so much for (TCP) connections already.

- test1157: test -H from empty file
  
  Verifies bugfix #2797

- [Tobias Blomberg brought this change]

  curl: Fix segfault when -H @headerfile is empty
  
  The curl binary would crash if the -H command line option was given a
  filename to read using the @filename syntax but that file was empty.
  
  Closes #2797

- mime: check Curl_rand_hex's return code
  
  Bug: https://curl.haxx.se/mail/archive-2018-07/0015.html
  Reported-by: Jeffrey Walton
  Closes #2795

- [Josh Bialkowski brought this change]

  docs/examples: add hiperfifo example using linux epoll/timerfd
  
  Closes #2804

- [Darío Hereñú brought this change]

  docs/INSTALL.md: minor formatting fixes
  
  Closes #2794

- [Christopher Head brought this change]

  docs/CURLOPT_URL: fix indentation
  
  The statement, “The application does not have to keep the string around
  after setting this option,” appears to be indented under the RTMP
  paragraph. It actually applies to all protocols, not just RTMP.
  Eliminate the extra indentation.
  
  Closes #2788

- [Christopher Head brought this change]

  docs/CURLOPT_WRITEFUNCTION: size is always 1
  
  For compatibility with `fwrite`, the `CURLOPT_WRITEFUNCTION` callback is
  passed two `size_t` parameters which, when multiplied, designate the
  number of bytes of data passed in. In practice, CURL always sets the
  first parameter (`size`) to 1.
  
  This practice is also enshrined in documentation and cannot be changed
  in future. The documentation states that the default callback is
  `fwrite`, which means `fwrite` must be a suitable function for this
  purpose. However, the documentation also states that the callback must
  return the number of *bytes* it successfully handled, whereas ISO C
  `fwrite` returns the number of items (each of size `size`) which it
  wrote. The only way these numbers can be equal is if `size` is 1.
  
  Since `size` is 1 and can never be changed in future anyway, document
  that fact explicitly and let users rely on it.
  
  Closes #2787

- [Carie Pointer brought this change]

  wolfSSL/CyaSSL: Fix memory leak in Curl_cyassl_random
  
  RNG structure must be freed by call to FreeRng after its use in
  Curl_cyassl_random. This call fixes Valgrind failures when running the
  test suite with wolfSSL.
  
  Closes #2784

- [Even Rouault brought this change]

  reuse_conn(): free old_conn->options
  
  This fixes a memory leak when CURLOPT_LOGIN_OPTIONS is used, together with
  connection reuse.
  
  I found this with oss-fuzz on GDAL and curl master:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9582
  I couldn't reproduce with the oss-fuzz original test case, but looking
  at curl source code pointed to this well reproducable leak.
  
  Closes #2790

Marcel Raad (25 Jul 2018)
- [Daniel Jelinski brought this change]

  system_win32: fix version checking
  
  In the current version, VERSION_GREATER_THAN_EQUAL 6.3 will return false
  when run on windows 10.0. This patch addresses that error.
  
  Closes https://github.com/curl/curl/pull/2792

Daniel Stenberg (24 Jul 2018)
- [Johannes Schindelin brought this change]

  auth: pick Bearer authentication whenever a token is available
  
  So far, the code tries to pick an authentication method only if
  user/password credentials are available, which is not the case for
  Bearer authentictation...
  
  Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
  Closes #2754

- [Johannes Schindelin brought this change]

  auth: only ever pick CURLAUTH_BEARER if we *have* a Bearer token
  
  The Bearer authentication was added to cURL 7.61.0, but there is a
  problem: if CURLAUTH_ANY is selected, and the server supports multiple
  authentication methods including the Bearer method, we strongly prefer
  that latter method (only CURLAUTH_NEGOTIATE beats it), and if the Bearer
  authentication fails, we will never even try to attempt any other
  method.
  
  This is particularly unfortunate when we already know that we do not
  have any Bearer token to work with.
  
  Such a scenario happens e.g. when using Git to push to Visual Studio
  Team Services (which supports Basic and Bearer authentication among
  other methods) and specifying the Personal Access Token directly in the
  URL (this aproach is frequently taken by automated builds).
  
  Let's make sure that we have a Bearer token to work with before we
  select the Bearer authentication among the available authentication
  methods.
  
  Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
  Closes #2754

Marcel Raad (22 Jul 2018)
- test320: treat curl320.out file as binary
  
  Otherwise, LF line endings are converted to CRLF on Windows,
  but no conversion is done for the reply, so the test case fails.
  
  Closes https://github.com/curl/curl/pull/2776

Daniel Stenberg (22 Jul 2018)
- vtls: set conn->data when closing TLS
