* NEWS: Finalize release

time_t on VMS is typically unsigned.  (Lazy man's solution to 2038?)
I added "(time_t)" type casts to negative values ("-1"), and changed
tests to avoid complaints.

* src/hsts.c (hsts_add_entry): Explicitly cast potentially negative time
  values to time_t to handle VMS quirks.
  (hsts_store_entry): Same
  (get_hsts_store_filename): Use new ajoin_dir_file function to join
  filenames
  (test_hsts_read_database): Same
* src/init.c (struct options): use-askpass is not implemented on VMS
  (ajoin_dir_file): New Function to join filenames in a platform
  agnostic manner
  (wgetrc_user_file_name): Use ajoin_dir_file to join paths. Doing this
  correctly, eliminates the need for a special case on VMS
* src/init.h: Add prototype for ajoin_dir_file
* src/log.c (check_redirect_output): Ignore on VMS
* src/main.c(option_data): Disable use-askpass on VMS
  (print_help): Same
  (get_hsts_database): Use ajoin_dir_file to join paths
  (print_version): Add VMS specific information to Version output
* src/utils.c (fork_to_background): Fix signature on VMS

Co-authored-by: Darshit Shah <darnir@gnu.org>

.gitignore

@@ -14,7 +14,9 @@
 /config.status
 /configure
 /lib/
+!/lib/Makefile.am
 /maint.mk
+/gnulib_po/
 # Wildcard Ignores
 *~
 po/*.gmo*
@@ -24,6 +26,11 @@ tests/*.log
 tests/*.trs
 testenv/*.log
 testenv/*.trs
+fuzz/*
+!fuzz/*.*
+fuzz/*.o
+fuzz/*.log
+fuzz/*.trs
 # build-aux/
 build-aux/.gitignore
 build-aux/ar-lib
@@ -59,6 +66,7 @@ po/Makevars
 po/POTFILES
 po/wget.pot
 po/stamp-po
+po/remove-potcdate.sed
 # src/
 src/.deps/
 src/Makefile
@@ -87,9 +95,16 @@ testenv/Makefile.in
 tests/Makefile
 tests/Makefile.in
 tests/unit-tests
+tests/unit-tests.o
+tests/.deps/
+tests/certs/interca.conf
+tests/certs/rootca.conf
 # util/
 util/Makefile
 util/Makefile.in
+# fuzz/
+fuzz/.deps/
+fuzz/Makefile.in
 # others
 /tags
 /cscope.out

.gitlab-ci.yml

@@ -3,6 +3,10 @@
 # to speed up compilation. We include a version number in cache
 # name to allow expiration of old caches.
 
+stages:
+  - stage1-testing
+  - stage2-tarball
+
 cache:
   key: "$CI_JOB_NAME-ver5"
   paths:
@@ -20,12 +24,13 @@ after_script:
   # somehow after_script loses environment
   - export CCACHE_BASEDIR=${PWD}
   - export CCACHE_DIR=${PWD}/cache
-  - ccache -s
+  - if which ccache >/dev/null; then ccache -s; fi
 
 variables:
   BUILD_IMAGES_PROJECT: gnuwget/build-images
   DEBIAN_BUILD: buildenv-debian-stretch
-  FEDORA_BUILD: buildenv-f27
+  DEBIAN_TESTING_BUILD: buildenv-debian-testing
+  FEDORA_BUILD: buildenv-fedora
   CENTOS7_BUILD: buildenv-centos7
   MINGW_BUILD: buildenv-mingw
   ALPINE_BUILD: buildenv-alpine
@@ -34,22 +39,27 @@ variables:
   GET_SOURCES_ATTEMPTS: "3"
   GIT_DEPTH: "5"
   CONFIGURE_BASE_FLAGS: --enable-assert --cache-file cache/config.cache
-  CFLAGS_DEFAULT: -O0 -g -ggdb3 -Wall -Wextra
+  CFLAGS_DEFAULT: -O0 -g -ggdb3
 
 
 VPATH/Debian:
+  stage: stage1-testing
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
   script:
-    - cp -a /builds/common/gnulib .
+    - contrib/spell-checker
     - export CFLAGS=$CFLAGS_DEFAULT
-    - ./bootstrap --skip-po
+    - ./bootstrap --skip-po && touch .manywarnings
+    - autoreconf -ivf
     - mkdir vpath && cd vpath
     - ../configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
     - make -j$(nproc)
     - make -j$(nproc) distcheck
+    - mv wget-*.gz ..
   tags:
     - shared
-    - docker
+    - linux
+  except:
+    - coverity-scan@gnuwget/wget
   artifacts:
     expire_in: 2 weeks
     when: on_failure
@@ -58,6 +68,11 @@ VPATH/Debian:
       - fuzz/*.log
       - tests/*.log
       - testenv/*.log
+  artifacts:
+    expire_in: 2 weeks
+    when: on_success
+    paths:
+      - wget-*.gz
 
 # In this build we combine
 #  * syntax-check
@@ -66,19 +81,24 @@ VPATH/Debian:
 #  * build/asan-check
 #  * build w/Werror and ubsan-check
 OpenSSL/Debian:
+  stage: stage1-testing
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
   script:
     - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
     - cat /etc/hosts
     - alias make="make -j$(nproc)"
     - ./bootstrap --skip-po
-  - ./configure $CONFIGURE_BASE_FLAGS --with-ssl=gnutls
+    - autoreconf -ivf
+    - ./configure $CONFIGURE_BASE_FLAGS --with-ssl=openssl
     - make syntax-check
     - make check
     - make distcheck
     - make check-valgrind
   tags:
     - shared
+    - linux
+  except:
+    - coverity-scan@gnuwget/wget
   artifacts:
     expire_in: 2 weeks
     when: on_failure
@@ -89,19 +109,24 @@ OpenSSL/Debian:
       - testenv/*.log
 
 GnuTLS/Debian:
+  stage: stage1-testing
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
   script:
     - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
     - cat /etc/hosts
     - alias make="make -j$(nproc)"
     - ./bootstrap --skip-po
-  - ./configure $CONFIGURE_BASE_FLAGS --with-ssl=openssl
+    - autoreconf -ivf
+    - ./configure $CONFIGURE_BASE_FLAGS --with-ssl=gnutls
     - make syntax-check
     - make check
     - make distcheck
     - make check-valgrind
   tags:
     - shared
+    - linux
+  except:
+    - coverity-scan@gnuwget/wget
   artifacts:
     expire_in: 2 weeks
     when: on_failure
@@ -111,79 +136,324 @@ GnuTLS/Debian:
       - tests/*.log
       - testenv/*.log
 
-#Centos7 build:
+Minimal/Debian:
-#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS7_BUILD
+  stage: stage1-testing
-#  script:
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
-#  - sed -i 's/AM_GNU_GETTEXT_VERSION(0.19.3)/AM_GNU_GETTEXT_VERSION(0.18.2)/g' configure.ac
+  script:
-#  - ./bootstrap && ./configure --enable-gcc-warnings --disable-doc && make -j$(nproc) check
+    - export CFLAGS=$CFLAGS_DEFAULT
-#  tags:
+    - ./bootstrap --skip-po
-#  - shared
+    - autoreconf -ivf
-#  artifacts:
+    - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
-#    expire_in: 2 weeks
+      --disable-nls --without-ssl --enable-ipv6 --without-zlib --without-libiconv-prefix
-#    when: on_failure
+      --disable-iri --disable-ntlm --disable-pcre --without-libpsl --without-libuuid
-#    paths:
+      --without-libintl-prefix
-#      - tests/*.log
+    - make -j$(nproc)
-#      - compat_reports/
+    - make -j$(nproc) check
+    - make check-valgrind
+  tags:
+    - shared
+    - linux
+  except:
+    - coverity-scan@gnuwget/wget
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
 
-#clang-analyzer/Fedora:
+# In this build we combine
-#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+#  * clang
-#  script:
+#  * ASan, UBSan
-#  - ./bootstrap
+#  * check, syntax-check
-#  - scan-build ./configure --disable-doc --enable-gcc-warnings
+Sanitizers/Debian:
-#  - make -j$(nproc) -C gl
+  stage: stage1-testing
-#  - scan-build --status-bugs -o scan-build-lib make -j$(nproc) -C lib
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
-#  tags:
+  script:
-#  - shared
+#    - export CFLAGS="$CFLAGS_DEFAULT -Werror"
-#  except:
+    - export CFLAGS="$CFLAGS_DEFAULT"
-#  - tags
+    - ./bootstrap --skip-po && touch .manywarnings
-#  artifacts:
+    - autoreconf -ivf
-#    expire_in: 2 weeks
+    - export CC="ccache clang"
-#    when: on_failure
+    - export UBSAN_OPTIONS=print_stacktrace=1
-#    paths:
+    - export ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-8/bin/llvm-symbolizer
-#      - scan-build-lib/*
+#    - export LSAN_OPTIONS=suppressions="$PWD/tests/clang-asan-suppressions"
+    - ./configure $CONFIGURE_BASE_FLAGS --enable-fsanitize-asan --enable-fsanitize-ubsan
+    - make -j$(nproc) check
+  tags:
+    - shared
+    - linux
+  except:
+    - coverity-scan@gnuwget/wget
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
 
-#pages:
+Scan-Build/Debian:
-#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+  script:
+    - export CFLAGS=$CFLAGS_DEFAULT
+    - ./bootstrap --skip-po
+    - scan-build ./configure $CONFIGURE_BASE_FLAGS
+    - make -C lib -j$(nproc)
+    - scan-build -v -enable-checker nullability --status-bugs -o scan-build make -j$(nproc)
+  tags:
+    - shared
+    - linux
+  except:
+    - tags
+    - coverity-scan@gnuwget/wget
+  allow_failure: true
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - scan-build/*
+
+Valgrind/Debian:
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_TESTING_BUILD
+  script:
+    - export CFLAGS=$CFLAGS_DEFAULT
+    - ./bootstrap --skip-po
+    - autoreconf -ivf
+    - ./configure $CONFIGURE_BASE_FLAGS --enable-valgrind-tests
+    - make -j$(nproc)
+    - make check -j$(nproc)
+  tags:
+    - shared
+    - linux
+  except:
+    - tags
+    - coverity-scan@gnuwget/wget
+  allow_failure: true
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
+
+Simple/Fedora:
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+  script:
+#    - export CFLAGS="$CFLAGS_DEFAULT -Werror"
+    - export CFLAGS="$CFLAGS_DEFAULT"
+    - ./bootstrap --skip-po && touch .manywarnings
+    - autoreconf -ivf
+    - ./configure $CONFIGURE_BASE_FLAGS
+    - make -j$(nproc) check
+  tags:
+    - shared
+    - linux
+  except:
+    - tags
+    - coverity-scan@gnuwget/wget
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
+
+#Alpine:
+#  stage: stage1-testing
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$ALPINE_BUILD
 #  script:
-#  - ./bootstrap
+#    - export CFLAGS="$CFLAGS_DEFAULT"
-#  - CFLAGS="-g -O0" ./configure --enable-gtk-doc --enable-code-coverage --disable-gcc-warnings
+#    - ./bootstrap --skip-po
+#    - ./configure $CONFIGURE_BASE_FLAGS
 #    - make -j$(nproc) check
-#  - make local-code-coverage-output
-#  - mkdir -p public
-#  - rm -rf public/coverage
-#  - mv libidn2-*-coverage public/coverage
-#  - rm -rf public/reference
-#  - mv doc/reference/html public/reference
-#  - make -C doc manual
-#  - rm -rf public/manual
-#  - mv doc/manual public/manual
 #  tags:
 #    - shared
-#  artifacts:
-#    when: on_success
-#    paths:
-#      - public
-#  only:
-#    - master
-
-#MinGW64:
-#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
-#  before_script:
-#  - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc &&
-#    echo ':DOSWin:M::MZ::/usr/bin/wine64:' > /proc/sys/fs/binfmt_misc/register
-#  script:
-#  - ./bootstrap
-#  - mingw64-configure --disable-valgrind-tests --disable-doc
-#  - mingw64-make -j$(nproc)
-#  - mingw64-make -j$(nproc) check
-#  tags:
-#  - shared
-#  - docker
 #  except:
 #    - tags
+#    - linux
 #  artifacts:
 #    expire_in: 2 weeks
 #    when: on_failure
 #    paths:
 #      - ./*.log
+#      - fuzz/*.log
 #      - tests/*.log
+#      - testenv/*.log
+
+pages:
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+  script:
+    - mkdir -p public
+    - ./bootstrap --skip-po
+    - autoreconf -ivf
+    - export CFLAGS="$CFLAGS_DEFAULT"
+    - ./configure $CONFIGURE_BASE_FLAGS
+    - make -j$(nproc) check-coverage
+
+# Tarball
+    - make dist
+    - mv wget-*.gz public/wget-latest.tar.gz
+
+# Test suite coverage report
+    - rm -rf public/coverage
+    - mv lcov public/coverage
+
+# Online Documentation
+    - make -C doc html
+    - rm -rf public/reference
+    - mv doc/wget.html public/reference
+
+# Coverage report for all our fuzz corpora
+    - make -j$(nproc) fuzz-coverage
+    - rm -rf public/fuzz-coverage
+    - mv lcov public/fuzz-coverage
+  tags:
+    - shared
+    - linux
+  artifacts:
+    when: on_success
+    paths:
+      - public
+  only:
+    - master
+
+
+MinGW64:
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$MINGW_BUILD
+  script:
+#    - apt-get install libhttp-daemon-perl libio-socket-ssl-perl python3
+    - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc &&
+      echo ':DOSWin:M::MZ::/usr/bin/wine:' > /proc/sys/fs/binfmt_misc/register
+    - ./bootstrap --skip-po
+    - autoreconf -ivf
+#    - cp pthread_sigmask.c.mingw lib/pthread_sigmask.c
+    - export CC="ccache $PREFIX-gcc"
+    - export GCCLIB=$(dirname $(find /usr/lib/gcc/$PREFIX -name libgcc_s_seh-1.dll|grep posix))
+    - export WINEPATH="$WINEPATH;/usr/$PREFIX/bin;/usr/$PREFIX/lib;$PWD/libwget/.libs;$GCCLIB"
+    - echo "WINEPATH=$WINEPATH"
+    - LIBS="-ldl -lpsapi" ./configure $CONFIGURE_BASE_FLAGS --build=x86_64-pc-linux-gnu --host=$PREFIX --enable-shared
+    - make -j$(nproc)
+    - make clean
+    - LIBS="-ldl -lpsapi" ./configure $CONFIGURE_BASE_FLAGS --build=x86_64-pc-linux-gnu --host=$PREFIX --enable-shared --disable-threads
+    - make -j$(nproc)
+    - cp -p src/wget.exe src/wget
+    - make check -j$(nproc) LOG_COMPILER=wine
+  tags:
+    - shared
+    - linux
+  except:
+    - tags
+    - coverity-scan@gnuwget/wget
+  allow_failure: true
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./config.h
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
+
+Build/Arch:
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$ARCH_BUILD
+  script:
+    - export CFLAGS="$CFLAGS_DEFAULT"
+    - ./bootstrap --skip-po && touch .manywarnings
+    - autoreconf -vif
+    - ./configure $CONFIGURE_BASE_FLAGS
+    - make -j$(nproc)
+    - make check -j$(nproc)
+  tags:
+    - shared
+    - linux
+  except:
+    - coverity-scan@gnuwget/wget
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - ./*.log
+      - fuzz/*.log
+      - tests/*.log
+      - testenv/*.log
+
+
+# Test building from tarball in a minimal non-dev environment
+Tarball:
+  stage: stage2-tarball
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$BASIC_BUILD
+  variables:
+    GIT_STRATEGY: none
+  script:
+    - apk add perl
+    # remove all files from git repo
+    - mv wget-*.gz /tmp
+    - rm -rf * .git* .travis*
+    - mv /tmp/wget-*.gz .
+    # unpack and build from tarball
+    - tar xvf wget-*.gz
+    - cd wget-*
+    - unset CC
+    - ./configure $CONFIGURE_BASE_FLAGS --with-ssl=no
+    - make -j$(nproc)
+    # make check doesn't work due to incomplete perl installation
+    # - make -j$(nproc) check
+    # check if essential files are accidentally cleaned
+    - make clean
+    - make -j$(nproc)
+  tags:
+    - shared
+    - linux
+  dependencies:
+    - VPATH/Debian
+  except:
+    - coverity-scan@gnuwget/wget
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - wget-*/*.log
+      - wget-*/fuzz/*.log
+      - wget-*/tests/*.log
+      - wget-*/testenv/*.log
+
+coverity:
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+  script:
+    - wget https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$COVERITY_SCAN_PROJECT_NAME" -O /tmp/coverity_tool.tgz
+    - tar xfz /tmp/coverity_tool.tgz
+    - ./bootstrap --skip-po
+    - autoreconf -ivf
+    - CFLAGS="-g -Og" ./configure --cache-file cache/config.cache --disable-doc
+    - cov-analysis-linux64-*/bin/cov-build --dir cov-int make -j$(nproc)
+    - tar cfz cov-int.tar.gz cov-int
+    - curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
+      --form token=$COVERITY_SCAN_TOKEN --form email=tim.ruehsen@gmx.de
+      --form file=@cov-int.tar.gz --form version="`git describe --tags`"
+      --form description="CI build"
+  tags:
+    - shared
+    - linux
+  only:
+    - coverity-scan@gnuwget/wget
+  artifacts:
+    expire_in: 1 week
+    when: on_failure
+    paths:
+      - cov-int/*.txt

.lgtm.yml

@@ -4,4 +4,4 @@ extraction:
       packages:
         - libgpgme11-dev
     configure:
-      command: ./bootstrap && ./configure
+      command: ./bootstrap && autoreconf -ivf && ./configure

.mailmap

@@ -0,0 +1,13 @@
+Tim Rühsen <tim.ruehsen@gmx.de> Tim Ruehsen <tim.ruehsen@gmx.de>
+Tim Rühsen <tim.ruehsen@gmx.de> rockdaboot <tim.ruehsen@gmx.de>
+Darshit Shah <darnir@gnu.org> <darnir@gmail.com>
+Darshit Shah <darnir@gnu.org> <darnir@reniac.com>
+Ander Juaristi <ajuaristi@gmx.es> <a@juaristi.eus>
+Ander Juaristi <ajuaristi@gmx.es> Ander Juaristi Alamos <ajuaristi@gmx.es>
+Micah Cowan <micah@cowan.name> micah <devnull@localhost>
+Steven Schubiger <stsc@members.fsf.org> Steven Schubiger <stsc@member.fsf.org>
+Steven Schubiger <stsc@members.fsf.org> <schubiger@gmail.com>
+Giuseppe Scrivano <gscrivano@gnu.org> <gscrivan@redhat.com>
+Gisle Vanem <gisle.vanem@gmail.com> <gvanem@yahoo.no>
+Gisle Vanem <gisle.vanem@gmail.com> <gvanem@broadpark.no>
+Gisle Vanem <gisle.vanem@gmail.com> <giva@bgnett.no>

.travis.yml

@@ -10,7 +10,7 @@ notifications:
     email:
         recipients:
             - darnir@gmail.com
-            - bug-wget@gnu.org
+            - wget-dev@gnu.org
         on_success: change
         on_failure: always
 

AUTHORS

@@ -55,4 +55,8 @@ Ted Mielczarek.  Support for parsing links from CSS.
 
 Saint Xavier.  Support for IRIs (RFC 3987).
 
-Giuseppe Scrivano.  Added support for HTTP/1.1.  Current Wget maintainer.
+Giuseppe Scrivano.  Added support for HTTP/1.1.  Active Wget Maintainer from 2010-2015.
+
+Tim Ruehsen.  Active Wget Maintainer / Developer from 2012-2020.
+
+Darshit Shah.  Active Wget Maintainer / Developer from 2013-2020.

CONTRIBUTING.md

@@ -0,0 +1,65 @@
+# Wget Contribution Guidelines
+
+1.  [Guidelines For Patch
+    Submissions](#Guidelines_For_Patch_Submissions)
+    1.  [What is a patch ?](#What_is_a_patch.3F)
+    2.  [Where to send the patches](#Where_to_send_the_patches)
+    3.  [Standards and coding style](#Standards_and_coding_style)
+
+
+Guidelines For Patch Submissions {#Guidelines_For_Patch_Submissions}
+================================
+
+What is a patch ? {#What_is_a_patch.3F}
+-----------------
+
+A patch file, also known as a \"diff\", is a textual representation of
+changes to source code. Patches are readable enough
+to be reviewed by []{#line-9 .anchor}humans and at the same time regular
+enough to be processed by programs. The `patch`
+utility is used to change the source code in the
+manner that the patch describes, this being called \"applying\" the
+patch. Patches work even on files that have been
+modified independently of the modifications in the
+patch, as long as those other changes do not
+conflict with the patch.
+
+Because of these properties, patches are the preferred means of
+distributing the changes to a free software project.
+If you have made a change to Wget and would like to
+contribute it, you will need to create a patch and
+send it to the developers; please read on.
+
+Where to send the patches {#Where_to_send_the_patches}
+-------------------------
+
+Patches intended to be applied to Wget should be mailed to
+bug-wget@gnu.org. Each patch will be reviewed by the
+developers, and will be acked and added to the
+distribution, or rejected with an explanation.
+Unfortunately, the developers are often busy with
+their day jobs, so the review process can take a while.
+
+*Every* patch should be accompanied by an explanation of what the patch
+changes, and why the change is desirable or
+necessary. The explanation need not be long, but
+please don\'t just send a patch without any
+accompanying text.
+
+Please send your patches as email attachments. It is important that the
+patch survives the travel unchanged so that we can feed it to
+the `patch` utility or `git am/apply` after or while reviewing it.
+
+
+Standards and coding style {#Standards_and_coding_style}
+--------------------------
+
+Wget abides by the GNU coding standards, available at:
+
+-   https://www.gnu.org/prep/standards.html
+
+But maybe even better is to stay with the surrounding coding style.
+
+When working with git: The commit messages needs a certain GNU style
+format. Please check `git log` for examples. The maintainers might
+correct small issues here before pushing / applying without asking.

Makefile.am

@@ -1,6 +1,5 @@
 # Makefile for `Wget' utility
-# Copyright (C) 1995-1997, 2006-2018 Free Software Foundation,
+# Copyright (C) 1995-1997, 2006-2020 Free Software Foundation, Inc.
-# Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -41,7 +40,7 @@ distuninstallcheck_listfiles = find . -type f | \
 ACLOCAL_AMFLAGS = -I m4
 
 # subdirectories in the distribution
-SUBDIRS = lib src doc po util fuzz tests testenv
+SUBDIRS = lib src doc po gnulib_po util fuzz tests testenv
 
 EXTRA_DIST = MAILING-LIST \
              msdos/config.h msdos/Makefile.DJ \
@@ -49,7 +48,7 @@ EXTRA_DIST = MAILING-LIST \
              build-aux/build_info.pl build-aux/git-version-gen .version
 
 CLEANFILES = *~ *.bak $(DISTNAME).tar.gz
-DISTCLEANFILES = po/stamp-po
+DISTCLEANFILES = po/stamp-po gnulib_po/stamp-po
 
 BUILT_SOURCES = .version
 
@@ -81,3 +80,30 @@ gen-ChangeLog:
 
 check-valgrind:
 	TESTS_ENVIRONMENT="VALGRIND_TESTS=1" $(MAKE) check
+
+LCOV_INFO=wget.info
+
+clean-lcov:
+	rm -rf $(LCOV_INFO) */*.gc?? */.libs/*.gc?? lcov/
+	lcov --zerocounters --directory src/
+
+check-coverage: clean clean-lcov
+	$(MAKE) CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+	lcov --capture --initial --directory src/ --output-file $(LCOV_INFO)
+	$(MAKE) CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage" VALGRIND_TESTS=0 check
+	lcov --capture --directory src/ --output-file $(LCOV_INFO)
+	lcov --remove $(LCOV_INFO) '/usr/include/*' '*/lib/*' -o $(LCOV_INFO)
+	genhtml --prefix . --ignore-errors source $(LCOV_INFO) --legend --title "Wget" --output-directory=lcov
+	@echo
+	@echo "You can now view the coverage report with 'xdg-open lcov/index.html'"
+
+fuzz-coverage: clean clean-lcov
+	$(MAKE) -C lib
+	$(MAKE) -C src CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+	$(MAKE) -C fuzz check CFLAGS="$(CFLAGS) --coverage" LDFLAGS="$(LDFLAGS) --coverage"
+	lcov --capture --initial --directory fuzz --directory src --output-file $(LCOV_INFO)
+	lcov --capture --directory fuzz --directory src --output-file $(LCOV_INFO)
+	lcov --remove $(LCOV_INFO) '/usr/include/*' '*/lib/*' -o $(LCOV_INFO)
+	genhtml --prefix . --ignore-errors source $(LCOV_INFO) --legend --title "Wget-fuzz" --output-directory=lcov
+	@echo
+	@echo "You can now view the coverage report with 'xdg-open lcov/index.html'"

NEWS

@@ -1,10 +1,55 @@
 GNU Wget NEWS -- history of user-visible changes.
 
-Copyright (C) 1997-2018 Free Software Foundation, Inc.
+Copyright (C) 1997-2020 Free Software Foundation, Inc.
 See the end for copying conditions.
 
 Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 
+* Changes in Wget 1.21
+
+** Improve the number of translated strings
+
+** Remove all uses of alloca
+   In some places the length of untrusted strings has been used, e.g.
+   strings from the command line or from remote.
+
+** Fix buffer overflows in progress bar code in some locales
+
+** Fix two null pointer accesses
+
+** Amend cookie file header to be recognized by the 'file' command
+
+** Post Handshake Authentication for OpenSSL
+
+** Require gettext version 0.19.3+
+
+** Add configure flags --enable-fsanitize-ubsan, --enable-fsanitize-asan
+   and --enable-fsanitize-msan for gcc and clang
+
+** Make several smaller fixes, enhance fuzzing, enhance building
+
+
+* Changes in Wget 1.20.3
+
+** Fixed a buffer overflow vulnerability
+
+
+* Changes in Wget 1.20.2
+
+** NTLM authentication will retry under certain cases
+
+
+* Changes in Wget 1.20.1
+
+** --xattr is no longer default since it introduces privacy issues.
+
+** --xattr saves the Referer as scheme/host/port, user/pw/path/query/fragment
+   are no longer saved to prevent privacy issues.
+
+** --xattr saves the Original URL without user/password to prevent
+   privacy issues.
+
+
 * Changes in Wget 1.20
 
 ** Add new option `--retry-on-host-error` to treat local errors as transient

README

@@ -14,7 +14,7 @@ While doing that, Wget respects the Robot Exclusion Standard
 (/robots.txt).  Wget can be instructed to convert the links in
 downloaded HTML files to the local files for offline viewing.
 
-Recursive downloading also works with FTP, where Wget can retrieves a
+Recursive downloading also works with FTP, where Wget can retrieve a
 hierarchy of directories and files.
 
 With both HTTP and FTP, Wget can check whether a remote file has
@@ -53,15 +53,14 @@ See the file `MAILING-LIST' for information about Wget mailing lists.
 Wget's home page is at <https://www.gnu.org/software/wget/>.
 
 If you would like to contribute code for Wget, please read
-https://wget.addictivecode.org/PatchGuidelines.
+CONTRIBUTING.md.
 
 Wget was originally written and mainained by Hrvoje Niksic.  Please see
 the file AUTHORS for a list of major contributors, and the ChangeLogs
 for a detailed listing of all contributions.
 
 
-Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
+Copyright (C) 1995-2020 Free Software Foundation, Inc.
-2005, 2006, 2007, 2008, 2009 Free Software Foundation, Inc.
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

README.checkout

@@ -8,7 +8,7 @@ Compiling From Repository Sources
    libiconv, libpsl, libpcre, pkg-config, libmetalink and GnuPG are not
    absolutely required):
 
-     * [20]autoconf (currently, GNU Wget requires version 2.61). This is
+     * [20]autoconf (currently, GNU Wget requires version 2.64). This is
        needed to generate the configure script from configure.in. This is
        not required when building from a tarball distribution; only when
        building from repository sources.
@@ -104,7 +104,7 @@ Compiling From Repository Sources
        The command line options --dns-servers and --bind-dns-address are
        only available when configured with --with-cares.
 
-     * [49]Gpef is required by some gnulib modules, most notably "unicase". You
+     * [49]gperf is required by some gnulib modules, most notably "unicase". You
        need the application installed on the machine to compile Wget from git.
 
 
@@ -161,8 +161,8 @@ Testing and development
  that bug, which might be tedious. Tests should only be run through GDB for that purpose.
 
 
- Copyright (C) 2008, 2010, 2014-2015, 2018 Free Software Foundation,
+ Copyright (C) 2008, 2010, 2014-2015, 2018-2020 Free Software
- Inc.
+ Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later
  <https://www.gnu.org/licenses/gpl.html>.
  This is free software: you are free to change and redistribute it.

bootstrap

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Print a version string.
-scriptversion=2018-10-13.05; # UTC
+scriptversion=2019-01-04.17; # UTC
 
 # Bootstrap this package from checked-out sources.
 
-# Copyright (C) 2003-2018 Free Software Foundation, Inc.
+# Copyright (C) 2003-2020 Free Software Foundation, Inc.
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -963,6 +963,16 @@ fi
 bootstrap_post_import_hook \
   || die "bootstrap_post_import_hook failed"
 
+# Don't proceed if there are uninitialized submodules.  In particular,
+# the next step will remove dangling links, which might be links into
+# uninitialized submodules.
+#
+# Uninitialized submodules are listed with an initial dash.
+if $use_git && git submodule | grep '^-' >/dev/null; then
+  die "some git submodules are not initialized. "     \
+      "Run 'git submodule init' and bootstrap again."
+fi
+
 # Remove any dangling symlink matching "*.m4" or "*.[ch]" in some
 # gnulib-populated directories.  Such .m4 files would cause aclocal to fail.
 # The following requires GNU find 4.2.3 or newer.  Considering the usual

bootstrap.conf

@@ -1,5 +1,5 @@
 # bootstrap.conf - Bootstrap configuration.
-# Copyright (C) 2007-2012, 2018 Free Software Foundation, Inc.
+# Copyright (C) 2007-2012, 2018-2020 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #
@@ -17,15 +17,16 @@
 # along with this program.  If not, see `https://www.gnu.org/licenses/'.
 
 # gnulib library name
+source_base=lib
+tests_base=lib/tests
 gnulib_name=libgnu
-gnulib_tool_option_extras=
+gnulib_tool_option_extras="--makefile-name=gnulib.mk --po-base=gnulib_po --po-domain=wget"
 use_libtool=0
 checkout_only_file=
 
 # gnulib modules used by this package.
 gnulib_modules="
 accept
-alloca
 announce-gen
 base32
 bind
@@ -38,7 +39,7 @@ connect
 dirname
 fcntl
 flock
-fnmatch
+fnmatch-gnu
 fopen
 futimens
 ftello
@@ -119,35 +120,24 @@ utime-h
 utimens
 vasprintf
 vsnprintf
+warnings
 wcwidth
 write
 xmemdup0
 xstrndup
 "
 
-gnulib_extra_files="
-	$build_aux/install-sh
-	$build_aux/mdate-sh
-	$build_aux/texinfo.tex
-	$build_aux/depcomp
-	$build_aux/config.guess
-	$build_aux/config.sub
-	$build_aux/config.rpath
-	doc/INSTALL
-"
-
 # Build prerequisites
 buildreq="\
-autoconf   2.62
+autoconf   2.64
 automake   1.11.1
 autopoint  -
 gettext    0.17
 git        1.4.4
 makeinfo   -
 perl       5.5
-rsync      -
 tar        -
-xz         -
+gzip       -
 flex       -
 gperf      -
 "
@@ -166,4 +156,10 @@ bootstrap_post_import_hook ()
        sed -e "s/gl_unicase_special_lookup.*/gl_unicase_special_lookup\ \(const char \*str, size_t len\)/g" \
          > lib/unicase/special-casing-table.h
   fi
+
+  # ./bootstrap calls 'autopoint --force' which will overwrite
+  #   po/Makevars.template. So here we add what we need for a VPATH
+  #   build. ./bootstrap will create po/Makevars from po/Makevars.template
+  #   after our change.
+  echo 'PACKAGE_GNU = yes' >> po/Makevars.template
 }

build-aux/build_info.pl

@@ -2,7 +2,7 @@
 
 # Generate build_info.c.
 
-# Copyright (C) 2009-2011, 2018 Free Software Foundation, Inc.
+# Copyright (C) 2009-2011, 2018-2020 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

cfg.mk

@@ -3,6 +3,7 @@ exclude_file_name_regexp--sc_trailing_blank = ^doc/annou.*$$
 exclude_file_name_regexp--sc_bindtextdomain = ^fuzz/.*.c$$
 exclude_file_name_regexp--sc_require_config_h = fuzz/main.c$$
 exclude_file_name_regexp--sc_require_config_h_first = fuzz/main.c$$
+# exclude_file_name_regexp--sc_po_
 
 
 export VC_LIST_EXCEPT_DEFAULT=^(lib/.*|m4/.*|md5/.*|build-aux/.*|src/gettext\.h|.*ChangeLog|tests/certs/.*)$$
@@ -28,10 +29,14 @@ local-checks-to-skip = \
     sc_program_name \
     sc_makefile_at_at_check \
     sc_cast_of_argument_to_free \
-    sc_prohibit_undesirable_word_seq
+    sc_prohibit_undesirable_word_seq \
+    sc_prohibit_gnu_make_extensions
 
 #SHELL=bash -x
 show-vc-list-except:
 	@$(VC_LIST_EXCEPT)
 
 VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)|ChangeLog-2014-12-10|/.*\.der|^tests/certs/.*|^fuzz/.*\.(in|repro)/.*$$
+
+update-copyright-env = UPDATE_COPYRIGHT_USE_INTERVALS=1
+generated_files =

configure.ac

@@ -1,5 +1,5 @@
 dnl Template file for GNU Autoconf
-dnl Copyright (C) 1995-1997, 2001, 2007-2014, 2018 Free Software
+dnl Copyright (C) 1995-1997, 2001, 2007-2014, 2018-2020 Free Software
 dnl Foundation, Inc.
 
 dnl This program is free software; you can redistribute it and/or modify
@@ -30,10 +30,8 @@ dnl
 dnl Process this file with autoconf to produce a configure script.
 dnl
 
-AC_INIT([wget],
+AC_INIT([wget],[m4_esyscmd(build-aux/git-version-gen .tarball-version)],[bug-wget@gnu.org])
-        m4_esyscmd([build-aux/git-version-gen .tarball-version]),
+AC_PREREQ([2.64])
-	[bug-wget@gnu.org])
-AC_PREREQ(2.63)
 
 dnl
 dnl What version of Wget are we building?
@@ -48,10 +46,14 @@ AC_CONFIG_SRCDIR([src/wget.h])
 dnl
 dnl Automake setup
 dnl
-AM_INIT_AUTOMAKE([1.9])
+AM_INIT_AUTOMAKE([subdir-objects])
+
+AC_USE_SYSTEM_EXTENSIONS
+AC_PROG_CC
+AM_PROG_CC_C_O
 
 dnl
-dnl Get cannonical host
+dnl Get canonical host
 dnl
 AC_CANONICAL_HOST
 AC_DEFINE_UNQUOTED([OS_TYPE], "$host_os",
@@ -70,7 +72,7 @@ AC_ARG_WITH([libpsl],
 
 dnl SSL: Configure SSL backend to use
 AC_ARG_WITH([ssl],
-  [AS_HELP_STRING([--with-ssl={gnutls,openssl}], [specify SSL backend. GNU TLS is the default.])])
+  [AS_HELP_STRING([--with-ssl={gnutls,openssl,no}], [specify SSL backend. GNU TLS is the default.])])
 
 dnl Zlib: Configure use of zlib for compression
 AC_ARG_WITH([zlib],
@@ -93,16 +95,69 @@ AC_ARG_ENABLE([fuzzing],
    AC_SUBST([LIB_FUZZING_ENGINE])
    AC_DEFINE([FUZZING], 1, [Define to 1 if this is a fuzzing build])
   ], [enable_fuzzing=no; LIB_FUZZING_ENGINE=""])
-#FUZZ_LIBS=$LIBS
-#if test $enable_fuzzing = "yes"; then
-#  OLD_LIBS=$LIBS
-#  AC_SEARCH_LIBS([dlsym], [dl dld])
-#  FUZZ_LIBS=$LIBS
-#  LIBS=$OLD_LIBS
-#fi
-#AC_SUBST([FUZZ_LIBS])
 AM_CONDITIONAL([FUZZING], [test "$enable_fuzzing" = "yes"])
 
+dnl needed for some fuzzers
+OLD_LIBS="$LIBS"
+AC_SEARCH_LIBS([dlopen], [dl dld])
+if [[ "${ac_cv_search_dlopen#-l}" != "${ac_cv_search_dlopen}" ]]; then
+  FUZZ_LIBS="${ac_cv_search_dlopen}"
+  AC_SUBST([FUZZ_LIBS])
+fi
+LIBS="$OLD_LIBS"
+
+
+AC_ARG_ENABLE([fsanitize-ubsan],
+  [AS_HELP_STRING([--enable-fsanitize-ubsan], [Turn on Undefined Behavior Sanitizer (for developers)])],
+  [gl_cc_sanitize_ubsan=yes], [gl_cc_sanitize_ubsan=no])
+
+AC_ARG_ENABLE([fsanitize-asan],
+  [AS_HELP_STRING([--enable-fsanitize-asan], [Turn on Address Sanitizer (for developers) (mutually exclusive with Memory/Thread sanitizer or Valgrind tests)])],
+  [gl_cc_sanitize_asan=yes], [gl_cc_sanitize_asan=no])
+
+AC_ARG_ENABLE([fsanitize-msan],
+  [AS_HELP_STRING([--enable-fsanitize-msan], [Turn on Memory Sanitizer (for developers) (mutually exclusive with Address/Thread sanitizer or Valgrind tests)])],
+  [gl_cc_sanitize_msan=yes], [gl_cc_sanitize_msan=no])
+
+if test "$gl_cc_sanitize_asan" = yes; then
+  if test "$gl_cc_sanitize_msan" = yes; then
+    AC_MSG_ERROR([Address Sanitizer and Memory Sanitizer are mutually exclusive])
+  fi
+fi
+
+if test "$gl_cc_sanitize_ubsan" = yes; then
+  gl_WARN_ADD([-fsanitize=undefined])
+  gl_WARN_ADD([-fno-sanitize-recover=undefined])
+
+  # additional clang options
+  gl_WARN_ADD([-fsanitize=integer])
+  gl_WARN_ADD([-fsanitize=nullability])
+  gl_WARN_ADD([-fno-sanitize-recover=nullability])
+fi
+
+if test "$gl_cc_sanitize_asan" = yes; then
+  gl_WARN_ADD([-fsanitize=address])
+  gl_WARN_ADD([-fno-omit-frame-pointer])
+
+  # additional clang option
+  gl_WARN_ADD([-fsanitize-address-use-after-scope])
+fi
+
+if test "$gl_cc_sanitize_msan" = yes; then
+  # clang options
+  gl_WARN_ADD([-fsanitize=memory])
+  gl_WARN_ADD([-fsanitize-memory-track-origins])
+
+  # gcc options
+  if test "$CCNAME" = "gcc"; then
+    gl_WARN_ADD([-fsanitize=leak])
+  fi
+
+  gl_WARN_ADD([-fno-omit-frame-pointer])
+  gl_WARN_ADD([-fPIE])
+fi
+
+
 dnl Opie: Support for opie s/key FTP logins
 AC_ARG_ENABLE([opie],
   [AS_HELP_STRING([--disable-opie], [disable support for opie or s/key FTP login])],
@@ -155,6 +210,12 @@ AC_ARG_ENABLE(valgrind-tests,
 AS_IF([test "x$ENABLE_VALGRIND" != xno], [
   AC_CHECK_PROG(HAVE_VALGRIND, valgrind, yes, no)
   AS_IF([test "x$HAVE_VALGRIND" = xyes], [
+    if test "$gl_cc_sanitize_asan" = yes; then
+      AC_MSG_ERROR([Valgrind and Address Sanitizer are mutually exclusive])
+    elif test "$gl_cc_sanitize_msan" = yes; then
+      AC_MSG_ERROR([Valgrind and Memory Sanitizer are mutually exclusive])
+    fi
+
     VALGRIND_TESTS="1"
     AC_SUBST(VALGRIND_TESTS)
     VALGRIND_INFO="Test suite will be run under Valgrind"
@@ -184,10 +245,6 @@ dnl We want these before the checks, so the checks can modify their values.
 test -z "$CFLAGS"  && CFLAGS= auto_cflags=1
 test -z "$CC" && cc_specified=yes
 
-AC_PROG_CC
-AM_PROG_CC_C_O
-AC_AIX
-
 gl_EARLY
 
 dnl
@@ -200,7 +257,7 @@ dnl
 dnl Gettext
 dnl
 AM_GNU_GETTEXT([external],[need-ngettext])
-AM_GNU_GETTEXT_VERSION([0.17])
+AM_GNU_GETTEXT_VERSION([0.19.3])
 
 AC_PROG_RANLIB
 
@@ -262,11 +319,7 @@ dnl Check sizes of integer types.  These are used to find n-bit
 dnl integral types on older systems that fail to provide intN_t and
 dnl uintN_t typedefs.
 dnl
-AC_CHECK_SIZEOF([short])
-AC_CHECK_SIZEOF([int])
 AC_CHECK_SIZEOF([long])
-AC_CHECK_SIZEOF([long long])
-AC_CHECK_SIZEOF([void *])
 
 dnl
 dnl Checks for non-universal or system-specific types.
@@ -281,9 +334,12 @@ AC_CHECK_TYPES(sig_atomic_t, [], [], [
 #include <signal.h>
 ])
 
-# gnulib
+# gnulib, AM_ICONV should be placed before gl_INIT
+AM_ICONV
 gl_INIT
 
+AX_CODE_COVERAGE
+
 dnl
 dnl Checks for library functions.
 dnl
@@ -301,8 +357,6 @@ dnl We expect to have these functions on Unix-like systems configure
 dnl runs on.  The defines are provided to get them in config.h.in so
 dnl Wget can still be ported to non-Unix systems (such as Windows)
 dnl that lack some of these functions.
-AC_DEFINE([HAVE_STRCASECMP], 1, [Define to 1 if you have the `strcasecmp' function.])
-AC_DEFINE([HAVE_STRNCASECMP], 1, [Define to 1 if you have the `strncasecmp' function.])
 AC_DEFINE([HAVE_STRDUP], 1, [Define to 1 if you have the `strdup' function.])
 AC_DEFINE([HAVE_ISATTY], 1, [Define to 1 if you have the `isatty' function.])
 
@@ -314,6 +368,116 @@ case $host_os in
     ;;
 esac
 
+# enable all possible compiler warnings in WARN_FLAGS
+#
+# to enable by default: create a file '.manywarnings'
+# enable explicitly : ./configure --enable-manywarnings
+# disable explicitly: ./configure --disable-manywarnings
+sanitizer_flags="$WARN_CFLAGS"
+wget_MANYWARNINGS(WARN_CFLAGS, C)
+WARN_CFLAGS="$WARN_CFLAGS $sanitizer_flags"
+
+if test -n "$WARN_CFLAGS"; then
+  if test "$CCNAME" = "gcc"; then
+    # Set up list of unwanted warnings
+    nw=
+    nw="$nw -Wsystem-headers"       # System headers may trigger lot's of useless warnings
+    nw="$nw -Wvla"                  # This project is C99
+    nw="$nw -Wstack-protector"
+    nw="$nw -Wmissing-field-initializer"
+    nw="$nw -Wtraditional"
+    nw="$nw -Wtraditional-conversion"
+    nw="$nw -Wc++-compat"
+    nw="$nw -Wcast-qual"
+    nw="$nw -Wconversion"
+    nw="$nw -Wsign-conversion"
+    nw="$nw -Wunsuffixed-float-constants"
+    nw="$nw -Wdeclaration-after-statement" # C89 only, messing up gcc < 5
+    nw="$nw -Wcast-function-type" # gcc 8, very noisy
+    nw="$nw -Wabi" # gcc 8, very noisy
+    nw="$nw -Wunused-macros" # triggers in auto-generated lex css parser, #pragma doesn't work, conflicts with -Werror
+	nw="$nw -Wchkp" # Deprecated option
+    if test "$cross_compiling" = yes; then
+      nw="$nw -Wformat"
+    fi
+
+    # remove unwanted warn flags
+    wget_WORD_REMOVE([WARN_CFLAGS], [$WARN_CFLAGS], [$nw])
+
+    WARN_CFLAGS="$WARN_CFLAGS -Wno-undef -Wno-float-equal"
+
+    # add more flags as you like
+    if test $GCC_VERSION -ge 5; then
+      WARN_CFLAGS="$WARN_CFLAGS -fdiagnostics-color=always"
+    fi
+    if test "$cross_compiling" = yes; then
+      WARN_CFLAGS="$WARN_CFLAGS -Wno-format"
+    fi
+    if test $GCC_VERSION -ge 8; then
+      WARN_CFLAGS="$WARN_CFLAGS -Wno-cast-function-type"
+    fi
+    # WARN_CFLAGS="$WARN_CFLAGS -Werror"
+
+    # We use a slightly smaller set of warning options for lib/.
+    # Remove the following and save the result in GNULIB_WARN_CFLAGS.
+    # Removing is not enough if these switches are implicitly set by other
+    #  flags like -Wall or -Wextra. We have to explicitly unset them
+    #  with -Wno-....
+    nw=
+    nw="$nw -Wpedantic"
+    nw="$nw -Wsign-compare"
+    nw="$nw -Wunused-parameter"
+    nw="$nw -Wswitch-default"
+    nw="$nw -Wformat-nonliteral"
+    nw="$nw -Wsuggest-attribute=pure"
+    nw="$nw -Wunsafe-loop-optimizations"
+    nw="$nw -Wundef"
+    nw="$nw -Wswitch-enum"
+    nw="$nw -Wbad-function-cast"
+    nw="$nw -Wredundant-decls"
+    nw="$nw -Werror"
+    wget_WORD_REMOVE([GNULIB_WARN_CFLAGS], [$WARN_CFLAGS], [$nw])
+    wget_WORD_REMOVE([CFLAGS], [$CFLAGS], [-Werror])
+
+    # disable options implicitly set by other options
+    GNULIB_WARN_CFLAGS="-Wno-error $GNULIB_WARN_CFLAGS"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-sign-compare -Wno-unused-parameter -Wno-alloca"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-float-conversion -Wno-cast-function-type"
+    if test "$cross_compiling" = yes; then
+      GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-incompatible-pointer-types"
+    fi
+
+  elif test "$CCNAME" = "clang"; then
+    # setup flags for this project
+    WARN_CFLAGS="$WARN_CFLAGS -Wno-system-headers -Wno-vla -Wno-cast-qual -Wno-padded"
+    WARN_CFLAGS="$WARN_CFLAGS -Wno-reserved-id-macro -Wno-sign-conversion  -Wno-disabled-macro-expansion"
+    WARN_CFLAGS="$WARN_CFLAGS -Wno-documentation -Wno-documentation-unknown-command"
+    WARN_CFLAGS="$WARN_CFLAGS -Wno-covered-switch-default -Wno-unused-macros"
+    WARN_CFLAGS="$WARN_CFLAGS -Wno-missing-field-initializers"
+
+    # remove all flags from WARN_FLAGS that are already in CFLAGS
+    # wget_WORD_REMOVE([WARN_CFLAGS], [$WARN_CFLAGS], [$CFLAGS])
+
+    wget_WORD_REMOVE([CFLAGS], [$CFLAGS], [-Werror])
+
+    # disable verbose options
+    GNULIB_WARN_CFLAGS="-Wno-error $GNULIB_WARN_CFLAGS"
+    GNULIB_WARN_CFLAGS="$WARN_CFLAGS -Wno-sign-compare -Wno-unused-parameter -Wno-undef -Wno-format-nonliteral"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-conversion -Wno-disabled-macro-expansion -Wno-c++98-compat"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-gnu-statement-expression -Wno-shorten-64-to-32 -Wno-switch-enum"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-unused-macros -Wno-missing-field-initializers"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-gnu-zero-variadic-macro-arguments -Wno-conditional-uninitialized"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-comma -Wno-assign-enum -Wno-unreachable-code -Wno-error"
+    GNULIB_WARN_CFLAGS="$GNULIB_WARN_CFLAGS -Wno-missing-field-initializers"
+
+    # remove all flags from GNULIB_WARN_FLAGS that are already in CFLAGS
+    # wget_WORD_REMOVE([GNULIB_WARN_CFLAGS], [$GNULIB_WARN_CFLAGS], [$CFLAGS])
+  fi
+
+  AC_SUBST([WARN_CFLAGS])
+  AC_SUBST([GNULIB_WARN_CFLAGS])
+fi
+
 
 dnl
 dnl Checks for libraries.
@@ -510,7 +674,7 @@ dnl is to autodetect IPv6 and use it where available.
 dnl
 
 AC_ARG_ENABLE(ipv6,
-  AC_HELP_STRING([--disable-ipv6],[disable IPv6 support]),
+  AS_HELP_STRING([--disable-ipv6],[disable IPv6 support]),
   [case "${enable_ipv6}" in
     no)
       AC_MSG_NOTICE([disabling IPv6 at user request])
@@ -591,7 +755,7 @@ dnl Check for IDN/IRIs
 dnl
 
 AC_ARG_ENABLE(iri,
-  AC_HELP_STRING([--disable-iri],[disable IDN/IRIs support]),
+  AS_HELP_STRING([--disable-iri],[disable IDN/IRIs support]),
   [case "${enable_iri}" in
     no)
       dnl Disable IRIs checking
@@ -618,8 +782,6 @@ AC_ARG_ENABLE(iri,
 )
 
 AS_IF([test "X$iri" != "Xno"],[
-  AM_ICONV
-
   if test "X$am_cv_func_iconv" != "Xyes"; then
     iri=no
     if test "X$force_iri" = "Xyes"; then
@@ -630,8 +792,7 @@ AS_IF([test "X$iri" != "Xno"],[
   fi
 ])
 
-AC_ARG_WITH(libidn, AC_HELP_STRING([--with-libidn=[DIR]],
+AC_ARG_WITH(libidn, AS_HELP_STRING([--with-libidn=[DIR]],[Support IDN2008/IRIs (needs GNU libidn2 + libunicode)]),
-                                   [Support IDN2008/IRIs (needs GNU libidn2 + libunicode)]),
                                    libidn=$withval, libidn="")
 if test "X$iri" != "Xno"; then
   AS_IF([test "x$with_libidn2" != xno], [
@@ -651,8 +812,7 @@ dnl
 dnl Check for UUID
 dnl
 
-AC_ARG_WITH(libuuid, AC_HELP_STRING([--without-libuuid],
+AC_ARG_WITH(libuuid, AS_HELP_STRING([--without-libuuid],[Generate UUIDs for WARC files via libuuid]))
-                                    [Generate UUIDs for WARC files via libuuid]))
 
 AS_IF([test "x$with_libuuid" = xyes], [
   # libuuid was explicitly requested
@@ -689,10 +849,8 @@ dnl
 dnl Check for PCRE2 / PCRE
 dnl
 
-AC_ARG_ENABLE(pcre2, AC_HELP_STRING([--disable-pcre2],
+AC_ARG_ENABLE(pcre2, AS_HELP_STRING([--disable-pcre2],[Disable PCRE2 style regular expressions]))
-                                   [Disable PCRE2 style regular expressions]))
+AC_ARG_ENABLE(pcre, AS_HELP_STRING([--disable-pcre],[Disable PCRE style regular expressions]))
-AC_ARG_ENABLE(pcre, AC_HELP_STRING([--disable-pcre],
-                                   [Disable PCRE style regular expressions]))
 
 AS_IF([test "X$enable_pcre2" != "Xno"],[
   enable_pcre2=no
@@ -820,13 +978,14 @@ AM_CONDITIONAL([IRI_IS_ENABLED], [test "X$iri" != "Xno"])
 AM_CONDITIONAL([WITH_SSL], [test "X$with_ssl" != "Xno"])
 AM_CONDITIONAL([METALINK_IS_ENABLED], [test "X$with_metalink" != "Xno"])
 AM_CONDITIONAL([WITH_XATTR], [test "X$ENABLE_XATTR" != "Xno"])
+AM_CONDITIONAL([WITH_NTLM], [test "X$ENABLE_NTLM" == "Xyes"])
 
 dnl
 dnl Create output
 dnl
 AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile util/Makefile
-                 po/Makefile.in tests/Makefile fuzz/Makefile
+                 po/Makefile.in gnulib_po/Makefile.in tests/Makefile
-                 lib/Makefile testenv/Makefile
+                 fuzz/Makefile lib/Makefile testenv/Makefile
                  tests/certs/interca.conf tests/certs/rootca.conf])
 AC_CONFIG_HEADERS([src/config.h])
 AC_OUTPUT
@@ -837,7 +996,7 @@ AC_MSG_NOTICE([Summary of build options:
   Host OS:           $host_os
   Install prefix:    $prefix
   Compiler:          $CC
-  CFlags:            $CFLAGS $CPPFLAGS
+  CFlags:            $CFLAGS $CPPFLAGS $WARN_CFLAGS
   LDFlags:           $LDFLAGS
   Libs:              $LIBS
   SSL:               $with_ssl

contrib/make-release

@@ -102,7 +102,14 @@ echo ""
 build-aux/announce-gen --release-type "$REL_TYPE" --package-name "$APP_LOWER" --previous-version="$PREV_VER" --current-version "$CUR_VER" --gpg-key-id="$GPG_KEY" --url-directory "https://${REL_LOC}/gnu/${APP_LOWER}" --news=NEWS > "$APP_NAME-$APP_VER.announce"
 
 echo ""
-echo "Announce email template placed at $APP_NAME-$APP_VER.announce"
+echo "Remaining Release Checklist:
+  1. Send a mail to coordinator@translationproject.org with the subject
+	 \"Requesting Translations for $APP_NAME-$APP_VER.POT\"
+  2. Announce email template placed at $APP_NAME-$APP_VER.announce.
+     Send an announce mail to info-gnu@gnu.org
+"
+
+echo ""
 
 prev_tag=$(git tag | tail -2 | head -1)
 echo ""

contrib/mk_authors

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+prev_tag=`git tag --sort=taggerdate|tail -1`
+
+echo -e "The authors list is autogenerated from the git history; sorted by number of commits\n"
+
+(
+if [ -z $prev_tag ]; then
+  git shortlog -sen
+else
+  git shortlog -sen ${prev_tag}..
+fi
+) | cut -f 2 | sed 's/@/ at /g'
+
+#(
+#if [ -z $prev_tag ]; then
+#  git log --reverse|grep -i reported|cut -d':' -f2|cut -d'<' -f1|cut -d' ' -f2-|tr -d '"'
+#else
+#  git log ${prev_tag}.. --reverse|grep -i reported|cut -d':' -f2|cut -d'<' -f1|cut -d' ' -f2-|tr -d '"'
+#fi
+#) | sort -u
+
+echo -e "\n\nThe translators list is autogenerated from po file history\n"
+
+sed -n 's/.*Last-Translator: *\(.*\) *<.*/\1/p' po/*.po | sort -u

contrib/spell-checker

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+#
+# see https://github.com/codespell-project/codespell
+#
+# in short:
+#  - pip install codespell
+#  - add ~/.local/bin to PATH
+
+set -e
+
+codespell $* -L "tim,gonna,cas,referer,fpr,vas,msdos,ifset,ba,tage,tolen,files',hist,lightening,wither" `git ls-files|\
+  egrep -v '_fuzzer.in|_fuzzer.repro|\.der$|\.pem$|gnulib|ChangeLog|tests/gpg|\.png$|\.dat$|contrib/spell-checker|tests/certs/.*\.crt'`
+
+#codespell $* -L "tim,gonna,cas,te,referer,ist,fpr,vas" src/wget.c contrib/spell-checker

doc/Makefile.am

@@ -1,5 +1,5 @@
 # Makefile for `wget' utility
-# Copyright (C) 1995-1997, 2007-2011, 2015, 2018 Free Software
+# Copyright (C) 1995-1997, 2007-2011, 2015, 2018-2020 Free Software
 # Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify

doc/fdl.texi

@@ -5,8 +5,8 @@
 @c hence no sectioning command or @node.
 
 @display
-Copyright @copyright{} 2000-2002, 2007-2008, 2015, 2018 Free Software
+Copyright @copyright{} 2000-2002, 2007-2008, 2015, 2018-2020 Free
-Foundation, Inc.
+Software Foundation, Inc.
 @uref{http://fsf.org/}
 
 Everyone is permitted to copy and distribute verbatim copies

doc/metalink-standard.txt

@@ -106,7 +106,7 @@ found unsafe too, the file is not downloaded.
 
 See [1 #section-1.1].
 
-cat > bugus.meta4 << EOF
+cat > bogus.meta4 << EOF
 <?xml version="1.0" encoding="UTF-8"?>
 <metalink xmlns="urn:ietf:params:xml:ns:metalink">
   <file name="/dir/A/File1">

doc/texi2pod.pl

@@ -1,6 +1,6 @@
 #! /usr/bin/env perl
 
-#   Copyright (C) 1999-2001, 2003, 2007, 2009-2011, 2015, 2018 Free
+#   Copyright (C) 1999-2001, 2003, 2007, 2009-2011, 2015, 2018-2020 Free
 #   Software Foundation, Inc.
 
 # This file is part of GCC.

doc/wget.texi

@@ -31,8 +31,8 @@ This file documents the GNU Wget utility for downloading network
 data.
 
 @c man begin COPYRIGHT
-Copyright @copyright{} 1996-2011, 2015, 2018 Free Software Foundation,
+Copyright @copyright{} 1996-2011, 2015, 2018-2020 Free Software
-Inc.
+Foundation, Inc.
 
 @iftex
 Permission is granted to make and distribute verbatim copies of
@@ -64,6 +64,8 @@ Texts.  A copy of the license is included in the section entitled
 @ignore
 @c man begin AUTHOR
 Originally written by Hrvoje Nikšić <hniksic@xemacs.org>.
+Currently maintained by Darshit Shah <darnir@gnu.org> and
+Tim Rühsen <tim.ruehsen@gmx.de>.
 @c man end
 @c man begin SEEALSO
 This is @strong{not} the complete manual for GNU Wget.
@@ -71,6 +73,9 @@ For more complete information, including more detailed explanations of
 some of the options, and a number of commands available
 for use with @file{.wgetrc} files and the @samp{-e} option, see the GNU
 Info entry for @file{wget}.
+
+Also see wget2(1), the updated version of GNU Wget with even better
+support for recursive downloading and modern protocols like HTTP/2.
 @c man end
 @end ignore
 
@@ -540,6 +545,14 @@ right NUMBER.
 Set preferred location for Metalink resources. This has effect if multiple
 resources with same priority are available.
 
+@cindex xattr
+@item --xattr
+Enable use of file system's extended attributes to save the
+original URL and the Referer HTTP header value if used.
+
+Be aware that the URL might contain private information like
+access tokens or credentials.
+
 
 @cindex force html
 @item -F
@@ -855,7 +868,7 @@ files.  In such a case, wget could simply be invoked with this parameter to get
 a much cleaner output on the screen.
 
 This option will also force the progress bar to be printed to @file{stderr} when
-used alongside the @samp{--logfile} option.
+used alongside the @samp{--output-file} option.
 
 @item -N
 @itemx --timestamping
@@ -1030,10 +1043,11 @@ megabytes (with @samp{m} suffix).
 Note that quota will never affect downloading a single file.  So if you
 specify @samp{wget -Q10k https://example.com/ls-lR.gz}, all of the
 @file{ls-lR.gz} will be downloaded.  The same goes even when several
-@sc{url}s are specified on the command-line.  However, quota is
+@sc{url}s are specified on the command-line.  The quota is checked only
-respected when retrieving either recursively, or from an input file.
+at the end of each downloaded file, so it will never result in a partially
-Thus you may safely type @samp{wget -Q2m -i sites}---download will be
+downloaded file. Thus you may safely type @samp{wget -Q2m -i sites}---download
-aborted when the quota is exceeded.
+will be aborted after the file that exhausts the quota is completely
+downloaded.
 
 Setting quota to 0 or to @samp{inf} unlimits the download quota.
 
@@ -1394,10 +1408,10 @@ to the inability of server-side scripts to cope with the connections.
 @cindex cache
 @item --no-cache
 Disable server-side cache.  In this case, Wget will send the remote
-server an appropriate directive (@samp{Pragma: no-cache}) to get the
+server appropriate directives (@samp{Cache-Control: no-cache} and
-file from the remote service, rather than returning the cached version.
+@samp{Pragma: no-cache}) to get the file from the remote service,
-This is especially useful for retrieving and flushing out-of-date
+rather than returning the cached version. This is especially useful
-documents on proxy servers.
+for retrieving and flushing out-of-date documents on proxy servers.
 
 Caching is allowed by default.
 
@@ -1809,7 +1823,7 @@ Set the cipher list string. Typically this string sets the
 cipher suites and other SSL/TLS options that the user wish should be used, in a
 set order of preference (GnuTLS calls it 'priority string'). This string
 will be fed verbatim to the SSL/TLS engine (OpenSSL or GnuTLS) and hence
-its format and syntax is dependant on that. Wget will not process or manipulate it
+its format and syntax is dependent on that. Wget will not process or manipulate it
 in any way. Refer to the OpenSSL or GnuTLS documentation for more information.
 
 @cindex SSL certificate, check
@@ -1983,7 +1997,7 @@ from the database.
 
 If you supply your own HSTS database via @samp{--hsts-file}, be aware that Wget
 may modify the provided file if any change occurs between the HSTS policies
-requested by the remote servers and those in the file. When Wget exists,
+requested by the remote servers and those in the file. When Wget exits,
 it effectively updates the HSTS database by rewriting the database file with the new entries.
 
 If the supplied file does not exist, Wget will create one. This file will contain the new HSTS
@@ -1997,7 +2011,7 @@ the same time over the HSTS database. Before dumping the updated HSTS entries
 on the file, Wget will re-read it and merge the changes.
 
 Using a custom HSTS database and/or modifying an existing one is discouraged.
-For more information about the potential security threats arised from such practice,
+For more information about the potential security threats arose from such practice,
 see section 14 "Security Considerations" of RFC 6797, specially section 14.9
 "Creative Manipulation of HSTS Policy Store".
 @end table
@@ -2190,8 +2204,21 @@ details.  The default maximum depth is 5.
 
 @item -l @var{depth}
 @itemx --level=@var{depth}
-Specify recursion maximum depth level @var{depth} (@pxref{Recursive
+Set the maximum number of subdirectories that Wget will recurse into to @var{depth}.
-Download}).
+In order to prevent one from accidentally downloading very large websites when using recursion
+this is limited to a depth of 5 by default, i.e., it will traverse at most 5 directories deep
+starting from the provided URL.
+Set @samp{-l 0} or @samp{-l inf} for infinite recursion depth.
+
+@example
+wget -r -l 0 http://@var{site}/1.html
+@end example
+
+Ideally, one would expect this to download just @file{1.html}.
+but unfortunately this is not the case, because @samp{-l 0} is equivalent to
+@samp{-l inf}---that is, infinite recursion.  To download a single @sc{html}
+page (or a handful of them), specify them all on the command line and leave away @samp{-r}
+and @samp{-l}. To download the essential items to view a single @sc{html} page, see @samp{page requisites}.
 
 @cindex proxy filling
 @cindex delete after retrieval
@@ -4190,7 +4217,7 @@ from the debug log before sending it to the bug address.  The
 @code{-d} won't go out of its way to collect sensitive information,
 but the log @emph{will} contain a fairly complete transcript of Wget's
 communication with the server, which may include passwords and pieces
-of downloaded data.  Since the bug address is publically archived, you
+of downloaded data.  Since the bug address is publicly archived, you
 may assume that all bug reports are visible to the public.
 
 @item
@@ -4439,7 +4466,7 @@ Tomislav Petrović, Mario Mikočević---many bug reports and
 suggestions.
 
 @item
-François Pinard---many thorough bug reports and discussions.
+Françis Pinard---many thorough bug reports and discussions.
 
 @item
 Karl Eichwalder---lots of help with internationalization, Makefile
@@ -4477,6 +4504,14 @@ Ted Mielczarek---donated support for CSS.
 @item
 Saint Xavier---Support for IRIs (RFC 3987).
 
+@item
+Tim Rühsen---Loads of helpful patches, especially fuzzing support and
+Continuous Integration. Maintainer since 2014.
+
+@item
+Darshit Shah---Many helpful patches. Community support on various platforms.
+Maintainer since 2014.
+
 @item
 People who provided donations for development---including Brian Gough.
 @end itemize

fuzz/Makefile.am

@@ -1,23 +1,30 @@
-AM_CFLAGS = $(WERROR_CFLAGS) $(WARN_CFLAGS) -Wno-unused-parameter -Wno-pedantic
+AM_CFLAGS = $(WERROR_CFLAGS) $(WARN_CFLAGS) $(CODE_COVERAGE_CFLAGS)
 AM_CPPFLAGS = -I$(top_srcdir)/src -I$(srcdir) -I$(top_builddir)/lib -I$(top_srcdir)/lib \
+ $(CODE_COVERAGE_CPPFLAGS) \
  -DSRCDIR=\"$(abs_srcdir)\"
 LDADD = ../lib/libgnu.a \
  $(GETADDRINFO_LIB) $(HOSTENT_LIB) $(INET_NTOP_LIB) $(INET_PTON_LIB) \
  $(LIBSOCKET) $(LIB_CLOCK_GETTIME) $(LIB_CRYPTO) $(LIB_GETLOGIN) $(LIB_NANOSLEEP) $(LIB_POLL) \
  $(LIB_POSIX_SPAWN) $(LIB_PTHREAD_SIGMASK) $(LIB_SELECT) $(LIBICONV) $(LIBINTL) \
  $(LIBMULTITHREAD) $(LIBTHREAD) $(SERVENT_LIB) @INTL_MACOSX_LIBS@ \
- -ldl
+ $(FUZZ_LIBS) $(CODE_COVERAGE_LIBS)
 
 WGET_TESTS = \
- wget_css_fuzzer$(EXEEXT) \
  wget_cookie_fuzzer$(EXEEXT) \
+ wget_css_fuzzer$(EXEEXT) \
  wget_ftpls_fuzzer$(EXEEXT) \
  wget_html_fuzzer$(EXEEXT) \
  wget_netrc_fuzzer$(EXEEXT) \
  wget_options_fuzzer$(EXEEXT) \
+ wget_progress_fuzzer$(EXEEXT) \
+ wget_read_hunk_fuzzer$(EXEEXT) \
  wget_robots_fuzzer$(EXEEXT) \
  wget_url_fuzzer$(EXEEXT)
 
+if WITH_NTLM
+  WGET_TESTS += wget_ntlm_fuzzer$(EXEEXT)
+endif
+
 if FUZZING
   bin_PROGRAMS = $(WGET_TESTS)
   LDADD += $(LIB_FUZZING_ENGINE)
@@ -36,12 +43,12 @@ endif
 ../src/libunittest.a:
 	$(MAKE) $(AM_MAKEFLAGS) -C ../src libunittest.a
 
-wget_css_fuzzer_SOURCES = wget_css_fuzzer.c $(MAIN)
-wget_css_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
-
 wget_cookie_fuzzer_SOURCES = wget_cookie_fuzzer.c $(MAIN)
 wget_cookie_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
 
+wget_css_fuzzer_SOURCES = wget_css_fuzzer.c $(MAIN)
+wget_css_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
 wget_ftpls_fuzzer_SOURCES = wget_ftpls_fuzzer.c $(MAIN)
 wget_ftpls_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
 
@@ -51,9 +58,18 @@ wget_html_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
 wget_netrc_fuzzer_SOURCES = wget_netrc_fuzzer.c $(MAIN)
 wget_netrc_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
 
+wget_ntlm_fuzzer_SOURCES = wget_ntlm_fuzzer.c $(MAIN)
+wget_ntlm_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
 wget_options_fuzzer_SOURCES = wget_options_fuzzer.c $(MAIN)
 wget_options_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
 
+wget_progress_fuzzer_SOURCES = wget_progress_fuzzer.c $(MAIN)
+wget_progress_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
+wget_read_hunk_fuzzer_SOURCES = wget_read_hunk_fuzzer.c $(MAIN)
+wget_read_hunk_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
+
 wget_robots_fuzzer_SOURCES = wget_robots_fuzzer.c $(MAIN)
 wget_robots_fuzzer_LDADD = ../src/libunittest.a $(LDADD)
 
@@ -74,7 +90,7 @@ clean-local:
 
 oss-fuzz:
 	if test "$$OUT" != ""; then \
-	XLIBS="-lpsl -lgnutls -lnettle -lhogweed -lidn2 -lunistring"; \
+	XLIBS="-lpsl -lgnutls -lhogweed -lnettle -lidn2 -lunistring"; \
 	for ccfile in wget*_fuzzer.c; do \
 	fuzzer=$$(basename $$ccfile .c); \
 	$$CXX $$CXXFLAGS -I$(top_srcdir)/src -I$(top_srcdir) -I$(top_srcdir)/lib \

fuzz/README.md

@@ -14,21 +14,22 @@ regression testing with top dir 'make check' or 'make check-valgrind'.
 
 Use the following commands on top dir:
 ```
-export CC=clang-6.0
+export CC=clang
-export CXX=clang++-6.0
+export CXX=clang++
 # address sanitizer:
-export CFLAGS="-O1 -g -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=undefined,integer,nullability -fsanitize=address -fsanitize-address-use-after-scope -fsanitize-coverage=trace-pc-guard,trace-cmp"
+#export CFLAGS="-O1 -g -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=undefined,integer,nullability -fsanitize=address -fsanitize-address-use-after-scope -fsanitize-coverage=trace-pc-guard,trace-cmp"
+export CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=undefined -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link"
 # undefined sanitizer;
 export CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fno-sanitize-recover=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fsanitize=fuzzer-no-link"
 export CXXFLAGS="$CFLAGS -stdlib=libc++"
 export LIB_FUZZING_ENGINE="-lFuzzer -lstdc++"
-./configure --enable-fuzzing --without-metalink --without-zlib --disable-pcre --without-libuuid
+./configure --enable-fuzzing --without-metalink --without-zlib --disable-pcre --without-libuuid --enable-assert
 make clean
 make -j$(nproc)
 cd fuzz
 
 # run wget_options_fuzzer
-UBSAN_OPTIONS=print_stacktrace=1 ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-6.0/bin/llvm-symbolizer \
+UBSAN_OPTIONS=print_stacktrace=1 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \
   ./run-clang.sh wget_options_fuzzer
 ```
 

fuzz/fuzzer.h

@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2017-2018 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2020 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *
@@ -20,6 +20,16 @@
 #include <stddef.h> // size_t
 #include <stdint.h> // uint8_t
 
+#define CLOSE_STDERR \
+	int bak = dup(STDERR_FILENO); \
+	int fd = open("/dev/null", O_WRONLY); \
+	dup2(fd, STDERR_FILENO); \
+	close(fd);
+
+#define RESTORE_STDERR \
+	dup2(bak, STDERR_FILENO); \
+	close(bak);
+
 #ifdef __cplusplus
 extern "C"
 #endif

fuzz/get_ossfuzz_corpora

@@ -23,10 +23,10 @@ fuzzer=$1
 project=wget
 
 # sync/copy the OSS-Fuzz corpora into the .new directory
-mkdir -p ${fuzzer}.new
+mkdir -p ${fuzzer}.in ${fuzzer}.new
-cp -fp ${fuzzer}.in/* ${fuzzer}.new
+cp -fp ${fuzzer}.in/* ${fuzzer}.new 2>/dev/null || true
-gsutil cp $(gsutil ls gs://${project}-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/${fuzzer}|tail -n 1) ${fuzzer}.new
+gsutil cp $(gsutil ls gs://${project}-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/${fuzzer}|tail -n 1) ${fuzzer}.new/
-(cd ${fuzzer}.new && unzip -q -f -o *.zip && rm *.zip)
+(cd ${fuzzer}.new && unzip -q -o *.zip && rm *.zip)
 
 # create fuzzer target
 BUILD_ONLY=1 ./run-clang.sh ${fuzzer}

fuzz/glob_crash.c

@@ -1,4 +1,22 @@
 /*
+ * Copyright (c) 2017-2020 Free Software Foundation, Inc.
+ *
+ * This file is part of GNU Wget.
+ *
+ * GNU Wget is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GNU Wget is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Wget.  If not, see <https://www.gnu.org/licenses/>.
+
+
  * Created 19.10.2017 by Tim Rühsen
  *
  * Call glob() using data from fuzzer crash file

fuzz/main.c

@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2017-2018 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2020 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *
@@ -54,6 +54,7 @@ static int test_all_from(const char *dirname)
 			struct file_memory *fmem;
 			if ((fmem = wget_read_file(fname))) {
 				printf("testing %ld bytes from '%s'\n", fmem->length, fname);
+				fflush(stdout);
 				LLVMFuzzerTestOneInput((uint8_t *)fmem->content, fmem->length);
 				wget_read_file_free(fmem);
 			}
@@ -87,10 +88,12 @@ int main(int argc, char **argv)
 		return system(cmd) != 0;
 	}
 
-	if ((target = strrchr(argv[0], SLASH)))
+	if ((target = strrchr(argv[0], SLASH))) {
+		if (strrchr(target, '/'))
 			target = strrchr(target, '/');
-	else
+	} else
 		target = strrchr(argv[0], '/');
+
 	target = target ? target + 1 : argv[0];
 
 	if (strncmp(target, "lt-", 3) == 0)

fuzz/run-afl.sh

@@ -1,6 +1,6 @@
 #!/bin/sh -eu
 
-# Copyright(c) 2017 Free Software Foundation, Inc.
+# Copyright (c) 2017, 2019-2020 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #

fuzz/run-clang.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 #
-# Copyright(c) 2017 Free Software Foundation, Inc.
+# Copyright (c) 2017, 2019-2020 Free Software Foundation, Inc.
 #
 # This file is part of GNU Wget.
 #

fuzz/wget_cookie_fuzzer.c

@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2017-2018 Free Software Foundation, Inc.
+ * Copyright (c) 2017-2020 Free Software Foundation, Inc.
  *
  * This file is part of GNU Wget.
  *
@@ -25,6 +25,8 @@
 #include <stdio.h>  // fmemopen
 #include <string.h>  // strncmp
 #include <stdlib.h>  // free
+#include <fcntl.h>  // open flags
+#include <unistd.h>  // close
 
 #include "wget.h"
 #undef fopen_wgetrc
@@ -60,15 +62,10 @@ FILE *fopen_wgetrc(const char *pathname, const char *mode)
 void exit_wget(int status)
 {
 }
-#else
-void exit(int status)
-{
-}
 #endif
 
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
-	FILE *bak;
 	struct cookie_jar *cookie_jar;
 	char *set_cookie;
 
@@ -79,8 +76,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	memcpy(set_cookie, data, size);
 	set_cookie[size] = 0;
 
-	bak = stderr;
+	CLOSE_STDERR
-	stderr = fopen("/dev/null", "w");
 
 	cookie_jar = cookie_jar_new();
 	cookie_handle_set_cookie(cookie_jar, "x", 81, "p", set_cookie);
@@ -88,8 +84,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	cookie_handle_set_cookie(cookie_jar, "x", 80, "p/d/", set_cookie);
 	cookie_jar_delete(cookie_jar);
 
-	fclose(stderr);
+	RESTORE_STDERR
-	stderr = bak;
 
 	free(set_cookie);
 

fuzz/wget_cookie_fuzzer.in/00026b85ea15a4c308623a853ece6a5211a2f731

@@ -0,0 +1 @@
+??????

fuzz/wget_cookie_fuzzer.in/0035f59e3bcb8762bcfee361e1ff93eca136fe00

@@ -1 +0,0 @@
-__Host-ID=x; expires=MoHos__Host-ID=x; expires=Mon, 29 Feb 2016 07:48:97 GMT; mh=/; domain=x.y; httponly; sec__Host-ID=x; expires=Mon, 29 Feb 2016 07:48:97 GMT; mh=/; domain=x.y; htut-ID=x; expires=Mon, 29 Feb 2016 07:48:97 GMT; mh=/; domain=x.y; hture

fuzz/wget_cookie_fuzzer.in/004537f3b1fd67347489185a1c4b55da58f6edca

@@ -0,0 +1 @@
+AAAAAAAAAAA

fuzz/wget_cookie_fuzzer.in/00b01919bd46e340101151ca756a8ec9380110d6

@@ -1 +0,0 @@
-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDNDDDDD廛max-ageDDDDDD'DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD僖DDDDDhttponlyDDDDDDDDDDDDDDDDDDD;

fuzz/wget_cookie_fuzzer.in/00b3bdd8fd5720714adc4522840c12d3a7fcc189

@@ -0,0 +1 @@
+]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

fuzz/wget_cookie_fuzzer.in/00e41b1326bbfab11b96affe7aba03085f444dd9

@@ -0,0 +1 @@
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

fuzz/wget_cookie_fuzzer.in/00e7c21c288cf850c7e4587c063c206d0a79933b

@@ -0,0 +1 @@
+¦=;e;x;Õ;e;e;r;s;„;A;r;y

fuzz/wget_cookie_fuzzer.in/011b4abb980285acc4ffcb6f28eb13b26a815420

@@ -1 +0,0 @@
-__Hos_o=;;yõ=m;tmID=m;=;y=m;y=m;<;yõ=‚m;tmID=m;

fuzz/wget_cookie_fuzzer.in/011f7cd59ed6793e828f6ed8683bba1dab177049

@@ -0,0 +1 @@
+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

fuzz/wget_cookie_fuzzer.in/015362e418005760f4012c4053a0fbf9c45310d8

@@ -1 +0,0 @@
-__expires=x; expires=Mon, 14 4032 07:48Mon, 14 4032 07:48:5$ GMT; stmID=x; expires=Mon, 14 4000 07:48:54 GMT; matp=x; expires=Mon, 43 4032 07:48:5$ G032 07:48:27 GMT; stm 14 4000 07ÅË8:54 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%GMT; m:48:54 GMT; stmI»D=x; e|pires=Mon, 14 4000 07ID=x; expires=Mon, 07 4032 07:48:5$ GMT; stmID=x; expin, 14 4032 07:48:5$ GMT; stmID=x; expires=Mon, 14 4000 07:48:54 GMT; matp=x; expires=Mon, 14 4032 07:48:5$ G!32 07:48:54 GMT; stm 14 4000 07ÅË8:54 GMT; m:48:54 GMT; stmI»n4 1, 4032 07:48:5$ GMT; stmID=x; expcure

fuzz/wget_cookie_fuzzer.in/01574bf1ccc14de2346f11653cbd9512f75adbaa

@@ -0,0 +1 @@
+]=;max-age=3;max-age=4;max-age=8;max-age=3;max-age=4;max-age=8

fuzz/wget_cookie_fuzzer.in/0174106d1fbbef9a747de148b506d6b88ffb10e8

@@ -1,2 +0,0 @@
-__H@=xqqqqqqqqqqqqqqqqq*qqqqqqFpath=; secure
-x-age; secure

fuzz/wget_cookie_fuzzer.in/0182e22e3e3ee81d273f6feaed8630c39a3bf3b0

@@ -1 +0,0 @@
-_dict=libwget_cookie_fuzzer.dmutate_depth                                                        _e=;Ä;Ø;;;;Ø;;;;Ä;=;;Ø;;;;Ä;=;__Host-I@=x; expires=Mon, 29 Feb@=x; expir                    st-016 07:48es=Mon, 28 Feb 2016 07::54 GMT;"max-48:

fuzz/wget_cookie_fuzzer.in/018f4d7f06cb8626e1756452581373e05ae41c56

@@ -0,0 +1 @@
+xxxxxx

fuzz/wget_cookie_fuzzer.in/01b626290786f7603b771ab34697a4efdc0756bf

@@ -0,0 +1 @@
+```````````````````````````````````````````

fuzz/wget_cookie_fuzzer.in/01cc44f3312eafab893506b616dee3c0d8431e1f

@@ -0,0 +1 @@
+***************************************************************************************************************************************************************************

fuzz/wget_cookie_fuzzer.in/01d94a6f21b47b294553d412889a784d3553cf6f

@@ -0,0 +1 @@
+

fuzz/wget_cookie_fuzzer.in/01f38c837feea81ed7f4b31933ced507ae134664

@@ -1 +0,0 @@
-_use¡’<>šÂÊà pa<70>h=_Host-ID=xGMT; max-age=5; pa<70>h=ÑÄß›<C39F>’ž•n=x.y; httpomax-agecure

fuzz/wget_cookie_fuzzer.in/0242325df3c4091ac99566dc6d59a1e20f20ebe0

@@ -1 +0,0 @@
-*=';:n*='d

fuzz/wget_cookie_fuzzer.in/0267987c41022bd8ea085cc77d08958e464248a6

@@ -1 +0,0 @@
-__Host-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=29 Feb 2016 10:48:54 GMT; max-age=5; p; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=58 Feb 2016 10:48:54 GMT; max-age=5; pathomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-IDBx; exp=x.y; athomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-IDBx; expires=29 Feb 2016 07:48:54 GMT; max-age=5; pathomai;ost-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=2; Feb 2016 10:48:5: GMT; max-age=5; pathomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=29 Feb 2096 07:48:54 GMT; max-age=5; pathomai;=x.y; httponly

fuzz/wget_cookie_fuzzer.in/026c61993a82946f6cdbd27e366a02f826519f32

@@ -0,0 +1 @@
+OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

fuzz/wget_cookie_fuzzer.in/029aa48342e903da8be6b70a5e75ac30a5835645

@@ -0,0 +1 @@
+*
=;*
=;*!=;*#=;*_=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*ﾋ=;*ｪ=;*_=;*!=;*#=;*#=;*_=;*
=;*ﾋ=;*_=;*!=;*#=;*_=;*@=;*W=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*ﾚ=;*@=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*ﾚ=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*_=;*ﾋ=;*_=;*p=;*_=;*_=;*ﾋ=;*_=;*ﾋ=;*_=;*!=;*_=;*ﾋ=;*_=;*!=;*#=;*_=;*ﾚ=;*_=;*!=;*#=;*_=;*ﾋ=;*_=;*_=;*p=;*_=;*_=;*#=;*ｽ=

fuzz/wget_cookie_fuzzer.in/02aa629c8b16cd17a44f3a0efec2feed43937642

@@ -0,0 +1 @@
+S

fuzz/wget_cookie_fuzzer.in/02d317a10470e3bc81c7a07caadf3983e125dafe

@@ -1 +0,0 @@
-xexpires= domain==/; domain==/; domain=th=/; domain=th=/; domain=th=/; domain==/; domain=th=/; domain==/; domain=th=/; domain==/; domain=ht=/; domain==/; domain=th=/; domain==/; domain=th=/expires=; domain==/; domain=th=/;omain==/;*=/; >domain=h=/; domain==/; doamin==/; doiain=th=/; domain=th=/:; domain=th=/; domain==/; domain=th=/; dom'ain==/; domain=th=/; domain==/; domain=th=/; ƒƒƒƒƒƒƒdomain==/; domain=th=/; domai=th=/; domain
 ==/; domain=th=/expires=; domain==/; domain=th=/;omain==/; domain=th=/; domain==/; domain=th=/expires=; domainy=

fuzz/wget_cookie_fuzzer.in/02d4d85c3221e9ec21b09090ed4076ffa41e7f40

@@ -0,0 +1 @@
+BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

fuzz/wget_cookie_fuzzer.in/0301121ca4abf006066d499ea7c366f511cfaeef

@@ -1 +0,0 @@
-_httpominimize_crash16 07:48??¿??????????????????????????????????,,,,,,,,,,6:48??¿????????????????????????expires=??????????,,,,,,,,,,,,,,ŠŠŠŠŠŠŠŠŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,???????54 GMT;‹ max-age=5; paagominimize_crash16 07:48??¿????????????;?????????????????????,,,,,,,,,,7:48??¿????????????????????????expires=??????????,,,,,,,,,,,,,,ŠŠŠŠŠŠŠŠŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,???????5path=2 GMT;‹ max-age=5; paagŠŠŠŠŠŠŠŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,l,,,???????54 GMT;‹ ŠŠŠ,,,,,,,,,,,,,,,,,,,,,,,,,l,,,???????54 GMT;‹ge=5=x.ÿÿÿly; sñcure

fuzz/wget_cookie_fuzzer.in/0343bb07c98f8a943e8eb80c0ba3d9758d372d22

@@ -0,0 +1 @@
+oo

fuzz/wget_cookie_fuzzer.in/036cbca628064121b00f73967de378ab5af995ec

@@ -1,2 +0,0 @@
-_ÿÿÿÿÿÿ
-ä=x; expi!res=-86148:54 =x; expires=-43855 Feb 6119 07:48:0Tx; expires=-437708 Feb 6120 07:48:54 8:54 =x; expires=-86148:54 =x; expires=-43855 Feb 6119 07:48:5Tx; expires=-437708 Feb 6120 07:48:54 8:54 =x; expires=-43855 Feb 6119 07:48:5TxC; expires=-437708 Feb 120 07:48:54 =b 6119 07:48:5Tx; expires=-218854 Feb 6120 07:48:54 =_axost-ID=x; 6120 07:48:54 =st-ID=x; expires=-87708 Feb 6119 07:48:54 =x; expires=3-4855 Feb 6119 07:48:5Tx; emax-age43855 Feb 6119 07:48:5Tx; expires=-437708 Feb 6120 07:48:54 =b 6119 07:48:5Tx; expires=-437708 Feb 6120 07:48:54 48:5Tx; expires=-437708 Feb 6120 07:48:54 =_axost-ID=x; ex88888888888888888888888888888888888888888pires=-c87708 Feb 6119 07:48:54 =x; expires=-43855 Feb 6119 07:48:5Tx; expires=-43855 Feb 611907:48:5T

fuzz/wget_cookie_fuzzer.in/03acba95c4fb641d959ba54a7f991615008a06aa

@@ -1 +0,0 @@
-"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

fuzz/wget_cookie_fuzzer.in/0400588615116f3510881ba1afbb6aa19cf669a4

@@ -0,0 +1 @@
+(=;expires==;expires=i;expires=M;expires=*;expires=*;expires==;expires=M;expires=M;expires=3;expires==;expires=M;expires=*;expires=*;expires==;expires=M;expires=M;expires=MonFeB1 7:4:83¹;expires==;expires=M;expires=*;expires=*;expires=x;expires=M;expires=ª;expires=*;expires==;expires=M;expires=M;expires=3;expires==;expires=M;expires=*;expires=*;expires==;expires=*;expires=M;expires=M;expires=4;expires=<;expires=M;expires=M;expires=E;expires=e

fuzz/wget_cookie_fuzzer.in/042dc4512fa3d391c5170cf3aa61e6a638f84342

@@ -0,0 +1 @@
+i

fuzz/wget_cookie_fuzzer.in/04324ba5551a81097da9fe2166ae876d78b101c2

@@ -1 +0,0 @@
-ě=;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;D;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;mai;Dmaa;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;Dmai;=

fuzz/wget_cookie_fuzzer.in/045240b6e36beb506efe8d0149db18e7cfca8953

@@ -0,0 +1 @@
+PPP

fuzz/wget_cookie_fuzzer.in/04905ec7b4e10e22a940d4b104dc87865dea61ac

@@ -0,0 +1 @@
+4444444444444444444444444444444444444444444

fuzz/wget_cookie_fuzzer.in/0499a0a3f2f4da8697632d5b7af66ec607b06d99

@@ -0,0 +1 @@
+^^

fuzz/wget_cookie_fuzzer.in/04a4c03a45442dad60d0b6dcfd6ed2c2dc0051ff

@@ -0,0 +1 @@
+22222222222222222222222222222222222222222222222222222222222222222222222222222222222222

fuzz/wget_cookie_fuzzer.in/053cf4633784095aabc7160ad1addc72b50637d4

@@ -1 +0,0 @@
-_ÿÿÿÿÿÿ	¤seedANShttponly.;domain=.;_;D=_;domain=.;domain=.;_;;domain=.;domain=.;;;doma=o;id;n.main=.;;d(o'main=.;domainn=.;domain=.;_;Domain=.;(;domain=.=_;domain=.;domain=.;_;;domain=.;domaiQQQQQQQQQQQQQQQQQQQQQQQQQQQQomain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;;;domain=.;d_D=_;domain=.;domain=.;_;n=.;domain=.;;;domain=.;;domain=.;;domain=.;domainain=.;domain=.;_;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;om

fuzz/wget_cookie_fuzzer.in/0542275d96ce647dd77b8478149d05beb623c66f

@@ -1,3 +0,0 @@
-__Host-ID=x; 4032 age=2;HHHHHHdomain=HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHh=l; domain=x.y; httpohttponly; sñcurnly;ýly; seceur
-e
-securd

fuzz/wget_cookie_fuzzer.in/056cd73f9a0d3c579caa3dd1563e7585cc3e8da8

@@ -0,0 +1 @@
+RRRRRRRRRRR

fuzz/wget_cookie_fuzzer.in/05a587d9f2f2968e54714bd3d69250fb2e174796

@@ -1 +0,0 @@
-_o=;=;=;y=;;=;=;;<3B>y=_e=';˙˙ qa<71>h=_Host-ID=xGMT; <20>h=_Host-ID=xGMT; domain=˙˙˙˙˙˙˙httponly; securSSSSSSSSSSSSSSSSnly; securSSSSSÓSSSSSSSSSSSSSSSSSSSSSSSSSSSS;=;=;=SSSSSSSSSS;;=;=;=;y=;=;=;=;;y=;=;=;=;=;=;=;==;=SSSS;=;==SSSSSSSSSSSSSSSSSSSS:SSSe

fuzz/wget_cookie_fuzzer.in/05b5fe2d8ce86bb5bc3b18748631d7ca0bc0a226

@@ -1 +0,0 @@
-_D=_;domain=.;domain=.;domain=.;;;do“ž–“=.;;domain=.;;domain=.;domTTT(TTTTTTTTTTTTTTT*************************************************************************************TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTainn=.;domainin=.;domain=.;;;doman;=o;i.dmain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;om

fuzz/wget_cookie_fuzzer.in/05f16b8bd7eff3186696ccebb0619a115072fdf0

@@ -1 +0,0 @@
-WWhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhghhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

fuzz/wget_cookie_fuzzer.in/06119248771c733c87fcab746323298c440b88b6

@@ -1 +0,0 @@
-__Host-KDFeec)ure

fuzz/wget_cookie_fuzzer.in/06576556d1ad802f247cad11ae748be47b70cd9c

@@ -0,0 +1 @@
+R

fuzz/wget_cookie_fuzzer.in/067d5096f219c64b53bb1c7d5e3754285b565a47

@@ -0,0 +1 @@
+

fuzz/wget_cookie_fuzzer.in/06b2a5c5b0c6dd151756d8fa2d67f179606f95a1

@@ -0,0 +1 @@
+IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII

fuzz/wget_cookie_fuzzer.in/0715e87f643e0f32be2130783123419efc847401

@@ -0,0 +1,18 @@
+	=;
+;
+;
+;
+;
+;;	;
+;
+;
+;
+;;
+;
+;
+;	
+;
+;
+;
+;	
+;

fuzz/wget_cookie_fuzzer.in/071b6a8b895bad8b47b531d14c5f9d9b1eba44a0

@@ -0,0 +1,24 @@
+J="/	path=pires=
+
+
+
+
+
+
+
+
+Jpath=
+
+
+
+
+
+
+
+
+
+
+
+™
+
+

fuzz/wget_cookie_fuzzer.in/0730ab2238e96a8cbec2b1b7efd6c0d49106c136

@@ -0,0 +1 @@
+wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww

fuzz/wget_cookie_fuzzer.in/07962e32beac4da179b30c06f1c1e71bd220f782

@@ -0,0 +1 @@
+nn

fuzz/wget_cookie_fuzzer.in/07991db1702d2aaa50c7c2ffb4c4d630d2906bf5

@@ -0,0 +1 @@
+kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk

fuzz/wget_cookie_fuzzer.in/07aa9b0a17225bfdabfaf2063aef2ddad399737c

@@ -1,2 +0,0 @@
-__Hos__Host-ID__Host-ID=x; expires=Mon, 5=x.y; httpontsecure-IDmain=ontsecureontsecure-ID=x; expires=Mon, 29 Feb 2016UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU«ªªªªªªªUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUax-age=2; pat$=/; x.y; httponly; ly; secure
-secure

fuzz/wget_cookie_fuzzer.in/07c342be6e560e7f43842e2e21b774e61d85f047

@@ -0,0 +1 @@
+l

fuzz/wget_cookie_fuzzer.in/07c9007c7acd7a4dd4268347e91923fc6c3cba76

@@ -1,2 +0,0 @@
-__H@=x@=x; expires=Mon, 29 Femmmmmmmmmmmqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq*qqqqqqFpath=; secure
-x-age; secure

fuzz/wget_cookie_fuzzer.in/07dcd371560bc43c48f56a2f55739ac66741d59d

@@ -0,0 +1 @@
+ggg

fuzz/wget_cookie_fuzzer.in/0829f419cd04b449972ff3adba76ac47f8931a26

@@ -1 +0,0 @@
-__Host-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expiMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM³¨MMMMMMMMMMMMMMMMMMMMMMMMMres=29 Feb 2expires=016 10:48:54 GMT; max-ageGMT; max-age=5; pathomt-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-IDBx; exp=x.y; athomt-ID=x; expires=58 Feb 2016 07:48:54 GMT;t-IDBx; expires=29 Feb 2016 07:48:54 GM;t-IDBx; exp=x.y; athomt-ID=x; expires=29 Fÿÿÿÿÿÿÿÿÿÿeb 2016 07:48:54 GMT;t-IDBx; expires=29 Feb 2016 07:48:54 GMT; max-age=5; pathomai;ost-ID=x; expires=29 FT; max-age=5; pathomai;ost-ID=x; expires=29 Feb 2016 07:48:54 GMT;t-ID=x; expires=2; Feb 2016 10:48:5: GMT; max-age=5; pathomt-ID=x;  max-age=5; pathomai;=x.y; httponly

fuzz/wget_cookie_fuzzer.in/0835ff8a8e4d36d31f38270374016e8b997e5a13

@@ -1 +0,0 @@
-__Host-ID=x; e httponjjjjjjjjjjjjjjjjjjjjzjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjzjjjjjjjjjjjjjjjjjjjjjjjjGMT;Žexpires=n=x.; sec}re

fuzz/wget_cookie_fuzzer.in/08534f33c201a45017b502e90a800f1b708ebcb3

@@ -0,0 +1 @@
+\

fuzz/wget_cookie_fuzzer.in/086340cf2f2ca55d9fe06da3cb24a9150474181b

@@ -1 +0,0 @@
-_D=_;domain=.;domain=.;_;D=_;domain=.;domain=.;_;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domainn=.;domain=.;_;Domain=.;(;domain=.=_;domain=.;domain=.;_;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=.;;;domain=.;d_D=_;domain=.;domain=.;_;D=_;dom_;D=_;domain=.;domain=.;_;;domain=.;domain==_;dom_;D=_;domain=.;domain=.;_;;domain=.;domain=.;;;domain=.;_NNN)NNNNires=M/n,çË4  
F; dNNNNNNNNNNNNNNNNy; ;domain=.;;domain=.;domainn=.;domain=.;_;D=_;domain=.;domain=.;domain=.;;;domain=.;domain=.;;;domain=.;;domain=..;;;domain=.;;domain=.;;domain=.;domainn=.;domain=.;_;D=_;domain=.;domain=.;domain=.;;;domain=.;domain=.;;;domain=.;;domain=.;;domain=.;domainhttp=.;domain=.;;domain=.;;;domain=.;domain=.;domain=.;(;domain=.;m.=ndin=.;;;domain=.;d_D=_;domain=.;domain=.;_;D=_;domain=.;domain=.;_;;doin=.;;;domain=.;domain=.;;;domain=.;;domainin=.;domain=.;domain=.;(;domain=.;;;domain=.;domain=onlyre.;om

fuzz/wget_cookie_fuzzer.in/08740c067691007b065abbfea868fffe188a743a

@@ -0,0 +1 @@
+&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

fuzz/wget_cookie_fuzzer.in/088fb1a4ab057f4fcf7d487006499060c7fe5773

@@ -0,0 +1 @@
+   

fuzz/wget_cookie_fuzzer.in/0899500d67e2311f01b9bdedc81a0ec79c5b6a03

@@ -0,0 +1 @@
+