Blame SOURCES/0008-curl-7.61.1-CVE-2018-20483.patch

f036d1
From 907da069c450ca20442839d9e95e3661a5c06b61 Mon Sep 17 00:00:00 2001
f036d1
From: Daniel Stenberg <daniel@haxx.se>
f036d1
Date: Sun, 5 Aug 2018 11:51:07 +0200
f036d1
Subject: [PATCH 01/14] URL-API
f036d1
f036d1
See header file and man pages for API. All documented API details work
f036d1
and are tested in the 1560 test case.
f036d1
f036d1
Closes #2842
f036d1
f036d1
Upstream-commit: fb30ac5a2d63773c529c19259754e2b306ac2e2e
f036d1
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
f036d1
---
f036d1
 docs/libcurl/Makefile.inc        |    1 +
f036d1
 docs/libcurl/curl_url.3          |   61 ++
f036d1
 docs/libcurl/curl_url_cleanup.3  |   44 +
f036d1
 docs/libcurl/curl_url_dup.3      |   52 ++
f036d1
 docs/libcurl/curl_url_get.3      |  110 +++
f036d1
 docs/libcurl/curl_url_set.3      |  120 +++
f036d1
 docs/libcurl/symbols-in-versions |   30 +
f036d1
 include/curl/Makefile.am         |    4 +-
f036d1
 include/curl/curl.h              |    1 +
f036d1
 include/curl/urlapi.h            |  121 +++
f036d1
 lib/Makefile.inc                 |    5 +-
f036d1
 lib/escape.c                     |   20 +-
f036d1
 lib/escape.h                     |    3 +-
f036d1
 lib/imap.c                       |    3 +-
f036d1
 lib/transfer.c                   |  314 +------
f036d1
 lib/url.c                        |   44 +-
f036d1
 lib/url.h                        |    2 +
f036d1
 lib/{escape.h => urlapi-int.h}   |   22 +-
f036d1
 lib/urlapi.c                     | 1315 ++++++++++++++++++++++++++++++
f036d1
 tests/data/Makefile.inc          |    2 +
f036d1
 tests/data/test1560              |   28 +
f036d1
 tests/libtest/Makefile.am        |    5 +
f036d1
 tests/libtest/Makefile.inc       |    4 +
f036d1
 tests/libtest/lib1560.c          |  760 +++++++++++++++++
f036d1
 24 files changed, 2716 insertions(+), 355 deletions(-)
f036d1
 create mode 100644 docs/libcurl/curl_url.3
f036d1
 create mode 100644 docs/libcurl/curl_url_cleanup.3
f036d1
 create mode 100644 docs/libcurl/curl_url_dup.3
f036d1
 create mode 100644 docs/libcurl/curl_url_get.3
f036d1
 create mode 100644 docs/libcurl/curl_url_set.3
f036d1
 create mode 100644 include/curl/urlapi.h
f036d1
 copy lib/{escape.h => urlapi-int.h} (66%)
f036d1
 create mode 100644 lib/urlapi.c
f036d1
 create mode 100644 tests/data/test1560
f036d1
 create mode 100644 tests/libtest/lib1560.c
f036d1
f036d1
diff --git a/docs/libcurl/Makefile.inc b/docs/libcurl/Makefile.inc
f036d1
index eea48c4..955492c 100644
f036d1
--- a/docs/libcurl/Makefile.inc
f036d1
+++ b/docs/libcurl/Makefile.inc
f036d1
@@ -22,4 +22,5 @@ man_MANS = curl_easy_cleanup.3 curl_easy_getinfo.3 curl_easy_init.3      \
f036d1
   curl_mime_data.3 curl_mime_data_cb.3 curl_mime_filedata.3              \
f036d1
   curl_mime_filename.3 curl_mime_subparts.3                              \
f036d1
   curl_mime_type.3 curl_mime_headers.3 curl_mime_encoder.3 libcurl-env.3 \
f036d1
+  curl_url.3 curl_url_cleanup.3 curl_url_dup.3 curl_url_get.3 curl_url_set.3 \
f036d1
   libcurl-security.3
f036d1
diff --git a/docs/libcurl/curl_url.3 b/docs/libcurl/curl_url.3
f036d1
new file mode 100644
f036d1
index 0000000..0a56264
f036d1
--- /dev/null
f036d1
+++ b/docs/libcurl/curl_url.3
f036d1
@@ -0,0 +1,61 @@
f036d1
+.\" **************************************************************************
f036d1
+.\" *                                  _   _ ____  _
f036d1
+.\" *  Project                     ___| | | |  _ \| |
f036d1
+.\" *                             / __| | | | |_) | |
f036d1
+.\" *                            | (__| |_| |  _ <| |___
f036d1
+.\" *                             \___|\___/|_| \_\_____|
f036d1
+.\" *
f036d1
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+.\" *
f036d1
+.\" * This software is licensed as described in the file COPYING, which
f036d1
+.\" * you should have received as part of this distribution. The terms
f036d1
+.\" * are also available at https://curl.haxx.se/docs/copyright.html.
f036d1
+.\" *
f036d1
+.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
f036d1
+.\" * copies of the Software, and permit persons to whom the Software is
f036d1
+.\" * furnished to do so, under the terms of the COPYING file.
f036d1
+.\" *
f036d1
+.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
f036d1
+.\" * KIND, either express or implied.
f036d1
+.\" *
f036d1
+.\" **************************************************************************
f036d1
+.TH curl_url 3 "6 Aug 2018" "libcurl" "libcurl Manual"
f036d1
+.SH NAME
f036d1
+curl_url - returns a new CURLU handle
f036d1
+.SH SYNOPSIS
f036d1
+.B #include <curl/curl.h>
f036d1
+
f036d1
+CURLU *curl_url();
f036d1
+.SH EXPERIMENTAL
f036d1
+The URL API is considered \fBEXPERIMENTAL\fP until further notice. Please test
f036d1
+it, report bugs and help us perfect it. Once proven to be reliable, the
f036d1
+experimental label will be removed.
f036d1
+
f036d1
+While this API is marked experimental, we reserve the right to modify the API
f036d1
+slightly if we deem it necessary and it makes it notably better or easier to
f036d1
+use.
f036d1
+.SH DESCRIPTION
f036d1
+This function will allocates and returns a pointer to a fresh CURLU handle, to
f036d1
+be used for further use of the URL API.
f036d1
+.SH RETURN VALUE
f036d1
+Returns a \fBCURLU *\fP if successful, or NULL if out of memory.
f036d1
+.SH EXAMPLE
f036d1
+.nf
f036d1
+  CURLUcode rc;
f036d1
+  CURLU *url = curl_url();
f036d1
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
f036d1
+  if(!rc) {
f036d1
+    char *scheme;
f036d1
+    rc = curl_url_get(url, CURLUPART_SCHEME, &scheme, 0);
f036d1
+    if(!rc) {
f036d1
+      printf("the scheme is %s\n", scheme);
f036d1
+      curl_free(scheme);
f036d1
+    }
f036d1
+    curl_url_cleanup(url);
f036d1
+  }
f036d1
+.fi
f036d1
+.SH AVAILABILITY
f036d1
+Added in curl 7.63.0
f036d1
+.SH "SEE ALSO"
f036d1
+.BR curl_url_cleanup "(3), " curl_url_get "(3), " curl_url_set "(3), "
f036d1
+.BR curl_url_dup "(3), "
f036d1
diff --git a/docs/libcurl/curl_url_cleanup.3 b/docs/libcurl/curl_url_cleanup.3
f036d1
new file mode 100644
f036d1
index 0000000..a8158b7
f036d1
--- /dev/null
f036d1
+++ b/docs/libcurl/curl_url_cleanup.3
f036d1
@@ -0,0 +1,44 @@
f036d1
+.\" **************************************************************************
f036d1
+.\" *                                  _   _ ____  _
f036d1
+.\" *  Project                     ___| | | |  _ \| |
f036d1
+.\" *                             / __| | | | |_) | |
f036d1
+.\" *                            | (__| |_| |  _ <| |___
f036d1
+.\" *                             \___|\___/|_| \_\_____|
f036d1
+.\" *
f036d1
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+.\" *
f036d1
+.\" * This software is licensed as described in the file COPYING, which
f036d1
+.\" * you should have received as part of this distribution. The terms
f036d1
+.\" * are also available at https://curl.haxx.se/docs/copyright.html.
f036d1
+.\" *
f036d1
+.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
f036d1
+.\" * copies of the Software, and permit persons to whom the Software is
f036d1
+.\" * furnished to do so, under the terms of the COPYING file.
f036d1
+.\" *
f036d1
+.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
f036d1
+.\" * KIND, either express or implied.
f036d1
+.\" *
f036d1
+.\" **************************************************************************
f036d1
+.TH curl_url_cleanup 3 "6 Aug 2018" "libcurl" "libcurl Manual"
f036d1
+.SH NAME
f036d1
+curl_url_cleanup - free a CURLU handle
f036d1
+.SH SYNOPSIS
f036d1
+.B #include <curl/curl.h>
f036d1
+
f036d1
+void curl_url_cleanup(CURLU *handle);
f036d1
+.fi
f036d1
+.SH DESCRIPTION
f036d1
+Frees all the resources associated with the given CURLU handle!
f036d1
+.SH RETURN VALUE
f036d1
+none
f036d1
+.SH EXAMPLE
f036d1
+.nf
f036d1
+  CURLU *url = curl_url();
f036d1
+  curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
f036d1
+  curl_url_cleanup(url);
f036d1
+.fi
f036d1
+.SH AVAILABILITY
f036d1
+Added in curl 7.63.0
f036d1
+.SH "SEE ALSO"
f036d1
+.BR curl_url_dup "(3), " curl_url "(3), " curl_url_set "(3), "
f036d1
+.BR curl_url_get "(3), "
f036d1
diff --git a/docs/libcurl/curl_url_dup.3 b/docs/libcurl/curl_url_dup.3
f036d1
new file mode 100644
f036d1
index 0000000..4815dbd
f036d1
--- /dev/null
f036d1
+++ b/docs/libcurl/curl_url_dup.3
f036d1
@@ -0,0 +1,52 @@
f036d1
+.\" **************************************************************************
f036d1
+.\" *                                  _   _ ____  _
f036d1
+.\" *  Project                     ___| | | |  _ \| |
f036d1
+.\" *                             / __| | | | |_) | |
f036d1
+.\" *                            | (__| |_| |  _ <| |___
f036d1
+.\" *                             \___|\___/|_| \_\_____|
f036d1
+.\" *
f036d1
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+.\" *
f036d1
+.\" * This software is licensed as described in the file COPYING, which
f036d1
+.\" * you should have received as part of this distribution. The terms
f036d1
+.\" * are also available at https://curl.haxx.se/docs/copyright.html.
f036d1
+.\" *
f036d1
+.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
f036d1
+.\" * copies of the Software, and permit persons to whom the Software is
f036d1
+.\" * furnished to do so, under the terms of the COPYING file.
f036d1
+.\" *
f036d1
+.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
f036d1
+.\" * KIND, either express or implied.
f036d1
+.\" *
f036d1
+.\" **************************************************************************
f036d1
+.TH curl_url_dup 3 "6 Aug 2018" "libcurl" "libcurl Manual"
f036d1
+.SH NAME
f036d1
+curl_url_dup - duplicate a CURLU handle
f036d1
+.SH SYNOPSIS
f036d1
+.B #include <curl/curl.h>
f036d1
+
f036d1
+CURLU *curl_url_dup(CURLU *inhandle);
f036d1
+.fi
f036d1
+.SH DESCRIPTION
f036d1
+Duplicates a given CURLU \fIinhandle\fP and all its contents and returns a
f036d1
+pointer to a new CURLU handle. The new handle also needs to be freed with
f036d1
+\fIcurl_url_cleanup(3)\fP.
f036d1
+.SH RETURN VALUE
f036d1
+Returns a new handle or NULL if out of memory.
f036d1
+.SH EXAMPLE
f036d1
+.nf
f036d1
+  CURLUcode rc;
f036d1
+  CURLU *url = curl_url();
f036d1
+  CURLU *url2;
f036d1
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
f036d1
+  if(!rc) {
f036d1
+    url2 = curl_url_dup(url); /* clone it! */
f036d1
+    curl_url_cleanup(url2);
f036d1
+  }
f036d1
+  curl_url_cleanup(url);
f036d1
+.fi
f036d1
+.SH AVAILABILITY
f036d1
+Added in curl 7.63.0
f036d1
+.SH "SEE ALSO"
f036d1
+.BR curl_url_cleanup "(3), " curl_url "(3), " curl_url_set "(3), "
f036d1
+.BR curl_url_get "(3), "
f036d1
diff --git a/docs/libcurl/curl_url_get.3 b/docs/libcurl/curl_url_get.3
f036d1
new file mode 100644
f036d1
index 0000000..824d496
f036d1
--- /dev/null
f036d1
+++ b/docs/libcurl/curl_url_get.3
f036d1
@@ -0,0 +1,110 @@
f036d1
+.\" **************************************************************************
f036d1
+.\" *                                  _   _ ____  _
f036d1
+.\" *  Project                     ___| | | |  _ \| |
f036d1
+.\" *                             / __| | | | |_) | |
f036d1
+.\" *                            | (__| |_| |  _ <| |___
f036d1
+.\" *                             \___|\___/|_| \_\_____|
f036d1
+.\" *
f036d1
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+.\" *
f036d1
+.\" * This software is licensed as described in the file COPYING, which
f036d1
+.\" * you should have received as part of this distribution. The terms
f036d1
+.\" * are also available at https://curl.haxx.se/docs/copyright.html.
f036d1
+.\" *
f036d1
+.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
f036d1
+.\" * copies of the Software, and permit persons to whom the Software is
f036d1
+.\" * furnished to do so, under the terms of the COPYING file.
f036d1
+.\" *
f036d1
+.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
f036d1
+.\" * KIND, either express or implied.
f036d1
+.\" *
f036d1
+.\" **************************************************************************
f036d1
+.TH curl_url_get 3 "6 Aug 2018" "libcurl" "libcurl Manual"
f036d1
+.SH NAME
f036d1
+curl_url_get - extract a part from a URL
f036d1
+.SH SYNOPSIS
f036d1
+.B #include <curl/curl.h>
f036d1
+
f036d1
+.nf
f036d1
+CURLUcode curl_url_get(CURLU *url,
f036d1
+                       CURLUPart what,
f036d1
+                       char **part,
f036d1
+                       unsigned int flags)
f036d1
+.fi
f036d1
+.SH DESCRIPTION
f036d1
+Given the \fIurl\fP handle of an already parsed URL, this function lets the
f036d1
+user extract individual pieces from it.
f036d1
+
f036d1
+The \fIwhat\fP argument should be the particular part to extract (see list
f036d1
+below) and \fIpart\fP points to a 'char *' to get updated to point to a newly
f036d1
+allocated string with the contents.
f036d1
+
f036d1
+The \fIflags\fP argument is a bitmask with individual features.
f036d1
+
f036d1
+The returned part pointer must be freed with \fIcurl_free(3)\fP after use.
f036d1
+.SH FLAGS
f036d1
+The flags argument is zero, one or more bits set in a bitmask.
f036d1
+.IP CURLU_DEFAULT_PORT
f036d1
+If the handle has no port stored, this option will make \fIcurl_url_get(3)\fP
f036d1
+return the default port for the used scheme.
f036d1
+.IP CURLU_DEFAULT_SCHEME
f036d1
+If the handle has no scheme stored, this option will make
f036d1
+\fIcurl_url_get(3)\fP return the default scheme instead of error.
f036d1
+.IP CURLU_NO_DEFAULT_PORT
f036d1
+Instructs \fIcurl_url_get(3)\fP to not return a port number if it matches the
f036d1
+default port for the scheme.
f036d1
+.IP CURLU_URLDECODE
f036d1
+Asks \fIcurl_url_get(3)\fP to URL decode the contents before returning it. It
f036d1
+will not attempt to decode the scheme, the port number or the full URL.
f036d1
+
f036d1
+The query component will also get plus-to-space convertion as a bonus when
f036d1
+this bit is set.
f036d1
+
f036d1
+Note that this URL decoding is charset unaware and you will get a zero
f036d1
+terminated string back with data that could be intended for a particular
f036d1
+encoding.
f036d1
+
f036d1
+If there's any byte values lower than 32 in the decoded string, the get
f036d1
+operation will return an error instead.
f036d1
+.SH PARTS
f036d1
+.IP CURLUPART_URL
f036d1
+When asked to return the full URL, \fIcurl_url_get(3)\fP will return a
f036d1
+normalized and possibly cleaned up version of what was previously parsed.
f036d1
+.IP CURLUPART_SCHEME
f036d1
+Scheme cannot be URL decoded on get.
f036d1
+.IP CURLUPART_USER
f036d1
+.IP CURLUPART_PASSWORD
f036d1
+.IP CURLUPART_OPTIONS
f036d1
+.IP CURLUPART_HOST
f036d1
+.IP CURLUPART_PORT
f036d1
+Port cannot be URL decoded on get.
f036d1
+.IP CURLUPART_PATH
f036d1
+.IP CURLUPART_QUERY
f036d1
+The query part will also get pluses converted to space when asked to URL
f036d1
+decode on get with the CURLU_URLDECODE bit.
f036d1
+.IP CURLUPART_FRAGMENT
f036d1
+.SH RETURN VALUE
f036d1
+Returns a CURLUcode error value, which is CURLUE_OK (0) if everything went
f036d1
+fine.
f036d1
+
f036d1
+If this function returns an error, no URL part is returned.
f036d1
+.SH EXAMPLE
f036d1
+.nf
f036d1
+  CURLUcode rc;
f036d1
+  CURLU *url = curl_url();
f036d1
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
f036d1
+  if(!rc) {
f036d1
+    char *scheme;
f036d1
+    rc = curl_url_get(url, CURLUPART_SCHEME, &scheme, 0);
f036d1
+    if(!rc) {
f036d1
+      printf("the scheme is %s\n", scheme);
f036d1
+      curl_free(scheme);
f036d1
+    }
f036d1
+    curl_url_cleanup(url);
f036d1
+  }
f036d1
+.fi
f036d1
+.SH AVAILABILITY
f036d1
+Added in curl 7.63.0
f036d1
+.SH "SEE ALSO"
f036d1
+.BR curl_url_cleanup "(3), " curl_url "(3), " curl_url_set "(3), "
f036d1
+.BR curl_url_dup "(3), "
f036d1
diff --git a/docs/libcurl/curl_url_set.3 b/docs/libcurl/curl_url_set.3
f036d1
new file mode 100644
f036d1
index 0000000..75fc0d9
f036d1
--- /dev/null
f036d1
+++ b/docs/libcurl/curl_url_set.3
f036d1
@@ -0,0 +1,120 @@
f036d1
+.\" **************************************************************************
f036d1
+.\" *                                  _   _ ____  _
f036d1
+.\" *  Project                     ___| | | |  _ \| |
f036d1
+.\" *                             / __| | | | |_) | |
f036d1
+.\" *                            | (__| |_| |  _ <| |___
f036d1
+.\" *                             \___|\___/|_| \_\_____|
f036d1
+.\" *
f036d1
+.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+.\" *
f036d1
+.\" * This software is licensed as described in the file COPYING, which
f036d1
+.\" * you should have received as part of this distribution. The terms
f036d1
+.\" * are also available at https://curl.haxx.se/docs/copyright.html.
f036d1
+.\" *
f036d1
+.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
f036d1
+.\" * copies of the Software, and permit persons to whom the Software is
f036d1
+.\" * furnished to do so, under the terms of the COPYING file.
f036d1
+.\" *
f036d1
+.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
f036d1
+.\" * KIND, either express or implied.
f036d1
+.\" *
f036d1
+.\" **************************************************************************
f036d1
+.TH curl_url_set 3 "6 Aug 2018" "libcurl" "libcurl Manual"
f036d1
+.SH NAME
f036d1
+curl_url_set - set a part from a URL
f036d1
+.SH SYNOPSIS
f036d1
+.B #include <curl/curl.h>
f036d1
+
f036d1
+CURLUcode curl_url_set(CURLU *url,
f036d1
+                       CURLUPart part,
f036d1
+                       const char *content,
f036d1
+                       unsigned int flags)
f036d1
+.fi
f036d1
+.SH DESCRIPTION
f036d1
+Given the \fIurl\fP handle of an already parsed URL, this function lets the
f036d1
+user set/update individual pieces of it.
f036d1
+
f036d1
+The \fIpart\fP argument should identify the particular URL part (see list
f036d1
+below) to set or change, with \fIcontent\fP pointing to a zero terminated
f036d1
+string with the new contents for that URL part. The contents should be in the
f036d1
+form and encoding they'd use in a URL: URL encoded.
f036d1
+
f036d1
+Setting a part to a NULL pointer will effectively remove that part's contents
f036d1
+from the CURLU handle.
f036d1
+
f036d1
+The \fIflags\fP argument is a bitmask with independent features.
f036d1
+.SH PARTS
f036d1
+.IP CURLUPART_URL
f036d1
+Allows the full URL of the handle to be replaced. If the handle already is
f036d1
+populated with a URL, the new URL can be relative to the previous.
f036d1
+
f036d1
+When successfully setting a new URL, relative or absolute, the handle contents
f036d1
+will be replaced with the information of the newly set URL.
f036d1
+
f036d1
+Pass a pointer to a zero terminated string to the \fIurl\fP parameter. The
f036d1
+string must point to a correctly formatted "RFC 3986+" URL or be a NULL
f036d1
+pointer.
f036d1
+.IP CURLUPART_SCHEME
f036d1
+Scheme cannot be URL decoded on set.
f036d1
+.IP CURLUPART_USER
f036d1
+.IP CURLUPART_PASSWORD
f036d1
+.IP CURLUPART_OPTIONS
f036d1
+.IP CURLUPART_HOST
f036d1
+The host name can use IDNA. The string must then be encoded as your locale
f036d1
+says or UTF-8 (when winidn is used).
f036d1
+.IP CURLUPART_PORT
f036d1
+Port cannot be URL encoded on set.
f036d1
+.IP CURLUPART_PATH
f036d1
+If a path is set in the URL without a leading slash, a slash will be inserted
f036d1
+automatically when this URL is read from the handle.
f036d1
+.IP CURLUPART_QUERY
f036d1
+The query part will also get spaces converted to pluses when asked to URL
f036d1
+encode on set with the CURLU_URLENCODE bit.
f036d1
+
f036d1
+If used in with \fICURLU_APPENDQUERY\fP, the provided part will be appended on
f036d1
+the end of the existing query - and if the previous part didn't end with an
f036d1
+ampersand (&), an ampersand will be inserted before the new appended part.
f036d1
+
f036d1
+When \fCURLU_APPENDQUERY\fP is used together with \fICURLU_URLENCODE\fP,
f036d1
+the '=' symbols will not be URL encoded.
f036d1
+
f036d1
+The question mark in the URL is not part of the actual query contents.
f036d1
+.IP CURLUPART_FRAGMENT
f036d1
+The hash sign in the URL is not part of the actual fragment contents.
f036d1
+.SH FLAGS
f036d1
+The flags argument is zero, one or more bits set in a bitmask.
f036d1
+.IP CURLU_NON_SUPPORT_SCHEME
f036d1
+If set, allows \fIcurl_url_set(3)\fP to set a non-supported scheme.
f036d1
+.IP CURLU_URLENCODE
f036d1
+When set, \fIcurl_url_set(3)\fP URL encodes the part on entry, except for
f036d1
+scheme, port and URL.
f036d1
+
f036d1
+When setting the path component with URL encoding enabled, the slash character
f036d1
+will be skipped.
f036d1
+
f036d1
+The query part gets space-to-plus conversion before the URL conversion.
f036d1
+
f036d1
+This URL encoding is charset unaware and will convert the input on a
f036d1
+byte-by-byte manner.
f036d1
+.SH RETURN VALUE
f036d1
+Returns a CURLUcode error value, which is CURLUE_OK (0) if everything went
f036d1
+fine.
f036d1
+
f036d1
+If this function returns an error, no URL part is returned.
f036d1
+.SH EXAMPLE
f036d1
+.nf
f036d1
+  CURLUcode rc;
f036d1
+  CURLU *url = curl_url();
f036d1
+  rc = curl_url_set(url, CURLUPART_URL, "https://example.com", 0);
f036d1
+  if(!rc) {
f036d1
+    char *scheme;
f036d1
+    /* change it to an FTP URL */
f036d1
+    rc = curl_url_set(url, CURLUPART_SCHEME, "ftp", 0);
f036d1
+  }
f036d1
+  curl_url_cleanup(url);
f036d1
+.fi
f036d1
+.SH AVAILABILITY
f036d1
+Added in curl 7.63.0
f036d1
+.SH "SEE ALSO"
f036d1
+.BR curl_url_cleanup "(3), " curl_url "(3), " curl_url_get "(3), "
f036d1
+.BR curl_url_dup "(3), "
f036d1
diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
f036d1
index 7448b4f..c797cb7 100644
f036d1
--- a/docs/libcurl/symbols-in-versions
f036d1
+++ b/docs/libcurl/symbols-in-versions
f036d1
@@ -718,6 +718,36 @@ CURLSSLSET_NO_BACKENDS          7.56.0
f036d1
 CURLSSLSET_OK                   7.56.0
f036d1
 CURLSSLSET_TOO_LATE             7.56.0
f036d1
 CURLSSLSET_UNKNOWN_BACKEND      7.56.0
f036d1
+CURLUPART_FRAGMENT              7.62.0
f036d1
+CURLUPART_HOST                  7.62.0
f036d1
+CURLUPART_OPTIONS               7.62.0
f036d1
+CURLUPART_PASSWORD              7.62.0
f036d1
+CURLUPART_PATH                  7.62.0
f036d1
+CURLUPART_PORT                  7.62.0
f036d1
+CURLUPART_QUERY                 7.62.0
f036d1
+CURLUPART_SCHEME                7.62.0
f036d1
+CURLUPART_URL                   7.62.0
f036d1
+CURLUPART_USER                  7.62.0
f036d1
+CURLUE_BAD_HANDLE               7.62.0
f036d1
+CURLUE_BAD_PARTPOINTER          7.62.0
f036d1
+CURLUE_BAD_PORT_NUMBER          7.62.0
f036d1
+CURLUE_MALFORMED_INPUT          7.62.0
f036d1
+CURLUE_NO_FRAGMENT              7.62.0
f036d1
+CURLUE_NO_HOST                  7.62.0
f036d1
+CURLUE_NO_OPTIONS               7.62.0
f036d1
+CURLUE_NO_PASSWORD              7.62.0
f036d1
+CURLUE_NO_PATH                  7.62.0
f036d1
+CURLUE_NO_PORT                  7.62.0
f036d1
+CURLUE_NO_QUERY                 7.62.0
f036d1
+CURLUE_NO_SCHEME                7.62.0
f036d1
+CURLUE_NO_USER                  7.62.0
f036d1
+CURLUE_OK                       7.62.0
f036d1
+CURLUE_OUT_OF_MEMORY            7.62.0
f036d1
+CURLUE_RELATIVE                 7.62.0
f036d1
+CURLUE_UNKNOWN_PART             7.62.0
f036d1
+CURLUE_UNSUPPORTED_SCHEME       7.62.0
f036d1
+CURLUE_URLDECODE                7.62.0
f036d1
+CURLUE_USER_NOT_ALLOWED         7.62.0
f036d1
 CURLUSESSL_ALL                  7.17.0
f036d1
 CURLUSESSL_CONTROL              7.17.0
f036d1
 CURLUSESSL_NONE                 7.17.0
f036d1
diff --git a/include/curl/Makefile.am b/include/curl/Makefile.am
f036d1
index 989d4a2..bf5f061 100644
f036d1
--- a/include/curl/Makefile.am
f036d1
+++ b/include/curl/Makefile.am
f036d1
@@ -5,7 +5,7 @@
f036d1
 #                            | (__| |_| |  _ <| |___
f036d1
 #                             \___|\___/|_| \_\_____|
f036d1
 #
f036d1
-# Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+# Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
 #
f036d1
 # This software is licensed as described in the file COPYING, which
f036d1
 # you should have received as part of this distribution. The terms
f036d1
@@ -21,7 +21,7 @@
f036d1
 ###########################################################################
f036d1
 pkginclude_HEADERS = \
f036d1
 	curl.h curlver.h easy.h mprintf.h stdcheaders.h multi.h \
f036d1
-	typecheck-gcc.h system.h
f036d1
+	typecheck-gcc.h system.h urlapi.h
f036d1
 
f036d1
 pkgincludedir= $(includedir)/curl
f036d1
 
f036d1
diff --git a/include/curl/curl.h b/include/curl/curl.h
f036d1
index 067b34d..8f473e2 100644
f036d1
--- a/include/curl/curl.h
f036d1
+++ b/include/curl/curl.h
f036d1
@@ -2779,6 +2779,7 @@ CURL_EXTERN CURLcode curl_easy_pause(CURL *handle, int bitmask);
f036d1
   stuff before they can be included! */
f036d1
 #include "easy.h" /* nothing in curl is fun without the easy stuff */
f036d1
 #include "multi.h"
f036d1
+#include "urlapi.h"
f036d1
 
f036d1
 /* the typechecker doesn't work in C++ (yet) */
f036d1
 #if defined(__GNUC__) && defined(__GNUC_MINOR__) && \
f036d1
diff --git a/include/curl/urlapi.h b/include/curl/urlapi.h
f036d1
new file mode 100644
f036d1
index 0000000..b16cfce
f036d1
--- /dev/null
f036d1
+++ b/include/curl/urlapi.h
f036d1
@@ -0,0 +1,121 @@
f036d1
+#ifndef __CURL_URLAPI_H
f036d1
+#define __CURL_URLAPI_H
f036d1
+/***************************************************************************
f036d1
+ *                                  _   _ ____  _
f036d1
+ *  Project                     ___| | | |  _ \| |
f036d1
+ *                             / __| | | | |_) | |
f036d1
+ *                            | (__| |_| |  _ <| |___
f036d1
+ *                             \___|\___/|_| \_\_____|
f036d1
+ *
f036d1
+ * Copyright (C) 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+ *
f036d1
+ * This software is licensed as described in the file COPYING, which
f036d1
+ * you should have received as part of this distribution. The terms
f036d1
+ * are also available at https://curl.haxx.se/docs/copyright.html.
f036d1
+ *
f036d1
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
f036d1
+ * copies of the Software, and permit persons to whom the Software is
f036d1
+ * furnished to do so, under the terms of the COPYING file.
f036d1
+ *
f036d1
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
f036d1
+ * KIND, either express or implied.
f036d1
+ *
f036d1
+ ***************************************************************************/
f036d1
+
f036d1
+#ifdef  __cplusplus
f036d1
+extern "C" {
f036d1
+#endif
f036d1
+
f036d1
+/* the error codes for the URL API */
f036d1
+typedef enum {
f036d1
+  CURLUE_OK,
f036d1
+  CURLUE_BAD_HANDLE,          /* 1 */
f036d1
+  CURLUE_BAD_PARTPOINTER,     /* 2 */
f036d1
+  CURLUE_MALFORMED_INPUT,     /* 3 */
f036d1
+  CURLUE_BAD_PORT_NUMBER,     /* 4 */
f036d1
+  CURLUE_UNSUPPORTED_SCHEME,  /* 5 */
f036d1
+  CURLUE_URLDECODE,           /* 6 */
f036d1
+  CURLUE_RELATIVE,            /* 7 */
f036d1
+  CURLUE_USER_NOT_ALLOWED,    /* 8 */
f036d1
+  CURLUE_UNKNOWN_PART,        /* 9 */
f036d1
+  CURLUE_NO_SCHEME,           /* 10 */
f036d1
+  CURLUE_NO_USER,             /* 11 */
f036d1
+  CURLUE_NO_PASSWORD,         /* 12 */
f036d1
+  CURLUE_NO_OPTIONS,          /* 13 */
f036d1
+  CURLUE_NO_HOST,             /* 14 */
f036d1
+  CURLUE_NO_PORT,             /* 15 */
f036d1
+  CURLUE_NO_PATH,             /* 16 */
f036d1
+  CURLUE_NO_QUERY,            /* 17 */
f036d1
+  CURLUE_NO_FRAGMENT,         /* 18 */
f036d1
+  CURLUE_OUT_OF_MEMORY        /* 19 */
f036d1
+} CURLUcode;
f036d1
+
f036d1
+typedef enum {
f036d1
+  CURLUPART_URL,
f036d1
+  CURLUPART_SCHEME,
f036d1
+  CURLUPART_USER,
f036d1
+  CURLUPART_PASSWORD,
f036d1
+  CURLUPART_OPTIONS,
f036d1
+  CURLUPART_HOST,
f036d1
+  CURLUPART_PORT,
f036d1
+  CURLUPART_PATH,
f036d1
+  CURLUPART_QUERY,
f036d1
+  CURLUPART_FRAGMENT
f036d1
+} CURLUPart;
f036d1
+
f036d1
+#define CURLU_DEFAULT_PORT (1<<0)       /* return default port number */
f036d1
+#define CURLU_NO_DEFAULT_PORT (1<<1)    /* act as if no port number was set,
f036d1
+                                           if the port number matches the
f036d1
+                                           default for the scheme */
f036d1
+#define CURLU_DEFAULT_SCHEME (1<<2)     /* return default scheme if
f036d1
+                                           missing */
f036d1
+#define CURLU_NON_SUPPORT_SCHEME (1<<3) /* allow non-supported scheme */
f036d1
+#define CURLU_PATH_AS_IS (1<<4)         /* leave dot sequences */
f036d1
+#define CURLU_DISALLOW_USER (1<<5)      /* no user+password allowed */
f036d1
+#define CURLU_URLDECODE (1<<6)          /* URL decode on get */
f036d1
+#define CURLU_URLENCODE (1<<7)          /* URL encode on set */
f036d1
+#define CURLU_APPENDQUERY (1<<8)        /* append a form style part */
f036d1
+
f036d1
+typedef struct Curl_URL CURLU;
f036d1
+
f036d1
+/*
f036d1
+ * curl_url() creates a new CURLU handle and returns a pointer to it.
f036d1
+ * Must be freed with curl_url_cleanup().
f036d1
+ */
f036d1
+CURL_EXTERN CURLU *curl_url(void);
f036d1
+
f036d1
+/*
f036d1
+ * curl_url_cleanup() frees the CURLU handle and related resources used for
f036d1
+ * the URL parsing. It will not free strings previously returned with the URL
f036d1
+ * API.
f036d1
+ */
f036d1
+CURL_EXTERN void curl_url_cleanup(CURLU *handle);
f036d1
+
f036d1
+/*
f036d1
+ * curl_url_dup() duplicates a CURLU handle and returns a new copy. The new
f036d1
+ * handle must also be freed with curl_url_cleanup().
f036d1
+ */
f036d1
+CURL_EXTERN CURLU *curl_url_dup(CURLU *in);
f036d1
+
f036d1
+/*
f036d1
+ * curl_url_get() extracts a specific part of the URL from a CURLU
f036d1
+ * handle. Returns error code. The returned pointer MUST be freed with
f036d1
+ * curl_free() afterwards.
f036d1
+ */
f036d1
+CURL_EXTERN CURLUcode curl_url_get(CURLU *handle, CURLUPart what,
f036d1
+                                   char **part, unsigned int flags);
f036d1
+
f036d1
+/*
f036d1
+ * curl_url_set() sets a specific part of the URL in a CURLU handle. Returns
f036d1
+ * error code. The passed in string will be copied. Passing a NULL instead of
f036d1
+ * a part string, clears that part.
f036d1
+ */
f036d1
+CURL_EXTERN CURLUcode curl_url_set(CURLU *handle, CURLUPart what,
f036d1
+                                   const char *part, unsigned int flags);
f036d1
+
f036d1
+
f036d1
+#ifdef __cplusplus
f036d1
+} /* end of extern "C" */
f036d1
+#endif
f036d1
+
f036d1
+#endif
f036d1
diff --git a/lib/Makefile.inc b/lib/Makefile.inc
f036d1
index 76ca6d0..1ff82e1 100644
f036d1
--- a/lib/Makefile.inc
f036d1
+++ b/lib/Makefile.inc
f036d1
@@ -54,7 +54,8 @@ LIB_CFILES = file.c timeval.c base64.c hostip.c progress.c formdata.c   \
f036d1
   http_ntlm.c curl_ntlm_wb.c curl_ntlm_core.c curl_sasl.c rand.c        \
f036d1
   curl_multibyte.c hostcheck.c conncache.c pipeline.c dotdot.c          \
f036d1
   x509asn1.c http2.c smb.c curl_endian.c curl_des.c system_win32.c      \
f036d1
-  mime.c sha256.c setopt.c curl_path.c curl_ctype.c curl_range.c psl.c
f036d1
+  mime.c sha256.c setopt.c curl_path.c curl_ctype.c curl_range.c psl.c  \
f036d1
+  urlapi.c
f036d1
 
f036d1
 LIB_HFILES = arpa_telnet.h netrc.h file.h timeval.h hostip.h progress.h \
f036d1
   formdata.h cookie.h http.h sendf.h ftp.h url.h dict.h if2ip.h         \
f036d1
@@ -74,7 +75,7 @@ LIB_HFILES = arpa_telnet.h netrc.h file.h timeval.h hostip.h progress.h \
f036d1
   curl_setup_once.h multihandle.h setup-vms.h pipeline.h dotdot.h       \
f036d1
   x509asn1.h http2.h sigpipe.h smb.h curl_endian.h curl_des.h           \
f036d1
   curl_printf.h system_win32.h rand.h mime.h curl_sha256.h setopt.h     \
f036d1
-  curl_path.h curl_ctype.h curl_range.h psl.h
f036d1
+  curl_path.h curl_ctype.h curl_range.h psl.h urlapi-int.h
f036d1
 
f036d1
 LIB_RCFILES = libcurl.rc
f036d1
 
f036d1
diff --git a/lib/escape.c b/lib/escape.c
f036d1
index 10774f0..afd3899 100644
f036d1
--- a/lib/escape.c
f036d1
+++ b/lib/escape.c
f036d1
@@ -5,7 +5,7 @@
f036d1
  *                            | (__| |_| |  _ <| |___
f036d1
  *                             \___|\___/|_| \_\_____|
f036d1
  *
f036d1
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
  *
f036d1
  * This software is licensed as described in the file COPYING, which
f036d1
  * you should have received as part of this distribution. The terms
f036d1
@@ -41,7 +41,7 @@
f036d1
    its behavior is altered by the current locale.
f036d1
    See https://tools.ietf.org/html/rfc3986#section-2.3
f036d1
 */
f036d1
-static bool Curl_isunreserved(unsigned char in)
f036d1
+bool Curl_isunreserved(unsigned char in)
f036d1
 {
f036d1
   switch(in) {
f036d1
     case '0': case '1': case '2': case '3': case '4':
f036d1
@@ -141,6 +141,8 @@ char *curl_easy_escape(struct Curl_easy *data, const char *string,
f036d1
  * Returns a pointer to a malloced string in *ostring with length given in
f036d1
  * *olen. If length == 0, the length is assumed to be strlen(string).
f036d1
  *
f036d1
+ * 'data' can be set to NULL but then this function can't convert network
f036d1
+ * data to host for non-ascii.
f036d1
  */
f036d1
 CURLcode Curl_urldecode(struct Curl_easy *data,
f036d1
                         const char *string, size_t length,
f036d1
@@ -151,7 +153,7 @@ CURLcode Curl_urldecode(struct Curl_easy *data,
f036d1
   char *ns = malloc(alloc);
f036d1
   size_t strindex = 0;
f036d1
   unsigned long hex;
f036d1
-  CURLcode result;
f036d1
+  CURLcode result = CURLE_OK;
f036d1
 
f036d1
   if(!ns)
f036d1
     return CURLE_OUT_OF_MEMORY;
f036d1
@@ -171,11 +173,13 @@ CURLcode Curl_urldecode(struct Curl_easy *data,
f036d1
 
f036d1
       in = curlx_ultouc(hex); /* this long is never bigger than 255 anyway */
f036d1
 
f036d1
-      result = Curl_convert_from_network(data, (char *)&in, 1);
f036d1
-      if(result) {
f036d1
-        /* Curl_convert_from_network calls failf if unsuccessful */
f036d1
-        free(ns);
f036d1
-        return result;
f036d1
+      if(data) {
f036d1
+        result = Curl_convert_from_network(data, (char *)&in, 1);
f036d1
+        if(result) {
f036d1
+          /* Curl_convert_from_network calls failf if unsuccessful */
f036d1
+          free(ns);
f036d1
+          return result;
f036d1
+        }
f036d1
       }
f036d1
 
f036d1
       string += 2;
f036d1
diff --git a/lib/escape.h b/lib/escape.h
f036d1
index 638666f..666f1ad 100644
f036d1
--- a/lib/escape.h
f036d1
+++ b/lib/escape.h
f036d1
@@ -7,7 +7,7 @@
f036d1
  *                            | (__| |_| |  _ <| |___
f036d1
  *                             \___|\___/|_| \_\_____|
f036d1
  *
f036d1
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
  *
f036d1
  * This software is licensed as described in the file COPYING, which
f036d1
  * you should have received as part of this distribution. The terms
f036d1
@@ -24,6 +24,7 @@
f036d1
 /* Escape and unescape URL encoding in strings. The functions return a new
f036d1
  * allocated string or NULL if an error occurred.  */
f036d1
 
f036d1
+bool Curl_isunreserved(unsigned char in);
f036d1
 CURLcode Curl_urldecode(struct Curl_easy *data,
f036d1
                         const char *string, size_t length,
f036d1
                         char **ostring, size_t *olen,
f036d1
diff --git a/lib/imap.c b/lib/imap.c
f036d1
index 942fe7d..28962c1 100644
f036d1
--- a/lib/imap.c
f036d1
+++ b/lib/imap.c
f036d1
@@ -159,7 +159,8 @@ const struct Curl_handler Curl_handler_imaps = {
f036d1
   ZERO_NULL,                        /* connection_check */
f036d1
   PORT_IMAPS,                       /* defport */
f036d1
   CURLPROTO_IMAPS,                  /* protocol */
f036d1
-  PROTOPT_CLOSEACTION | PROTOPT_SSL /* flags */
f036d1
+  PROTOPT_CLOSEACTION | PROTOPT_SSL | /* flags */
f036d1
+  PROTOPT_URLOPTIONS
f036d1
 };
f036d1
 #endif
f036d1
 
f036d1
diff --git a/lib/transfer.c b/lib/transfer.c
f036d1
index 7159d5c..ecd1063 100644
f036d1
--- a/lib/transfer.c
f036d1
+++ b/lib/transfer.c
f036d1
@@ -75,6 +75,7 @@
f036d1
 #include "http2.h"
f036d1
 #include "mime.h"
f036d1
 #include "strcase.h"
f036d1
+#include "urlapi-int.h"
f036d1
 
f036d1
 /* The last 3 #include files should be in this order */
f036d1
 #include "curl_printf.h"
f036d1
@@ -1453,311 +1454,6 @@ CURLcode Curl_posttransfer(struct Curl_easy *data)
f036d1
   return CURLE_OK;
f036d1
 }
f036d1
 
f036d1
-#ifndef CURL_DISABLE_HTTP
f036d1
-/*
f036d1
- * Find the separator at the end of the host name, or the '?' in cases like
f036d1
- * http://www.url.com?id=2380
f036d1
- */
f036d1
-static const char *find_host_sep(const char *url)
f036d1
-{
f036d1
-  const char *sep;
f036d1
-  const char *query;
f036d1
-
f036d1
-  /* Find the start of the hostname */
f036d1
-  sep = strstr(url, "//");
f036d1
-  if(!sep)
f036d1
-    sep = url;
f036d1
-  else
f036d1
-    sep += 2;
f036d1
-
f036d1
-  query = strchr(sep, '?');
f036d1
-  sep = strchr(sep, '/');
f036d1
-
f036d1
-  if(!sep)
f036d1
-    sep = url + strlen(url);
f036d1
-
f036d1
-  if(!query)
f036d1
-    query = url + strlen(url);
f036d1
-
f036d1
-  return sep < query ? sep : query;
f036d1
-}
f036d1
-
f036d1
-/*
f036d1
- * Decide in an encoding-independent manner whether a character in an
f036d1
- * URL must be escaped. The same criterion must be used in strlen_url()
f036d1
- * and strcpy_url().
f036d1
- */
f036d1
-static bool urlchar_needs_escaping(int c)
f036d1
-{
f036d1
-    return !(ISCNTRL(c) || ISSPACE(c) || ISGRAPH(c));
f036d1
-}
f036d1
-
f036d1
-/*
f036d1
- * strlen_url() returns the length of the given URL if the spaces within the
f036d1
- * URL were properly URL encoded.
f036d1
- * URL encoding should be skipped for host names, otherwise IDN resolution
f036d1
- * will fail.
f036d1
- */
f036d1
-static size_t strlen_url(const char *url, bool relative)
f036d1
-{
f036d1
-  const unsigned char *ptr;
f036d1
-  size_t newlen = 0;
f036d1
-  bool left = TRUE; /* left side of the ? */
f036d1
-  const unsigned char *host_sep = (const unsigned char *) url;
f036d1
-
f036d1
-  if(!relative)
f036d1
-    host_sep = (const unsigned char *) find_host_sep(url);
f036d1
-
f036d1
-  for(ptr = (unsigned char *)url; *ptr; ptr++) {
f036d1
-
f036d1
-    if(ptr < host_sep) {
f036d1
-      ++newlen;
f036d1
-      continue;
f036d1
-    }
f036d1
-
f036d1
-    switch(*ptr) {
f036d1
-    case '?':
f036d1
-      left = FALSE;
f036d1
-      /* FALLTHROUGH */
f036d1
-    default:
f036d1
-      if(urlchar_needs_escaping(*ptr))
f036d1
-        newlen += 2;
f036d1
-      newlen++;
f036d1
-      break;
f036d1
-    case ' ':
f036d1
-      if(left)
f036d1
-        newlen += 3;
f036d1
-      else
f036d1
-        newlen++;
f036d1
-      break;
f036d1
-    }
f036d1
-  }
f036d1
-  return newlen;
f036d1
-}
f036d1
-
f036d1
-/* strcpy_url() copies a url to a output buffer and URL-encodes the spaces in
f036d1
- * the source URL accordingly.
f036d1
- * URL encoding should be skipped for host names, otherwise IDN resolution
f036d1
- * will fail.
f036d1
- */
f036d1
-static void strcpy_url(char *output, const char *url, bool relative)
f036d1
-{
f036d1
-  /* we must add this with whitespace-replacing */
f036d1
-  bool left = TRUE;
f036d1
-  const unsigned char *iptr;
f036d1
-  char *optr = output;
f036d1
-  const unsigned char *host_sep = (const unsigned char *) url;
f036d1
-
f036d1
-  if(!relative)
f036d1
-    host_sep = (const unsigned char *) find_host_sep(url);
f036d1
-
f036d1
-  for(iptr = (unsigned char *)url;    /* read from here */
f036d1
-      *iptr;         /* until zero byte */
f036d1
-      iptr++) {
f036d1
-
f036d1
-    if(iptr < host_sep) {
f036d1
-      *optr++ = *iptr;
f036d1
-      continue;
f036d1
-    }
f036d1
-
f036d1
-    switch(*iptr) {
f036d1
-    case '?':
f036d1
-      left = FALSE;
f036d1
-      /* FALLTHROUGH */
f036d1
-    default:
f036d1
-      if(urlchar_needs_escaping(*iptr)) {
f036d1
-        snprintf(optr, 4, "%%%02x", *iptr);
f036d1
-        optr += 3;
f036d1
-      }
f036d1
-      else
f036d1
-        *optr++=*iptr;
f036d1
-      break;
f036d1
-    case ' ':
f036d1
-      if(left) {
f036d1
-        *optr++='%'; /* add a '%' */
f036d1
-        *optr++='2'; /* add a '2' */
f036d1
-        *optr++='0'; /* add a '0' */
f036d1
-      }
f036d1
-      else
f036d1
-        *optr++='+'; /* add a '+' here */
f036d1
-      break;
f036d1
-    }
f036d1
-  }
f036d1
-  *optr = 0; /* zero terminate output buffer */
f036d1
-
f036d1
-}
f036d1
-
f036d1
-/*
f036d1
- * Returns true if the given URL is absolute (as opposed to relative)
f036d1
- */
f036d1
-static bool is_absolute_url(const char *url)
f036d1
-{
f036d1
-  char prot[16]; /* URL protocol string storage */
f036d1
-  char letter;   /* used for a silly sscanf */
f036d1
-
f036d1
-  return (2 == sscanf(url, "%15[^?&/:]://%c", prot, &letter)) ? TRUE : FALSE;
f036d1
-}
f036d1
-
f036d1
-/*
f036d1
- * Concatenate a relative URL to a base URL making it absolute.
f036d1
- * URL-encodes any spaces.
f036d1
- * The returned pointer must be freed by the caller unless NULL
f036d1
- * (returns NULL on out of memory).
f036d1
- */
f036d1
-static char *concat_url(const char *base, const char *relurl)
f036d1
-{
f036d1
-  /***
f036d1
-   TRY to append this new path to the old URL
f036d1
-   to the right of the host part. Oh crap, this is doomed to cause
f036d1
-   problems in the future...
f036d1
-  */
f036d1
-  char *newest;
f036d1
-  char *protsep;
f036d1
-  char *pathsep;
f036d1
-  size_t newlen;
f036d1
-  bool host_changed = FALSE;
f036d1
-
f036d1
-  const char *useurl = relurl;
f036d1
-  size_t urllen;
f036d1
-
f036d1
-  /* we must make our own copy of the URL to play with, as it may
f036d1
-     point to read-only data */
f036d1
-  char *url_clone = strdup(base);
f036d1
-
f036d1
-  if(!url_clone)
f036d1
-    return NULL; /* skip out of this NOW */
f036d1
-
f036d1
-  /* protsep points to the start of the host name */
f036d1
-  protsep = strstr(url_clone, "//");
f036d1
-  if(!protsep)
f036d1
-    protsep = url_clone;
f036d1
-  else
f036d1
-    protsep += 2; /* pass the slashes */
f036d1
-
f036d1
-  if('/' != relurl[0]) {
f036d1
-    int level = 0;
f036d1
-
f036d1
-    /* First we need to find out if there's a ?-letter in the URL,
f036d1
-       and cut it and the right-side of that off */
f036d1
-    pathsep = strchr(protsep, '?');
f036d1
-    if(pathsep)
f036d1
-      *pathsep = 0;
f036d1
-
f036d1
-    /* we have a relative path to append to the last slash if there's one
f036d1
-       available, or if the new URL is just a query string (starts with a
f036d1
-       '?')  we append the new one at the end of the entire currently worked
f036d1
-       out URL */
f036d1
-    if(useurl[0] != '?') {
f036d1
-      pathsep = strrchr(protsep, '/');
f036d1
-      if(pathsep)
f036d1
-        *pathsep = 0;
f036d1
-    }
f036d1
-
f036d1
-    /* Check if there's any slash after the host name, and if so, remember
f036d1
-       that position instead */
f036d1
-    pathsep = strchr(protsep, '/');
f036d1
-    if(pathsep)
f036d1
-      protsep = pathsep + 1;
f036d1
-    else
f036d1
-      protsep = NULL;
f036d1
-
f036d1
-    /* now deal with one "./" or any amount of "../" in the newurl
f036d1
-       and act accordingly */
f036d1
-
f036d1
-    if((useurl[0] == '.') && (useurl[1] == '/'))
f036d1
-      useurl += 2; /* just skip the "./" */
f036d1
-
f036d1
-    while((useurl[0] == '.') &&
f036d1
-          (useurl[1] == '.') &&
f036d1
-          (useurl[2] == '/')) {
f036d1
-      level++;
f036d1
-      useurl += 3; /* pass the "../" */
f036d1
-    }
f036d1
-
f036d1
-    if(protsep) {
f036d1
-      while(level--) {
f036d1
-        /* cut off one more level from the right of the original URL */
f036d1
-        pathsep = strrchr(protsep, '/');
f036d1
-        if(pathsep)
f036d1
-          *pathsep = 0;
f036d1
-        else {
f036d1
-          *protsep = 0;
f036d1
-          break;
f036d1
-        }
f036d1
-      }
f036d1
-    }
f036d1
-  }
f036d1
-  else {
f036d1
-    /* We got a new absolute path for this server */
f036d1
-
f036d1
-    if((relurl[0] == '/') && (relurl[1] == '/')) {
f036d1
-      /* the new URL starts with //, just keep the protocol part from the
f036d1
-         original one */
f036d1
-      *protsep = 0;
f036d1
-      useurl = &relurl[2]; /* we keep the slashes from the original, so we
f036d1
-                              skip the new ones */
f036d1
-      host_changed = TRUE;
f036d1
-    }
f036d1
-    else {
f036d1
-      /* cut off the original URL from the first slash, or deal with URLs
f036d1
-         without slash */
f036d1
-      pathsep = strchr(protsep, '/');
f036d1
-      if(pathsep) {
f036d1
-        /* When people use badly formatted URLs, such as
f036d1
-           "http://www.url.com?dir=/home/daniel" we must not use the first
f036d1
-           slash, if there's a ?-letter before it! */
f036d1
-        char *sep = strchr(protsep, '?');
f036d1
-        if(sep && (sep < pathsep))
f036d1
-          pathsep = sep;
f036d1
-        *pathsep = 0;
f036d1
-      }
f036d1
-      else {
f036d1
-        /* There was no slash. Now, since we might be operating on a badly
f036d1
-           formatted URL, such as "http://www.url.com?id=2380" which doesn't
f036d1
-           use a slash separator as it is supposed to, we need to check for a
f036d1
-           ?-letter as well! */
f036d1
-        pathsep = strchr(protsep, '?');
f036d1
-        if(pathsep)
f036d1
-          *pathsep = 0;
f036d1
-      }
f036d1
-    }
f036d1
-  }
f036d1
-
f036d1
-  /* If the new part contains a space, this is a mighty stupid redirect
f036d1
-     but we still make an effort to do "right". To the left of a '?'
f036d1
-     letter we replace each space with %20 while it is replaced with '+'
f036d1
-     on the right side of the '?' letter.
f036d1
-  */
f036d1
-  newlen = strlen_url(useurl, !host_changed);
f036d1
-
f036d1
-  urllen = strlen(url_clone);
f036d1
-
f036d1
-  newest = malloc(urllen + 1 + /* possible slash */
f036d1
-                  newlen + 1 /* zero byte */);
f036d1
-
f036d1
-  if(!newest) {
f036d1
-    free(url_clone); /* don't leak this */
f036d1
-    return NULL;
f036d1
-  }
f036d1
-
f036d1
-  /* copy over the root url part */
f036d1
-  memcpy(newest, url_clone, urllen);
f036d1
-
f036d1
-  /* check if we need to append a slash */
f036d1
-  if(('/' == useurl[0]) || (protsep && !*protsep) || ('?' == useurl[0]))
f036d1
-    ;
f036d1
-  else
f036d1
-    newest[urllen++]='/';
f036d1
-
f036d1
-  /* then append the new piece on the right side */
f036d1
-  strcpy_url(&newest[urllen], useurl, !host_changed);
f036d1
-
f036d1
-  free(url_clone);
f036d1
-
f036d1
-  return newest;
f036d1
-}
f036d1
-#endif /* CURL_DISABLE_HTTP */
f036d1
-
f036d1
 /*
f036d1
  * Curl_follow() handles the URL redirect magic. Pass in the 'newurl' string
f036d1
  * as given by the remote server and set up the new URL to request.
f036d1
@@ -1809,12 +1505,12 @@ CURLcode Curl_follow(struct Curl_easy *data,
f036d1
     }
f036d1
   }
f036d1
 
f036d1
-  if(!is_absolute_url(newurl)) {
f036d1
+  if(!Curl_is_absolute_url(newurl, NULL, 8)) {
f036d1
     /***
f036d1
      *DANG* this is an RFC 2068 violation. The URL is supposed
f036d1
      to be absolute and this doesn't seem to be that!
f036d1
      */
f036d1
-    char *absolute = concat_url(data->change.url, newurl);
f036d1
+    char *absolute = Curl_concat_url(data->change.url, newurl);
f036d1
     if(!absolute)
f036d1
       return CURLE_OUT_OF_MEMORY;
f036d1
     newurl = absolute;
f036d1
@@ -1823,7 +1519,7 @@ CURLcode Curl_follow(struct Curl_easy *data,
f036d1
     /* The new URL MAY contain space or high byte values, that means a mighty
f036d1
        stupid redirect URL but we still make an effort to do "right". */
f036d1
     char *newest;
f036d1
-    size_t newlen = strlen_url(newurl, FALSE);
f036d1
+    size_t newlen = Curl_strlen_url(newurl, FALSE);
f036d1
 
f036d1
     /* This is an absolute URL, don't allow the custom port number */
f036d1
     disallowport = TRUE;
f036d1
@@ -1832,7 +1528,7 @@ CURLcode Curl_follow(struct Curl_easy *data,
f036d1
     if(!newest)
f036d1
       return CURLE_OUT_OF_MEMORY;
f036d1
 
f036d1
-    strcpy_url(newest, newurl, FALSE); /* create a space-free URL */
f036d1
+    Curl_strcpy_url(newest, newurl, FALSE); /* create a space-free URL */
f036d1
     newurl = newest; /* use this instead now */
f036d1
 
f036d1
   }
f036d1
diff --git a/lib/url.c b/lib/url.c
f036d1
index dcc1ecc..4f75f11 100644
f036d1
--- a/lib/url.c
f036d1
+++ b/lib/url.c
f036d1
@@ -1939,30 +1939,37 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
f036d1
   return NULL;
f036d1
 }
f036d1
 
f036d1
-static CURLcode findprotocol(struct Curl_easy *data,
f036d1
-                             struct connectdata *conn,
f036d1
-                             const char *protostr)
f036d1
+/* returns the handdler if the given scheme is built-in */
f036d1
+const struct Curl_handler *Curl_builtin_scheme(const char *scheme)
f036d1
 {
f036d1
   const struct Curl_handler * const *pp;
f036d1
   const struct Curl_handler *p;
f036d1
-
f036d1
-  /* Scan protocol handler table and match against 'protostr' to set a few
f036d1
-     variables based on the URL. Now that the handler may be changed later
f036d1
-     when the protocol specific setup function is called. */
f036d1
-  for(pp = protocols; (p = *pp) != NULL; pp++) {
f036d1
-    if(strcasecompare(p->scheme, protostr)) {
f036d1
+  /* Scan protocol handler table and match against 'scheme'. The handler may
f036d1
+     be changed later when the protocol specific setup function is called. */
f036d1
+  for(pp = protocols; (p = *pp) != NULL; pp++)
f036d1
+    if(strcasecompare(p->scheme, scheme))
f036d1
       /* Protocol found in table. Check if allowed */
f036d1
-      if(!(data->set.allowed_protocols & p->protocol))
f036d1
-        /* nope, get out */
f036d1
-        break;
f036d1
+      return p;
f036d1
+  return NULL; /* not found */
f036d1
+}
f036d1
 
f036d1
-      /* it is allowed for "normal" request, now do an extra check if this is
f036d1
-         the result of a redirect */
f036d1
-      if(data->state.this_is_a_follow &&
f036d1
-         !(data->set.redir_protocols & p->protocol))
f036d1
-        /* nope, get out */
f036d1
-        break;
f036d1
 
f036d1
+static CURLcode findprotocol(struct Curl_easy *data,
f036d1
+                             struct connectdata *conn,
f036d1
+                             const char *protostr)
f036d1
+{
f036d1
+  const struct Curl_handler *p = Curl_builtin_scheme(protostr);
f036d1
+
f036d1
+  if(p && /* Protocol found in table. Check if allowed */
f036d1
+     (data->set.allowed_protocols & p->protocol)) {
f036d1
+
f036d1
+    /* it is allowed for "normal" request, now do an extra check if this is
f036d1
+       the result of a redirect */
f036d1
+    if(data->state.this_is_a_follow &&
f036d1
+       !(data->set.redir_protocols & p->protocol))
f036d1
+      /* nope, get out */
f036d1
+      ;
f036d1
+    else {
f036d1
       /* Perform setup complement if some. */
f036d1
       conn->handler = conn->given = p;
f036d1
 
f036d1
@@ -1971,7 +1978,6 @@ static CURLcode findprotocol(struct Curl_easy *data,
f036d1
     }
f036d1
   }
f036d1
 
f036d1
-
f036d1
   /* The protocol was not found in the table, but we don't have to assign it
f036d1
      to anything since it is already assigned to a dummy-struct in the
f036d1
      create_conn() function when the connectdata struct is allocated. */
f036d1
diff --git a/lib/url.h b/lib/url.h
f036d1
index ef3ebf0..0034f82 100644
f036d1
--- a/lib/url.h
f036d1
+++ b/lib/url.h
f036d1
@@ -69,6 +69,8 @@ void Curl_getoff_all_pipelines(struct Curl_easy *data,
f036d1
 
f036d1
 void Curl_close_connections(struct Curl_easy *data);
f036d1
 
f036d1
+const struct Curl_handler *Curl_builtin_scheme(const char *scheme);
f036d1
+
f036d1
 #define CURL_DEFAULT_PROXY_PORT 1080 /* default proxy port unless specified */
f036d1
 #define CURL_DEFAULT_HTTPS_PROXY_PORT 443 /* default https proxy port unless
f036d1
                                              specified */
f036d1
diff --git a/lib/escape.h b/lib/urlapi-int.h
f036d1
similarity index 66%
f036d1
copy from lib/escape.h
f036d1
copy to lib/urlapi-int.h
f036d1
index 638666f..7ac09fd 100644
f036d1
--- a/lib/escape.h
f036d1
+++ b/lib/urlapi-int.h
f036d1
@@ -1,5 +1,5 @@
f036d1
-#ifndef HEADER_CURL_ESCAPE_H
f036d1
-#define HEADER_CURL_ESCAPE_H
f036d1
+#ifndef HEADER_CURL_URLAPI_INT_H
f036d1
+#define HEADER_CURL_URLAPI_INT_H
f036d1
 /***************************************************************************
f036d1
  *                                  _   _ ____  _
f036d1
  *  Project                     ___| | | |  _ \| |
f036d1
@@ -7,7 +7,7 @@
f036d1
  *                            | (__| |_| |  _ <| |___
f036d1
  *                             \___|\___/|_| \_\_____|
f036d1
  *
f036d1
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
  *
f036d1
  * This software is licensed as described in the file COPYING, which
f036d1
  * you should have received as part of this distribution. The terms
f036d1
@@ -21,13 +21,9 @@
f036d1
  * KIND, either express or implied.
f036d1
  *
f036d1
  ***************************************************************************/
f036d1
-/* Escape and unescape URL encoding in strings. The functions return a new
f036d1
- * allocated string or NULL if an error occurred.  */
f036d1
-
f036d1
-CURLcode Curl_urldecode(struct Curl_easy *data,
f036d1
-                        const char *string, size_t length,
f036d1
-                        char **ostring, size_t *olen,
f036d1
-                        bool reject_crlf);
f036d1
-
f036d1
-#endif /* HEADER_CURL_ESCAPE_H */
f036d1
-
f036d1
+#include "curl_setup.h"
f036d1
+bool Curl_is_absolute_url(const char *url, char *scheme, size_t buflen);
f036d1
+char *Curl_concat_url(const char *base, const char *relurl);
f036d1
+size_t Curl_strlen_url(const char *url, bool relative);
f036d1
+void Curl_strcpy_url(char *output, const char *url, bool relative);
f036d1
+#endif
f036d1
diff --git a/lib/urlapi.c b/lib/urlapi.c
f036d1
new file mode 100644
f036d1
index 0000000..8287861
f036d1
--- /dev/null
f036d1
+++ b/lib/urlapi.c
f036d1
@@ -0,0 +1,1315 @@
f036d1
+/***************************************************************************
f036d1
+ *                                  _   _ ____  _
f036d1
+ *  Project                     ___| | | |  _ \| |
f036d1
+ *                             / __| | | | |_) | |
f036d1
+ *                            | (__| |_| |  _ <| |___
f036d1
+ *                             \___|\___/|_| \_\_____|
f036d1
+ *
f036d1
+ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
f036d1
+ *
f036d1
+ * This software is licensed as described in the file COPYING, which
f036d1
+ * you should have received as part of this distribution. The terms
f036d1
+ * are also available at https://curl.haxx.se/docs/copyright.html.
f036d1
+ *
f036d1
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
f036d1
+ * copies of the Software, and permit persons to whom the Software is
f036d1
+ * furnished to do so, under the terms of the COPYING file.
f036d1
+ *
f036d1
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
f036d1
+ * KIND, either express or implied.
f036d1
+ *
f036d1
+ ***************************************************************************/
f036d1
+
f036d1
+#include "curl_setup.h"
f036d1
+
f036d1
+#include "urldata.h"
f036d1
+#include "urlapi-int.h"
f036d1
+#include "strcase.h"
f036d1
+#include "dotdot.h"
f036d1
+#include "url.h"
f036d1
+#include "escape.h"
f036d1
+#include "curl_ctype.h"
f036d1
+
f036d1
+/* The last 3 #include files should be in this order */
f036d1
+#include "curl_printf.h"
f036d1
+#include "curl_memory.h"
f036d1
+#include "memdebug.h"
f036d1
+
f036d1
+/* Internal representation of CURLU. Point to URL-encoded strings. */
f036d1
+struct Curl_URL {
f036d1
+  char *scheme;
f036d1
+  char *user;
f036d1
+  char *password;
f036d1
+  char *options; /* IMAP only? */
f036d1
+  char *host;
f036d1
+  char *port;
f036d1
+  char *path;
f036d1
+  char *query;
f036d1
+  char *fragment;
f036d1
+
f036d1
+  char *scratch; /* temporary scratch area */
f036d1
+  long portnum; /* the numerical version */
f036d1
+};
f036d1
+
f036d1
+#define DEFAULT_SCHEME "https"
f036d1
+
f036d1
+/* scheme is not URL encoded, the longest libcurl supported ones are 6
f036d1
+   letters */
f036d1
+#define MAX_SCHEME_LEN 8
f036d1
+
f036d1
+static void free_urlhandle(struct Curl_URL *u)
f036d1
+{
f036d1
+  free(u->scheme);
f036d1
+  free(u->user);
f036d1
+  free(u->password);
f036d1
+  free(u->options);
f036d1
+  free(u->host);
f036d1
+  free(u->port);
f036d1
+  free(u->path);
f036d1
+  free(u->query);
f036d1
+  free(u->fragment);
f036d1
+  free(u->scratch);
f036d1
+}
f036d1
+
f036d1
+/* move the full contents of one handle onto another and
f036d1
+   free the original */
f036d1
+static void mv_urlhandle(struct Curl_URL *from,
f036d1
+                         struct Curl_URL *to)
f036d1
+{
f036d1
+  free_urlhandle(to);
f036d1
+  *to = *from;
f036d1
+  free(from);
f036d1
+}
f036d1
+
f036d1
+/*
f036d1
+ * Find the separator at the end of the host name, or the '?' in cases like
f036d1
+ * http://www.url.com?id=2380
f036d1
+ */
f036d1
+static const char *find_host_sep(const char *url)
f036d1
+{
f036d1
+  const char *sep;
f036d1
+  const char *query;
f036d1
+
f036d1
+  /* Find the start of the hostname */
f036d1
+  sep = strstr(url, "//");
f036d1
+  if(!sep)
f036d1
+    sep = url;
f036d1
+  else
f036d1
+    sep += 2;
f036d1
+
f036d1
+  query = strchr(sep, '?');
f036d1
+  sep = strchr(sep, '/');
f036d1
+
f036d1
+  if(!sep)
f036d1
+    sep = url + strlen(url);
f036d1
+
f036d1
+  if(!query)
f036d1
+    query = url + strlen(url);
f036d1
+
f036d1
+  return sep < query ? sep : query;
f036d1
+}
f036d1
+
f036d1
+/*
f036d1
+ * Decide in an encoding-independent manner whether a character in an
f036d1
+ * URL must be escaped. The same criterion must be used in strlen_url()
f036d1
+ * and strcpy_url().
f036d1
+ */
f036d1
+static bool urlchar_needs_escaping(int c)
f036d1
+{
f036d1
+    return !(ISCNTRL(c) || ISSPACE(c) || ISGRAPH(c));
f036d1
+}
f036d1
+
f036d1
+/*
f036d1
+ * strlen_url() returns the length of the given URL if the spaces within the
f036d1
+ * URL were properly URL encoded.
f036d1
+ * URL encoding should be skipped for host names, otherwise IDN resolution
f036d1
+ * will fail.
f036d1
+ */
f036d1
+size_t Curl_strlen_url(const char *url, bool relative)
f036d1
+{
f036d1
+  const unsigned char *ptr;
f036d1
+  size_t newlen = 0;
f036d1
+  bool left = TRUE; /* left side of the ? */
f036d1
+  const unsigned char *host_sep = (const unsigned char *) url;
f036d1
+
f036d1
+  if(!relative)
f036d1
+    host_sep = (const unsigned char *) find_host_sep(url);
f036d1
+
f036d1
+  for(ptr = (unsigned char *)url; *ptr; ptr++) {
f036d1
+
f036d1
+    if(ptr < host_sep) {
f036d1
+      ++newlen;
f036d1
+      continue;
f036d1
+    }
f036d1
+
f036d1
+    switch(*ptr) {
f036d1
+    case '?':
f036d1
+      left = FALSE;
f036d1
+      /* FALLTHROUGH */
f036d1
+    default:
f036d1
+      if(urlchar_needs_escaping(*ptr))
f036d1
+        newlen += 2;
f036d1
+      newlen++;
f036d1
+      break;
f036d1
+    case ' ':
f036d1
+      if(left)
f036d1
+        newlen += 3;
f036d1
+      else
f036d1
+        newlen++;
f036d1
+      break;
f036d1
+    }
f036d1
+  }
f036d1
+  return newlen;
f036d1
+}
f036d1
+
f036d1
+/* strcpy_url() copies a url to a output buffer and URL-encodes the spaces in
f036d1
+ * the source URL accordingly.
f036d1
+ * URL encoding should be skipped for host names, otherwise IDN resolution
f036d1
+ * will fail.
f036d1
+ */
f036d1
+void Curl_strcpy_url(char *output, const char *url, bool relative)
f036d1
+{
f036d1
+  /* we must add this with whitespace-replacing */
f036d1
+  bool left = TRUE;
f036d1
+  const unsigned char *iptr;
f036d1
+  char *optr = output;
f036d1
+  const unsigned char *host_sep = (const unsigned char *) url;
f036d1
+
f036d1
+  if(!relative)
f036d1
+    host_sep = (const unsigned char *) find_host_sep(url);
f036d1
+
f036d1
+  for(iptr = (unsigned char *)url;    /* read from here */
f036d1
+      *iptr;         /* until zero byte */
f036d1
+      iptr++) {
f036d1
+
f036d1
+    if(iptr < host_sep) {
f036d1
+      *optr++ = *iptr;
f036d1
+      continue;
f036d1
+    }
f036d1
+
f036d1
+    switch(*iptr) {
f036d1
+    case '?':
f036d1
+      left = FALSE;
f036d1
+      /* FALLTHROUGH */
f036d1
+    default:
f036d1
+      if(urlchar_needs_escaping(*iptr)) {
f036d1
+        snprintf(optr, 4, "%%%02x", *iptr);
f036d1
+        optr += 3;
f036d1
+      }
f036d1
+      else
f036d1
+        *optr++=*iptr;
f036d1
+      break;
f036d1
+    case ' ':
f036d1
+      if(left) {
f036d1
+        *optr++='%'; /* add a '%' */
f036d1
+        *optr++='2'; /* add a '2' */
f036d1
+        *optr++='0'; /* add a '0' */
f036d1
+      }
f036d1
+      else
f036d1
+        *optr++='+'; /* add a '+' here */
f036d1
+      break;
f036d1
+    }
f036d1
+  }
f036d1
+  *optr = 0; /* zero terminate output buffer */
f036d1
+
f036d1
+}
f036d1
+
f036d1
+/*
f036d1
+ * Returns true if the given URL is absolute (as opposed to relative) within
f036d1
+ * the buffer size. Returns the scheme in the buffer if TRUE and 'buf' is
f036d1
+ * non-NULL.
f036d1
+ */
f036d1
+bool Curl_is_absolute_url(const char *url, char *buf, size_t buflen)
f036d1
+{
f036d1
+  size_t i;
f036d1
+  for(i = 0; i < buflen && url[i]; ++i) {
f036d1
+    char s = url[i];
f036d1
+    if(s == ':') {
f036d1
+      if(buf)
f036d1
+        buf[i] = 0;
f036d1
+      return TRUE;
f036d1
+    }
f036d1
+    /* RFC 3986 3.1 explains:
f036d1
+      scheme      = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
f036d1
+    */
f036d1
+    else if(ISALNUM(s) || (s == '+') || (s == '-') || (s == '.') ) {
f036d1
+      if(buf)
f036d1
+        buf[i] = (char)TOLOWER(s);
f036d1
+    }
f036d1
+    else
f036d1
+      break;
f036d1
+  }
f036d1
+  return FALSE;
f036d1
+}
f036d1
+
f036d1
+/*
f036d1
+ * Concatenate a relative URL to a base URL making it absolute.
f036d1
+ * URL-encodes any spaces.
f036d1
+ * The returned pointer must be freed by the caller unless NULL
f036d1
+ * (returns NULL on out of memory).
f036d1
+ */
f036d1
+char *Curl_concat_url(const char *base, const char *relurl)
f036d1
+{
f036d1
+  /***
f036d1
+   TRY to append this new path to the old URL
f036d1
+   to the right of the host part. Oh crap, this is doomed to cause
f036d1
+   problems in the future...
f036d1
+  */
f036d1
+  char *newest;
f036d1
+  char *protsep;
f036d1
+  char *pathsep;
f036d1
+  size_t newlen;
f036d1
+  bool host_changed = FALSE;
f036d1
+
f036d1
+  const char *useurl = relurl;
f036d1
+  size_t urllen;
f036d1
+
f036d1
+  /* we must make our own copy of the URL to play with, as it may
f036d1
+     point to read-only data */
f036d1
+  char *url_clone = strdup(base);
f036d1
+
f036d1
+  if(!url_clone)
f036d1
+    return NULL; /* skip out of this NOW */
f036d1
+
f036d1
+  /* protsep points to the start of the host name */
f036d1
+  protsep = strstr(url_clone, "//");
f036d1
+  if(!protsep)
f036d1
+    protsep = url_clone;
f036d1
+  else
f036d1
+    protsep += 2; /* pass the slashes */
f036d1
+
f036d1
+  if('/' != relurl[0]) {
f036d1
+    int level = 0;
f036d1
+
f036d1
+    /* First we need to find out if there's a ?-letter in the URL,
f036d1
+       and cut it and the right-side of that off */
f036d1
+    pathsep = strchr(protsep, '?');
f036d1
+    if(pathsep)
f036d1
+      *pathsep = 0;
f036d1
+
f036d1
+    /* we have a relative path to append to the last slash if there's one
f036d1
+       available, or if the new URL is just a query string (starts with a
f036d1
+       '?')  we append the new one at the end of the entire currently worked
f036d1
+       out URL */
f036d1
+    if(useurl[0] != '?') {
f036d1
+      pathsep = strrchr(protsep, '/');
f036d1
+      if(pathsep)
f036d1
+        *pathsep = 0;
f036d1
+    }
f036d1
+
f036d1
+    /* Check if there's any slash after the host name, and if so, remember
f036d1
+       that position instead */
f036d1
+    pathsep = strchr(protsep, '/');
f036d1
+    if(pathsep)
f036d1
+      protsep = pathsep + 1;
f036d1
+    else
f036d1
+      protsep = NULL;
f036d1
+
f036d1
+    /* now deal with one "./" or any amount of "../" in the newurl
f036d1
+       and act accordingly */
f036d1
+
f036d1
+    if((useurl[0] == '.') && (useurl[1] == '/'))
f036d1
+      useurl += 2; /* just skip the "./" */
f036d1
+
f036d1
+    while((useurl[0] == '.') &&
f036d1
+          (useurl[1] == '.') &&
f036d1
+          (useurl[2] == '/')) {
f036d1
+      level++;
f036d1
+      useurl += 3; /* pass the "../" */
f036d1
+    }
f036d1
+
f036d1
+    if(protsep) {
f036d1
+      while(level--) {
f036d1
+        /* cut off one more level from the right of the original URL */
f036d1
+        pathsep = strrchr(protsep, '/');
f036d1
+        if(pathsep)
f036d1
+          *pathsep = 0;
f036d1
+        else {
f036d1
+          *protsep = 0;
f036d1
+          break;
f036d1
+        }
f036d1
+      }
f036d1
+    }
f036d1
+  }
f036d1
+  else {
f036d1
+    /* We got a new absolute path for this server */
f036d1
+
f036d1
+    if((relurl[0] == '/') && (relurl[1] == '/')) {
f036d1
+      /* the new URL starts with //, just keep the protocol part from the
f036d1
+         original one */
f036d1
+      *protsep = 0;
f036d1
+      useurl = &relurl[2]; /* we keep the slashes from the original, so we
f036d1
+                              skip the new ones */
f036d1
+      host_changed = TRUE;
f036d1
+    }
f036d1
+    else {
f036d1
+      /* cut off the original URL from the first slash, or deal with URLs
f036d1
+         without slash */
f036d1
+      pathsep = strchr(protsep, '/');
f036d1
+      if(pathsep) {
f036d1
+        /* When people use badly formatted URLs, such as
f036d1
+           "http://www.url.com?dir=/home/daniel" we must not use the first
f036d1
+           slash, if there's a ?-letter before it! */
f036d1
+        char *sep = strchr(protsep, '?');
f036d1
+        if(sep && (sep < pathsep))
f036d1
+          pathsep = sep;
f036d1
+        *pathsep = 0;
f036d1
+      }
f036d1
+      else {
f036d1
+        /* There was no slash. Now, since we might be operating on a badly
f036d1
+           formatted URL, such as "http://www.url.com?id=2380" which doesn't
f036d1
+           use a slash separator as it is supposed to, we need to check for a
f036d1
+           ?-letter as well! */
f036d1
+        pathsep = strchr(protsep, '?');
f036d1
+        if(pathsep)
f036d1
+          *pathsep = 0;
f036d1
+      }
f036d1
+    }
f036d1
+  }
f036d1
+
f036d1
+  /* If the new part contains a space, this is a mighty stupid redirect
f036d1
+     but we still make an effort to do "right". To the left of a '?'
f036d1
+     letter we replace each space with %20 while it is replaced with '+'
f036d1
+     on the right side of the '?' letter.
f036d1
+  */
f036d1
+  newlen = Curl_strlen_url(useurl, !host_changed);
f036d1
+
f036d1
+  urllen = strlen(url_clone);
f036d1
+
f036d1
+  newest = malloc(urllen + 1 + /* possible slash */
f036d1
+                  newlen + 1 /* zero byte */);
f036d1
+
f036d1
+  if(!newest) {
f036d1
+    free(url_clone); /* don't leak this */
f036d1
+    return NULL;
f036d1
+  }
f036d1
+
f036d1
+  /* copy over the root url part */
f036d1
+  memcpy(newest, url_clone, urllen);
f036d1
+
f036d1
+  /* check if we need to append a slash */
f036d1
+  if(('/' == useurl[0]) || (protsep && !*protsep) || ('?' == useurl[0]))
f036d1
+    ;
f036d1
+  else
f036d1
+    newest[urllen++]='/';
f036d1
+
f036d1
+  /* then append the new piece on the right side */
f036d1
+  Curl_strcpy_url(&newest[urllen], useurl, !host_changed);
f036d1
+
f036d1
+  free(url_clone);
f036d1
+
f036d1
+  return newest;
f036d1
+}
f036d1
+
f036d1
+/*
f036d1
+ * parse_hostname_login()
f036d1
+ *
f036d1
+ * Parse the login details (user name, password and options) from the URL and
f036d1
+ * strip them out of the host name
f036d1
+ *
f036d1
+ */
f036d1
+static CURLUcode parse_hostname_login(struct Curl_URL *u,
f036d1
+                                      const struct Curl_handler *h,
f036d1
+                                      char **hostname,
f036d1
+                                      unsigned int flags)
f036d1
+{
f036d1
+  CURLUcode result = CURLUE_OK;
f036d1
+  CURLcode ccode;
f036d1
+  char *userp = NULL;
f036d1
+  char *passwdp = NULL;
f036d1
+  char *optionsp = NULL;
f036d1
+
f036d1
+  /* At this point, we're hoping all the other special cases have
f036d1
+   * been taken care of, so conn->host.name is at most
f036d1
+   *    [user[:password][;options]]@]hostname
f036d1
+   *
f036d1
+   * We need somewhere to put the embedded details, so do that first.
f036d1
+   */
f036d1
+
f036d1
+  char *ptr = strchr(*hostname, '@');
f036d1
+  char *login = *hostname;
f036d1
+
f036d1
+  if(!ptr)
f036d1
+    goto out;
f036d1
+
f036d1
+  /* We will now try to extract the
f036d1
+   * possible login information in a string like:
f036d1
+   * ftp://user:password@ftp.my.site:8021/README */
f036d1
+  *hostname = ++ptr;
f036d1
+
f036d1
+  /* We could use the login information in the URL so extract it. Only parse
f036d1
+     options if the handler says we should. */
f036d1
+  ccode = Curl_parse_login_details(login, ptr - login - 1,
f036d1
+                                   &userp, &passwdp,
f036d1
+                                   h->flags & PROTOPT_URLOPTIONS ?
f036d1
+                                   &optionsp:NULL);
f036d1
+  if(ccode) {
f036d1
+    result = CURLUE_MALFORMED_INPUT;
f036d1
+    goto out;
f036d1
+  }
f036d1
+
f036d1
+  if(userp) {
f036d1
+    if(flags & CURLU_DISALLOW_USER) {
f036d1
+      /* Option DISALLOW_USER is set and url contains username. */
f036d1
+      result = CURLUE_USER_NOT_ALLOWED;
f036d1
+      goto out;
f036d1
+    }
f036d1
+
f036d1
+    u->user = userp;
f036d1
+  }
f036d1
+
f036d1
+  if(passwdp)
f036d1
+    u->password = passwdp;
f036d1
+
f036d1
+  if(optionsp)
f036d1
+    u->options = optionsp;
f036d1
+
f036d1
+  return CURLUE_OK;
f036d1
+  out:
f036d1
+
f036d1
+  free(userp);
f036d1
+  free(passwdp);
f036d1
+  free(optionsp);
f036d1
+
f036d1
+  return result;
f036d1
+}
f036d1
+
f036d1
+static CURLUcode parse_port(struct Curl_URL *u, char *hostname)
f036d1
+{
f036d1
+  char *portptr;
f036d1
+  char endbracket;
f036d1
+  int len;
f036d1
+
f036d1
+  if((1 == sscanf(hostname, "[%*45[0123456789abcdefABCDEF:.]%c%n",
f036d1
+                  &endbracket, &len)) &&
f036d1
+     (']' == endbracket)) {
f036d1
+    /* this is a RFC2732-style specified IP-address */
f036d1
+    portptr = &hostname[len];
f036d1
+    if (*portptr != ':')
f036d1
+      return CURLUE_MALFORMED_INPUT;
f036d1
+  }
f036d1
+  else
f036d1
+    portptr = strchr(hostname, ':');
f036d1
+
f036d1
+  if(portptr) {
f036d1
+    char *rest;
f036d1
+    long port;
f036d1
+    char portbuf[7];
f036d1
+
f036d1
+    if(!ISDIGIT(portptr[1]))
f036d1
+      return CURLUE_BAD_PORT_NUMBER;
f036d1
+
f036d1
+    port = strtol(portptr + 1, &rest, 10);  /* Port number must be decimal */
f036d1
+
f036d1
+    if((port <= 0) || (port > 0xffff))
f036d1
+      /* Single unix standard says port numbers are 16 bits long, but we don't
f036d1
+         treat port zero as OK. */
f036d1
+      return CURLUE_BAD_PORT_NUMBER;
f036d1
+
f036d1
+    if(rest[0])
f036d1
+      return CURLUE_BAD_PORT_NUMBER;
f036d1
+
f036d1
+    if(rest != &portptr[1]) {
f036d1
+      *portptr++ = '\0'; /* cut off the name there */
f036d1
+      *rest = 0;
f036d1
+      /* generate a new to get rid of leading zeroes etc */
f036d1
+      snprintf(portbuf, sizeof(portbuf), "%ld", port);
f036d1
+      u->portnum = port;
f036d1
+      u->port = strdup(portbuf);
f036d1
+      if(!u->port)
f036d1
+        return CURLUE_OUT_OF_MEMORY;
f036d1
+    }
f036d1
+    else {
f036d1
+      /* Browser behavior adaptation. If there's a colon with no digits after,
f036d1
+         just cut off the name there which makes us ignore the colon and just
f036d1
+         use the default port. Firefox and Chrome both do that. */
f036d1
+      *portptr = '\0';
f036d1
+    }
f036d1
+  }
f036d1
+
f036d1
+  return CURLUE_OK;
f036d1
+}
f036d1
+
f036d1
+/* scan for byte values < 31 or 127 */
f036d1
+static CURLUcode junkscan(char *part)
f036d1
+{
f036d1
+  char badbytes[]={
f036d1
+    /* */ 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
f036d1
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
f036d1
+    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
f036d1
+    0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
f036d1
+    0x7f,
f036d1
+    0x00 /* zero terminate */
f036d1
+  };
f036d1
+  if(part) {
f036d1
+    size_t n = strlen(part);
f036d1
+    size_t nfine = strcspn(part, badbytes);
f036d1
+    if(nfine != n)
f036d1
+      /* since we don't know which part is scanned, return a generic error
f036d1
+         code */
f036d1
+      return CURLUE_MALFORMED_INPUT;
f036d1
+  }
f036d1
+  return CURLUE_OK;
f036d1
+}
f036d1
+
f036d1
+static CURLUcode hostname_check(char *hostname, unsigned int flags)
f036d1
+{
f036d1
+  const char *l; /* accepted characters */
f036d1
+  size_t len;
f036d1
+  size_t hlen = strlen(hostname);
f036d1
+  (void)flags;
f036d1
+
f036d1
+  if(hostname[0] == '[') {
f036d1
+    hostname++;
f036d1
+    l = "0123456789abcdefABCDEF::.";
f036d1
+    hlen -= 2;
f036d1
+  }
f036d1
+  else /* % for URL escaped letters */
f036d1
+    l = "0123456789abcdefghijklimnopqrstuvwxyz-_.ABCDEFGHIJKLIMNOPQRSTUVWXYZ%";
f036d1
+
f036d1
+  len = strspn(hostname, l);
f036d1
+  if(hlen != len)
f036d1
+    /* hostname with bad content */
f036d1
+    return CURLUE_MALFORMED_INPUT;
f036d1
+
f036d1
+  return CURLUE_OK;
f036d1
+}
f036d1
+
f036d1
+#define HOSTNAME_END(x) (((x) == '/') || ((x) == '?') || ((x) == '#'))
f036d1
+
f036d1
+static CURLUcode seturl(const char *url, CURLU *u, unsigned int flags)
f036d1
+{
f036d1
+  char *path;
f036d1
+  bool path_alloced = FALSE;
f036d1
+  char *hostname;
f036d1
+  char *query = NULL;
f036d1
+  char *fragment = NULL;
f036d1
+  CURLUcode result;
f036d1
+  bool url_has_scheme = FALSE;
f036d1
+  char schemebuf[MAX_SCHEME_LEN];
f036d1
+  char *schemep;
f036d1
+  size_t schemelen = 0;
f036d1
+  size_t urllen;
f036d1
+  const struct Curl_handler *h = NULL;
f036d1
+
f036d1
+  if(!url)
f036d1
+    return CURLUE_MALFORMED_INPUT;
f036d1
+
f036d1
+  /*************************************************************
f036d1
+   * Parse the URL.
f036d1
+   ************************************************************/
f036d1
+  /* allocate scratch area */
f036d1
+  urllen = strlen(url);
f036d1
+  path = u->scratch = malloc(urllen * 2 + 2);
f036d1
+  if(!path)
f036d1
+    return CURLUE_OUT_OF_MEMORY;
f036d1
+
f036d1
+  hostname = &path[urllen + 1];
f036d1
+  hostname[0] = 0;
f036d1
+
f036d1
+  /* MSDOS/Windows style drive prefix, eg c: in c:foo */
f036d1
+#define STARTS_WITH_DRIVE_PREFIX(str) \
f036d1
+  ((('a' <= str[0] && str[0] <= 'z') || \
f036d1
+    ('A' <= str[0] && str[0] <= 'Z')) && \
f036d1
+   (str[1] == ':'))
f036d1
+
f036d1
+  /* MSDOS/Windows style drive prefix, optionally with
f036d1
+   * a '|' instead of ':', followed by a slash or NUL */
f036d1
+#define STARTS_WITH_URL_DRIVE_PREFIX(str) \
f036d1
+  ((('a' <= (str)[0] && (str)[0] <= 'z') || \
f036d1
+    ('A' <= (str)[0] && (str)[0] <= 'Z')) && \
f036d1
+   ((str)[1] == ':' || (str)[1] == '|') && \
f036d1
+   ((str)[2] == '/' || (str)[2] == '\\' || (str)[2] == 0))
f036d1
+
f036d1
+  if(Curl_is_absolute_url(url, schemebuf, sizeof(schemebuf))) {
f036d1
+    url_has_scheme = TRUE;
f036d1
+    schemelen = strlen(schemebuf);
f036d1
+  }
f036d1
+
f036d1
+  /* handle the file: scheme */
f036d1
+  if(url_has_scheme && strcasecompare(schemebuf, "file")) {
f036d1
+    /* path has been allocated large anough to hold this */
f036d1
+    strcpy(path, &url[5]);
f036d1
+
f036d1
+    hostname = NULL; /* no host for file: URLs */
f036d1
+    u->scheme = strdup("file");
f036d1
+    if(!u->scheme)
f036d1
+      return CURLUE_OUT_OF_MEMORY;
f036d1
+
f036d1
+    /* Extra handling URLs with an authority component (i.e. that start with
f036d1
+     * "file://")
f036d1
+     *
f036d1
+     * We allow omitted hostname (e.g. file:/<path>) -- valid according to
f036d1
+     * RFC 8089, but not the (current) WHAT-WG URL spec.
f036d1
+     */
f036d1
+    if(path[0] == '/' && path[1] == '/') {
f036d1
+      /* swallow the two slashes */
f036d1
+      char *ptr = &path[2];
f036d1
+
f036d1
+      /*
f036d1
+       * According to RFC 8089, a file: URL can be reliably dereferenced if:
f036d1
+       *
f036d1
+       *  o it has no/blank hostname, or
f036d1
+       *
f036d1
+       *  o the hostname matches "localhost" (case-insensitively), or
f036d1
+       *
f036d1
+       *  o the hostname is a FQDN that resolves to this machine.
f036d1
+       *
f036d1
+       * For brevity, we only consider URLs with empty, "localhost", or
f036d1
+       * "127.0.0.1" hostnames as local.
f036d1
+       *
f036d1
+       * Additionally, there is an exception for URLs with a Windows drive
f036d1
+       * letter in the authority (which was accidentally omitted from RFC 8089
f036d1
+       * Appendix E, but believe me, it was meant to be there. --MK)
f036d1
+       */
f036d1
+      if(ptr[0] != '/' && !STARTS_WITH_URL_DRIVE_PREFIX(ptr)) {
f036d1
+        /* the URL includes a host name, it must match "localhost" or
f036d1
+           "127.0.0.1" to be valid */
f036d1
+        if(!checkprefix("localhost/", ptr) &&
f036d1
+           !checkprefix("127.0.0.1/", ptr)) {
f036d1
+          /* Invalid file://hostname/, expected localhost or 127.0.0.1 or
f036d1
+             none */
f036d1
+          return CURLUE_MALFORMED_INPUT;
f036d1
+        }
f036d1
+        ptr += 9; /* now points to the slash after the host */
f036d1
+      }
f036d1
+
f036d1
+      path = ptr;
f036d1
+    }
f036d1
+
f036d1
+#if !defined(MSDOS) && !defined(WIN32) && !defined(__CYGWIN__)
f036d1
+    /* Don't allow Windows drive letters when not in Windows.
f036d1
+     * This catches both "file:/c:" and "file:c:" */
f036d1
+    if(('/' == path[0] && STARTS_WITH_URL_DRIVE_PREFIX(&path[1])) ||
f036d1
+       STARTS_WITH_URL_DRIVE_PREFIX(path)) {
f036d1
+      /* File drive letters are only accepted in MSDOS/Windows */
f036d1
+      return CURLUE_MALFORMED_INPUT;
f036d1
+    }
f036d1
+#else
f036d1
+    /* If the path starts with a slash and a drive letter, ditch the slash */
f036d1
+    if('/' == path[0] && STARTS_WITH_URL_DRIVE_PREFIX(&path[1])) {
f036d1
+      /* This cannot be done with strcpy, as the memory chunks overlap! */
f036d1
+      memmove(path, &path[1], strlen(&path[1]) + 1);
f036d1
+    }
f036d1
+#endif
f036d1
+
f036d1
+  }
f036d1
+  else {
f036d1
+    /* clear path */
f036d1
+    const char *p;
f036d1
+    const char *hostp;
f036d1
+    size_t len;
f036d1
+    path[0] = 0;
f036d1
+
f036d1
+    if(url_has_scheme) {
f036d1
+      int i = 0;
f036d1
+      p = &url[schemelen + 1];
f036d1
+      while(p && (*p == '/') && (i < 4)) {
f036d1
+        p++;
f036d1
+        i++;
f036d1
+      }
f036d1
+      if((i < 1) || (i>3))
f036d1
+        /* less than one or more than three slashes */
f036d1
+        return CURLUE_MALFORMED_INPUT;
f036d1
+
f036d1
+      schemep = schemebuf;
f036d1
+      if(!Curl_builtin_scheme(schemep) &&
f036d1
+         !(flags & CURLU_NON_SUPPORT_SCHEME))
f036d1
+        return CURLUE_UNSUPPORTED_SCHEME;
f036d1
+
f036d1
+      if(junkscan(schemep))
f036d1
+        return CURLUE_MALFORMED_INPUT;
f036d1
+    }
f036d1
+    else {
f036d1
+      /* no scheme! */
f036d1
+
f036d1
+      if(!(flags & CURLU_DEFAULT_SCHEME))
f036d1
+        return CURLUE_MALFORMED_INPUT;
f036d1
+      schemep = (char *) DEFAULT_SCHEME;
f036d1
+
f036d1
+      /*
f036d1
+       * The URL was badly formatted, let's try without scheme specified.
f036d1
+       */
f036d1
+      p = url;
f036d1
+    }
f036d1
+    hostp = p; /* host name starts here */
f036d1
+
f036d1
+    while(*p && !HOSTNAME_END(*p)) /* find end of host name */
f036d1
+      p++;
f036d1
+
f036d1
+    len = p - hostp;
f036d1
+    if(!len)
f036d1
+      return CURLUE_MALFORMED_INPUT;
f036d1
+
f036d1
+    memcpy(hostname, hostp, len);
f036d1
+    hostname[len] = 0;
f036d1
+
f036d1
+    len = strlen(p);
f036d1
+    memcpy(path, p, len);
f036d1
+    path[len] = 0;
f036d1
+
f036d1
+    u->scheme = strdup(schemep);
f036d1
+    if(!u->scheme)
f036d1
+      return CURLUE_OUT_OF_MEMORY;
f036d1
+  }