Prepare NEWS for new release

.. since ws_mypath() saves the address it returns in a static pointer
for reuse, to also be returned in later calls.

.gitlab-ci.yml

@@ -0,0 +1,189 @@
+# we utilize the images generated by the build-images project, to
+# speed up CI runs. We also use ccache and store config.cache
+# to speed up compilation. We include a version number in cache
+# name to allow expiration of old caches.
+
+cache:
+  key: "$CI_JOB_NAME-ver5"
+  paths:
+    - cache/
+
+before_script:
+  # CCache Config
+  - mkdir -p cache
+  - export CCACHE_BASEDIR=${PWD}
+  - export CCACHE_DIR=${PWD}/cache
+  - echo $CCACHE_DIR
+  - export CC="ccache gcc"
+
+after_script:
+  # somehow after_script loses environment
+  - export CCACHE_BASEDIR=${PWD}
+  - export CCACHE_DIR=${PWD}/cache
+  - ccache -s
+
+variables:
+  BUILD_IMAGES_PROJECT: gnuwget/build-images
+  DEBIAN_BUILD: buildenv-debian-stretch
+  FEDORA_BUILD: buildenv-f27
+  CENTOS7_BUILD: buildenv-centos7
+  MINGW_BUILD: buildenv-mingw
+  ALPINE_BUILD: buildenv-alpine
+  ARCH_BUILD: buildenv-arch
+  BASIC_BUILD: buildenv-basic
+  GET_SOURCES_ATTEMPTS: "3"
+  GIT_DEPTH: "5"
+  CONFIGURE_BASE_FLAGS: --enable-assert --cache-file cache/config.cache
+  CFLAGS_DEFAULT: -O0 -g -ggdb3 -Wall -Wextra
+
+
+VPATH/Debian:
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+  script:
+    - cp -a /builds/common/gnulib .
+    - export CFLAGS=$CFLAGS_DEFAULT
+    - ./bootstrap --skip-po
+    - mkdir vpath && cd vpath
+    - ../configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+    - make -j$(nproc)
+    - make -j$(nproc) distcheck
+  tags:
+    - shared
+    - docker
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
+
+# In this build we combine
+#  * syntax-check
+#  * abi-check
+#  * build/valgrind-check
+#  * build/asan-check
+#  * build w/Werror and ubsan-check
+OpenSSL/Debian:
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+  script:
+  - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
+  - cat /etc/hosts
+  - alias make="make -j$(nproc)"
+  - ./bootstrap --skip-po
+  - ./configure $CONFIGURE_BASE_FLAGS --with-ssl=gnutls
+  - make syntax-check
+  - make check
+  - make distcheck
+  - make check-valgrind
+  tags:
+  - shared
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
+
+GnuTLS/Debian:
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+  script:
+  - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
+  - cat /etc/hosts
+  - alias make="make -j$(nproc)"
+  - ./bootstrap --skip-po
+  - ./configure $CONFIGURE_BASE_FLAGS --with-ssl=openssl
+  - make syntax-check
+  - make check
+  - make distcheck
+  - make check-valgrind
+  tags:
+  - shared
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
+
+#Centos7 build:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS7_BUILD
+#  script:
+#  - sed -i 's/AM_GNU_GETTEXT_VERSION(0.19.3)/AM_GNU_GETTEXT_VERSION(0.18.2)/g' configure.ac
+#  - ./bootstrap && ./configure --enable-gcc-warnings --disable-doc && make -j$(nproc) check
+#  tags:
+#  - shared
+#  artifacts:
+#    expire_in: 2 weeks
+#    when: on_failure
+#    paths:
+#      - tests/*.log
+#      - compat_reports/
+
+#clang-analyzer/Fedora:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+#  script:
+#  - ./bootstrap
+#  - scan-build ./configure --disable-doc --enable-gcc-warnings
+#  - make -j$(nproc) -C gl
+#  - scan-build --status-bugs -o scan-build-lib make -j$(nproc) -C lib
+#  tags:
+#  - shared
+#  except:
+#  - tags
+#  artifacts:
+#    expire_in: 2 weeks
+#    when: on_failure
+#    paths:
+#      - scan-build-lib/*
+
+#pages:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+#  script:
+#  - ./bootstrap
+#  - CFLAGS="-g -O0" ./configure --enable-gtk-doc --enable-code-coverage --disable-gcc-warnings
+#  - make -j$(nproc) check
+#  - make local-code-coverage-output
+#  - mkdir -p public
+#  - rm -rf public/coverage
+#  - mv libidn2-*-coverage public/coverage
+#  - rm -rf public/reference
+#  - mv doc/reference/html public/reference
+#  - make -C doc manual
+#  - rm -rf public/manual
+#  - mv doc/manual public/manual
+#  tags:
+#  - shared
+#  artifacts:
+#    when: on_success
+#    paths:
+#      - public
+#  only:
+#    - master
+
+#MinGW64:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+#  before_script:
+#  - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc &&
+#    echo ':DOSWin:M::MZ::/usr/bin/wine64:' > /proc/sys/fs/binfmt_misc/register
+#  script:
+#  - ./bootstrap
+#  - mingw64-configure --disable-valgrind-tests --disable-doc
+#  - mingw64-make -j$(nproc)
+#  - mingw64-make -j$(nproc) check
+#  tags:
+#  - shared
+#  - docker
+#  except:
+#  - tags
+#  artifacts:
+#    expire_in: 2 weeks
+#    when: on_failure
+#    paths:
+#      - ./*.log
+#      - tests/*.log

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "gnulib"]
 	path = gnulib
-	url = git://git.sv.gnu.org/gnulib.git
+	url = https://git.savannah.gnu.org/git/gnulib.git

.lgtm.yml

@@ -0,0 +1,7 @@
+extraction:
+  cpp:
+    prepare:
+      packages:
+        - libgpgme11-dev
+    configure:
+      command: ./bootstrap && ./configure

.travis.yml

@@ -1,4 +1,5 @@
 sudo: no
+dist: trusty
 
 language: c
 

COPYING

@@ -1,7 +1,7 @@
                     GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -645,7 +645,7 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
@@ -664,11 +664,11 @@ might be different; for a GUI interface, you would use an "about box".
   You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
+<https://www.gnu.org/licenses/>.
 
   The GNU General Public License does not permit incorporating your program
 into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+<https://www.gnu.org/philosophy/why-not-lgpl.html>.

MAILING-LIST

@@ -7,21 +7,14 @@ Primary List
 The primary mailinglist for discussion, bug-reports, or questions about
 GNU Wget is at <bug-wget@gnu.org>. To subscribe, send an email to
 <bug-wget-join@gnu.org>, or visit
-`http://lists.gnu.org/mailman/listinfo/bug-wget'.
+`https://lists.gnu.org/mailman/listinfo/bug-wget'.
 
    You do not need to subscribe to send a message to the list; however,
 please note that unsubscribed messages are moderated, and may take a
 while before they hit the list--*usually around a day*.  If you want
 your message to show up immediately, please subscribe to the list
 before posting. Archives for the list may be found at
-`http://lists.gnu.org/pipermail/bug-wget/'.
-
-   An NNTP/Usenettish gateway is also available via Gmane
-(http://gmane.org/about.php). You can see the Gmane archives at
-`http://news.gmane.org/gmane.comp.web.wget.general'. Note that the
-Gmane archives conveniently include messages from both the current
-list, and the previous one. Messages also show up in the Gmane archives
-sooner than they do at `lists.gnu.org'.
+`https://lists.gnu.org/pipermail/bug-wget/'.
 
 Obsolete Lists
 --------------
@@ -31,10 +24,7 @@ discussion list, and another list, <wget-patches@sunsite.dk> was used
 for submitting and discussing patches to GNU Wget.
 
    Messages from <wget@sunsite.dk> are archived at
-     `http://www.mail-archive.com/wget%40sunsite.dk/' and at
-
-     `http://news.gmane.org/gmane.comp.web.wget.general' (which also
-     continues to archive the current list, <bug-wget@gnu.org>).
+     `https://www.mail-archive.com/wget%40sunsite.dk/' and at
 
    Messages from <wget-patches@sunsite.dk> are archived at
-     `http://news.gmane.org/gmane.comp.web.wget.patches'.
+     `https://news.gmane.org/gmane.comp.web.wget.patches'.

Makefile.am

@@ -1,6 +1,6 @@
 # Makefile for `Wget' utility
-# Copyright (C) 1995, 1996, 1997, 2006, 2007, 2008, 2009, 2010, 2011
-# Free Software Foundation, Inc.
+# Copyright (C) 1995-1997, 2006-2018 Free Software Foundation,
+# Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -13,7 +13,7 @@
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # Additional permission under GNU GPL version 3 section 7
 
@@ -41,7 +41,7 @@ distuninstallcheck_listfiles = find . -type f | \
 ACLOCAL_AMFLAGS = -I m4
 
 # subdirectories in the distribution
-SUBDIRS = lib src doc po tests util testenv
+SUBDIRS = lib src doc po util fuzz tests testenv
 
 EXTRA_DIST = MAILING-LIST \
              msdos/config.h msdos/Makefile.DJ \
@@ -49,6 +49,7 @@ EXTRA_DIST = MAILING-LIST \
              build-aux/build_info.pl build-aux/git-version-gen .version
 
 CLEANFILES = *~ *.bak $(DISTNAME).tar.gz
+DISTCLEANFILES = po/stamp-po
 
 BUILT_SOURCES = .version
 

NEWS

@@ -1,10 +1,103 @@
 GNU Wget NEWS -- history of user-visible changes.
 
-Copyright (C) 1997-2017 Free Software Foundation, Inc.
+Copyright (C) 1997-2018 Free Software Foundation, Inc.
 See the end for copying conditions.
 
 Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 
+* Changes in Wget 1.20
+
+** Add new option `--retry-on-host-error` to treat local errors as transient
+and hence Wget will retry to download the file after a brief waiting period.
+
+** Fixed multiple potential resource leaks as found by static analysis
+
+** Wget will now not create an empty wget-log file when running with -q and -b
+switches together
+
+** When compiled using the GnuTLS >= 3.6.3, Wget now has support for TLSv1.3
+
+** Now there is support for using libpcre2 for regex pattern matching
+
+** When downloading over FTP recursively, one can now use the
+--{accept,reject}-regex switches to fine-tune the downloaded files
+
+** Building Wget from the git sources now requires autoconf 2.63 or above.
+Building from the Tarballs works as it used to.
+
+
+* Changes in Wget 1.19.5
+
+* Fix cookie injection (CVE-2018-0494)
+
+* Enable TLS1.3 with recent OpenSSL environment
+
+* New option --ciphers to set GnuTLS / OpenSSL ciphers directly
+
+* Updated CSS grammar to CSS 2.2
+
+* Fixed several memleaks found by OSS-Fuzz
+
+* Fixed several buffer overflows found by OSS-Fuzz
+
+* Fixed several integer overflows found by OSS-Fuzz
+
+* Several minor bug fixes
+
+
+* Changes in Wget 1.19.4
+
+* A major bug that caused GZip'ed pages to never be decompressed has been fixed
+
+* Support for Content-Encoding and Transfer-Encoding have been marked as
+  experimental and disabled by default
+
+
+* Changes in Wget 1.19.3
+
+* Prevent erroneous decompression of .gz and .tgz files with broken servers
+
+* Added support for HTTP 308 Permanent Redirect response
+
+* Fix a segfault in some cases where the Content-Type header is not sent
+
+* Support OpenSSL 1.1 builds without using deprecated features
+
+* Fix netrc file detection on Windows
+
+* Several minor bug fixes
+
+
+* Changes in Wget 1.19.2
+
+* Fix CVE-2017-13089 (Stack overflow in HTTP protocol handling)
+
+* Fix CVE-2017-13090 (Heap overflow in HTTP protocol handling)
+
+* New option --compression for gzip Content-Encoding
+
+* New option --[no]-netrc to control .netrc parsing
+
+* Added GNU extensions to .netrc parsing
+
+* Improved IDNA 2003 compatibility
+
+* Fix VPATH issues
+
+* Improved and extended the test suite
+
+* Support Wayback Machine's X-Archive-Orig-last-modified
+
+* Several bug fixes
+
+
+* Changes in Wget 1.19.1
+
+* Fix bugs, a regression, portability/build issues
+
+* Add new option --retry-on-http-error
+
+
 * Changes in Wget 1.19
 
 * New option --use-askpass=COMMAND. Fetch user/password by calling
@@ -691,7 +784,7 @@ addresses when accessing the first one fails.
 non-standard port.
 
 ** Wget now supports the robots.txt directives specified in
-<http://www.robotstxt.org/wc/norobots-rfc.txt>.
+<http://www.robotstxt.org/norobots-rfc.txt>.
 
 ** URL parser has been fixed, especially the infamous overzealous
 quoting.  Wget no longer dequotes reserved characters, e.g. `%3F' is

README

@@ -1,7 +1,7 @@
                                                           -*- text -*-
 GNU Wget
 ========
-                  Current Web home: http://www.gnu.org/software/wget/
+                  Current Web home: https://www.gnu.org/software/wget/
 
 GNU Wget is a free utility for non-interactive download of files from
 the Web.  It supports HTTP, HTTPS, and FTP protocols, as well as
@@ -50,10 +50,10 @@ resides at <ftp://ftp.gnu.org/pub/gnu/wget/>.
 Please report bugs in Wget to <bug-wget@gnu.org>.
 
 See the file `MAILING-LIST' for information about Wget mailing lists.
-Wget's home page is at <http://www.gnu.org/software/wget/>.
+Wget's home page is at <https://www.gnu.org/software/wget/>.
 
 If you would like to contribute code for Wget, please read
-http://wget.addictivecode.org/PatchGuidelines.
+https://wget.addictivecode.org/PatchGuidelines.
 
 Wget was originally written and mainained by Hrvoje Niksic.  Please see
 the file AUTHORS for a list of major contributors, and the ChangeLogs

README.checkout

@@ -104,6 +104,10 @@ Compiling From Repository Sources
        The command line options --dns-servers and --bind-dns-address are
        only available when configured with --with-cares.
 
+     * [49]Gpef is required by some gnulib modules, most notably "unicase". You
+	   need the application installed on the machine to compile Wget from git.
+
+
    For those who might be confused as to what to do once they check out
    the source code, considering configure and Makefile do not yet exist at
    that point, a shell script called bootstrap has been provided. After
@@ -116,7 +120,7 @@ Compiling From Repository Sources
  $  cd wget        # assumes you've cloned a repository to "./wget"
     2. Generate all the automatically-generated files required prior to
        configuring the package:
- $  ./bootstrap
+ $  ./bootstrap (or: bash ./bootstrap)
     3. Configure the package and compile it:
  $  ./configure --enable-assert [some_parameters]
  $  make
@@ -157,7 +161,8 @@ Testing and development
  that bug, which might be tedious. Tests should only be run through GDB for that purpose.
 
 
- Copyright (C) 2008,2010,2014,2015 Free Software Foundation, Inc.
+ Copyright (C) 2008, 2010, 2014-2015, 2018 Free Software Foundation,
+ Inc.
  License GPLv3+: GNU GPL version 3 or later
  <https://www.gnu.org/licenses/gpl.html>.
  This is free software: you are free to change and redistribute it.
@@ -198,7 +203,7 @@ References
   32. https://www.gnu.org/software/libiconv/
   33. https://git-scm.com/
   34. https://github.com/rockdaboot/libpsl
-  35. http://www.pcre.org
+  35. https://www.pcre.org
   36. http://wget.addictivecode.org/CompilingRepoSources?action=edit&editor=text
   37. http://wget.addictivecode.org/CompilingRepoSources
   38. http://wget.addictivecode.org/CompilingRepoSources?action=info
@@ -212,3 +217,4 @@ References
   46. https://launchpad.net/libmetalink
   47. https://www.gnupg.org
   48. https://c-ares.haxx.se/
+  49. https://www.gnu.org/software/gperf/

bootstrap

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Print a version string.
-scriptversion=2016-01-24.06; # UTC
+scriptversion=2018-10-13.05; # UTC
 
 # Bootstrap this package from checked-out sources.
 
-# Copyright (C) 2003-2016 Free Software Foundation, Inc.
+# Copyright (C) 2003-2018 Free Software Foundation, Inc.
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -17,7 +17,7 @@ scriptversion=2016-01-24.06; # UTC
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 # Originally written by Paul Eggert.  The canonical version of this
 # script is maintained as build-aux/bootstrap in gnulib, however, to
@@ -47,6 +47,8 @@ PERL="${PERL-perl}"
 
 me=$0
 
+default_gnulib_url=git://git.sv.gnu.org/gnulib
+
 usage() {
   cat <<EOF
 Usage: $me [OPTION]...
@@ -76,6 +78,37 @@ contents are read as shell variables to configure the bootstrap.
 For build prerequisites, environment variables like \$AUTOCONF and \$AMTAR
 are honored.
 
+Gnulib sources can be fetched in various ways:
+
+ * If this package is in a git repository with a 'gnulib' submodule
+   configured, then that submodule is initialized and updated and sources
+   are fetched from there.  If \$GNULIB_SRCDIR is set (directly or via
+   --gnulib-srcdir) and is a git repository, then it is used as a reference.
+
+ * Otherwise, if \$GNULIB_SRCDIR is set (directly or via --gnulib-srcdir),
+   then sources are fetched from that local directory.  If it is a git
+   repository and \$GNULIB_REVISION is set, then that revision is checked
+   out.
+
+ * Otherwise, if this package is in a git repository with a 'gnulib'
+   submodule configured, then that submodule is initialized and updated and
+   sources are fetched from there.
+
+ * Otherwise, if the 'gnulib' directory does not exist, Gnulib sources are
+   cloned into that directory using git from \$GNULIB_URL, defaulting to
+   $default_gnulib_url.
+   If \$GNULIB_REVISION is set, then that revision is checked out.
+
+ * Otherwise, the existing Gnulib sources in the 'gnulib' directory are
+   used.  If it is a git repository and \$GNULIB_REVISION is set, then that
+   revision is checked out.
+
+If you maintain a package and want to pin a particular revision of the
+Gnulib sources that has been tested with your package, then there are two
+possible approaches: either configure a 'gnulib' submodule with the
+appropriate revision, or set \$GNULIB_REVISION (and if necessary
+\$GNULIB_URL) in $me.conf.
+
 Running without arguments will suffice in most cases.
 EOF
 }
@@ -129,19 +162,12 @@ bootstrap_post_import_hook() { :; }
 # Override it via your own definition in bootstrap.conf.
 bootstrap_epilogue() { :; }
 
-# The command to download all .po files for a specified domain into
-# a specified directory.  Fill in the first %s is the domain name, and
-# the second with the destination directory.  Use rsync's -L and -r
-# options because the latest/%s directory and the .po files within are
-# all symlinks.
+# The command to download all .po files for a specified domain into a
+# specified directory.  Fill in the first %s with the destination
+# directory and the second with the domain name.
 po_download_command_format=\
-"rsync --delete --exclude '*.s1' -Lrtvz \
- 'translationproject.org::tp/latest/%s/' '%s'"
-
-# Fallback for downloading .po files (if rsync fails).
-po_download_command_format2=\
-"wget --mirror -nd -q -np -A.po -P '%s' \
- http://translationproject.org/latest/%s/"
+"wget --mirror --level=1 -nd -q -A.po -P '%s' \
+ https://translationproject.org/latest/%s/"
 
 # Prefer a non-empty tarname (4th argument of AC_INIT if given), else
 # fall back to the package name (1st argument with munging)
@@ -170,7 +196,15 @@ source_base=lib
 m4_base=m4
 doc_base=doc
 tests_base=tests
-gnulib_extra_files=''
+gnulib_extra_files="
+        build-aux/install-sh
+        build-aux/mdate-sh
+        build-aux/texinfo.tex
+        build-aux/depcomp
+        build-aux/config.guess
+        build-aux/config.sub
+        doc/INSTALL
+"
 
 # Additional gnulib-tool options to use.  Use "\newline" to break lines.
 gnulib_tool_option_extras=
@@ -264,24 +298,18 @@ case "$0" in
   *) test -r "$0.conf" && . ./"$0.conf" ;;
 esac
 
-# Extra files from gnulib, which override files from other sources.
-test -z "${gnulib_extra_files}" && \
-  gnulib_extra_files="
-        build-aux/install-sh
-        build-aux/mdate-sh
-        build-aux/texinfo.tex
-        build-aux/depcomp
-        build-aux/config.guess
-        build-aux/config.sub
-        doc/INSTALL
-"
-
 if test "$vc_ignore" = auto; then
   vc_ignore=
   test -d .git && vc_ignore=.gitignore
   test -d CVS && vc_ignore="$vc_ignore .cvsignore"
 fi
 
+if test x"$gnulib_modules$gnulib_files$gnulib_extra_files" = x; then
+  use_gnulib=false
+else
+  use_gnulib=true
+fi
+
 # Translate configuration into internal form.
 
 # Parse options.
@@ -418,28 +446,30 @@ sort_ver() { # sort -V is not generally available
   done
 }
 
+get_version_sed='
+# Move version to start of line.
+s/.*[v ]\([0-9]\)/\1/
+
+# Skip lines that do not start with version.
+/^[0-9]/!d
+
+# Remove characters after the version.
+s/[^.a-z0-9-].*//
+
+# The first component must be digits only.
+s/^\([0-9]*\)[a-z-].*/\1/
+
+#the following essentially does s/5.005/5.5/
+s/\.0*\([1-9]\)/.\1/g
+p
+q'
+
 get_version() {
   app=$1
 
   $app --version >/dev/null 2>&1 || { $app --version; return 1; }
 
-  $app --version 2>&1 |
-  sed -n '# Move version to start of line.
-          s/.*[v ]\([0-9]\)/\1/
-
-          # Skip lines that do not start with version.
-          /^[0-9]/!d
-
-          # Remove characters after the version.
-          s/[^.a-z0-9-].*//
-
-          # The first component must be digits only.
-          s/^\([0-9]*\)[a-z-].*/\1/
-
-          #the following essentially does s/5.005/5.5/
-          s/\.0*\([1-9]\)/.\1/g
-          p
-          q'
+  $app --version 2>&1 | sed -n "$get_version_sed"
 }
 
 check_versions() {
@@ -610,95 +640,101 @@ git_modules_config () {
   test -f .gitmodules && git config --file .gitmodules "$@"
 }
 
-if $use_git; then
-  gnulib_path=$(git_modules_config submodule.gnulib.path)
-  test -z "$gnulib_path" && gnulib_path=gnulib
-fi
-
-# Get gnulib files.  Populate $GNULIB_SRCDIR, possibly updating a
-# submodule, for use in the rest of the script.
-
-case ${GNULIB_SRCDIR--} in
--)
-  # Note that $use_git is necessarily true in this case.
-  if git_modules_config submodule.gnulib.url >/dev/null; then
-    echo "$0: getting gnulib files..."
-    git submodule init -- "$gnulib_path" || exit $?
-    git submodule update -- "$gnulib_path" || exit $?
-
-  elif [ ! -d "$gnulib_path" ]; then
-    echo "$0: getting gnulib files..."
-
-    trap cleanup_gnulib 1 2 13 15
-
-    shallow=
-    git clone -h 2>&1 | grep -- --depth > /dev/null && shallow='--depth 2'
-    git clone $shallow git://git.sv.gnu.org/gnulib "$gnulib_path" ||
-      cleanup_gnulib
-
-    trap - 1 2 13 15
+if $use_gnulib; then
+  if $use_git; then
+    gnulib_path=$(git_modules_config submodule.gnulib.path)
+    test -z "$gnulib_path" && gnulib_path=gnulib
   fi
-  GNULIB_SRCDIR=$gnulib_path
-  ;;
-*)
-  # Use GNULIB_SRCDIR directly or as a reference.
-  if $use_git && test -d "$GNULIB_SRCDIR"/.git && \
-        git_modules_config submodule.gnulib.url >/dev/null; then
-    echo "$0: getting gnulib files..."
-    if git submodule -h|grep -- --reference > /dev/null; then
-      # Prefer the one-liner available in git 1.6.4 or newer.
-      git submodule update --init --reference "$GNULIB_SRCDIR" \
-        "$gnulib_path" || exit $?
-    else
-      # This fallback allows at least git 1.5.5.
-      if test -f "$gnulib_path"/gnulib-tool; then
-        # Since file already exists, assume submodule init already complete.
-        git submodule update -- "$gnulib_path" || exit $?
-      else
-        # Older git can't clone into an empty directory.
-        rmdir "$gnulib_path" 2>/dev/null
-        git clone --reference "$GNULIB_SRCDIR" \
-          "$(git_modules_config submodule.gnulib.url)" "$gnulib_path" \
-          && git submodule init -- "$gnulib_path" \
-          && git submodule update -- "$gnulib_path" \
-          || exit $?
+
+  # Get gnulib files.  Populate $GNULIB_SRCDIR, possibly updating a
+  # submodule, for use in the rest of the script.
+
+  case ${GNULIB_SRCDIR--} in
+  -)
+    # Note that $use_git is necessarily true in this case.
+    if git_modules_config submodule.gnulib.url >/dev/null; then
+      echo "$0: getting gnulib files..."
+      git submodule init -- "$gnulib_path" || exit $?
+      git submodule update -- "$gnulib_path" || exit $?
+
+    elif [ ! -d "$gnulib_path" ]; then
+      echo "$0: getting gnulib files..."
+
+      trap cleanup_gnulib 1 2 13 15
+
+      shallow=
+      if test -z "$GNULIB_REVISION"; then
+        git clone -h 2>&1 | grep -- --depth > /dev/null && shallow='--depth 2'
       fi
+      git clone $shallow ${GNULIB_URL:-$default_gnulib_url} "$gnulib_path" \
+        || cleanup_gnulib
+
+      trap - 1 2 13 15
     fi
     GNULIB_SRCDIR=$gnulib_path
+    ;;
+  *)
+    # Use GNULIB_SRCDIR directly or as a reference.
+    if $use_git && test -d "$GNULIB_SRCDIR"/.git && \
+          git_modules_config submodule.gnulib.url >/dev/null; then
+      echo "$0: getting gnulib files..."
+      if git submodule -h|grep -- --reference > /dev/null; then
+        # Prefer the one-liner available in git 1.6.4 or newer.
+        git submodule update --init --reference "$GNULIB_SRCDIR" \
+          "$gnulib_path" || exit $?
+      else
+        # This fallback allows at least git 1.5.5.
+        if test -f "$gnulib_path"/gnulib-tool; then
+          # Since file already exists, assume submodule init already complete.
+          git submodule update -- "$gnulib_path" || exit $?
+        else
+          # Older git can't clone into an empty directory.
+          rmdir "$gnulib_path" 2>/dev/null
+          git clone --reference "$GNULIB_SRCDIR" \
+            "$(git_modules_config submodule.gnulib.url)" "$gnulib_path" \
+            && git submodule init -- "$gnulib_path" \
+            && git submodule update -- "$gnulib_path" \
+            || exit $?
+        fi
+      fi
+      GNULIB_SRCDIR=$gnulib_path
+    fi
+    ;;
+  esac
+
+  if test -d "$GNULIB_SRCDIR"/.git && test -n "$GNULIB_REVISION" \
+     && ! git_modules_config submodule.gnulib.url >/dev/null; then
+    (cd "$GNULIB_SRCDIR" && git checkout "$GNULIB_REVISION") || cleanup_gnulib
   fi
-  ;;
-esac
 
-# $GNULIB_SRCDIR now points to the version of gnulib to use, and
-# we no longer need to use git or $gnulib_path below here.
+  # $GNULIB_SRCDIR now points to the version of gnulib to use, and
+  # we no longer need to use git or $gnulib_path below here.
 
-if $bootstrap_sync; then
-  cmp -s "$0" "$GNULIB_SRCDIR/build-aux/bootstrap" || {
-    echo "$0: updating bootstrap and restarting..."
-    case $(sh -c 'echo "$1"' -- a) in
-      a) ignored=--;;
-      *) ignored=ignored;;
-    esac
-    exec sh -c \
-      'cp "$1" "$2" && shift && exec "${CONFIG_SHELL-/bin/sh}" "$@"' \
-      $ignored "$GNULIB_SRCDIR/build-aux/bootstrap" \
-      "$0" "$@" --no-bootstrap-sync
-  }
+  if $bootstrap_sync; then
+    cmp -s "$0" "$GNULIB_SRCDIR/build-aux/bootstrap" || {
+      echo "$0: updating bootstrap and restarting..."
+      case $(sh -c 'echo "$1"' -- a) in
+        a) ignored=--;;
+        *) ignored=ignored;;
+      esac
+      exec sh -c \
+        'cp "$1" "$2" && shift && exec "${CONFIG_SHELL-/bin/sh}" "$@"' \
+        $ignored "$GNULIB_SRCDIR/build-aux/bootstrap" \
+        "$0" "$@" --no-bootstrap-sync
+    }
+  fi
+
+  gnulib_tool=$GNULIB_SRCDIR/gnulib-tool
+  <$gnulib_tool || exit $?
 fi
 
-gnulib_tool=$GNULIB_SRCDIR/gnulib-tool
-<$gnulib_tool || exit $?
-
 # Get translations.
 
 download_po_files() {
   subdir=$1
   domain=$2
   echo "$me: getting translations into $subdir for $domain..."
-  cmd=$(printf "$po_download_command_format" "$domain" "$subdir")
-  eval "$cmd" && return
-  # Fallback to HTTP.
-  cmd=$(printf "$po_download_command_format2" "$subdir" "$domain")
+  cmd=$(printf "$po_download_command_format" "$subdir" "$domain")
   eval "$cmd"
 }
 
@@ -788,9 +824,9 @@ symlink_to_dir()
       # Leave any existing symlink alone, if it already points to the source,
       # so that broken build tools that care about symlink times
       # aren't confused into doing unnecessary builds.  Conversely, if the
-      # existing symlink's time stamp is older than the source, make it afresh,
+      # existing symlink's timestamp is older than the source, make it afresh,
       # so that broken tools aren't confused into skipping needed builds.  See
-      # <http://lists.gnu.org/archive/html/bug-gnulib/2011-05/msg00326.html>.
+      # <https://lists.gnu.org/r/bug-gnulib/2011-05/msg00326.html>.
       test -h "$dst" &&
       src_ls=$(ls -diL "$src" 2>/dev/null) && set $src_ls && src_i=$1 &&
       dst_ls=$(ls -diL "$dst" 2>/dev/null) && set $dst_ls && dst_i=$1 &&
@@ -896,32 +932,33 @@ fi
 
 # Import from gnulib.
 
-gnulib_tool_options="\
- --import\
- --no-changelog\
- --aux-dir $build_aux\
- --doc-base $doc_base\
- --lib $gnulib_name\
- --m4-base $m4_base/\
- --source-base $source_base/\
- --tests-base $tests_base\
- --local-dir $local_gl_dir\
- $gnulib_tool_option_extras\
-"
-if test $use_libtool = 1; then
-  case "$gnulib_tool_options " in
-    *' --libtool '*) ;;
-    *) gnulib_tool_options="$gnulib_tool_options --libtool" ;;
-  esac
-fi
-echo "$0: $gnulib_tool $gnulib_tool_options --import ..."
-$gnulib_tool $gnulib_tool_options --import $gnulib_modules \
-  || die "gnulib-tool failed"
+if $use_gnulib; then
+  gnulib_tool_options="\
+   --no-changelog\
+   --aux-dir=$build_aux\
+   --doc-base=$doc_base\
+   --lib=$gnulib_name\
+   --m4-base=$m4_base/\
+   --source-base=$source_base/\
+   --tests-base=$tests_base\
+   --local-dir=$local_gl_dir\
+   $gnulib_tool_option_extras\
+  "
+  if test $use_libtool = 1; then
+    case "$gnulib_tool_options " in
+      *' --libtool '*) ;;
+      *) gnulib_tool_options="$gnulib_tool_options --libtool" ;;
+    esac
+  fi
+  echo "$0: $gnulib_tool $gnulib_tool_options --import ..."
+  $gnulib_tool $gnulib_tool_options --import $gnulib_modules \
+    || die "gnulib-tool failed"
 
-for file in $gnulib_files; do
-  symlink_to_dir "$GNULIB_SRCDIR" $file \
-    || die "failed to symlink $file"
-done
+  for file in $gnulib_files; do
+    symlink_to_dir "$GNULIB_SRCDIR" $file \
+      || die "failed to symlink $file"
+  done
+fi
 
 bootstrap_post_import_hook \
   || die "bootstrap_post_import_hook failed"
@@ -1018,7 +1055,7 @@ bootstrap_epilogue
 echo "$0: done.  Now you can run './configure'."
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
 # time-stamp-time-zone: "UTC0"

bootstrap.conf

@@ -1,6 +1,5 @@
 # bootstrap.conf - Bootstrap configuration.
-# Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012 Free Software Foundation,
-# Inc.
+# Copyright (C) 2007-2012, 2018 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #
@@ -9,13 +8,13 @@
 # the Free Software Foundation, either version 3 of the License, or (at
 # your option) any later version.
 #
-# GNU Wgt is distributed in the hope that it will be useful, but
+# GNU Wget is distributed in the hope that it will be useful, but
 # WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see `http://www.gnu.org/licenses/'.
+# along with this program.  If not, see `https://www.gnu.org/licenses/'.
 
 # gnulib library name
 gnulib_name=libgnu
@@ -49,10 +48,11 @@ getopt-gnu
 getpass-gnu
 getpeername
 getsockname
-gettext
+gettext-h
 gitlog-to-changelog
 git-version-gen
 gnupload
+group-member
 hostent
 ioctl
 iconv
@@ -102,6 +102,7 @@ strerror_r-posix
 strpbrk
 strptime
 strtok_r
+strtol
 strtoll
 symlink
 sys_types
@@ -111,11 +112,14 @@ unlink
 unlocked-io
 update-copyright
 libunistring-optional
-unistr/base
-unicase/tolower
+unistr/u8-strlen
+unicase/u8-tolower
+utime
+utime-h
 utimens
 vasprintf
 vsnprintf
+wcwidth
 write
 xmemdup0
 xstrndup
@@ -145,4 +149,21 @@ rsync      -
 tar        -
 xz         -
 flex       -
+gperf      -
 "
+
+bootstrap_post_import_hook ()
+{
+  # We need to patch unicase/special-casing-table.h for gperf < 3.1
+  GPERF_VER=$(gperf --version | {
+    IFS=' .' read x y major minor bugfix _
+    printf "%d%02d%02d" $major $minor $bugfix
+  })
+
+  if [ $GPERF_VER -lt 30100 ]; then
+    echo "Creating lib/unicase/special-casing-table.h for gperf < 3.1"
+     gperf -m 10 lib/unicase/special-casing-table.gperf | \
+       sed -e "s/gl_unicase_special_lookup.*/gl_unicase_special_lookup\ \(const char \*str, size_t len\)/g" \
+         > lib/unicase/special-casing-table.h
+  fi
+}

build-aux/build_info.pl

@@ -2,7 +2,7 @@
 
 # Generate build_info.c.
 
-# Copyright (C) 2009, 2010, 2011 Free Software Foundation, Inc.
+# Copyright (C) 2009-2011, 2018 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

cfg.mk

@@ -1,4 +1,11 @@
-export VC_LIST_EXCEPT_DEFAULT=^(lib/.*|m4/.*|md5/.*|build-aux/.*|src/gettext\.h|.*ChangeLog)$$
+# Explicit syntax-check exceptions.
+exclude_file_name_regexp--sc_trailing_blank = ^doc/annou.*$$
+exclude_file_name_regexp--sc_bindtextdomain = ^fuzz/.*.c$$
+exclude_file_name_regexp--sc_require_config_h = fuzz/main.c$$
+exclude_file_name_regexp--sc_require_config_h_first = fuzz/main.c$$
+
+
+export VC_LIST_EXCEPT_DEFAULT=^(lib/.*|m4/.*|md5/.*|build-aux/.*|src/gettext\.h|.*ChangeLog|tests/certs/.*)$$
 
 local-checks-to-skip = \
     sc_const_long_option \
@@ -21,9 +28,10 @@ local-checks-to-skip = \
     sc_program_name \
     sc_makefile_at_at_check \
     sc_cast_of_argument_to_free \
+    sc_prohibit_undesirable_word_seq
 
 #SHELL=bash -x
 show-vc-list-except:
 	@$(VC_LIST_EXCEPT)
 
-VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)|ChangeLog-2014-12-10|/.*.der$$
+VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)|ChangeLog-2014-12-10|/.*\.der|^tests/certs/.*|^fuzz/.*\.(in|repro)/.*$$

configure.ac

@@ -1,6 +1,6 @@
 dnl Template file for GNU Autoconf
-dnl Copyright (C) 1995, 1996, 1997, 2001, 2007, 2008, 2009, 2010, 2011, 2012,
-dnl 2013, 2014 Free Software Foundation, Inc.
+dnl Copyright (C) 1995-1997, 2001, 2007-2014, 2018 Free Software
+dnl Foundation, Inc.
 
 dnl This program is free software; you can redistribute it and/or modify
 dnl it under the terms of the GNU General Public License as published by
@@ -33,7 +33,7 @@ dnl
 AC_INIT([wget],
         m4_esyscmd([build-aux/git-version-gen .tarball-version]),
 	[bug-wget@gnu.org])
-AC_PREREQ(2.61)
+AC_PREREQ(2.63)
 
 dnl
 dnl What version of Wget are we building?
@@ -87,6 +87,22 @@ dnl
 dnl Process features
 dnl
 
+AC_ARG_ENABLE([fuzzing],
+  [AS_HELP_STRING([--enable-fuzzing], [Turn on fuzzing build (for developers)])],
+  [enable_fuzzing=yes;
+   AC_SUBST([LIB_FUZZING_ENGINE])
+   AC_DEFINE([FUZZING], 1, [Define to 1 if this is a fuzzing build])
+  ], [enable_fuzzing=no; LIB_FUZZING_ENGINE=""])
+#FUZZ_LIBS=$LIBS
+#if test $enable_fuzzing = "yes"; then
+#  OLD_LIBS=$LIBS
+#  AC_SEARCH_LIBS([dlsym], [dl dld])
+#  FUZZ_LIBS=$LIBS
+#  LIBS=$OLD_LIBS
+#fi
+#AC_SUBST([FUZZ_LIBS])
+AM_CONDITIONAL([FUZZING], [test "$enable_fuzzing" = "yes"])
+
 dnl Opie: Support for opie s/key FTP logins
 AC_ARG_ENABLE([opie],
   [AS_HELP_STRING([--disable-opie], [disable support for opie or s/key FTP login])],
@@ -184,7 +200,7 @@ dnl
 dnl Gettext
 dnl
 AM_GNU_GETTEXT([external],[need-ngettext])
-AM_GNU_GETTEXT_VERSION([0.18.1])
+AM_GNU_GETTEXT_VERSION([0.17])
 
 AC_PROG_RANLIB
 
@@ -237,7 +253,7 @@ dnl
 AC_HEADER_STDBOOL
 AC_CHECK_HEADERS(unistd.h sys/time.h)
 AC_CHECK_HEADERS(termios.h sys/ioctl.h sys/select.h utime.h sys/utime.h)
-AC_CHECK_HEADERS(stdint.h inttypes.h pwd.h wchar.h)
+AC_CHECK_HEADERS(stdint.h inttypes.h pwd.h wchar.h dlfcn.h)
 
 AC_CHECK_DECLS(h_errno,,,[#include <netdb.h>])
 
@@ -275,7 +291,7 @@ AC_FUNC_MMAP
 AC_FUNC_FSEEKO
 AC_CHECK_FUNCS(strptime timegm vsnprintf vasprintf drand48 pathconf)
 AC_CHECK_FUNCS(strtoll usleep ftello sigblock sigsetjmp memrchr wcwidth mbtowc)
-AC_CHECK_FUNCS(sleep symlink utime strlcpy random)
+AC_CHECK_FUNCS(sleep symlink utime strlcpy random fmemopen)
 
 if test x"$ENABLE_OPIE" = xyes; then
   AC_LIBOBJ([ftp-opie])
@@ -477,35 +493,6 @@ else
   fi
 fi
 
-dnl
-dnl Check for libmetalink
-dnl
-AS_IF([test x"$with_metalink" != xno], [
-  PKG_CHECK_MODULES([METALINK], libmetalink, [
-      LIBS="$METALINK_LIBS $LIBS"
-      CFLAGS="$METALINK_CFLAGS $CFLAGS"
-      AC_DEFINE([HAVE_METALINK], [1], [Define if using metalink.])
-      with_metalink=yes
-    ], [
-      with_metalink=no
-    ])
-
-  have_gpg=no
-  AS_IF([test x"$with_metalink" = xyes], [
-    dnl
-    dnl Check for GPGME
-    dnl
-    m4_ifdef([AM_PATH_GPGME], [
-      AM_PATH_GPGME([], [
-        LIBS="$GPGME_LIBS $LIBS"
-        CFLAGS="$GPGME_CFLAGS $CFLAGS"
-        AC_DEFINE([HAVE_GPGME], [1], [Define if GPGME is available.])
-        have_gpg=yes
-      ])
-    ])
-  ])
-])
-
 dnl **********************************************************************
 dnl Checks for IPv6
 dnl **********************************************************************
@@ -641,10 +628,6 @@ AS_IF([test "X$iri" != "Xno"],[
       AC_MSG_NOTICE([disabling IRIs because libiconv wasn't found])
     fi
   fi
-],[  # else
-  # For some reason, this seems to be set even when we don't check.
-  # Explicitly unset.
-  LIBICONV=
 ])
 
 AC_ARG_WITH(libidn, AC_HELP_STRING([--with-libidn=[DIR]],
@@ -663,11 +646,6 @@ if test "X$iri" != "Xno"; then
 #    ])
   ])
 fi
-if test "X$iri" = "Xno"; then
-  # we don't need libunistring - clear settings from gnulib module
-  LIBUNISTRING=""
-  LTLIBUNISTRING=""
-fi
 
 dnl
 dnl Check for UUID
@@ -708,18 +686,39 @@ AS_IF([test "x$uuid_mode" = x1], [
 ])
 
 dnl
-dnl Check for PCRE
+dnl Check for PCRE2 / PCRE
 dnl
 
+AC_ARG_ENABLE(pcre2, AC_HELP_STRING([--disable-pcre2],
+                                   [Disable PCRE2 style regular expressions]))
 AC_ARG_ENABLE(pcre, AC_HELP_STRING([--disable-pcre],
                                    [Disable PCRE style regular expressions]))
 
-AS_IF([test "X$enable_pcre" != "Xno"],[
+AS_IF([test "X$enable_pcre2" != "Xno"],[
+  enable_pcre2=no
+  PKG_CHECK_MODULES([PCRE2], libpcre2-8, [
+    CFLAGS="$PCRE2_CFLAGS $CFLAGS"
+    LIBS="$PCRE2_LIBS $LIBS"
+    AC_DEFINE([HAVE_LIBPCRE2], [1], [Define if libpcre2 is available.])
+    enable_pcre2=yes
+  ], [
+    AC_CHECK_HEADER(pcre2.h, [
+      AC_CHECK_LIB(pcre2-8, pcre2_compile_8, [
+        LIBS="${LIBS} -lpcre2-8"
+        AC_DEFINE([HAVE_LIBPCRE2], 1, [Define if libpcre2 is available.])
+        enable_pcre2=yes
+      ])
+    ])
+  ])
+])
+
+AS_IF([test "X$enable_pcre" != "Xno" && test "X$enable_pcre2" != "Xyes"],[
   PKG_CHECK_MODULES([PCRE], libpcre, [
     CFLAGS="$PCRE_CFLAGS $CFLAGS"
     AC_CHECK_HEADER(pcre.h, [
       LIBS="$PCRE_LIBS $LIBS"
       AC_DEFINE([HAVE_LIBPCRE], [1], [Define if libpcre is available.])
+      enable_pcre=yes
     ])
   ], [
     AC_CHECK_HEADER(pcre.h, [
@@ -731,6 +730,8 @@ AS_IF([test "X$enable_pcre" != "Xno"],[
   ])
 ])
 
+AS_IF([test "X$enable_pcre2" = Xyes], [PCRE_INFO="yes, via libpcre2"], [test "X$enable_pcre" = Xyes], [PCRE_INFO="yes, via libpcre"], [PCRE_INFO=no])
+
 dnl
 dnl Check for libcares (resolver library)
 dnl
@@ -756,6 +757,38 @@ AS_IF([test "X$with_cares" = "Xyes"],[
   RESOLVER_INFO="libc, --bind-dns-address and --dns-servers not available"
 ])
 
+dnl
+dnl Check for libmetalink
+dnl
+AS_IF([test x"$with_metalink" != xno], [
+  PKG_CHECK_MODULES([METALINK], libmetalink, [
+      LIBS="$METALINK_LIBS $LIBS"
+      CFLAGS="$METALINK_CFLAGS $CFLAGS"
+      AC_DEFINE([HAVE_METALINK], [1], [Define if using metalink.])
+      with_metalink=yes
+    ], [
+      with_metalink=no
+    ])
+
+  have_gpg=no
+  AS_IF([test x"$with_metalink" = xyes], [
+    dnl
+    dnl Check for GPGME
+    dnl
+    m4_ifdef([AM_PATH_GPGME], [
+      AM_PATH_GPGME([], [
+        # Put libgpgme to the end of the library list since it introduces a -L linker flags.
+        # That -L might break the build if there are two different version of
+        # a library (e.g. GnuTLS) in /usr/local and in the system directory.
+        LIBS="$LIBS $GPGME_LIBS"
+        CFLAGS="$GPGME_CFLAGS $CFLAGS"
+        AC_DEFINE([HAVE_GPGME], [1], [Define if GPGME is available.])
+        have_gpg=yes
+      ])
+    ])
+  ])
+])
+
 dnl
 dnl Extended Attribute support
 dnl
@@ -792,8 +825,9 @@ dnl
 dnl Create output
 dnl
 AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile util/Makefile
-                 po/Makefile.in tests/Makefile
-                 lib/Makefile testenv/Makefile])
+                 po/Makefile.in tests/Makefile fuzz/Makefile
+                 lib/Makefile testenv/Makefile
+                 tests/certs/interca.conf tests/certs/rootca.conf])
 AC_CONFIG_HEADERS([src/config.h])
 AC_OUTPUT
 
@@ -809,6 +843,7 @@ AC_MSG_NOTICE([Summary of build options:
   SSL:               $with_ssl
   Zlib:              $with_zlib
   PSL:               $with_libpsl
+  PCRE:              $PCRE_INFO
   Digest:            $ENABLE_DIGEST
   NTLM:              $ENABLE_NTLM
   OPIE:              $ENABLE_OPIE
@@ -820,4 +855,5 @@ AC_MSG_NOTICE([Summary of build options:
   Resolver:          $RESOLVER_INFO
   GPGME:             $have_gpg
   IRI:               $iri
+  Fuzzing build:     $enable_fuzzing, $LIB_FUZZING_ENGINE
 ])

contrib/check-hard

@@ -12,7 +12,8 @@ if [ $CORES -lt 1 ]; then CORES=1; fi
 echo "Running: make distclean"
 make distclean > /dev/null || true
 
-CFLAGS="-std=c89 -pedantic -O0 -g -Wall -Wextra -Wstrict-prototypes -Wold-style-definition -Wwrite-strings -Wshadow -Wformat -Wformat-security -Wunreachable-code -Wstrict-prototypes -Wmissing-prototypes -Wold-style-definition"
+#CFLAGS="-std=c89 -pedantic -O0 -g -Wall -Wextra -Wstrict-prototypes -Wold-style-definition -Wwrite-strings -Wshadow -Wformat -Wformat-security -Wunreachable-code -Wstrict-prototypes -Wmissing-prototypes -Wold-style-definition"
+CFLAGS="-Wall -Wextra -O2 -g"
 
 CACHEFILE=$PWD/config_check.cache
 
@@ -30,7 +31,7 @@ for CC in gcc clang; do
   # the compiler changed, so we have to remove the cache file here
   rm -f $CACHEFILE
 
-  for options in "" "--with-ssl=openssl"; do
+  for options in "" "--with-ssl=openssl" "--disable-iri"; do
     export DISTCHECK_CONFIGURE_FLAGS="-C --cache-file=$CACHEFILE $options"
     echo "  ./configure $DISTCHECK_CONFIGURE_FLAGS"
     ./configure $DISTCHECK_CONFIGURE_FLAGS CFLAGS="$CFLAGS" > /dev/null

contrib/make-release

@@ -0,0 +1,113 @@
+#!/usr/bin/env sh
+
+# GNU Wget: Make a new release
+#
+# This is a helper script to make a new release of GNU Wget
+#
+# Make sure that
+
+set -e
+set -o pipefail
+set -u
+
+export CFLAGS="-g -O2 -Wall"
+
+EXTENSIONS="gzip lzip"
+
+ask_continue() {
+	printf "Continue? [y/N]: "
+	read inp
+	[ "$inp" != "y" ] && [ "$inp" != "Y" ] && exit 1
+	# For some completely weird reason, this set +x is required. Else, the test
+	# *ALWAYS* fails
+	set +x
+}
+
+if [ ! -d ".git" ]; then
+	echo "Please run this script from the root of the git repository"
+fi
+
+echo "This script will make a new release and upload it to the GNU FTP Servers"
+echo "Will run git clean -dxf to get a clean dir"
+ask_continue
+
+# Make sure we have a clean working directory
+git clean -dxfq
+
+echo "=> Bootstrap"
+./bootstrap > /dev/null 2>&1
+
+echo "=> Configure"
+./configure -q
+
+APP_NAME=$(grep "^PACKAGE_NAME='" configure | cut -d "'" -f2)
+APP_VER=$(grep "^PACKAGE_VERSION='" configure | cut -d "'" -f2)
+
+echo "Making release for $APP_NAME $APP_VER"
+ask_continue
+
+NEWS_VERSION=$(grep -i "Changes in $APP_NAME" NEWS | head -1 | awk '{print $5}')
+if [ "$NEWS_VERSION" != "$APP_VER" ]; then
+	echo "Latest version in NEWS file does not match latest tag"
+	exit 1
+fi
+CUR_VER=$(git describe | sed 's/^v//')
+PREV_VER=$(git describe --abbrev=0 --tags $(git rev-list --tags --skip=1 --max-count=1) | sed 's/^v//')
+LNO_CVER=$(grep -in "Changes in $APP_NAME" NEWS | head -1 | cut -f1 -d:)
+LNO_PVER=$(grep -in "Changes in $APP_NAME" NEWS | head -2 | tail -1 | cut -f1 -d:)
+sed -n "${LNO_CVER},${LNO_PVER}p" NEWS
+echo "This is the current contents of your NEWS"
+ask_continue
+
+echo "=> Make distcheck"
+make -s distcheck > /dev/null 2>&1
+
+for ext in $EXTENSIONS; do
+	[ "$ext" = 'gz' ] && ext="gzip"
+	[ "$ext" = 'lz' ] && ext="lzip"
+	echo "=> Making $APP_NAME-$CUR_VER.tar.$ext"
+	make -s "dist-$ext" > /dev/null
+done
+
+echo ""
+REL_TYPE=
+REL_LOC=
+while [ -z $REL_TYPE ]; do
+	printf "Enter release type (alpha, beta, stable): "
+	read x
+	case $x in
+		a|A|alpha|Alpha) REL_TYPE=alpha && REL_LOC="alpha.gnu.org";;
+		b|B|beta|Beta) REL_TYPE=beta && REL_LOC="alpha.gnu.org";;
+		s|S|stable|Stable) REL_TYPE=stable && REL_LOC="ftp.gnu.org";;
+	esac
+done
+
+GPG_KEY=
+while [ -z $GPG_KEY ]; do
+	printf "Enter GPG Key ID for Signing: "
+	read key
+	gpg --list-keys "$key" || continue
+	printf "Will use this key to sign releases. Continue? [y/N]: "
+	read x
+	[ "$x" = "y" ] || [ "$x" = "Y" ] && GPG_KEY="$key"
+done
+
+echo ""
+
+APP_LOWER="$(echo "$APP_NAME" | tr '[:upper:]' '[:lower:]')"
+./build-aux/gnupload --to "$REL_LOC:$APP_LOWER" --user "$GPG_KEY" --symlink-regex "$APP_LOWER-$CUR_VER".tar.*
+
+echo ""
+
+build-aux/announce-gen --release-type "$REL_TYPE" --package-name "$APP_LOWER" --previous-version="$PREV_VER" --current-version "$CUR_VER" --gpg-key-id="$GPG_KEY" --url-directory "https://${REL_LOC}/gnu/${APP_LOWER}" --news=NEWS > "$APP_NAME-$APP_VER.announce"
+
+echo ""
+echo "Announce email template placed at $APP_NAME-$APP_VER.announce"
+
+prev_tag=$(git tag | tail -2 | head -1)
+echo ""
+echo "Don't forget to mention the following contributors in the announcement:"
+(
+  git log "${prev_tag}.." --format="%aN" --reverse
+  git log "${prev_tag}.." --reverse | grep -i reported | cut -d':' -f2 | cut -d'<' -f1 | cut -d' ' -f2- | tr -d '"'
+) | sort -u

contrib/release

@@ -0,0 +1,123 @@
+#!/bin/bash -e
+#
+# Written 2016 by Tim Ruehsen
+#
+# To get the version number right: add a signed tag and
+#   make sure the working dir is clean (git diff).
+# If that fails, put the version into '.tarball-version'.
+
+export CFLAGS="-g -O2 -Wall"
+
+echo
+echo "* Bootstrap"
+#./bootstrap >/dev/null
+
+echo
+echo "* Configure"
+#./configure -q
+
+extensions="gz lz"
+app_name=$(grep "^PACKAGE_NAME='" configure|cut -d "'" -f2)
+app_ver=$(grep "^PACKAGE_VERSION='" configure|cut -d "'" -f2)
+
+echo "Current version of $app_name is $app_ver"
+echo
+echo -n "Is that OK ? [y/N] "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+echo
+grep -i "Changes in $app_name" NEWS|head -1
+echo -n "Did you edit the NEWS file ? [y/N] "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+echo
+echo "* Make"
+#make -s clean
+#make -s
+
+echo
+echo "* Make distcheck"
+#make -s distcheck >/dev/null
+
+echo
+echo "* Make dist"
+for ext in $extensions; do
+  [[ $ext = 'gz' ]] && ext="gzip"
+  [[ $ext = 'lz' ]] && ext="lzip"
+  make -s dist-$ext >/dev/null
+done
+
+while true; do
+  echo "Alpha or Regular release ? [R/A] "
+  read x
+  if test "$x" = "r" || test "$x" = "R"; then
+    directory="/incoming/ftp"
+    break
+  elif test "$x" = "a" || test "$x" = "A"; then
+    directory="/incoming/alpha"
+    break
+  fi
+done
+
+x=$(gpg --list-secret-keys 2>/dev/null|grep ^sec|awk '{ print $2 }')
+echo $x
+if [ "$x" = "" ]; then
+  echo No signing key found - please check with 'gpg --list-secret-keys'
+  exit 1
+fi
+
+# arrays just work in Bash
+keys=($x)
+if [ ${#keys[@]} -eq 1 ]; then
+  IFS='/' arr=($x)
+  signing_key=${arr[1]}
+else
+  for ((i=0; i < ${#keys[@]}; i++)); do
+    echo "$((i+1))) ${keys[i]}"
+  done
+  while true; do
+    echo -n "Enter 1-${#keys[@]}: "
+    read x
+
+    # check for digits only
+    if [ -n "${i//[0-9]/}" ]; then continue; fi
+
+    if test $x -ge 1 || test $x -le ${#keys[@]}; then
+      IFS='/' arr=(${keys[$((x-1))]})
+      signing_key=${arr[1]}
+      break
+    fi
+  done
+fi
+unset IFS
+
+echo
+echo -n "Really upload to ftp-upload.gnu.org/$directory ? "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+for ext in $extensions; do
+  app_tarball="${app_name}-${app_ver}.tar.$ext"
+  gpg --default-key $signing_key --yes -b $app_tarball
+
+  echo -e "version: 1.2\nfilename: ${app_tarball}\ndirectory: ${app_name}\n" >${app_tarball}.directive
+  gpg --default-key $signing_key --yes --clearsign ${app_tarball}.directive
+
+ftp -v -n -i -p ftp-upload.gnu.org <<EOF
+user anonymous
+cd $directory
+put ${app_tarball}
+put ${app_tarball}.sig
+put ${app_tarball}.directive.asc
+EOF
+
+done
+
+prev_tag=`git tag|tail -2|head -1`
+echo "Don't forget to mention the following contributors in the announcement:"
+(
+  git log ${prev_tag}.. --format="%aN" --reverse
+  git log ${prev_tag}.. --reverse|grep -i reported|cut -d':' -f2|cut -d'<' -f1|cut -d' ' -f2-|tr -d '"'
+) | sort -u

doc/Makefile.am

@@ -1,6 +1,6 @@
 # Makefile for `wget' utility
-# Copyright (C) 1995, 1996, 1997, 2007, 2008, 2009, 2010, 2011, 2015
-# Free Software Foundation, Inc.
+# Copyright (C) 1995-1997, 2007-2011, 2015, 2018 Free Software
+# Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

doc/announcement_1.19.txt

@@ -0,0 +1,104 @@
+Hello,
+
+we are pleased to announce the new version of GNU wget 1.19.
+
+It comes with major improvements for Metalink, IDNA2008 for
+international domain names, an option to call external tools
+for fetching user/password, several bugfixes and improvements.
+
+Many thanks go to all the contributors and list activists !
+
+Contributors (from the git log):
+Ander Juaristi
+Dale R. Worley 
+Eli Zaretskii 
+Gisle Vanem 
+Giuseppe Scrivano
+Göran Uddeborg 
+Jann Horn 
+Jeffery To
+Jérémie Courrèges-Anglas 
+Liam R. Howlett
+losgrandes
+Matthew White
+Misra, Deapesh 
+Nikos Mavrogiannopoulos
+Noël Köthe
+Piotr Wajda
+Rahul Bedarkar
+Sean Burford
+Tim Rühsen
+Tobias Stoeckmann
+vijeth-aradhya
+
+
+The new version is available for download here:
+
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.gz
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.xz
+
+and the GPG detached signatures using the key 0x08302DB6A2670428:
+
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.gz.sig
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.xz.sig
+
+To reduce load on the main server, you can use this redirector service
+which automatically redirects you to a mirror:
+
+http://ftpmirror.gnu.org/wget/wget-1.19.tar.gz
+http://ftpmirror.gnu.org/wget/wget-1.19.tar.xz
+
+
+Noteworthy changes:
+
+* New option --use-askpass=COMMAND. Fetch user/password by calling
+  an external program.
+
+* Use IDNA2008 (+ TR46 if available) through libidn2
+
+* When processing a Metalink header, --metalink-index=<number> allows
+  to process the header's application/metalink4+xml files.
+
+* When processing a Metalink file, --trust-server-names enables the
+  use of the destination file names specified in the Metalink file,
+  otherwise a safe destination file name is computed.
+
+* When processing a Metalink file, enforce a safe destination path.
+  Remove any drive letter prefix under w32, i.e. 'C:D:file'.  Call
+  libmetalink's metalink_check_safe_path() to prevent absolute,
+  relative, or home paths:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* When processing a Metalink file, --directory-prefix=<prefix> sets
+  the top of the retrieval tree to prefix for Metalink downloads.
+
+* When processing a Metalink file, reject downloaded files which don't
+  agree with their own metalink:size value:
+  https://tools.ietf.org/html/rfc5854#section-4.2.16
+
+* When processing a Metalink file, with --continue resume partially
+  downloaded files and keep fully downloaded files even if they fail
+  the verification.
+
+* When processing a Metalink file, create the parent directories of a
+  "path/file" destination file name:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* On a recursive download, append a .tmp suffix to temporary files
+  that will be deleted after being parsed, and create them
+  readable/writable only by the owner.
+
+* New make target 'check-valgrind'
+
+* Fix several bugs
+
+* Fix compatibility issues
+
+
+Please report any problem you may experience to the bug-wget@gnu.org
+mailing list.
+
+For the maintainers of Wget,
+Tim

doc/fdl.texi

@@ -5,7 +5,7 @@
 @c hence no sectioning command or @node.
 
 @display
-Copyright @copyright{} 2000, 2001, 2002, 2007, 2008, 2015 Free Software
+Copyright @copyright{} 2000-2002, 2007-2008, 2015, 2018 Free Software
 Foundation, Inc.
 @uref{http://fsf.org/}
 

doc/texi2pod.pl

@@ -1,7 +1,7 @@
 #! /usr/bin/env perl
 
-#   Copyright (C) 1999, 2000, 2001, 2003, 2007, 2009, 2010, 2011, 2015
-#   Free Software Foundation, Inc.
+#   Copyright (C) 1999-2001, 2003, 2007, 2009-2011, 2015, 2018 Free
+#   Software Foundation, Inc.
 
 # This file is part of GCC.
 

doc/wget.texi

@@ -31,9 +31,8 @@ This file documents the GNU Wget utility for downloading network
 data.
 
 @c man begin COPYRIGHT
-Copyright @copyright{} 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003,
-2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2015 Free Software
-Foundation, Inc.
+Copyright @copyright{} 1996-2011, 2015, 2018 Free Software Foundation,
+Inc.
 
 @iftex
 Permission is granted to make and distribute verbatim copies of
@@ -193,6 +192,8 @@ options, or via the initialization file @file{.wgetrc} (@pxref{Startup
 File}).  Wget allows you to define @dfn{global} startup files
 (@file{/usr/local/etc/wgetrc} by default) for site settings. You can also
 specify the location of a startup file with the --config option.
+To disable the reading of config files, use --no-config.
+If both --config and --no-config are given, --no-config is ignored.
  
 
 @ignore
@@ -566,7 +567,10 @@ would be resolved to @samp{http://foo/baz/b.html}.
 
 @cindex specify config 
 @item --config=@var{FILE}
-Specify the location of a startup file you wish to use.
+Specify the location of a startup file you wish to use instead of the
+default one(s). Use --no-config to disable reading of config files.
+If both --config and --no-config are given, --no-config is ignored.
+
 
 @item --rejected-log=@var{logfile}
 Logs all URL rejections to @var{logfile} as comma separated values.  The values
@@ -703,6 +707,12 @@ Before (over)writing a file, back up an existing file by adding a
 files are rotated to @samp{.2}, @samp{.3}, and so on, up to
 @var{backups} (and lost beyond that).
 
+@cindex authentication credentials
+@item --no-netrc
+Do not try to obtain credentials from @file{.netrc} file. By default
+@file{.netrc} file is searched for credentials in case none have been
+passed on command line and authentication is required.
+
 @cindex continue retrieval
 @cindex incomplete downloads
 @cindex resume download
@@ -1335,6 +1345,11 @@ renamed from @samp{--html-extension}, to better reflect its new
 behavior. The old option name is still acceptable, but should now be
 considered deprecated.
 
+As of version 1.19.2, Wget will also ensure that any downloaded files with
+a @code{Content-Encoding} of @samp{br}, @samp{compress}, @samp{deflate}
+or @samp{gzip} end in the suffix @samp{.br}, @samp{.Z}, @samp{.zlib}
+and @samp{.gz} respectively.
+
 At some point in the future, this option may well be expanded to
 include suffixes for other types of content, including content types
 that are not parsed by Wget.
@@ -1519,6 +1534,23 @@ wget --header="Host: foo.bar" http://localhost/
 In versions of Wget prior to 1.10 such use of @samp{--header} caused
 sending of duplicate headers.
 
+@cindex Content-Encoding, choose
+@item --compression=@var{type}
+Choose the type of compression to be used.  Legal values are
+@samp{auto}, @samp{gzip} and @samp{none}.
+
+If @samp{auto} or @samp{gzip} are specified, Wget asks the server to
+compress the file using the gzip compression format. If the server
+compresses the file and responds with the @code{Content-Encoding}
+header field set appropriately, the file will be decompressed
+automatically.
+
+If @samp{none} is specified, wget will not ask the server to compress
+the file and will not decompress any server responses. This is the default.
+
+Compression support is currently experimental. In case it is turned on,
+please report any bugs to @code{bug-wget@@gnu.org}.
+
 @cindex redirect
 @item --max-redirect=@var{number}
 Specifies the maximum number of redirections to follow for a resource.
@@ -1718,6 +1750,25 @@ some few obscure servers, which never send HTTP authentication
 challenges, but accept unsolicited auth info, say, in addition to
 form-based authentication.
 
+@item --retry-on-host-error
+Consider host errors, such as ``Temporary failure in name resolution'',
+as non-fatal, transient errors.
+
+@item --retry-on-http-error=@var{code[,code,...]}
+Consider given HTTP response codes as non-fatal, transient errors.
+Supply a comma-separated list of 3-digit HTTP response codes as
+argument. Useful to work around special circumstances where retries
+are required, but the server responds with an error code normally not
+retried by Wget. Such errors might be 503 (Service Unavailable) and
+429 (Too Many Requests). Retries enabled by this option are performed
+subject to the normal retry timing and retry count limitations of
+Wget.
+
+Using this option is intended to support special use cases only and is
+generally not recommended, as it can force retries even in cases where
+the server is actually trying to decrease its load. Please use wisely
+and only if you know what you are doing.
+
 @end table
 
 @node HTTPS (SSL/TLS) Options, FTP Options, HTTP Options, Invoking
@@ -1733,25 +1784,34 @@ If Wget is compiled without SSL support, none of these options are available.
 @cindex SSL protocol, choose
 @item --secure-protocol=@var{protocol}
 Choose the secure protocol to be used.  Legal values are @samp{auto},
-@samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1}, @samp{TLSv1_1}, @samp{TLSv1_2}
-and @samp{PFS}.  If @samp{auto} is used, the SSL library is given the
-liberty of choosing the appropriate protocol automatically, which is
+@samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1}, @samp{TLSv1_1}, @samp{TLSv1_2},
+@samp{TLSv1_3} and @samp{PFS}.  If @samp{auto} is used, the SSL library is
+given the liberty of choosing the appropriate protocol automatically, which is
 achieved by sending a TLSv1 greeting. This is the default.
 
-Specifying @samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1}, @samp{TLSv1_1} or
-@samp{TLSv1_2} forces the use of the corresponding protocol.  This is
-useful when talking to old and buggy SSL server implementations that
-make it hard for the underlying SSL library to choose the correct
-protocol version.  Fortunately, such servers are quite rare.
+Specifying @samp{SSLv2}, @samp{SSLv3}, @samp{TLSv1}, @samp{TLSv1_1},
+@samp{TLSv1_2} or @samp{TLSv1_3} forces the use of the corresponding
+protocol.  This is useful when talking to old and buggy SSL server
+implementations that make it hard for the underlying SSL library to choose
+the correct protocol version.  Fortunately, such servers are quite rare.
 
 Specifying @samp{PFS} enforces the use of the so-called Perfect Forward
 Security cipher suites. In short, PFS adds security by creating a one-time
 key for each SSL connection. It has a bit more CPU impact on client and server.
-We use known to be secure ciphers (e.g. no MD4) and the TLS protocol.
+We use known to be secure ciphers (e.g. no MD4) and the TLS protocol. This mode
+also explicitly excludes non-PFS key exchange methods, such as RSA.
 
 @item --https-only
 When in recursive mode, only HTTPS links are followed.
 
+@item --ciphers
+Set the cipher list string. Typically this string sets the
+cipher suites and other SSL/TLS options that the user wish should be used, in a
+set order of preference (GnuTLS calls it 'priority string'). This string
+will be fed verbatim to the SSL/TLS engine (OpenSSL or GnuTLS) and hence
+its format and syntax is dependant on that. Wget will not process or manipulate it
+in any way. Refer to the OpenSSL or GnuTLS documentation for more information.
+
 @cindex SSL certificate, check
 @item --no-check-certificate
 Don't check the server certificate against the available certificate
@@ -3337,10 +3397,16 @@ Turn globbing on/off---the same as @samp{--glob} and @samp{--no-glob}.
 Define a header for HTTP downloads, like using
 @samp{--header=@var{string}}.
 
+@item compression = @var{string}
+Choose the compression type to be used.  Legal values are @samp{auto}
+(the default), @samp{gzip}, and @samp{none}.  The same as
+@samp{--compression=@var{string}}.
+
 @item adjust_extension = on/off
 Add a @samp{.html} extension to @samp{text/html} or
-@samp{application/xhtml+xml} files that lack one, or a @samp{.css}
-extension to @samp{text/css} files that lack one, like
+@samp{application/xhtml+xml} files that lack one, a @samp{.css}
+extension to @samp{text/css} files that lack one, and a @samp{.br},
+@samp{.Z}, @samp{.zlib} or @samp{.gz} to compressed files like
 @samp{-E}. Previously named @samp{html_extension} (still acceptable,
 but deprecated).
 
@@ -4080,7 +4146,11 @@ via IRC at @code{irc.freenode.org}, @code{#wget}. Come check it out!
 
 @c man begin BUGS
 You are welcome to submit bug reports via the GNU Wget bug tracker (see
-@url{https://savannah.gnu.org/bugs/?func=additem&group=wget}).
+@url{https://savannah.gnu.org/bugs/?func=additem&group=wget}) or to our
+mailing list @email{bug-wget@@gnu.org}.
+
+Visit @url{https://lists.gnu.org/mailman/listinfo/bug-wget} to
+get more info (how to subscribe, list archives, ...).
 
 Before actually submitting a bug report, please try to follow a few
 simple guidelines.
@@ -4251,7 +4321,7 @@ server.
 
 Until version 1.8, Wget supported the first version of the standard,
 written by Martijn Koster in 1994 and available at
-@url{http://www.robotstxt.org/robotstxt.html}.  As of version 1.8,
+@url{http://www.robotstxt.org/orig.html}.  As of version 1.8,
 Wget has supported the additional directives specified in the internet
 draft @samp{<draft-koster-robots-00.txt>} titled ``A Method for Web
 Robots Control''.  The draft, which has as far as I know never made to
@@ -4270,7 +4340,7 @@ this:
 @end example
 
 This is explained in some detail at
-@url{http://www.robotstxt.org/wc/meta-user.html}.  Wget supports this
+@url{http://www.robotstxt.org/meta.html}.  Wget supports this
 method of robot exclusion in addition to the usual @file{/robots.txt}
 exclusion.
 

fuzz/Makefile.am

@@ -0,0 +1,87 @@
+AM_CFLAGS = $(WERROR_CFLAGS) $(WARN_CFLAGS) -Wno-unused-parameter -Wno-pedantic
+AM_CPPFLAGS = -I$(top_srcdir)/src -I$(srcdir) -I$(top_builddir)/lib -I$(top_srcdir)/lib \
+ -DSRCDIR=\"$(abs_srcdir)\"
+LDADD = ../lib/libgnu.a \
+ $(GETADDRINFO_LIB) $(HOSTENT_LIB) $(INET_NTOP_LIB) $(INET_PTON_LIB) \
+ $(LIBSOCKET) $(LIB_CLOCK_GETTIME) $(LIB_CRYPTO) $(LIB_GETLOGIN) $(LIB_NANOSLEEP) $(LIB_POLL) \
+ $(LIB_POSIX_SPAWN) $(LIB_PTHREAD_SIGMASK) $(LIB_SELECT) $(LIBICONV) $(LIBINTL) \
+ $(LIBMULTITHREAD) $(LIBTHREAD) $(SERVENT_LIB) @INTL_MACOSX_LIBS@ \
+ -ldl
+
+WGET_TESTS = \
+ wget_css_fuzzer$(EXEEXT) \
+ wget_cookie_fuzzer$(EXEEXT) \
+ wget_ftpls_fuzzer$(EXEEXT) \
+ wget_html_fuzzer$(EXEEXT) \
+ wget_netrc_fuzzer$(EXEEXT) \
+ wget_options_fuzzer$(EXEEXT) \
+ wget_robots_fuzzer$(EXEEXT) \
+ wget_url_fuzzer$(EXEEXT)
+
+if FUZZING
+  bin_PROGRAMS = $(WGET_TESTS)
+  LDADD += $(LIB_FUZZING_ENGINE)
+  MAIN = fuzzer.h
+#  AM_LDFLAGS = -no-install -all-static
+else
+  AM_CPPFLAGS += -DTEST_RUN
+  AM_TESTS_ENVIRONMENT = export VALGRIND_TESTS"=@VALGRIND_TESTS@";
+  TESTS = $(WGET_TESTS)
+  check_PROGRAMS = $(WGET_TESTS)
+  MAIN = main.c fuzzer.h
+endif
+
+# Make libunittest "PHONY" so we're always sure we're up-to-date.
+.PHONY: ../src/libunittest.a
+../src/libunittest.a:
+	$(MAKE) $(AM_MAKEFLAGS) -C ../src libunittest.a
+
+wget_css_fuzzer_SOURCES = wget_css_fuzzer.c $(MAIN)
+wget_css_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_cookie_fuzzer_SOURCES = wget_cookie_fuzzer.c $(MAIN)
+wget_cookie_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_ftpls_fuzzer_SOURCES = wget_ftpls_fuzzer.c $(MAIN)
+wget_ftpls_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_html_fuzzer_SOURCES = wget_html_fuzzer.c $(MAIN)
+wget_html_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_netrc_fuzzer_SOURCES = wget_netrc_fuzzer.c $(MAIN)
+wget_netrc_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_options_fuzzer_SOURCES = wget_options_fuzzer.c $(MAIN)
+wget_options_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_robots_fuzzer_SOURCES = wget_robots_fuzzer.c $(MAIN)
+wget_robots_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_url_fuzzer_SOURCES = wget_url_fuzzer.c $(MAIN)
+wget_url_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+#EXTRA_DIST = $(wildcard *.options) $(wildcard *.dict) \
+# $(wildcard *.in) $(wildcard *.repro)
+
+dist-hook:
+	find $(srcdir) -name '*.options' -exec cp -v '{}' $(distdir) ';'
+	find $(srcdir) -name '*.dict' -exec cp -v '{}' $(distdir) ';'
+#	find $(srcdir) -name '*.in' -exec cp -vr '{}' $(distdir) ';'
+	find $(srcdir) -name '*.repro' -exec cp -vr '{}' $(distdir) ';'
+
+clean-local:
+	rm -rf *.gc?? *.log lcov
+
+oss-fuzz:
+	if test "$$OUT" != ""; then \
+	XLIBS="-lpsl -lgnutls -lnettle -lhogweed -lidn2 -lunistring"; \
+	for ccfile in wget*_fuzzer.c; do \
+	fuzzer=$$(basename $$ccfile .c); \
+	$$CXX $$CXXFLAGS -I$(top_srcdir)/src -I$(top_srcdir) -I$(top_srcdir)/lib \
+	"$${fuzzer}.c" -o "$${fuzzer}" \
+	../src/libunittest.a ../lib/libgnu.a $${LIB_FUZZING_ENGINE} \
+	-Wl,-Bstatic $${XLIBS} -Wl,-Bdynamic; \
+	done; \
+	fi
+
+.PHONY: oss-fuzz

fuzz/README.md

@@ -0,0 +1,84 @@
+# Fuzzers
+
+These are fuzzers designed for use with `libFuzzer` or `afl`. They can
+be used to run on Google's OSS-Fuzz (https://github.com/google/oss-fuzz/).
+
+The convention used here is that the initial values for each parser fuzzer
+are taken from the $NAME.in directory.
+
+Crash reproducers from OSS-Fuzz are put into $NAME.repro directory for
+regression testing with top dir 'make check' or 'make check-valgrind'.
+
+
+# Running a fuzzer using clang
+
+Use the following commands on top dir:
+```
+export CC=clang-6.0
+export CXX=clang++-6.0
+# address sanitizer:
+export CFLAGS="-O1 -g -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=undefined,integer,nullability -fsanitize=address -fsanitize-address-use-after-scope -fsanitize-coverage=trace-pc-guard,trace-cmp"
+# undefined sanitizer;
+export CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fno-sanitize-recover=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fsanitize=fuzzer-no-link"
+export CXXFLAGS="$CFLAGS -stdlib=libc++"
+export LIB_FUZZING_ENGINE="-lFuzzer -lstdc++"
+./configure --enable-fuzzing --without-metalink --without-zlib --disable-pcre --without-libuuid
+make clean
+make -j$(nproc)
+cd fuzz
+
+# run wget_options_fuzzer
+UBSAN_OPTIONS=print_stacktrace=1 ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-6.0/bin/llvm-symbolizer \
+  ./run-clang.sh wget_options_fuzzer
+```
+
+If you see a crash, then a crash corpora is written that can be used for further
+investigation. E.g.
+```
+==2410==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000004e90 at pc 0x00000049cf9c bp 0x7fffb5543f70 sp 0x7fffb5543720
+...
+Test unit written to ./crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
+```
+
+To reproduce the crash:
+```
+./wget_options_fuzzer < ./crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
+```
+
+You can also copy/move that file into wget_options_fuzzer.repro/
+and re-build the project without fuzzing for a valgrind run, if you like that better.
+Just a `./configure` and a `make check-valgrind` should reproduce it.
+
+
+# Running a fuzzer using AFL
+
+Use the following commands on top dir:
+
+```
+$ export LIB_FUZZING_ENGINE=""
+$ CC=afl-clang-fast ./configure --enable-fuzzing
+$ make -j$(nproc) clean all
+$ cd fuzz
+$ ./run-afl.sh wget_options_fuzzer
+```
+
+# Fuzz code coverage using the corpus directories *.in/
+
+Code coverage reports currently work best with gcc+lcov+genhtml.
+
+In the top directory:
+```
+CC=gcc CFLAGS="-O0 -g" ./configure
+make fuzz-coverage
+xdg-open lcov/index.html
+```
+
+To work on corpora for better coverage, `cd fuzz` and use e.g.
+`./view-coverage.sh wget_options_fuzzer`.
+
+
+# Creating wget_options_fuzzer.dict
+
+```
+for i in `../src/wget --help|tr ' ' '\n'|grep ^--|cut -c 3-|sort`;do echo \"$i\"; done >wget_options_fuzzer.dict
+```

fuzz/fuzzer.h

@@ -0,0 +1,26 @@
+/*
+ * Copyright(c) 2017-2018 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <stddef.h> // size_t
+#include <stdint.h> // uint8_t
+
+#ifdef __cplusplus
+extern "C"
+#endif
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

fuzz/get_all_corpora

@@ -0,0 +1,11 @@
+#!/bin/sh -eu
+
+if ! grep -q FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION Makefile; then
+  echo "The fuzzers haven't been built for fuzzing (maybe for regression testing !?)"
+  echo "Please built regarding README.md and try again."
+  exit 1
+fi
+
+for fuzzer in *_fuzzer.c; do
+  ./get_ossfuzz_corpora $(basename $fuzzer .c)
+done

fuzz/get_ossfuzz_corpora

@@ -0,0 +1,46 @@
+#!/bin/sh -eu
+
+# As a first step see README.md and follow the steps under "Running a fuzzer using clang".
+
+# You might need 'gsutil' to download new corpora from the Google cloud:
+# Read the docs at https://github.com/google/oss-fuzz/blob/master/docs/corpora.md
+# then install 'google-cloud-sdk' and execute 'gcloud init'.
+# Now 'gsutil' should be ready to use.
+
+if test -z "$1"; then
+  echo "Usage: $0 <fuzzer target>"
+  echo "Example: $0 wget_options_fuzzer"
+  exit 1
+fi
+
+if ! grep -q FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION Makefile; then
+  echo "The fuzzers haven't been built for fuzzing (maybe for regression testing !?)"
+  echo "Please built regarding README.md and try again."
+  exit 1
+fi
+
+fuzzer=$1
+project=wget
+
+# sync/copy the OSS-Fuzz corpora into the .new directory
+mkdir -p ${fuzzer}.new
+cp -fp ${fuzzer}.in/* ${fuzzer}.new
+gsutil cp $(gsutil ls gs://${project}-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/${fuzzer}|tail -n 1) ${fuzzer}.new
+(cd ${fuzzer}.new && unzip -q -f -o *.zip && rm *.zip)
+
+# create fuzzer target
+BUILD_ONLY=1 ./run-clang.sh ${fuzzer}
+
+# merge the corpora into the .in directory
+./${fuzzer} -merge=1 ${fuzzer}.in ${fuzzer}.new
+
+# now clear .new dir and put all corpora there
+rm -rf ${fuzzer}.new
+mv ${fuzzer}.in ${fuzzer}.new
+mkdir ${fuzzer}.in
+
+# now merge again (optimizes number of corpora)
+./${fuzzer} -merge=1 ${fuzzer}.in ${fuzzer}.new
+
+echo
+echo "If new files have been added, 'git add' and 'git commit' them."

fuzz/glob_crash.c

@@ -0,0 +1,32 @@
+/*
+ * Created 19.10.2017 by Tim Rühsen
+ *
+ * Call glob() using data from fuzzer crash file
+ *
+ * Build and execute with instrumented gnulib (amend -I paths as needed):
+ *
+ * clang build (spills out WRITE heap buffer overflow)
+ * export CC=clang-6.0
+ * export CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope"
+ * $CC $CFLAGS -I.. -I../lib glob_crash.c -o glob_crash ../lib/.libs/libgnu.a
+ * ./glob_crash
+ *
+ * gcc build (spills out READ heap buffer overflow):
+ * export CC=gcc
+ * export CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope"
+ * $CC $CFLAGS -I.. -I../lib glob_crash.c -o glob_crash ../lib/.libs/libgnu.a
+ * ./glob_crash
+ */
+
+#include <glob.h>
+
+int main(int argc, char **argv)
+{
+static unsigned char data[] = "1e";
+
+	glob_t pglob;
+	if (glob(data, GLOB_TILDE|GLOB_ONLYDIR|GLOB_NOCHECK, NULL, &pglob) == 0)
+		globfree(&pglob);
+
+	return 0;
+}

fuzz/main.c

@@ -0,0 +1,154 @@
+/*
+ * Copyright(c) 2017-2018 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <fcntl.h>
+
+#include "fuzzer.h"
+#include "utils.h"
+
+#ifdef TEST_RUN
+
+#include <dirent.h>
+
+#ifdef _WIN32
+#  define SLASH '\\'
+#else
+#  define SLASH '/'
+#endif
+
+static int test_all_from(const char *dirname)
+{
+	DIR *dirp;
+
+	if ((dirp = opendir(dirname))) {
+		struct dirent *dp;
+
+		while ((dp = readdir(dirp))) {
+			if (*dp->d_name == '.') continue;
+
+			char fname[strlen(dirname) + strlen(dp->d_name) + 2];
+			snprintf(fname, sizeof(fname), "%s/%s", dirname, dp->d_name);
+
+                        struct file_memory *fmem;
+			if ((fmem = wget_read_file(fname))) {
+				printf("testing %ld bytes from '%s'\n", fmem->length, fname);
+				LLVMFuzzerTestOneInput((uint8_t *)fmem->content, fmem->length);
+                                wget_read_file_free(fmem);
+			}
+		}
+		closedir(dirp);
+		return 0;
+	}
+
+	return 1;
+}
+
+int main(int argc, char **argv)
+{
+	// if VALGRIND testing is enabled, we have to call ourselves with valgrind checking
+	const char *valgrind = getenv("VALGRIND_TESTS");
+	const char *target;
+	size_t target_len;
+
+	if (!valgrind || !*valgrind || !strcmp(valgrind, "0")) {
+		// fallthrough
+	}
+	else if (!strcmp(valgrind, "1")) {
+		char cmd[strlen(argv[0]) + 256];
+
+		snprintf(cmd, sizeof(cmd), "VALGRIND_TESTS=\"\" valgrind --error-exitcode=301 --leak-check=yes --show-reachable=yes --track-origins=yes %s", argv[0]);
+		return system(cmd) != 0;
+	} else {
+		char cmd[strlen(valgrind) + strlen(argv[0]) + 32];
+
+		snprintf(cmd, sizeof(cmd), "VALGRIND_TESTS="" %s %s", valgrind, argv[0]);
+		return system(cmd) != 0;
+	}
+
+	if ((target = strrchr(argv[0], SLASH)))
+		target = strrchr(target, '/');
+	else
+		target = strrchr(argv[0], '/');
+	target = target ? target + 1 : argv[0];
+
+	if (strncmp(target, "lt-", 3) == 0)
+		target += 3;
+
+	target_len = strlen(target);
+
+#ifdef _WIN32
+	target_len -= 4; // ignore .exe
+#endif
+
+	{
+		int rc;
+		char corporadir[sizeof(SRCDIR) + 1 + target_len + 8];
+		snprintf(corporadir, sizeof(corporadir), SRCDIR "/%.*s.in", (int) target_len, target);
+
+		rc = test_all_from(corporadir);
+		if (rc)
+			fprintf(stderr, "Failed to find %s\n", corporadir);
+
+		snprintf(corporadir, sizeof(corporadir), SRCDIR "/%.*s.repro", (int) target_len, target);
+		if (test_all_from(corporadir) && rc)
+			return 77; // SKIP
+	}
+
+	return 0;
+}
+
+#else
+
+#ifndef __AFL_LOOP
+static int __AFL_LOOP(int n)
+{
+	static int first = 1;
+
+	if (first) {
+		first = 0;
+		return n && --n > 0;
+	}
+
+	return 0;
+}
+#endif
+
+int main(int argc, char **argv)
+{
+	int ret;
+	unsigned char buf[64 * 1024];
+
+	while (__AFL_LOOP(10000)) { // only works with clang - we have to use 1 because static/global vars in wget
+		ret = fread(buf, 1, sizeof(buf), stdin);
+		if (ret < 0)
+			return 0;
+
+		LLVMFuzzerTestOneInput(buf, ret);
+	}
+
+	return 0;
+}
+
+#endif /* #ifdef TEST_RUN */

fuzz/run-afl.sh

@@ -0,0 +1,59 @@
+#!/bin/sh -eu
+
+# Copyright(c) 2017 Free Software Foundation, Inc.
+#
+# This file is part of GNU Wget.
+#
+# GNU Wget is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GNU Wget is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with GNU Wget.  If not, see <https://www.gnu.org/licenses/>.
+
+if ! grep -q '^CC=.afl-clang-fast' ../config.log; then
+	echo "compile first library as:"
+	echo "CC=afl-clang-fast ./configure"
+	exit 1
+fi
+
+if test -z "$1"; then
+	echo "Usage: $0 test-case"
+	echo "Example: $0 wget_options_fuzzer"
+	exit 1
+fi
+
+fuzzer=$1
+#rm -f $fuzzer
+#afl-clang-fast -O2 -g -I.. main.c "${fuzzer}.c" -o "${fuzzer}"
+
+### minimize test corpora
+if test -d ${fuzzer}.in; then
+  mkdir -p ${fuzzer}.min
+  for i in `ls ${fuzzer}.in`; do
+    fin="${fuzzer}.in/$i"
+    fmin="${fuzzer}.min/$i"
+    if ! test -e $fmin || test $fin -nt $fmin; then
+      afl-tmin -m 500 -i $fin -o $fmin -- ./${fuzzer}
+    fi
+  done
+fi
+
+TMPOUT=${fuzzer}.out
+mkdir -p ${TMPOUT}
+
+if test -f ${fuzzer}.dict; then
+  afl-fuzz -m 500 -i ${fuzzer}.min -o ${TMPOUT} -x ${fuzzer}.dict -- ./${fuzzer}
+else
+  afl-fuzz -m 500 -i ${fuzzer}.min -o ${TMPOUT} -- ./${fuzzer}
+fi
+
+echo "output was stored in $TMPOUT"
+
+exit 0

fuzz/run-clang.sh

@@ -0,0 +1,57 @@
+#!/bin/bash -e
+#
+# Copyright(c) 2017 Free Software Foundation, Inc.
+#
+# This file is part of GNU Wget.
+#
+# GNU Wget is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# GNU Wget is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with GNU Wget.  If not, see <https://www.gnu.org/licenses/>.
+
+trap ctrl_c INT
+
+ctrl_c() {
+  ./${fuzzer} -merge=1 ${fuzzer}.in ${fuzzer}.new
+  rm -rf ${fuzzer}.new
+}
+
+if test -z "$1"; then
+	echo "Usage: $0 <fuzzer target>"
+	echo "Example: $0 wget_options_fuzzer"
+	exit 1
+fi
+
+if ! grep -q FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION Makefile; then
+  echo "The fuzzers haven't been built for fuzzing (maybe for regression testing !?)"
+  echo "Please built regarding README.md and try again."
+  exit 1
+fi
+
+# you'll need ~2GB free memory per worker !
+fuzzer=$1
+workers=$(($(nproc) - 0))
+jobs=$workers
+
+if test -n "$BUILD_ONLY"; then
+  exit 0
+fi
+
+# create directory for NEW test corpora (covering new areas of code)
+mkdir -p ${fuzzer}.new
+
+if test -f ${fuzzer}.dict; then
+  ./${fuzzer} -dict=${fuzzer}.dict ${fuzzer}.new ${fuzzer}.in -jobs=$jobs -workers=$workers
+else
+  ./${fuzzer} ${fuzzer}.new ${fuzzer}.in -jobs=$jobs -workers=$workers
+fi
+
+exit 0

fuzz/view-coverage.sh

@@ -0,0 +1,37 @@
+#!/bin/bash -eu
+#
+# (C)2017 Tim Ruehsen tim.ruehsen@gmx.de
+#
+# View the coverage report for one or more fuzzers.
+
+# 1. execute 'make fuzz-coverage' in the top directory
+# 2. execute './view-coverage.sh <fuzz target(s)>
+
+# Example with single fuzzer:
+#   ./view-coverage.sh wget_options_fuzzer
+
+# Example with two fuzzers:
+#   ./view-coverage.sh wget_options_fuzzer wget_html_parse_fuzzer
+
+if test -z "$1"; then
+  echo "Usage: $0 <fuzz target(s)>"
+  echo "Example: $0 wget_options_fuzzer"
+  exit 1
+fi
+
+#fuzzer="./"$1
+LCOV_INFO=coverage.info
+#./coverage.sh $fuzzer
+#lcov --capture --initial --directory ../src/.libs --directory . --output-file $LCOV_INFO
+#lcov --capture --directory ../src/.libs --output-file $LCOV_INFO
+#lcov --remove $LCOV_INFO '*/test_linking.c' '*/css_tokenizer.lex' '*/<stdout>' '*/*.h' -o $LCOV_INFO
+#genhtml --prefix . --ignore-errors source $LCOV_INFO --legend --title "$1" --output-directory=lcov
+
+lcov --zerocounters --directory ../src/
+lcov --capture --initial --directory ../src/.libs --directory . --output-file $LCOV_INFO
+make check TESTS="$*" CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+lcov --capture --directory ../src/.libs --output-file $LCOV_INFO
+lcov --remove $LCOV_INFO '*/css_tokenizer.lex' '*/*.h' -o $LCOV_INFO
+genhtml --prefix . --ignore-errors source $LCOV_INFO --legend --title "$*" --output-directory=lcov
+
+xdg-open lcov/index.html

fuzz/wget_cookie_fuzzer.c

@@ -0,0 +1,97 @@
+/*
+ * Copyright(c) 2017-2018 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+
+#include <sys/types.h>
+#include <dirent.h> // opendir, readdir
+#include <stdint.h> // uint8_t
+#include <stdio.h>  // fmemopen
+#include <string.h>  // strncmp
+#include <stdlib.h>  // free
+
+#include "wget.h"
+#undef fopen_wgetrc
+
+#ifdef __cplusplus
+  extern "C" {
+#endif
+  #include "cookies.h"
+
+  // declarations for wget internal functions
+  int main_wget(int argc, const char **argv);
+  void cleanup(void);
+  FILE *fopen_wget(const char *pathname, const char *mode);
+  FILE *fopen_wgetrc(const char *pathname, const char *mode);
+  void exit_wget(int status);
+#ifdef __cplusplus
+  }
+#endif
+
+#include "fuzzer.h"
+
+FILE *fopen_wget(const char *pathname, const char *mode)
+{
+	return fopen("/dev/null", mode);
+}
+
+FILE *fopen_wgetrc(const char *pathname, const char *mode)
+{
+	return NULL;
+}
+
+#ifdef FUZZING
+void exit_wget(int status)
+{
+}
+#else
+void exit(int status)
+{
+}
+#endif
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+	FILE *bak;
+	struct cookie_jar *cookie_jar;
+	char *set_cookie;
+
+	if (size > 1024) // same as max_len = ... in .options file
+		return 0;
+
+	set_cookie = (char *) malloc(size + 1);
+	memcpy(set_cookie, data, size);
+	set_cookie[size] = 0;
+
+	bak = stderr;
+	stderr = fopen("/dev/null", "w");
+
+	cookie_jar = cookie_jar_new();
+	cookie_handle_set_cookie(cookie_jar, "x", 81, "p", set_cookie);
+	cookie_handle_set_cookie(cookie_jar, "x", 81, "p", set_cookie);
+	cookie_handle_set_cookie(cookie_jar, "x", 80, "p/d/", set_cookie);
+	cookie_jar_delete(cookie_jar);
+
+	fclose(stderr);
+	stderr = bak;
+
+        free(set_cookie);
+
+	return 0;
+}

fuzz/wget_cookie_fuzzer.dict

@@ -0,0 +1,6 @@
+tag1="expires="
+tag2="path="
+tag3="domain="
+tag4="httponly"
+tag5="secure"
+tag6="max-age"

fuzz/wget_cookie_fuzzer.in/0035f59e3bcb8762bcfee361e1ff93eca136fe00

@@ -0,0 +1 @@
+__Host-ID=x; expires=MoHos__Host-ID=x; expires=Mon, 29 Feb 2016 07:48:97 GMT; mh=/; domain=x.y; httponly; sec__Host-ID=x; expires=Mon, 29 Feb 2016 07:48:97 GMT; mh=/; domain=x.y; htut-ID=x; expires=Mon, 29 Feb 2016 07:48:97 GMT; mh=/; domain=x.y; hture

fuzz/wget_cookie_fuzzer.in/00b01919bd46e340101151ca756a8ec9380110d6

@@ -0,0 +1 @@
+DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDNDDDDD廛max-ageDDDDDD'DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD僖DDDDDhttponlyDDDDDDDDDDDDDDDDDDD;

fuzz/wget_cookie_fuzzer.in/011b4abb980285acc4ffcb6f28eb13b26a815420

@@ -0,0 +1 @@
+__Hos_o=;;yõ=m;tmID=m;=;y=m;y=m;<;yõ=‚m;tmID=m;

fuzz/wget_cookie_fuzzer.in/015362e418005760f4012c4053a0fbf9c45310d8

@@ -0,0 +1 @@
+__expires=x; expires=Mon, 14 4032 07:48Mon, 14 4032 07:48:5$ GMT; stmID=x; expires=Mon, 14 4000 07:48:54 GMT; matp=x; expires=Mon, 43 4032 07:48:5$ G032 07:48:27 GMT; stm 14 4000 07ÅË8:54 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%GMT; m:48:54 GMT; stmI»D=x; e|pires=Mon, 14 4000 07ID=x; expires=Mon, 07 4032 07:48:5$ GMT; stmID=x; expin, 14 4032 07:48:5$ GMT; stmID=x; expires=Mon, 14 4000 07:48:54 GMT; matp=x; expires=Mon, 14 4032 07:48:5$ G!32 07:48:54 GMT; stm 14 4000 07ÅË8:54 GMT; m:48:54 GMT; stmI»n4 1, 4032 07:48:5$ GMT; stmID=x; expcure

fuzz/wget_cookie_fuzzer.in/0174106d1fbbef9a747de148b506d6b88ffb10e8

@@ -0,0 +1,2 @@
+__H@=xqqqqqqqqqqqqqqqqq*qqqqqqFpath=; secure
+x-age; secure

fuzz/wget_cookie_fuzzer.in/0182e22e3e3ee81d273f6feaed8630c39a3bf3b0

@@ -0,0 +1 @@
+_dict=libwget_cookie_fuzzer.dmutate_depth                                                        _e=;Ä;Ø;;;;Ø;;;;Ä;=;;Ø;;;;Ä;=;__Host-I@=x; expires=Mon, 29 Feb@=x; expir                    st-016 07:48es=Mon, 28 Feb 2016 07::54 GMT;"max-48:

fuzz/wget_cookie_fuzzer.in/01f38c837feea81ed7f4b31933ced507ae134664

@@ -0,0 +1 @@
+_use¡’<>šÂÊà pa<70>h=_Host-ID=xGMT; max-age=5; pa<70>h=ÑÄß›<C39F>’ž•n=x.y; httpomax-agecure

fuzz/wget_cookie_fuzzer.in/0242325df3c4091ac99566dc6d59a1e20f20ebe0

@@ -0,0 +1 @@
+*=';:n*='d

fuzz/wget_cookie_fuzzer.in/0267987c41022bd8ea085cc77d08958e464248a6

@@ -0,0 +1 @@
+__Host-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=29 Feb 2016 10:48:54 GMT; max-age=5; p; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=58 Feb 2016 10:48:54 GMT; max-age=5; pathomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-IDBx; exp=x.y; athomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-IDBx; expires=29 Feb 2016 07:48:54 GMT; max-age=5; pathomai;ost-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=2; Feb 2016 10:48:5: GMT; max-age=5; pathomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=29 Feb 2096 07:48:54 GMT; max-age=5; pathomai;=x.y; httponly

fuzz/wget_cookie_fuzzer.in/02a0fe821c4e2772c50ce233c36a4506a0e4cbb3

@@ -0,0 +1 @@
+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

fuzz/wget_cookie_fuzzer.in/02d317a10470e3bc81c7a07caadf3983e125dafe

@@ -0,0 +1 @@
+xexpires= domain==/; domain==/; domain=th=/; domain=th=/; domain=th=/; domain==/; domain=th=/; domain==/; domain=th=/; domain==/; domain=ht=/; domain==/; domain=th=/; domain==/; domain=th=/expires=; domain==/; domain=th=/;omain==/;*=/; >domain=h=/; domain==/; doamin==/; doiain=th=/; domain=th=/:; domain=th=/; domain==/; domain=th=/; dom'ain==/; domain=th=/; domain==/; domain=th=/; ƒƒƒƒƒƒƒdomain==/; domain=th=/; domai=th=/; domain
 ==/; domain=th=/expires=; domain==/; domain=th=/;omain==/; domain=th=/; domain==/; domain=th=/expires=; domainy=

fuzz/wget_cookie_fuzzer.in/0301121ca4abf006066d499ea7c366f511cfaeef

@@ -0,0 +1 @@
+_httpominimize_crash16 07:48??¿??????????????????????????????????,,,,,,,,,,6:48??¿????????????????????????expires=??????????,,,,,,,,,,,,,,ŠŠŠŠŠŠŠŠŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,???????54 GMT;‹ max-age=5; paagominimize_crash16 07:48??¿????????????;?????????????????????,,,,,,,,,,7:48??¿????????????????????????expires=??????????,,,,,,,,,,,,,,ŠŠŠŠŠŠŠŠŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,???????5path=2 GMT;‹ max-age=5; paagŠŠŠŠŠŠŠŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,l,,,???????54 GMT;‹ ŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,l,,,???????54 GMT;‹ge=5=x.ÿÿÿly; sñcure

fuzz/wget_cookie_fuzzer.in/036cbca628064121b00f73967de378ab5af995ec

@@ -0,0 +1,2 @@
+_ÿÿÿÿÿÿ
+ä=x; expi!res=-86148:54 =x; expires=-43855 Feb 6119 07:48:0Tx; expires=-437708 Feb 6120 07:48:54 8:54 =x; expires=-86148:54 =x; expires=-43855 Feb 6119 07:48:5Tx; expires=-437708 Feb 6120 07:48:54 8:54 =x; expires=-43855 Feb 6119 07:48:5TxC; expires=-437708 Feb 120 07:48:54 =b 6119 07:48:5Tx; expires=-218854 Feb 6120 07:48:54 =_axost-ID=x; 6120 07:48:54 =st-ID=x; expires=-87708 Feb 6119 07:48:54 =x; expires=3-4855 Feb 6119 07:48:5Tx; emax-age43855 Feb 6119 07:48:5Tx; expires=-437708 Feb 6120 07:48:54 =b 6119 07:48:5Tx; expires=-437708 Feb 6120 07:48:54 48:5Tx; expires=-437708 Feb 6120 07:48:54 =_axost-ID=x; ex88888888888888888888888888888888888888888pires=-c87708 Feb 6119 07:48:54 =x; expires=-43855 Feb 6119 07:48:5Tx; expires=-43855 Feb 611907:48:5T

fuzz/wget_cookie_fuzzer.in/03acba95c4fb641d959ba54a7f991615008a06aa

@@ -0,0 +1 @@
+"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

fuzz/wget_cookie_fuzzer.in/04324ba5551a81097da9fe2166ae876d78b101c2

@@ -0,0 +1 @@
+ě=;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;D;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;mai;Dmaa;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;=

fuzz/wget_cookie_fuzzer.in/053cf4633784095aabc7160ad1addc72b50637d4

@@ -0,0 +1 @@
+_ÿÿÿÿÿÿ	¤seedANShttponly.;domain=.;_;D=_;domain=.;domain=.;_;;domain=.;domain=.;;;doma=o;id;n.main=.;;d(o'main=.;domainn=.;domain=.;_;Domain=.;(;domain=.=_;domain=.;domain=.;_;;domain=.;domaiQQQQQQQQQQQQQQQQQQQQQQQQQQQQomain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;;;domain=.;d_D=_;domain=.;domain=.;_;n=.;domain=.;;;domain=.;;domain=.;;domain=.;domainain=.;domain=.;_;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;om

fuzz/wget_cookie_fuzzer.in/0542275d96ce647dd77b8478149d05beb623c66f

@@ -0,0 +1,3 @@
+__Host-ID=x; 4032 age=2;HHHHHHdomain=HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHh=l; domain=x.y; httpohttponly; sñcurnly;ýly; seceur
+e
+securd

fuzz/wget_cookie_fuzzer.in/05570ae54e2d055e6f5299b6c537c017c7d6a48d

@@ -0,0 +1 @@
+:=;domain=';path=/p/

fuzz/wget_cookie_fuzzer.in/05a587d9f2f2968e54714bd3d69250fb2e174796

@@ -0,0 +1 @@
+_o=;=;=;y=;;=;=;;<3B>y=_e=';˙˙ qa<71>h=_Host-ID=xGMT; <20>h=_Host-ID=xGMT; domain=˙˙˙˙˙˙˙httponly; securSSSSSSSSSSSSSSSSnly; securSSSSSÓSSSSSSSSSSSSSSSSSSSSSSSSSSSS;=;=;=SSSSSSSSSS;;=;=;=;y=;=;=;=;;y=;=;=;=;=;=;=;==;=SSSS;=;==SSSSSSSSSSSSSSSSSSSS:SSSe

fuzz/wget_cookie_fuzzer.in/05b5fe2d8ce86bb5bc3b18748631d7ca0bc0a226

@@ -0,0 +1 @@
+_D=_;domain=.;domain=.;domain=.;;;do“ž–“=.;;domain=.;;domain=.;domTTT(TTTTTTTTTTTTTTT*************************************************************************************TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTainn=.;domainin=.;domain=.;;;doman;=o;i.dmain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;om

fuzz/wget_cookie_fuzzer.in/05f16b8bd7eff3186696ccebb0619a115072fdf0

@@ -0,0 +1 @@
+WWhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

fuzz/wget_cookie_fuzzer.in/06119248771c733c87fcab746323298c440b88b6

@@ -0,0 +1 @@
+__Host-KDFeec)ure

fuzz/wget_cookie_fuzzer.in/07aa9b0a17225bfdabfaf2063aef2ddad399737c

@@ -0,0 +1,2 @@
+__Hos__Host-ID__Host-ID=x; expires=Mon, 5=x.y; httpontsecure-IDmain=ontsecureontsecure-ID=x; expires=Mon, 29 Feb 2016UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU«ªªªªªªªUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUax-age=2; pat$=/; x.y; httponly; ly; secure
+secure

fuzz/wget_cookie_fuzzer.in/07c9007c7acd7a4dd4268347e91923fc6c3cba76

@@ -0,0 +1,2 @@
+__H@=x@=x; expires=Mon, 29 Femmmmmmmmmmmqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq*qqqqqqFpath=; secure
+x-age; secure

fuzz/wget_cookie_fuzzer.in/0829f419cd04b449972ff3adba76ac47f8931a26

@@ -0,0 +1 @@
+__Host-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expiMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM³¨MMMMMMMMMMMMMMMMMMMMMMMMMres=29 Feb 2expires=016 10:48:54 GMT; max-ageGMT; max-age=5; pathomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-IDBx; exp=x.y; athomt-ID=x; expires=58 Feb 2016 07:48:54 GMT;t-IDBx; expires=29 Feb 2016 07:48:54 GM;t-IDBx; exp=x.y; athomt-ID=x; expires=29 Fÿÿÿÿÿÿÿÿÿÿeb 2016 07:48:54 GMT;t-IDBx; expires=29 Feb 2016 07:48:54 GMT; max-age=5; pathomai;ost-ID=x; expires=29 FT; max-age=5; pathomai;ost-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=2; Feb 2016 10:48:5: GMT; max-age=5; pathomt-ID=x;  max-age=5; pathomai;=x.y; httponly

fuzz/wget_cookie_fuzzer.in/0835ff8a8e4d36d31f38270374016e8b997e5a13

@@ -0,0 +1 @@
+__Host-ID=x; e httponjjjjjjjjjjjjjjjjjjjjzjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjzjjjjjjjjjjjjjjjjjjjjjjjjGMT;Žexpires=n=x.; sec}re

fuzz/wget_cookie_fuzzer.in/086340cf2f2ca55d9fe06da3cb24a9150474181b

@@ -0,0 +1 @@
+_D=_;domain=.;domain=.;_;D=_;domain=.;domain=.;_;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domainn=.;domain=.;_;Domain=.;(;domain=.=_;domain=.;domain=.;_;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;;;domain=.;d_D=_;domain=.;domain=.;_;D=_;dom_;D=_;domain=.;domain=.;_;;domain=.;domain==_;dom_;D=_;domain=.;domain=.;_;;domain=.;domain=.;;;domain=.;_NNN)NNNNires=M/n,çË4  
F; dNNNNNNNNNNNNNNNNy; ;domain=.;;domain=.;domainn=.;domain=.;_;D=_;domain=.;domain=.;domain=.;;;domain=.;domain=.;;;domain=.;;domain=..;;;domain=.;;domain=.;;domain=.;domainn=.;domain=.;_;D=_;domain=.;domain=.;domain=.;;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domainhttp=.;domain=.;;domain=.;;;domain=.;domain=.;domain=.;(;domain=.;m.=ndin=.;;;domain=.;d_D=_;domain=.;domain=.;_;D=_;domain=.;domain=.;_;;doin=.;;;domain=.;domain=.;;;domain=.;;domainin=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=onlyre.;om

fuzz/wget_cookie_fuzzer.in/0b16b493efdc23a02de1809c983e85d46373f7b2

@@ -0,0 +1,4 @@
+(_pathnul‘)__Hos__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-Id=x; expires,M 2on=domain=064 07:4:854(nuŽ‘)_ GMT; max-‘)__Hos__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-Id=x; expires,M 2o)n=domain=064 07:4:854(nuŽ‘)_ GMT; max-À;e=4 páth:=/; s__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-Id=x; expires,M 2on=domain=064 07:4:854 GMT; a; ÿÿÿ)GMmaire
+secÀ;e=4 páth:=/; s__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-Id=x; expires,M 2on=domain=064 07:4:854 GMT; a__Hosnul‘)__Hos__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-Id=x; expires,M 2on=domain=064 07:4:854(nuŽ‘)_ GMT; max-‘)__Hos__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-Id=x; expires,M 2o)n=domain=064 07:4:854(nuŽ‘)_ GMT; max-À;e=4 páth:=/; s__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-I__Host-Id=x; expires,M 2on=domain=064 07:4:854 st-Id=x; expires,M 2on=domain=064 07:4:854(nuŽ‘)_ GMT; maire
+secure
+€

fuzz/wget_cookie_fuzzer.in/0b3347f2d6f06d017998f3d3d845f8fd06ccc20b

@@ -0,0 +1 @@
+9=;exp=;expires=¹;expires=8=;expires=¹;expires=¹99=;expires=¹;expires==;expires=¹;expires=¹;e;expires=¹;expires=¹99kk=;expires=¹;expires==;expires=¹;expires=¹;expires==ires=¹;expires=8=;expires=¹;expires=¹99=;expires=¹;expires==;expires=¹;expires=¹;e;exp_res=¹;expires=¹;expires==ires=¹;expires=8=;expires=¹;expires=¹99=;expires=¹;expires==;expires=¹;expires=¹;e;exps=¹;expires=8=;expires=¹;expires=¹99=;expires=¹;expires==;expires=¹;expires=¹;e;expires=¹;expires=¹;expires==ires=¹;expires=8=;expires=¹;expires=¹;expires=¹99kk=;expires=¹;ex99kk=;expires=¹;expires==;expires=s=¹;expires=¹99=;expires=¹;expires==;expires=¹;expires=¹;e;expires=¹;expires=¹99kk=;expiresA¹;expires==;expires=¹;expires=¹;expires==ires=¹;expires=8=;expires=¹;expires=¹99=;expires=¹;expires==;expires=¹;expires=¹;e;expires=¹;expires=¹;expires==ires=¹;expires=8=;expires=¹;expires=¹99=;expires=¹;expires==;expires=¹==;expires=¹;expires=¹;expires==ires=¹;expires=8=;99kk=;expires=¹;expires==;expires=¹;expires=¹;exp¹;expires=¹;expires==;;e

fuzz/wget_cookie_fuzzer.in/0b52d98054fbd5a0e57b167e260e97ca17ea06a5

@@ -0,0 +1 @@
+_16 07:48'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''':53 Gmain=xcrse ;

fuzz/wget_cookie_fuzzer.in/0b7671936f3761633505683129ca821b3add5497

@@ -0,0 +1 @@
+xmth=/;.;secure@=x..;secure@=x..;secure@=x..;secpath=ure@=x;xmth=/;.;secure@=x..;sectre@=x..;secure@=x;xmth=/;.;secure@=x..;secure@=x..;secure@=x;xmth=/;.;secure@=httponlyre@=x..;secure@=x;xmth=/;.;secure@=x..;secure@=x..;secure@=x;xmth=/;.;secure@=x..;secure@=x..;secure@=x;xmth=/;.;ctre@=x..;.;secure@=x..;secure@=x;

fuzz/wget_cookie_fuzzer.in/0c0f48d441e66d5b711acdbd4f492eab38abf197

@@ -0,0 +1 @@
+_ANSI_D=_;domain=.;domain=.;domain=.;;;do“ž–“=.;;domain=.;;domain=.;domTTTTTTTTTTTTTTTTTTT*************************************************************************************TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTainn=.;domain=.;_;Domain=.;(;domain=.=_;domain=.;domain=.;_;;domain=.;domain=.;;};domain=.;;domain=.;;domain=.;do=_;domain=.;domain=.;_;D=_;domain=*;domain=.;_;;domain=.;domain=.;;;doman;=o;i.dmain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;om

fuzz/wget_cookie_fuzzer.in/0dd428e972c4b763116b5af56affc91996ab60e1

@@ -0,0 +1 @@
+x/ict=""  <20><>==

fuzz/wget_cookie_fuzzer.in/0de4d1f2d4c9f6cdb98195b0524c568d6183a346

@@ -0,0 +1 @@
+__Hos__Hostk__Hos__Host-__Hos__Host-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT; íID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT;Host-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT__Host-__Hos__Host-ID=x; expires=Mon, 29 Feb 4000 07: íax-ÀpD=x; expires-a-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT__Host-__Hos__Host-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT; íID=x; expires=Mon, 29 Feb 4000 07:48:5-4 , 29 Feb 4000 07: íax-ÀpD=x; expires-a-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT__Host-__Hos__Host-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT; íID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT;Host-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT__Host-__Hos__Host-ID=x; expires=Mon, 29 Feb 4000 07: íax-ÀpD=GMT;Host-ID=x; expires=Mon, 29 Feb 4000 07:48:5-4 GMT__Host-__Hos__Host-ID=x; expires=Mon, 29 Feb 4000 07: íax-ÀpD=x; expires-age=2; p™‹ontsecurgÏe-ID=xÏ

fuzz/wget_cookie_fuzzer.in/0dea21c2f5d32f0715b0e46cd12341bbe3012164

@@ -0,0 +1 @@
+D=seï;DT=;D=þ;D=;DD=;;D=;DD=;D=;D=;D=;D=þ;D=w;DD=;D=;D=;DD=:;D=;DT=;D=;D=w;domain=D=;D=

fuzz/wget_cookie_fuzzer.in/0e2313ec4f2f19e78444a2bfa864f9ee1f70bd63

@@ -0,0 +1 @@
+__Host-ID=x; expires=Mon, 44 F
 ;httponly domain=x.y; httponlyre

fuzz/wget_cookie_fuzzer.in/0e243cf63dd1929a8c58db7c60a0a6e926f2f3c3

@@ -0,0 +1 @@
+@ 

fuzz/wget_cookie_fuzzer.in/0e50986db5155d9d8298b82b4dfbfecd9c45b614

@@ -0,0 +1 @@
+xmth=/; 4 ..<2E>;<3B>e<EFBFBD>.;<3B>n<EFBFBD>e<EFBFBD>.;<3B>nly=

fuzz/wget_cookie_fuzzer.in/0e542b08cd32d1678e88dce6b6806d87040459b1

@@ -0,0 +1 @@
+_dict=wget_cook{{{{{{{{{{{{{{{{{{{{{{{{˙˙˙˙˙˙)˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙;;path=/; domain=x.y; h˙˙˙˙˙˙˙˙˙˙˙˙ttđPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPő˙˙˙˙˙ŕŕsńcure

fuzz/wget_cookie_fuzzer.in/0fb36c323ea959840fb5e1246d955abede1e45a4

@@ -0,0 +1,2 @@
+__Hires=˙{{{{{{{{{{{{{{{{{{{{{{{{{{{{˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙use_cmp˙˙˙˙˙˙VVVVVVVVVVVVVVVVV˙˙˙˙˙˙˙VVVVVVVVVVVVVVVVVVVVVVonly; sy; ecure
+sńcure

fuzz/wget_cookie_fuzzer.in/0fc19b6938d67dfb40de2a424844d6c0d6aced89

@@ -0,0 +1,5 @@
+ahttponlyi!=x&y;qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqQqqqqqqqqqqqi!=x&y;qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq path=&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&; secure
+x-age; sec29 Feb 2015 07:48:54 GMT; max-domai!=x&y;qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq path=&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&; secure
+x-age; secuqqqqq path=&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&; secure
+x-age; sec29 Feb 2015 07:48:54 GM!=x&y;qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq path=&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&(&&&&&&&&&&&; secure
+x-age; secure

fuzz/wget_cookie_fuzzer.in/0fef88d8c757ae221ab1ffeaa1be805c53b4df06

@@ -0,0 +1 @@
+__Host-ax-domain=x.y; patI@=\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ax-doma®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®®in=x.y; patMon, ;T; #mŸ‡Ò›<C392>’žŒn=x.y; path=h path=x.y; pt=ahh path=httponl@=x; expires=Mon, ;T; max-domain=x.y;__Host-I@=x; expires=-domain=x.y; patI@=x; eres=Mon, ;T; #max-domain=x.y; patMon, ;T; #max-domain=x.y;p atx; expires=Mon, ;T; max-doure

fuzz/wget_cookie_fuzzer.in/1017f3e0cf8c825932b970f421ccf77c432dfce6

@@ -0,0 +1,11 @@
+__Hos__Host-ID=x; expires=Mottpont-ID=x; exp7:48:54 GMT; mires=Moe
+secure
+aø-Àge=5; path=/; domain=x.y exp7:48:57:48:54 GMT; mires=Moe
+secure
+aø-À&&&&&&&ge=5; path=/; domain=x.y exp7:48:54 GMT; mires=Moe
+secuANT; max-\ge=2ÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇ; xain=x.y; hexp4 GMT; mires=Moe
+seexpires=Mottpont-ID=x; exp7:48:54 GMT; mires=Moe
+secure
+aø-Àge=5; path=/; domain=x.y exp7:48:54 GMT; mires=Moe
+secuANT; max-\ge=2ÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇ; xaÇÇÇÇÇÇ; xain=x.y; hcuANT; max-\ge=2ÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇ9>; xain=x.y; hexpiÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇsecureÇÇÇÇÇÇÇÇÇÇ; xain=x.y; hexpires= ly; secure
+secure

fuzz/wget_cookie_fuzzer.in/107c11d59716083dede0d35f25db938e40882c5b

@@ -0,0 +1 @@
+Pxdict="get_cookmagth=/doiimain=~"~~~~~~~~~~~~~~~~~max-age~~~~~~~~~~~~~~~~~~~~~~~~~~~~=˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙==/;(domain=th=/=/; domaininy=

fuzz/wget_cookie_fuzzer.in/10e260b45bd55be75ff88ce9dc9e1370a98ca152

@@ -0,0 +1,4 @@
+__Hos__Host-ID=x; expires=Mon, 29 Feb 4000 07:48:54 GMT; max-Àge=5; path=/; domain=x.y; main=x.y; httpont-ID=x; expires=Mon, 29 Feb 2016 07:48:54 GMT; max-age=2; path=/; domain=x.y; httponly; ly; sCCCCCCCCCCCCCCCCCCCCCCCCCCCe}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}cure__Ho=x; expires=Mon, 29 Feb 4000 0:7:48:54 GMs__Host-ID=x; expires=Mon, 29 Feb 4000 07:48:54 GT; max-Àge=5; path=/; domain=x.y; httpont-Îecureexpires=Mon, 29 Feb 2016 0::48:54MT; max-Àge=5; path=/; domain=x.y; httpont-ID=x; expires=Mon, 29 Feb 2016 07:48:54 GMT; max-age=2; pa GMT; max-age=2; path=/; domai
+seth=/; domai
+secure
+cure

fuzz/wget_cookie_fuzzer.in/112cfa68cdd59feed9e014fff7e04ebf5f5341e2

@@ -0,0 +1,2 @@
+__Hos__Host-ID__Host-IDcure-ID=x; expires=Mon, 32 Feb 2016UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU«ªªªªªªªUUUUUUUost-IDcure-ID=x; expires=Mon, 32 Feb 2016UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU«ªªªªªªªUUUUUUUUUUUUUUUUUUU¥ªUUUUUUUUUUUUUUax-a httponly; ly; sUUUUUUUUUUUU¥ªUÕUUUUUUUUUUUUax-a httponly; ly; secure
+secure

fuzz/wget_cookie_fuzzer.in/1165eacb2eb937b19a418ef46a32b10aacc05f30

@@ -0,0 +1,2 @@
+__Hos_ßH6 07:48:54 ÿÿÿÿ; expires=Modict=wget_cookie_:48:54 ÿÿÿy; èttpont-ID=x; expires=MANSI_on, 29 Fgb 2016 07:4 httponly;GANSI_*MT; max-age=httponlySt0ctypeIcE/; domain=x.y; httponly; ly; sec!re
+secure

fuzz/wget_cookie_fuzzer.in/11a5838cb163c1a079b428b728b49d03ac9d0447

@@ -0,0 +1 @@
+=;*=;*=;*=;*=;*=;*=;*==;*=;*=;*=;*=;*=;*=þ;*=;*=;**=;*=;*=;*=;*=;*=;*==;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;**=;*=;*=;*=;*=;*=;*==;*=;*=;*=;=;*=;*=;*=;*=;*==;*=;*=;*=;*=;*=;*=;*==;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;**=;*=;*=;*=;*=;*=;*==;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;**=;*=;*=;*=;^^*=;*=;*==;*=;*;*=;*=;*=secure;**=;*=;*=;*=;*=;*=;*==;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;**=;*=;*=;*=;*=;*=;*==;*=;*=;*=;=;*=;*=;*=;*=;*=;*=;*==;*=;*=;*=;*=jjj;*=;*=;*=;*=;**=;*=;*=;*=;*=;*=;*==;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;*=;**=;*=;*=;

fuzz/wget_cookie_fuzzer.in/137d7e2c5076c4d3eb7d2e2914d165f9f5fbb6d4

@@ -0,0 +1 @@
+xdicp="get_cookmagth=/doiimain=~"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=ÿÿÿÿÿÿÿxpi…šŒÂÄß›<C39F>mainy=

fuzz/wget_cookie_fuzzer.in/1527fa34c94ebdf4569be575dedd1ad3b91c7769

@@ -0,0 +1 @@
+xmagth=/; domain=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=/; domain==/; domain=th=/; domain=th=/; domain=th=/; domain==/; domain=th=/; domain==/; domain=th=/; domain==/; domain=th=/; domain==/; domain=th=/; domain==/; domain=th=/expires=; domain==/; domain=th=/;omain==/; domain=th=/; domain==/; d=/; domain==/; domain=th=/; domain*=/; domain=h=/; domain==/; domain==/; domain=th=/; domain=th=/; domain=th=/;á domain==/; domain=th=/; ain=th=/; domain==/; domain=th=/expires=; domainy=

fuzz/wget_cookie_fuzzer.in/1537744fc2abcf9c0ff0c81794d85dac5d05b6ef

@@ -0,0 +1 @@
+__Host- max-age=5; paph=/; domai29! 2016 07:48omai__Host-IDn, 29! 2016 07:48:54 GMT; max-age=5K path=/;  max-age=RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR5 dge=5; path´/; d4 GMT; m

fuzz/wget_cookie_fuzzer.in/1546fcd04c2c5de52b2952e444507b51b3ab333c

@@ -0,0 +1,3 @@
+__Hos__Host-ID=x; expires=Mottpont-ID=x; exp7:48:54 GMT; mires=Moe
+secure
+aø-Àge=5;ax-\ge=2ÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇ; xain=x.y; hexpiÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇ; xain=x.y; hcuANT; max-\ge=2ÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇÇires= ly; secure(secure

fuzz/wget_cookie_fuzzer.in/155567b3a98715b73fcac6f74c32e877a67b3867

@@ -0,0 +1 @@
+_==x;max-age=4; max-age=8; max-age=8ag; max-age=9; max-age=8; max-age=8ag; ax-age=8ag; max-age=9; max-age=8;àmax-age=8ag; max-age=9; max-age=83; max-agm=9a-x;eage=8_;max-age=4; max-age=8; max-age=8=ag; max-age=9; max-age=83; max-age=9;max-age=8_; mmax-age=9; max-age=83; max-age=9;max-age=8_;max-age=4; max-age=8; max-__Host-ID=:54 GMT; max-age=5K path=/;  max-age=5; path=T; max-age=5K path=/;  max-age=5; path=/7:48:54 GMT; max-age=5K path=/age=8=