{"thread":{"id":"63599","subject":"git - passes wrong types to curl_easy_setopt","startedAt":"2025-06-07T22:36:17Z","lastAt":"2025-06-07T23:22:52Z","messageCount":2,"participants":["Peter Michael Green","Todd Zullinger"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"519896","messageId":"07b6d5b3-7de5-db8c-5db0-c8c37dbf5364@debian.org","threadId":"63599","inReplyTo":null,"subject":"git - passes wrong types to curl_easy_setopt","fromName":"Peter Michael Green","fromEmail":"plugwash@debian.org","sentAt":"2025-06-07T22:28:20Z","receivedAt":"2025-06-07T22:36:17Z","isPatch":false,"sender":{"key":"plugwash@debian.org","avatar":null},"body":"When building against curl 8.14 git creates a whole bunch of compiler\nwarnings. We originally discovered this because of a package in Debian\nthat was using an embedded code copy of git and building it with\n-Werror (see debian bug 1107412) but the issue is clearly visible\nwhen rebuilding the git package in current sid.\n\n> imap-send.c:1421:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1421 |         curl_easy_setopt(curl, CURLOPT_PORT, srvc->port);\n> imap-send.c:1434:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1434 |         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, srvc->ssl_verify);\n> imap-send.c:1435:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1435 |         curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, srvc->ssl_verify);\n> http-push.c:197:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    197 |         curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);\n> http-push.c:197:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    197 |         curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);\n> http-push.c:197:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    197 |         curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);\n> http-push.c:197:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    197 |         curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);\n> http-push.c:197:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    197 |         curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);\n> http-push.c:197:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    197 |         curl_easy_setopt(curl, CURLOPT_HTTPGET, 1);\n> remote-curl.c:880:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    880 |         curl_easy_setopt(slot->curl, CURLOPT_NOBODY, 0);\n> remote-curl.c:881:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    881 |         curl_easy_setopt(slot->curl, CURLOPT_POST, 1);\n> remote-curl.c:885:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    885 |         curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDSIZE, 4);\n> http.c:1010:17: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1010 |                 curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, 0);\n> http.c:1011:17: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1011 |                 curl_easy_setopt(result, CURLOPT_SSL_VERIFYHOST, 0);\n> http.c:1014:17: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1014 |                 curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, 1);\n> http.c:1016:17: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1016 |                 curl_easy_setopt(result, CURLOPT_SSL_VERIFYHOST, 2);\n> http.c:1048:17: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1048 |                 curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NO_REVOKE);\n> http.c:1108:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1108 |         curl_easy_setopt(result, CURLOPT_MAXREDIRS, 20);\n> http.c:1109:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1109 |         curl_easy_setopt(result, CURLOPT_POSTREDIR, CURL_REDIR_POST_ALL);\n> http.c:1142:17: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1142 |                 curl_easy_setopt(result, CURLOPT_FTP_USE_EPSV, 0);\n> http.c:1183:25: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1183 |                         curl_easy_setopt(result,\n> http.c:1186:25: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1186 |                         curl_easy_setopt(result,\n> http.c:1189:25: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1189 |                         curl_easy_setopt(result,\n> http.c:1192:25: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1192 |                         curl_easy_setopt(result,\n> http.c:1195:25: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>   1195 |                         curl_easy_setopt(result, CURLOPT_PROXYTYPE, CURLPROXY_HTTPS);\n> http.c:709:9: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]\n>    709 |         curl_easy_setopt(c, CURLOPT_TCP_KEEPALIVE, 1);\n\nWhile the compiler warnings appear to be new with curl 8.14\nthe underlying issue does not. curl_easy_setopt is a variadic\nfunction whose parameter types depend on the option selected.\n\nPassing a parameter of the wrong type to a variadic function\ncan have consequences that vary by architecture and the types\nof the preceding parameters. It's possible that the right\nthing will happen by \"accident\", either because the types\nare in-fact the same size, or for example a 32-bit value\nmay be converted to a 64-bit value where the top bits are\ngarbage and the bottom bits are correct this may then be\nconverted back to a 32-bit value throwing away the garbage.\n\nBut it's equally possible the right thing will not happen,\nthat the variadic function will end up dealing with garabage\nand will misbehave or crash\n\nI think the fix here is just to add casts and literal suffixes\nso the argument is passed as the correct type, but I'd\nappreciate feedback from people more familiar with the codebase\n\n"},{"id":"519897","messageId":"aETJyXsVRS_sSej0@teonanacatl.net","threadId":"63599","inReplyTo":"07b6d5b3-7de5-db8c-5db0-c8c37dbf5364@debian.org","subject":"Re: git - passes wrong types to curl_easy_setopt","fromName":"Todd Zullinger","fromEmail":"tmz@pobox.com","sentAt":"2025-06-07T23:22:49Z","receivedAt":"2025-06-07T23:22:52Z","isPatch":false,"sender":{"key":"tmz@pobox.com","avatar":"https://avatars.githubusercontent.com/u/806319?v=4"},"body":"Peter Michael Green wrote:\n> When building against curl 8.14 git creates a whole bunch of compiler\n> warnings. We originally discovered this because of a package in Debian\n> that was using an embedded code copy of git and building it with\n> -Werror (see debian bug 1107412) but the issue is clearly visible\n> when rebuilding the git package in current sid.\n\nI believe this was fixed by a series Peff posted last week:\n\n    <20250604205505.GA1510724@coredump.intra.peff.net>\n\nc80760403b (Merge branch 'jk/curl-easy-setopt-typefix' into\njs/curl-easy-setopt-typefix, 2025-06-05) is the merge commit\nfor the series:\n\n    https://github.com/git/git/commit/c80760403b\n\nIt's on the master branch, so it should be included in\nv2.50.0-rc2, scheduled for Monday.\n\n-- \nTodd\n"}]}