                                  _   _ ____  _
                              ___| | | |  _ \| |
                             / __| | | | |_) | |
                            | (__| |_| |  _ <| |___
                             \___|\___/|_| \_\_____|

                                  Changelog

Version 7.64.0 (6 Feb 2019)

Daniel Stenberg (6 Feb 2019)
- RELEASE-NOTES: 7.64.0

- RELEASE-PROCEDURE: update the release calendar

- THANKS: 7.64.0 status

Daniel Gustafsson (5 Feb 2019)
- ROADMAP: remove already performed item
  
  Commit 7a09b52c98ac8d840a8a9907b1a1d9a9e684bcf5 introduced support
  for the draft-ietf-httpbis-cookie-alone-01 cookie draft, and while
  the entry was removed from the TODO it was mistakenly left here.
  Fix by removing and rewording the entry slightly.
  
  Closes #3530
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- [Etienne Simard brought this change]

  CONTRIBUTE.md: Fix grammatical errors
  
  Fix grammatical errors making the document read better. Also fixes
  a typo.
  
  Closes #3525
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

Daniel Stenberg (4 Feb 2019)
- [Julian Z brought this change]

  docs: use $(INSTALL_DATA) to install man page
  
  Fixes #3518
  Closes #3522

Jay Satiro (4 Feb 2019)
- [Ladar Levison brought this change]

  runtests.pl: Fix perl call to include srcdir
  
  - Use explicit include opt for perl calls.
  
  Prior to this change some scripts couldn't find their dependencies.
  
  At the top, perl is called using with the "-Isrcdir" option, and it
  works:
  
  https://github.com/curl/curl/blob/curl-7_63_0/tests/runtests.pl#L183
  
  But on line 3868, that option is omitted. This caused problems for me,
  as the symbol-scan.pl script in particular couldn't find its
  dependencies properly:
  
  https://github.com/curl/curl/blob/curl-7_63_0/tests/runtests.pl#L3868
  
  This patch fixes that oversight by making calls to perl sub-shells
  uniform.
  
  Closes https://github.com/curl/curl/pull/3496

Daniel Stenberg (4 Feb 2019)
- [Daniel Gustafsson brought this change]

  smtp: avoid risk of buffer overflow in strtol
  
  If the incoming len 5, but the buffer does not have a termination
  after 5 bytes, the strtol() call may keep reading through the line
  buffer until is exceeds its boundary. Fix by ensuring that we are
  using a bounded read with a temporary buffer on the stack.
  
  Bug: https://curl.haxx.se/docs/CVE-2019-3823.html
  Reported-by: Brian Carpenter (Geeknik Labs)
  CVE-2019-3823

- ntlm: fix *_type3_message size check to avoid buffer overflow
  
  Bug: https://curl.haxx.se/docs/CVE-2019-3822.html
  Reported-by: Wenxiang Qian
  CVE-2019-3822

- NTLM: fix size check condition for type2 received data
  
  Bug: https://curl.haxx.se/docs/CVE-2018-16890.html
  Reported-by: Wenxiang Qian
  CVE-2018-16890

Marcel Raad (1 Feb 2019)
- [georgeok brought this change]

  spnego_sspi: add support for channel binding
  
  Attempt to add support for Secure Channel binding when negotiate
  authentication is used. The problem to solve is that by default IIS
  accepts channel binding and curl doesn't utilise them. The result was a
  401 response. Scope affects only the Schannel(winssl)-SSPI combination.
  
  Fixes https://github.com/curl/curl/issues/3503
  Closes https://github.com/curl/curl/pull/3509

Daniel Stenberg (1 Feb 2019)
- RELEASE-NOTES: synced

- schannel: stop calling it "winssl"
  
  Stick to "Schannel" everywhere. The configure option --with-winssl is
  kept to allow existing builds to work but --with-schannel is added as an
  alias.
  
  Closes #3504

- multi: set the EXPIRE_*TIMEOUT timers at TIMER_STARTSINGLE time
  
  To make sure Curl_timeleft() also thinks the timeout has been reached
  when one of the EXPIRE_*TIMEOUTs expires.
  
  Bug: https://curl.haxx.se/mail/lib-2019-01/0073.html
  Reported-by: Zhao Yisha
  Closes #3501

- [John Marshall brought this change]

  doc: use meaningless port number in CURLOPT_LOCALPORT example
  
  Use an ephemeral port number here; previously the example had 8080
  which could be confusing as the common web server port number might
  be misinterpreted as suggesting this option affects the remote port.
  
  URL: https://curl.haxx.se/mail/lib-2019-01/0084.html
  Closes #3513

GitHub (29 Jan 2019)
- [Gisle Vanem brought this change]

  Escape the '\'
  
  A backslash should be escaped in Roff / Troff.

Jay Satiro (29 Jan 2019)
- TODO: WinSSL: 'Add option to disable client cert auto-send'
  
  By default WinSSL selects and send a client certificate automatically,
  but for privacy and consistency we should offer an option to disable the
  default auto-send behavior.
  
  Reported-by: Jeroen Ooms
  
  Closes https://github.com/curl/curl/issues/2262

Daniel Stenberg (28 Jan 2019)
- [Jeremie Rapin brought this change]

  sigpipe: if mbedTLS is used, ignore SIGPIPE
  
  mbedTLS doesn't have a sigpipe management. If a write/read occurs when
  the remote closes the socket, the signal is raised and kills the
  application.  Use the curl mecanisms fix this behavior.
  
  Signed-off-by: Jeremie Rapin <j.rapin@overkiz.com>
  
  Closes #3502

- unit1653: make it survive torture tests

Jay Satiro (28 Jan 2019)
- [Michael Kujawa brought this change]

  timeval: Disable MSVC Analyzer GetTickCount warning
  
  Compiling with msvc /analyze and a recent Windows SDK warns against
  using GetTickCount (Suggests to use GetTickCount64 instead.)
  
  Since GetTickCount is only being used when GetTickCount64 isn't
  available, I am disabling that warning.
  
  Fixes https://github.com/curl/curl/issues/3437
  Closes https://github.com/curl/curl/pull/3440

Daniel Stenberg (26 Jan 2019)
- configure: rewrite --enable-code-coverage
  
  The previously used ax_code_coverage.m4 is not license compatible and
  must not be used.
  
  Reported-by: William A. Rowe Jr
  Fixes #3497
  Closes #3499

- [Felix Hädicke brought this change]

  setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION for libssh
  
  CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION are supported for
  libssh as well. So accepting these options only when compiling with
  libssh2 is wrong here.
  
  Fixes #3493
  Closes #3494

- [Felix Hädicke brought this change]

  libssh: do not let libssh create socket
  
  By default, libssh creates a new socket, instead of using the socket
  created by curl for SSH connections.
  
  Pass the socket created by curl to libssh using ssh_options_set() with
  SSH_OPTIONS_FD directly after ssh_new(). So libssh uses our socket
  instead of creating a new one.
  
  This approach is very similar to what is done in the libssh2 code, where
  the socket created by curl is passed to libssh2 when
  libssh2_session_startup() is called.
  
  Fixes #3491
  Closes #3495

- RELEASE-NOTES: synced

- [Archangel_SDY brought this change]

  schannel: preserve original certificate path parameter
  
  Fixes #3480
  Closes #3487

- KNOWN_BUGS: tests not compatible with python3
  
  Closes #3289
  [skip ci]

Daniel Gustafsson (20 Jan 2019)
- memcmp: avoid doing single char memcmp
  
  There is no real gain in performing memcmp() comparisons on single
  characters, so change these to array subscript inspections which
  saves a call and makes the code clearer.
  
  Closes #3486
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Jay Satiro <raysatiro@yahoo.com>

Daniel Stenberg (19 Jan 2019)
- COPYING: it's 2019
  
  [skip ci]

- [hhb brought this change]

  configure: fix recv/send/select detection on Android
  
  This reverts commit d4f25201fb7da03fc88f90d51101beb3d0026db9.
  
  The overloadable attribute is removed again starting from
  NDK17. Actually they only exist in two NDK versions (15 and 16). With
  overloadable, the first condition tried will succeed. Results in wrong
  detection result.
  
  Closes #3484

Marcel Raad (19 Jan 2019)
- [georgeok brought this change]

  ntlm_sspi: add support for channel binding
  
  Windows extended potection (aka ssl channel binding) is required
  to login to ntlm IIS endpoint, otherwise the server returns 401
  responses.
  
  Fixes #3280
  Closes #3321

Daniel Stenberg (18 Jan 2019)
- schannel: on connection close there might not be a transfer
  
  Reported-by: Marcel Raad
  Fixes #3412
  Closes #3483

- [Joel Depooter brought this change]

  ssh: log the libssh2 error message when ssh session startup fails
  
  When a ssh session startup fails, it is useful to know why it has
  failed. This commit changes the message from:
     "Failure establishing ssh session"
  to something like this, for example:
     "Failure establishing ssh session: -5, Unable to exchange encryption keys"
  
  Closes #3481

Alessandro Ghedini (16 Jan 2019)
- Fix typo in manpage

Daniel Stenberg (16 Jan 2019)
- RELEASE-NOTES: synced

Sergei Nikulov (16 Jan 2019)
- cmake: updated check for HAVE_POLL_FINE to match autotools

Daniel Stenberg (16 Jan 2019)
- curl-compilers.m4: check for __ibmxl__ to detect xlclang
  
  Follow-up to 2fa0d57e2e3. The __xlc__ symbol is only defined there if a
  particular flag is used for legacy macros.
  
  Fixes #3474
  Closes #3479

- openssl: fix the SSL_get_tlsext_status_ocsp_resp call
  
  .... to not pass in a const in the second argument as that's not how it
  is supposed to be used and might cause compiler warnings.
  
  Reported-by: Pavel Pavlov
  Fixes #3477
  Closes #3478

- curl-compilers.m4: detect xlclang
  
  Since it isn't totally clang compatible, we detect this IBM clang
  front-end and if detected, avoids some clang specific magic.
  
  Reported-by: Kees Dekker
  Fixes #3474
  Closes #3476

- README: add codacy code quality badge
  
  [skip ci]

- extract_if_dead: follow-up to 54b201b48c90a
  
  extract_if_dead() dead is called from two functions, and only one of
  them should get conn->data updated and now neither call path clears it.
  
  scan-build found a case where conn->data would be NULL dereferenced in
  ConnectionExists() otherwise.
  
  Closes #3473

- multi: remove "Dead assignment"
  
  Found by scan-build. Follow-up to 4c35574bb785ce.
  
  Closes #3471

- tests: move objnames-* from lib into tests
  
  Since they're used purely for testing purposes, I think they should
  rather be stored there.
  
  Closes #3470

Sergei Nikulov (15 Jan 2019)
- travis: added cmake build for osx

Daniel Stenberg (14 Jan 2019)
- [Frank Gevaerts brought this change]

  cookie: fix comment typo (url_path_len -> uri_path_len)
  
  Closes #3469

Marcel Raad (14 Jan 2019)
- winbuild: conditionally use /DZLIB_WINAPI
  
  zlibwapi.lib (dynamic library) and zlibstat.lib (static library) have
  the ZLIB_WINAPI define set by default. Using them requires that define
  too.
  
  Ref: https://zlib.net/DLL_FAQ.txt
  
  Fixes https://github.com/curl/curl/issues/3133
  Closes https://github.com/curl/curl/pull/3460

Daniel Stenberg (14 Jan 2019)
- src/Makefile: make 'tidy' target work for metalink builds

- extract_if_dead: use a known working transfer when checking connections
  
  Make sure that this function sets a proper "live" transfer for the
  connection before calling the protocol-specific connection check
  function, and then clear it again afterward as a non-used connection has
  no current transfer.
  
  Reported-by: Jeroen Ooms
  Reviewed-by: Marcel Raad
  Reviewed-by: Daniel Gustafsson
  Fixes #3463
  Closes #3464

- openssl: adapt to 3.0.0, OpenSSL_version_num() is deprecated
  
  OpenSSL_version() replaces OpenSSL_version_num()
  
  Closes #3462

Sergei Nikulov (11 Jan 2019)
- cmake: added checks for HAVE_VARIADIC_MACROS_C99 and HAVE_VARIADIC_MACROS_GCC

Daniel Stenberg (11 Jan 2019)
- urldata: rename easy_conn to just conn
  
  We use "conn" everywhere to be a pointer to the connection.
  
  Introduces two functions that "attaches" and "detaches" the connection
  to and from the transfer.
  
  Going forward, we should favour using "data->conn" (since a transfer
  always only has a single connection or none at all) to "conn->data"
  (since a connection can have none, one or many transfers associated with
  it and updating conn->data to be correct is error prone and a frequent
  reason for internal issues).
  
  Closes #3442

- tool_cb_prg: avoid integer overflow
  
  When calculating the progress bar width.
  
  Reported-by: Peng Li
  Fixes #3456
  Closes #3458

Daniel Gustafsson (11 Jan 2019)
- travis: turn off copyright year checks in checksrc
  
  Invoking the maintainer intended COPYRIGHTYEAR check for everyone
  in the PR pipeline is too invasive, especially at the turn of the
  year when many files get affected. Remove and leave it as a tool
  for maintainers to verify patches before commits.
  
  This reverts f7bdf4b2e1d81b2652b81b9b3029927589273b41.
  
  After discussion with: Daniel Stenberg

Daniel Stenberg (10 Jan 2019)
- KNOWN_BUGS: cmake makes unusable tool_hugehelp.c with MinGW
  
  Closes #3125

- KNOWN_BUGS: Improve --data-urlencode space encoding
  
  Closes #3229

Patrick Monnerat (10 Jan 2019)
- os400: add a missing closing bracket
  
  See https://github.com/curl/curl/issues/3453#issuecomment-453054458
  
  Reported-by: jonrumsey on github

- os400: fix extra parameter syntax error.
  
  Reported-by: jonrumsey on github
  Closes #3453

Daniel Stenberg (10 Jan 2019)
- test1558: verify CURLINFO_PROTOCOL on file:// transfer
  
  Attempt to reproduce issue #3444.
  
  Closes #3447

- RELEASE-NOTES: synced

- xattr: strip credentials from any URL that is stored
  
  Both user and password are cleared uncondtitionally.
  
  Added unit test 1621 to verify.
  
  Fixes #3423
  Closes #3433

- cookies: allow secure override when done over HTTPS
  
  Added test 1562 to verify.
  
  Reported-by: Jeroen Ooms
  Fixes #3445
  Closes #3450

- multi: multiplexing improvements
  
  Fixes #3436
  Closes #3448
  
   Problem 1
  
  After LOTS of scratching my head, I eventually realized that even when doing
  10 uploads in parallel, sometimes the socket callback to the application that
  tells it what to wait for on the socket, looked like it would reflect the
  status of just the single transfer that just changed state.
  
  Digging into the code revealed that this was indeed the truth. When multiple
  transfers are using the same connection, the application did not correctly get
  the *combined* flags for all transfers which then could make it switch to READ
  (only) when in fact most transfers wanted to get told when the socket was
  WRITEABLE.
  
   Problem 1b
  
  A separate but related regression had also been introduced by me when I
  cleared connection/transfer association better a while ago, as now the logic
  couldn't find the connection and see if that was marked as used by more
  transfers and then it would also prematurely remove the socket from the socket
  hash table even in times other transfers were still using it!
  
   Fix 1
  
  Make sure that each socket stored in the socket hash has a "combined" action
  field of what to ask the application to wait for, that is potentially the ORed
  action of multiple parallel transfers. And remove that socket hash entry only
  if there are no transfers left using it.
  
   Problem 2
  
  The socket hash entry stored an association to a single transfer using that
  socket - and when curl_multi_socket_action() was called to tell libcurl about
  activities on that specific socket only that transfer was "handled".
  
  This was WRONG, as a single socket/connection can be used by numerous parallel
  transfers and not necessarily a single one.
  
   Fix 2
  
  We now store a list of handles in the socket hashtable entry and when libcurl
  is told there's traffic for a particular socket, it now iterates over all
  known transfers using that single socket.

- test1561: improve test name
  
  [skip ci]

- [Katsuhiko YOSHIDA brought this change]

  cookies: skip custom cookies when redirecting cross-site
  
  Closes #3417

- THANKS: fixups and a dedupe
  
  [skip ci]

- timediff: fix math for unsigned time_t
  
  Bug: https://curl.haxx.se/mail/lib-2018-12/0088.html
  
  Closes #3449

- [Bernhard M. Wiedemann brought this change]

  tests: allow tests to pass by 2037-02-12
  
  similar to commit f508d29f3902104018
  
  Closes #3443

- RELEASE-NOTES: synced

- [Brad Spencer brought this change]

  curl_multi_remove_handle() don't block terminating c-ares requests
  
  Added Curl_resolver_kill() for all three resolver modes, which only
  blocks when necessary, along with test 1592 to confirm
  curl_multi_remove_handle() doesn't block unless it must.
  
  Closes #3428
  Fixes #3371

- Revert "http_negotiate: do not close connection until negotiation is completed"
  
  This reverts commit 07ebaf837843124ee670e5b8c218b80b92e06e47.
  
  This also reopens PR #3275 which brought the change now reverted.
  
  Fixes #3384
  Closes #3439

- curl/urlapi.h: include "curl.h" first
  
  This allows programs to include curl/urlapi.h directly.
  
  Reviewed-by: Daniel Gustafsson
  Reported-by: Ben Kohler
  Fixes #3438
  Closes #3441

Marcel Raad (6 Jan 2019)
- VS projects: fix build warning
  
  Starting with Visual Studio 2017 Update 9, Visual Studio doesn't like
  the MinimalRebuild option anymore and warns:
  
  cl : Command line warning D9035: option 'Gm' has been deprecated and
  will be removed in a future release
  
  The option can be safely removed so that the default is used.
  
  Closes https://github.com/curl/curl/pull/3425

- schannel: fix compiler warning
  
  When building with Unicode on MSVC, the compiler warns about freeing a
  pointer to const in Curl_unicodefree. Fix this by declaring it as
  non-const and casting the argument to Curl_convert_UTF8_to_tchar to
  non-const too, like we do in all other places.
  
  Closes https://github.com/curl/curl/pull/3435

Daniel Stenberg (4 Jan 2019)
- [Rikard Falkeborn brought this change]

  printf: introduce CURL_FORMAT_TIMEDIFF_T

- [Rikard Falkeborn brought this change]

  printf: fix format specifiers
  
  Closes #3426

- libtest/stub_gssapi: use "real" snprintf
  
  ... since it doesn't link with libcurl.
  
  Reverts the commit dcd6f81025 changes from this file.
  
  Bug: https://curl.haxx.se/mail/lib-2019-01/0000.html
  Reported-by: Shlomi Fish
  Reviewed-by: Daniel Gustafsson
  Reviewed-by: Kamil Dudka
  
  Closes #3434

- INTERNALS: correct some outdated function names
  
  Closes #3431

- docs/version.d: mention MultiSSL
  
  Reviewed-by: Daniel Gustafsson
  Closes #3432

Daniel Gustafsson (2 Jan 2019)
- [Rikard Falkeborn brought this change]

  examples: Update .gitignore
  
  Add a few missing examples to make `make examples` not leave the
  workspace in a dirty state.
  
  Closes #3427
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

- THANKS: add more missing names
  
  Add Adrian Burcea who made the artwork for the curl://up 2018 event
  which was held in Stockholm, Sweden.

- docs: mention potential leak in curl_slist_append
  
  When a non-empty list is appended to, and used as the returnvalue,
  the list pointer can leak in case of an allocation failure in the
  curl_slist_append() call. This is correctly handled in curl code
  usage but we weren't explicitly pointing it out in the API call
  documentation. Fix by extending the RETURNVALUE manpage section
  and example code.
  
  Closes #3424
  Reported-by: dnivras on github
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Marcel Raad (1 Jan 2019)
- tvnow: silence conversion warnings
  
  MinGW-w64 defaults to targeting Windows 7 now, so GetTickCount64 is
  used and the milliseconds are represented as unsigned long long,
  leading to a compiler warning when implicitly converting them to long.

Daniel Stenberg (1 Jan 2019)
- THANKS: dedupe more names
  
  Researched-by: Tae Wong

Marcel Raad (1 Jan 2019)
- [Markus Moeller brought this change]

  ntlm: update selection of type 3 response
  
  NTLM2 did not work i.e. no NTLMv2 response was created. Changing the
  check seems to work.
  
  Ref: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-NLMP/[MS-NLMP].pdf
  
  Fixes https://github.com/curl/curl/issues/3286
  Closes https://github.com/curl/curl/pull/3287
  Closes https://github.com/curl/curl/pull/3415

Daniel Stenberg (31 Dec 2018)
- THANKS: added missing names from year <= 2000
  
  Due to a report of a missing name in THANKS I manually went through an
  old CHANGES.0 file and added many previously missing names here.

Daniel Gustafsson (30 Dec 2018)
- urlapi: fix parsing ipv6 with zone index
  
  The previous fix for parsing IPv6 URLs with a zone index was a paddle
  short for URLs without an explicit port. This patch fixes that case
  and adds a unit test case.
  
  This bug was highlighted by issue #3408, and while it's not the full
  fix for the problem there it is an isolated bug that should be fixed
  regardless.
  
  Closes #3411
  Reported-by: GitYuanQu on github
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (30 Dec 2018)
- THANKS: dedupe Guenter Knauf
  
  Reported-by: Tae Wong

- THANKS: missing name from the 6.3.1 release!

Daniel Gustafsson (27 Dec 2018)
- RELEASE-NOTES: synced

- [Claes Jakobsson brought this change]

  hostip: support wildcard hosts
  
  This adds support for wildcard hosts in CURLOPT_RESOLVE. These are
  try-last so any non-wildcard entry is resolved first. If specified,
  any host not matched by another CURLOPT_RESOLVE config will use this
  as fallback.
  
  Example send a.com to 10.0.0.1 and everything else to 10.0.0.2:
    curl --resolve *:443:10.0.0.2 --resolve a.com:443:10.0.0.1 \
         https://a.com https://b.com
  
  This is probably quite similar to using:
    --connect-to a.com:443:10.0.0.1:443 --connect-to :443:10.0.0.2:443
  
  Closes #3406
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- url: fix incorrect indentation

Patrick Monnerat (26 Dec 2018)
- os400: upgrade ILE/RPG binding.
  
  - Trailer function support.
  - http 0.9 option.
  - curl_easy_upkeep.

Daniel Gustafsson (25 Dec 2018)
- FAQ: remove mention of sourceforge for github
  
  The project bug tracker is no longer hosted at sourceforge but is now
  hosted on the curl Github page. Update the FAQ to reflect.
  
  Closes #3410
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

- openvms: fix typos in documentation

- openvms: fix OpenSSL discovery on VAX
  
  The DCL code had a typo in one of the commands which would make the
  OpenSSL discovery on VAX fail. The correct syntax is F$ENVIRONMENT.
  
  Closes #3407
  Reviewed-by: Viktor Szakats <commit@vszakats.net>

Daniel Stenberg (24 Dec 2018)
- [Ruslan Baratov brought this change]

  cmake: use lowercase for function name like the rest of the code
  
  Reviewed-by: Sergei Nikulov
  
  closes #3196

- Revert "libssh: no data pointer == nothing to do"
  
  This reverts commit c98ee5f67f497195c9 since commit f3ce38739fa fixed the
  problem in a more generic way.

- disconnect: set conn->data for protocol disconnect
  
  Follow-up to fb445a1e18d: Set conn->data explicitly to point out the
  current transfer when invoking the protocol-specific disconnect function
  so that it can work correctly.
  
  Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12173

Jay Satiro (23 Dec 2018)
- [Pavel Pavlov brought this change]

  timeval: Use high resolution timestamps on Windows
  
  - Use QueryPerformanceCounter on Windows Vista+
  
  There is confusing info floating around that QueryPerformanceCounter
  can leap etc, which might have been true long time ago, but no longer
  the case nowadays (perhaps starting from WinXP?). Also, boost and
  std::chrono::steady_clock use QueryPerformanceCounter in a similar way.
  
  Prior to this change GetTickCount or GetTickCount64 was used, which has
  lower resolution. That is still the case for <= XP.
  
  Fixes https://github.com/curl/curl/issues/3309
  Closes https://github.com/curl/curl/pull/3318

Daniel Stenberg (22 Dec 2018)
- libssh: no data pointer == nothing to do

- conncache_unlock: avoid indirection by changing input argument type

- disconnect: separate connections and easy handles better
  
  Do not assume/store assocation between a given easy handle and the
  connection if it can be avoided.
  
  Long-term, the 'conn->data' pointer should probably be removed as it is a
  little too error-prone. Still used very widely though.
  
  Reported-by: masbug on github
  Fixes #3391
  Closes #3400

- libssh: free sftp_canonicalize_path() data correctly
  
  Assisted-by: Harry Sintonen
  
  Fixes #3402
  Closes #3403

- RELEASE-NOTES: synced

- http: added options for allowing HTTP/0.9 responses
  
  Added CURLOPT_HTTP09_ALLOWED and --http0.9 for this purpose.
  
  For now, both the tool and library allow HTTP/0.9 by default.
  docs/DEPRECATE.md lays out the plan for when to reverse that default: 6
  months after the 7.64.0 release. The options are added already now so
  that applications/scripts can start using them already now.
  
  Fixes #2873
  Closes #3383

- if2ip: remove unused function Curl_if_is_interface_name
  
  Closes #3401

- http2: clear pause stream id if it gets closed
  
  Reported-by: Florian Pritz
  
  Fixes #3392
  Closes #3399

Daniel Gustafsson (20 Dec 2018)
- [David Garske brought this change]

  wolfssl: Perform cleanup
  
  This adds a cleanup callback for cyassl. Resolves possible memory leak
  when using ECC fixed point cache.
  
  Closes #3395
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>
  Reviewed-by: Daniel Gustafsson <daniel@yesql.se>

Daniel Stenberg (20 Dec 2018)
- mbedtls: follow-up VERIFYHOST fix from f097669248
  
  Fix-by: Eric Rosenquist
  
  Fixes #3376
  Closes #3390

- curlver: bump to 7.64.0 for next release

Daniel Gustafsson (19 Dec 2018)
- cookies: extend domain checks to non psl builds
  
  Ensure to perform the checks we have to enforce a sane domain in
  the cookie request. The check for non-PSL enabled builds is quite
  basic but it's better than nothing.
  
  Closes #2964
  Reviewed-by: Daniel Stenberg <daniel@haxx.se>

Daniel Stenberg (19 Dec 2018)
- [Matus Uzak brought this change]

  smb: fix incorrect path in request if connection reused
  
  Follow-up to 09e401e01bf9.  If connection gets reused, then data member
  will be copied, but not the proto member.  As a result, in smb_do(),
  path has been set from the original proto.share data.
  
  Closes #3388

- curl -J: do not append to the destination file
  
  Reported-by: Kamil Dudka
  Fixes #3380
  Closes #3381

- mbedtls: use VERIFYHOST
  
  Previously, VERIFYPEER would enable/disable all checks.
  
  Reported-by: Eric Rosenquist
  Fixes #3376
  Closes #3380

- pingpong: change default response timeout to 120 seconds
  
  Previously it was 30 minutes

- pingpong: ignore regular timeout in disconnect phase
  
  The timeout set with CURLOPT_TIMEOUT is no longer used when
  disconnecting from one of the pingpong protocols (FTP, IMAP, SMTP,
  POP3).
  
  Reported-by: jasal82 on github
  
  Fixes #3264
  Closes #3374

- TODO: Windows: set attribute 'archive' for completed downloads
  
  Closes #3354

- RELEASE-NOTES: synced

- http: minor whitespace cleanup from f464535b

- [Ayoub Boudhar brought this change]

  http: Implement trailing headers for chunked transfers
  
  This adds the CURLOPT_TRAILERDATA and CURLOPT_TRAILERFUNCTION
  options that allow a callback based approach to sending trailing headers
  with chunked transfers.
  
  The test server (sws) was updated to take into account the detection of the
  end of transfer in the case of trailing headers presence.
  
  Test 1591 checks that trailing headers can be sent using libcurl.
  
  Closes #3350

- darwinssl: accept setting max-tls with default min-tls
  
  Reported-by: Andrei Neculau
  Fixes #3367
  Closes #3373

- gopher: fix memory leak from 9026083ddb2a9

- [Leonardo Taccari brought this change]

  test1201: Add a trailing `?' to the selector
  
  This verify that the `?' in the selector is kept as is.
  
  Verifies the fix in #3370

- [Leonardo Taccari brought this change]

  gopher: always include the entire gopher-path in request
  
  After the migration to URL API all octets in the selector after the
  first `?' were interpreted as query and accidentally discarded and not
  passed to the server.
  
  Add a gopherpath to always concatenate possible path and query URL
  pieces.
  
