Keep the vcxproj source list alphabetical

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

.gitattributes

@@ -0,0 +1,3 @@
+# Resource scripts are Windows tooling input and must stay CRLF: the engine has no
+# encoding guard, so an autocrlf checkout could otherwise flatten them silently.
+*.rc text eol=crlf

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential clang autoconf automake libtool autoconf-archive \
-            zlib1g-dev libssl-dev
+            zlib1g-dev libssl-dev libbrotli-dev libzstd-dev
 
       - name: Configure
         run: |
@@ -50,12 +50,17 @@ jobs:
           # committed generated files already let a plain checkout build.
           autoreconf -fi
           ./configure
+          # a missing decoder would silently drop the coding from Accept-Encoding
+          grep -q "define HTS_USEBROTLI 1" config.h
+          grep -q "define HTS_USEZSTD 1" config.h
 
       - name: Build
         run: make -j"$(nproc)"
 
       - name: Test
-        run: make check
+        run: |
+          jobs=$(( $(nproc) * 2 )); [ "$jobs" -le 16 ] || jobs=16
+          make check -j"$jobs"
 
       - name: Print the test log on failure
         if: failure()
@@ -80,7 +85,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential autoconf automake libtool autoconf-archive \
-            zlib1g-dev libssl-dev
+            zlib1g-dev libssl-dev libbrotli-dev libzstd-dev
 
       - name: Configure
         run: |
@@ -99,7 +104,8 @@ jobs:
           sudo find /usr/bin /usr/local/bin -maxdepth 1 -name 'python3*' \
             -exec mv {} {}.hidden \;
           ! command -v python3
-          make check
+          jobs=$(( $(nproc) * 2 )); [ "$jobs" -le 16 ] || jobs=16
+          make check -j"$jobs"
 
       - name: Print the test log on failure
         if: failure()
@@ -120,25 +126,70 @@ jobs:
       - name: Install build dependencies
         run: |
           set -euo pipefail
-          brew install autoconf automake libtool autoconf-archive
+          brew install autoconf automake libtool autoconf-archive brotli zstd
 
       - name: Configure
         run: |
           set -euo pipefail
           ssl="$(brew --prefix openssl@3)"
+          brewp="$(brew --prefix)"
           autoreconf -fi
-          ./configure CPPFLAGS="-I${ssl}/include" LDFLAGS="-L${ssl}/lib"
+          ./configure CPPFLAGS="-I${ssl}/include -I${brewp}/include" \
+            LDFLAGS="-L${ssl}/lib -L${brewp}/lib"
+          grep -q "define HTS_USEBROTLI 1" config.h
+          grep -q "define HTS_USEZSTD 1" config.h
 
       - name: Build
         run: make -j"$(sysctl -n hw.ncpu)"
 
+      - name: Add loopback aliases (macOS lacks 127.0.0.2/.3)
+        # 19_local-connect-fallback needs the dead 127.0.0.2/.3 to refuse
+        # instantly like Linux; alias them onto lo0 so they don't stall to timeout.
+        run: |
+          set -euo pipefail
+          sudo ifconfig lo0 alias 127.0.0.2 up
+          sudo ifconfig lo0 alias 127.0.0.3 up
+
       - name: Test
-        run: make check
+        run: |
+          jobs=$(( $(sysctl -n hw.ncpu) * 2 )); [ "$jobs" -le 16 ] || jobs=16
+          make check -j"$jobs"
 
       - name: Print the test log on failure
         if: failure()
         run: cat tests/test-suite.log 2>/dev/null || true
 
+  # Runtime smoke of the WebHTTrack launcher on macOS: it carries a Darwin-only
+  # browser path (open -W) and nothing else exercises htsserver. Install into a
+  # temp prefix, then check webhttrack brings up htsserver and serves the UI.
+  webhttrack-macos:
+    name: webhttrack smoke (macOS arm64)
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install build dependencies
+        run: |
+          set -euo pipefail
+          brew install autoconf automake libtool autoconf-archive brotli zstd
+
+      - name: Build and install into a temp prefix
+        run: |
+          set -euo pipefail
+          ssl="$(brew --prefix openssl@3)"
+          brewp="$(brew --prefix)"
+          autoreconf -fi
+          ./configure CPPFLAGS="-I${ssl}/include -I${brewp}/include" \
+            LDFLAGS="-L${ssl}/lib -L${brewp}/lib" \
+            --prefix="$RUNNER_TEMP/inst"
+          make -j"$(sysctl -n hw.ncpu)"
+          make install
+
+      - name: Smoke-test webhttrack
+        run: bash tests/webhttrack-smoke.sh "$RUNNER_TEMP/inst"
+
   # Portability/hardening: 32-bit (i386) build on the x86-64 runner via multilib
   # -- no extra hardware. Exercises the 32-bit size_t/pointer ABI, where size
   # and bounds math can truncate or wrap in ways 64-bit never reveals (the axis
@@ -159,7 +210,8 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential gcc-multilib autoconf automake libtool \
-            autoconf-archive zlib1g-dev:i386 libssl-dev:i386
+            autoconf-archive zlib1g-dev:i386 libssl-dev:i386 \
+            libbrotli-dev:i386 libzstd-dev:i386
 
       - name: Configure
         run: |
@@ -171,7 +223,9 @@ jobs:
         run: make -j"$(nproc)"
 
       - name: Test
-        run: make check
+        run: |
+          jobs=$(( $(nproc) * 2 )); [ "$jobs" -le 16 ] || jobs=16
+          make check -j"$jobs"
 
       - name: Print the test log on failure
         if: failure()
@@ -198,7 +252,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential autoconf automake libtool autoconf-archive \
-            zlib1g-dev libssl-dev
+            zlib1g-dev libssl-dev libbrotli-dev libzstd-dev
 
       - name: Configure (sanitized)
         run: |
@@ -226,7 +280,9 @@ jobs:
         env:
           ASAN_OPTIONS: detect_leaks=0:abort_on_error=1:halt_on_error=1:strict_string_checks=1:malloc_fill_byte=202:max_malloc_fill_size=2147483647:free_fill_byte=203:max_free_fill_size=2147483647
           UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
-        run: make check
+        run: |
+          jobs=$(( $(nproc) * 2 )); [ "$jobs" -le 16 ] || jobs=16
+          make check -j"$jobs"
 
       - name: Print the test log on failure
         if: failure()
@@ -272,7 +328,8 @@ jobs:
           # 01_engine-* only; zlib-dependent self-tests are named 01_zlib-* and
           # skipped here (uninstrumented libz floods MSan with false positives).
           tests="$(cd tests && ls 01_engine-*.test | tr '\n' ' ')"
-          make check TESTS="$tests"
+          jobs=$(( $(nproc) * 2 )); [ "$jobs" -le 16 ] || jobs=16
+          make check -j"$jobs" TESTS="$tests"
 
       - name: Print the test log on failure
         if: failure()
@@ -297,7 +354,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential clang autoconf automake libtool autoconf-archive \
-            zlib1g-dev libssl-dev
+            zlib1g-dev libssl-dev libbrotli-dev libzstd-dev
 
       - name: Configure (fuzzers, static)
         run: |
@@ -347,7 +404,9 @@ jobs:
         run: make -j"$(nproc)"
 
       - name: Test
-        run: make check
+        run: |
+          jobs=$(( $(nproc) * 2 )); [ "$jobs" -le 16 ] || jobs=16
+          make check -j"$jobs"
 
       - name: Print the test log on failure
         if: failure()
@@ -375,7 +434,7 @@ jobs:
           apt-get install -y --no-install-recommends \
             ca-certificates git \
             build-essential autoconf automake libtool autoconf-archive \
-            zlib1g-dev libssl-dev \
+            zlib1g-dev libssl-dev libbrotli-dev libzstd-dev \
             debhelper devscripts lintian fakeroot
 
       - uses: actions/checkout@v6
@@ -419,7 +478,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             build-essential autoconf automake libtool autoconf-archive \
-            zlib1g-dev libssl-dev
+            zlib1g-dev libssl-dev libbrotli-dev libzstd-dev
 
       - name: distcheck
         run: |
@@ -495,6 +554,16 @@ jobs:
       - name: shfmt
         run: shfmt -d -i 4 $SHELL_SCRIPTS
 
+      # MSBuild rejects a malformed .vcxproj with a bare MSB4025 and no build, so
+      # catch it here in seconds rather than on a Windows runner minutes in.
+      - name: XML well-formedness (MSBuild project files)
+        run: |
+          set -euo pipefail
+          for f in src/*.vcxproj; do
+            python3 -c "import sys,xml.dom.minidom; xml.dom.minidom.parse(sys.argv[1])" "$f"
+            echo "ok $f"
+          done
+
   # Check clang-format on CHANGED LINES ONLY. The engine predates clang-format
   # (it was shaped by an old Visual Studio formatter) and does not round-trip,
   # so we never reformat the whole tree -- only the lines a PR touches.

.github/workflows/codeql.yml

@@ -0,0 +1,63 @@
+# CodeQL static analysis (C). The security-extended suite covers the classes
+# this codebase actually fights: overflows, tainted-size allocs, format bugs.
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    # Weekly re-scan of master so new/updated queries land without a push.
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: analyze (c-cpp)
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      # Upload findings to the repo's code-scanning dashboard.
+      security-events: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install build dependencies
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential autoconf automake libtool autoconf-archive \
+            zlib1g-dev libssl-dev
+
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: c-cpp
+          build-mode: manual
+          queries: security-extended
+          # fopen's umask-controlled 0666 is intended for mirror/cache/log
+          # output; the one credential file (cookies.txt) is kept 0600 on Unix.
+          config: |
+            query-filters:
+              - exclude:
+                  id: cpp/world-writable-file-creation
+
+      # Manual build: CodeQL traces the compiler, so build exactly what ships.
+      - name: Build
+        run: |
+          set -euo pipefail
+          autoreconf -fi
+          ./configure
+          make -j"$(nproc)"
+
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:c-cpp"

.github/workflows/windows-build.yml

@@ -0,0 +1,145 @@
+# Windows build of the engine (VS2022 v143 + vcpkg): libhttrack, the CLI,
+# webhttrack, proxytrack.
+#
+# The autotools CI covers the unix builds; this covers the MSVC one, which had
+# no coverage at all and had drifted (the old .vcproj pinned OpenSSL 1.0.1j).
+# libhttrack.dll is what the WinHTTrack GUI links against.
+name: windows-build
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  libhttrack:
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [x64, Win32]
+        configuration: [Release]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive   # coucal lives in src/coucal
+
+      # Located through vswhere rather than microsoft/setup-msbuild: the repo
+      # only allows GitHub-owned actions.
+      - name: Find MSBuild
+        shell: pwsh
+        run: |
+          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+          $msbuild = & $vswhere -latest -products * -requires Microsoft.Component.MSBuild `
+            -find MSBuild\**\Bin\MSBuild.exe | Select-Object -First 1
+          if (-not $msbuild) { throw "MSBuild not found" }
+          Write-Host "MSBuild: $msbuild"
+          "MSBUILD=$msbuild" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      - name: Enable vcpkg MSBuild integration
+        shell: pwsh
+        run: vcpkg integrate install
+
+      # httrack and webhttrack carry a ProjectReference to libhttrack, so building
+      # them builds it first; proxytrack is standalone.
+      - name: Build
+        shell: pwsh
+        run: |
+          foreach ($proj in @("libhttrack", "httrack", "webhttrack", "proxytrack")) {
+            & $env:MSBUILD "src\$proj.vcxproj" `
+              /m `
+              /p:Configuration=${{ matrix.configuration }} `
+              /p:Platform=${{ matrix.platform }} `
+              /p:VcpkgEnableManifest=true `
+              /flp:LogFile=msbuild-$proj.log`;Verbosity=normal
+            if ($LASTEXITCODE -ne 0) { throw "$proj failed" }
+          }
+
+      # WinHTTrack links src\$(Platform)\$(Configuration)\libhttrack.lib, so the
+      # import lib and the DLL both have to land there under that exact name.
+      - name: Check the binaries landed where they are expected
+        shell: pwsh
+        run: |
+          $dir = "src\${{ matrix.platform }}\${{ matrix.configuration }}"
+          $want = @("libhttrack.dll", "libhttrack.lib", "httrack.exe",
+                    "webhttrack.exe", "proxytrack.exe")
+          foreach ($f in $want) {
+            if (-not (Test-Path "$dir\$f")) { throw "missing $dir\$f" }
+            Write-Host "found $dir\$f"
+          }
+
+      # A CRT split across the exe/DLL boundary links fine and crashes on the
+      # first cross-heap free, so assert both sides import the *same* vcruntime.
+      # Also assert the machine type: Test-Path alone would accept an x64 binary
+      # sitting in the Win32 output dir.
+      - name: Check the CRT is shared across the boundary
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $dir = "src\${{ matrix.platform }}\${{ matrix.configuration }}"
+          $dumpbin = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" `
+            -latest -find VC\Tools\MSVC\**\bin\Host*\*\dumpbin.exe | Select-Object -First 1
+          if (-not $dumpbin) { throw "dumpbin not found" }
+          $wantMachine = if ("${{ matrix.platform }}" -eq "x64") { "x64" } else { "x86" }
+
+          function Get-Crt($path) {
+            $out = & $dumpbin /dependents /headers $path
+            if ($LASTEXITCODE -ne 0) { throw "dumpbin failed on $path" }
+            ,@($out | Select-String -Pattern '^\s*(vcruntime\d+d?\.dll)$' |
+               ForEach-Object { $_.Matches[0].Groups[1].Value.ToLower() })
+          }
+
+          # Negative control: cmd.exe links the old msvcrt, not vcruntime140. If
+          # this came back non-empty the detector would match anything, and the
+          # assertion below would pass on a mismatched CRT too.
+          if ((Get-Crt "$env:SystemRoot\System32\cmd.exe").Count -ne 0) {
+            throw "negative control failed: the vcruntime detector matches anything"
+          }
+
+          $crts = @{}
+          foreach ($f in @("libhttrack.dll", "httrack.exe")) {
+            $crt = Get-Crt "$dir\$f"
+            if ($crt.Count -eq 0) { throw "$f imports no vcruntime: static or mismatched CRT" }
+            $crts[$f] = $crt
+
+            $hdr = & $dumpbin /headers "$dir\$f"
+            if (-not ($hdr | Select-String -SimpleMatch "machine ($wantMachine)")) {
+              throw "$f is not $wantMachine"
+            }
+            Write-Host "$f -> $($crt -join ',') ($wantMachine)"
+          }
+
+          $a = $crts["libhttrack.dll"] | Sort-Object
+          $b = $crts["httrack.exe"] | Sort-Object
+          if (Compare-Object $a $b) {
+            throw "CRT mismatch across the boundary: libhttrack.dll=$a httrack.exe=$b"
+          }
+
+      # The engine self-tests exercise the codecs the DLL was linked with: a
+      # missing brotli/zstd decoder shows up here, not just at link time.
+      - name: Run the content-coding self-tests
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $exe = "src\${{ matrix.platform }}\${{ matrix.configuration }}\httrack.exe"
+          $tmp = New-Item -ItemType Directory -Path (Join-Path $env:RUNNER_TEMP "st")
+          foreach ($t in @("acceptencoding", "contentcodings")) {
+            $out = & $exe -O NUL "-#test=$t" $tmp.FullName run
+            if ($LASTEXITCODE -ne 0) { throw "$t failed" }
+            if (-not ($out | Select-String -SimpleMatch "$t self-test OK")) {
+              throw "$t did not report OK: $out"
+            }
+            Write-Host ($out -join "`n")
+          }
+
+      - name: Upload MSBuild logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: msbuild-${{ matrix.platform }}-${{ matrix.configuration }}
+          path: msbuild-*.log
+          if-no-files-found: ignore

.gitignore

@@ -34,8 +34,9 @@ Makefile
 *.so.*
 *.a
 
-# make dist output.
+# make dist output; dist/ holds httrack-gh-release staging artifacts.
 /httrack-*.tar.gz
+/dist/
 
 # Editor / autotools backup files.
 *~

AGENTS.md

@@ -6,8 +6,19 @@ the operational checklist: toolchain, invariants, and how to ship a change.
 ## Build & test
 - Fresh clone first: `git submodule update --init src/coucal`
 - `./bootstrap` (regenerates `configure` via `autoreconf`; needs autoconf,
-  automake, libtool), then `bash configure && make && make check`. Or run
+  automake, libtool), then `bash configure && make -j"$(nproc)" && make check
-  `sh build.sh` to do bootstrap + configure + make in one shot.
+  -j"$(nproc)"`. Always pass `-j` to `make check`: the suite runs under
+  automake's parallel harness and each crawl test binds its own ephemeral-port
+  server, so `-j` never contends and a multi-minute serial run drops to
+  seconds. A new `.test` added to `$(TESTS)` is scheduled onto a free worker
+  automatically; only a test slower than the current longest raises the floor.
+  On a few-core Linux box, `-j` at 2x the core count is faster still: the tests
+  spend much of their wall time asleep (server trickles, httrack self-pacing),
+  so an idle core covers a sleeping one. CI uses `min(2*cores, 16)` on every
+  platform, macOS included: the test server raises its listen backlog
+  (`request_queue_size`) so macOS/BSD don't drop connections under a parallel
+  `-c16` bigcrawl the way Python's default backlog of 5 did.
+  Or run `sh build.sh` to do bootstrap + configure + make in one shot.
 
 ## Hard invariants
 - **Generated autotools files are NOT in git.** `configure`, every

CLAUDE.local.md

@@ -0,0 +1 @@
+/home/roche/git/httrack-works/CLAUDE.httrack.local.md

README

@@ -40,7 +40,6 @@ These are the principals limits of HTTrack for that moment. Note that we did not
 that would have solved them.
 
 - Several scripts generating complex filenames may not find them (ex: img.src='image'+a+Mobj.dst+'.gif')
-- Some java classes may not find some files on them (class included)
 - Cgi-bin links may not work properly in some cases (parameters needed). To avoid them: use filters like -*cgi-bin*
 
 

configure.ac

@@ -1,6 +1,6 @@
 AC_PREREQ([2.71])
 
-AC_INIT([httrack], [3.49.11], [roche+packaging@httrack.com], [httrack], [http://www.httrack.com/])
+AC_INIT([httrack], [3.49.12], [roche+packaging@httrack.com], [httrack], [http://www.httrack.com/])
 AC_COPYRIGHT([
 HTTrack Website Copier, Offline Browser for Windows and Unix
 Copyright (C) 1998-2015 Xavier Roche and other contributors
@@ -29,11 +29,11 @@ AC_CONFIG_SRCDIR(src/httrack.c)
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_HEADERS(config.h)
 AM_INIT_AUTOMAKE([subdir-objects])
-# 3:3:0: 3.49.11 only adds enum values, macros and inline helpers to the
+# 3:4:0: 3.49.12 tail-appends one field (why_url) to httrackp and otherwise only
-# installed headers (no struct layout or exported signature changed vs
+# deletes dead comments; no struct layout or exported signature broke vs 3.49.11,
-# 3.49.10), so it stays soname .so.3; bump revision.
+# so it stays soname .so.3; bump revision.
 # (3:0:0 was the htsblk mime-buffer widening, the ABI break that moved .so.2 -> .so.3.)
-VERSION_INFO="3:3:0"
+VERSION_INFO="3:4:0"
 AM_MAINTAINER_MODE
 AC_USE_SYSTEM_EXTENSIONS
 
@@ -64,16 +64,6 @@ AC_SUBST(LT_CV_OBJDIR,$lt_cv_objdir)
 # Export version info
 AC_SUBST(VERSION_INFO)
 
-# Versioned plugin name for dlopen() in hts_create_opt(); soname major is
-# libtool's current - age, so this tracks VERSION_INFO bumps automatically.
-HTS_SONAME_MAJOR=$((${VERSION_INFO%%:*} - ${VERSION_INFO##*:}))
-case "$host_os" in
-darwin*) HTS_LIBHTSJAVA_NAME="libhtsjava.$HTS_SONAME_MAJOR.dylib" ;;
-*) HTS_LIBHTSJAVA_NAME="libhtsjava.so.$HTS_SONAME_MAJOR" ;;
-esac
-AC_DEFINE_UNQUOTED([HTS_LIBHTSJAVA_NAME], ["$HTS_LIBHTSJAVA_NAME"],
-  [Versioned libhtsjava runtime name, derived from VERSION_INFO])
-
 ### Default CFLAGS
 DEFAULT_CFLAGS="-Wall -Wformat -Wformat-security \
 -Wmultichar -Wwrite-strings -Wcast-qual -Wcast-align \
@@ -102,7 +92,8 @@ AX_CHECK_COMPILE_FLAG([-Wignored-qualifiers], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -
 AX_CHECK_COMPILE_FLAG([-Werror=attribute-warning], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -Werror=attribute-warning"])
 AX_CHECK_COMPILE_FLAG([-Werror=user-defined-warnings], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -Werror=user-defined-warnings"])
 AX_CHECK_COMPILE_FLAG([-fstrict-aliasing -Wstrict-aliasing], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -fstrict-aliasing -Wstrict-aliasing"])
-AX_CHECK_COMPILE_FLAG([-fstack-protector], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -fstack-protector"])
+AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -fstack-protector-strong"],
+	[AX_CHECK_COMPILE_FLAG([-fstack-protector], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -fstack-protector"])])
 AX_CHECK_COMPILE_FLAG([-fstack-clash-protection], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -fstack-clash-protection"])
 AX_CHECK_COMPILE_FLAG([-fcf-protection], [DEFAULT_CFLAGS="$DEFAULT_CFLAGS -fcf-protection"])
 AX_CHECK_LINK_FLAG([-Wl,--discard-all], [DEFAULT_LDFLAGS="$DEFAULT_LDFLAGS -Wl,--discard-all"])
@@ -110,9 +101,16 @@ AX_CHECK_LINK_FLAG([-Wl,--no-undefined], [DEFAULT_LDFLAGS="$DEFAULT_LDFLAGS -Wl,
 AX_CHECK_LINK_FLAG([-Wl,-z,relro,-z,now], [DEFAULT_LDFLAGS="$DEFAULT_LDFLAGS -Wl,-z,relro,-z,now"])
 AX_CHECK_LINK_FLAG([-Wl,-z,noexecstack], [DEFAULT_LDFLAGS="$DEFAULT_LDFLAGS -Wl,-z,noexecstack"])
 
+# Fortify libc calls (=3, else =2) unless the toolchain predefines it; skip
+# sanitizer builds, whose interceptors want the unfortified calls.
+case "$CFLAGS" in
+*-fsanitize=*) ;;
+*) AX_ADD_FORTIFY_SOURCE ;;
+esac
+
 # Force libc back into DT_NEEDED for libraries that reach it only through
-# libhttrack (libhtsjava, the libtest callbacks), but only with a GNU-style
+# libhttrack (the libtest callbacks), but only with a GNU-style linker; Apple
-# linker; Apple ld rejects these flags and links libSystem unconditionally.
+# ld rejects these flags and links libSystem unconditionally.
 AX_CHECK_LINK_FLAG([-Wl,--push-state,--no-as-needed,-lc,--pop-state],
 	[LIBC_FORCE_LINK="-Wl,--push-state,--no-as-needed,-lc,--pop-state"])
 AC_SUBST([LIBC_FORCE_LINK])
@@ -175,6 +173,10 @@ AC_CHECK_HEADERS([execinfo.h])
 ### zlib
 CHECK_ZLIB()
 
+### brotli and zstd content codings (optional)
+CHECK_BROTLI()
+CHECK_ZSTD()
+
 ### OpenSSL is explicitly enabled/disabled ?
 AC_MSG_CHECKING(whether to enable https support)
 AC_ARG_ENABLE([https],

debian/changelog

@@ -1,3 +1,13 @@
+httrack (3.49.12-1) unstable; urgency=medium
+
+  * New upstream release: security and crawl-correctness fixes (remote stack
+    overflow in Content-Type/-Encoding parsing, fuzzer-found parser over-reads,
+    world-readable cookies.txt, filter-pattern denial of service) plus a new
+    --why filter diagnostic; full list in history.txt.
+  * Build with _FORTIFY_SOURCE and -fstack-protector-strong.
+
+ -- Xavier Roche <xavier@debian.org>  Fri, 10 Jul 2026 21:11:09 +0200
+
 httrack (3.49.11-1) unstable; urgency=medium
 
   * New upstream release: crawl correctness and security fixes (network-facing

debian/control

@@ -2,7 +2,7 @@ Source: httrack
 Section: web
 Maintainer: Xavier Roche <roche@httrack.com>
 Standards-Version: 4.7.4
-Build-Depends: debhelper-compat (= 14), autoconf, autoconf-archive, automake, libtool, zlib1g-dev, libssl-dev
+Build-Depends: debhelper-compat (= 14), autoconf, autoconf-archive, automake, libtool, zlib1g-dev, libssl-dev, libbrotli-dev, libzstd-dev
 Rules-Requires-Root: no
 Homepage: http://www.httrack.com
 Vcs-Git: https://github.com/xroche/httrack.git

debian/copyright

@@ -7,9 +7,8 @@ Files: *
 Copyright: 1998-2026 Xavier Roche and other contributors
 License: GPL-3+
 Comment:
- The engine includes contributions from Yann Philippot (src/htsjava.c,
+ htsbasenet.h links against the system OpenSSL library (originally by Eric
- src/htsjava.h). htsbasenet.h links against the system OpenSSL library
+ Young); no OpenSSL/SSLeay code is bundled here.
- (originally by Eric Young); no OpenSSL/SSLeay code is bundled here.
 
 Files: src/minizip/*
 Copyright: 1998-2010 Gilles Vollant

debian/libhttrack-dev.files

@@ -1,5 +1,4 @@
 usr/include/httrack
 usr/lib/*/libhttrack.{so}
-usr/lib/*/libhtsjava.{so}
 usr/share/httrack/libtest
 usr/lib/*/httrack/libtest

debian/libhttrack3.files

@@ -1,3 +1,2 @@
 usr/lib/*/libhttrack.so.3*
-usr/lib/*/libhtsjava.so.3*
 usr/share/httrack/templates

fuzz/Makefile.am

@@ -1,7 +1,7 @@
 # libFuzzer harnesses; built only with --enable-fuzzers (requires clang).
 if FUZZERS
 noinst_PROGRAMS = fuzz-charset fuzz-meta fuzz-idna fuzz-entities \
-	fuzz-unescape fuzz-filters fuzz-url
+	fuzz-unescape fuzz-filters fuzz-url fuzz-header fuzz-cachendx
 endif
 
 AM_CPPFLAGS = \
@@ -23,6 +23,8 @@ fuzz_entities_SOURCES = fuzz-entities.c fuzz.h
 fuzz_unescape_SOURCES = fuzz-unescape.c fuzz.h
 fuzz_filters_SOURCES = fuzz-filters.c fuzz.h
 fuzz_url_SOURCES = fuzz-url.c fuzz.h
+fuzz_header_SOURCES = fuzz-header.c fuzz.h
+fuzz_cachendx_SOURCES = fuzz-cachendx.c fuzz.h
 
 # List corpus files explicitly: automake does not expand EXTRA_DIST globs.
 EXTRA_DIST = README.md run-fuzzers.sh \
@@ -34,5 +36,10 @@ EXTRA_DIST = README.md run-fuzzers.sh \
 	corpus/unescape/percent.txt \
 	corpus/filters/filter.bin corpus/filters/filter-size.bin \
 	corpus/filters/regress-empty-subject-unique.bin \
+	corpus/filters/redos-star-classes.bin \
 	corpus/url/http-url.txt corpus/url/relative-path.txt \
-	corpus/url/regress-file-empty-path.txt corpus/url/regress-long-path-abort.txt
+	corpus/url/regress-file-empty-path.txt corpus/url/regress-long-path-abort.txt \
+	corpus/header/full-response.txt corpus/header/redirect.txt \
+	corpus/cachendx/new-format.txt corpus/cachendx/old-format.txt \
+	corpus/cachendx/regress-overadvance.bin \
+	corpus/cachendx/regress-truncated-entry.bin

fuzz/corpus/cachendx/new-format.txt

@@ -0,0 +1,7 @@
+8
+CACHE-1.1
+28
+Mon, 01 Jan 2024 00:00:00 GMT
+www.example.com
+/index.html
+123

fuzz/corpus/cachendx/old-format.txt

@@ -0,0 +1,5 @@
+3
+1.0
+www.example.com
+/page
+5

fuzz/corpus/cachendx/regress-overadvance.bin

@@ -0,0 +1,2 @@
+32768
+CACHE-1.1

fuzz/corpus/cachendx/regress-truncated-entry.bin

@@ -0,0 +1,5 @@
+8
+CACHE-1.1
+1
+x
+www.example.com

fuzz/corpus/header/full-response.txt

@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: text/html; charset=utf-8
+Content-Length: 1234
+Content-Encoding: gzip
+Last-Modified: Mon, 01 Jan 2024 00:00:00 GMT
+Etag: "abc"
+Location: http://example.com/x
+Set-Cookie: ID=42; path=/; domain=.example.com
+Content-Range: bytes 0-99/100
+Transfer-Encoding: chunked

fuzz/corpus/header/redirect.txt

@@ -0,0 +1,3 @@
+HTTP/1.0 301 Moved
+Location: /elsewhere
+Content-Disposition: attachment; filename="a.pdf"

fuzz/corpus/meta/meta-content-first.html

@@ -0,0 +1 @@
+<meta content="text/html; charset=gb2312" http-equiv="content-type">

fuzz/corpus/meta/meta-truncated.html

@@ -0,0 +1 @@
+<meta charset='utf-8

fuzz/corpus/meta/meta-unquoted.html

@@ -0,0 +1 @@
+<meta   charset = utf-8 />

fuzz/fuzz-cachendx.c

@@ -0,0 +1,65 @@
+/* ------------------------------------------------------------ */
+/*
+HTTrack Website Copier, Offline Browser for Windows and Unix
+Copyright (C) 2026 Xavier Roche and other contributors
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+Ethical use: we kindly ask that you NOT use this software to harvest email
+addresses or to collect any other private information about people. Doing so
+would dishonor our work and waste the many hours we have spent on it.
+
+Please visit our Website: http://www.httrack.com
+*/
+
+/* Fuzz the cache-index (.ndx) parser: a corrupt or truncated index must not
+   walk the length-prefixed cache_brstr/cache_binput scan past the buffer.
+   Mirrors the -#C cache-listing scan (htscoremain.c). */
+#include "fuzz.h"
+#include "htscache.h"
+#include "htslib.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  char *buf = fuzz_strdup(data, size);
+  const char *const end = buf + size;
+  char firstline[256];
+  char *a = buf;
+
+  /* header: two length-prefixed fields (version, last-modified) */
+  a += cache_brstr(a, firstline, sizeof(firstline));
+  a += cache_brstr(a, firstline, sizeof(firstline));
+
+  /* body: newline-delimited host/file/position triples; the length-prefixed
+     scan must stay inside the buffer */
+  while (a != NULL && a < end) {
+    char BIGSTK line[HTS_URLMAXSIZE * 2];
+    char linepos[256];
+    int pos;
+
+    a = strchr(a + 1, '\n');
+    if (a == NULL)
+      break;
+    a++;
+    a += cache_binput(a, end, line, HTS_URLMAXSIZE);
+    a += cache_binput(a, end, line + strlen(line), HTS_URLMAXSIZE);
+    a += cache_binput(a, end, linepos, 200);
+    sscanf(linepos, "%d", &pos);
+    (void) pos;
+  }
+
+  freet(buf);
+  return 0;
+}

fuzz/fuzz-header.c

@@ -0,0 +1,74 @@
+/* ------------------------------------------------------------ */
+/*
+HTTrack Website Copier, Offline Browser for Windows and Unix
+Copyright (C) 2026 Xavier Roche and other contributors
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+Ethical use: we kindly ask that you NOT use this software to harvest email
+addresses or to collect any other private information about people. Doing so
+would dishonor our work and waste the many hours we have spent on it.
+
+Please visit our Website: http://www.httrack.com
+*/
+
+/* Fuzz the HTTP response-header parser (htslib.c): treatfirstline on the
+   status line, treathead on each following header. Both consume raw bytes
+   off the wire and copy fields into fixed htsblk buffers; treathead also
+   mutates its line in place and drives cookie parsing. */
+#include "fuzz.h"
+#include "htslib.h"
+#include "htsbauth.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  char *buf = fuzz_strdup(data, size);
+  htsblk r;
+  t_cookie *cookie = calloct(1, sizeof(*cookie));
+  char *line = malloct(size + 1);
+  char *p = buf;
+  int first = 1;
+
+  memset(&r, 0, sizeof(r));
+  cookie->max_len = (int) sizeof(cookie->data);
+  r.location = malloct(HTS_URLMAXSIZE * 2);
+  r.location[0] = '\0';
+
+  /* feed one header line at a time, as the receive loop does */
+  while (p != NULL && *p != '\0') {
+    char *nl = strchr(p, '\n');
+    size_t n = (nl != NULL) ? (size_t) (nl - p) : strlen(p);
+    size_t i, len = 0;
+
+    /* binput drops every '\r' on the wire; mirror it */
+    for (i = 0; i < n; i++)
+      if (p[i] != '\r')
+        line[len++] = p[i];
+    line[len] = '\0';
+    if (first) {
+      treatfirstline(&r, line);
+      first = 0;
+    } else {
+      treathead(cookie, "www.example.com", "/", &r, line);
+    }
+    p = (nl != NULL) ? nl + 1 : NULL;
+  }
+
+  freet(r.location);
+  freet(line);
+  freet(cookie);
+  freet(buf);
+  return 0;
+}

fuzz/run-fuzzers.sh

@@ -2,8 +2,8 @@
 # Drive every built harness against its seed corpus.
 #   run-fuzzers.sh <build-fuzz-dir> check       deterministic replay (CI smoke)
 #   run-fuzzers.sh <build-fuzz-dir> [seconds]   timed mutation run (discovery)
-# Replay is crash/leak-only and never mutates, so it can't hit strjoker's
+# Replay is crash/leak-only and never mutates; the per-unit -timeout guards
-# catastrophic backtracking; the timed mode can, hence the per-unit -timeout.
+# both modes against pathological slowdowns (e.g. pre-#501 strjoker).
 set -euo pipefail
 
 srcdir=$(cd "$(dirname "$0")" && pwd)

history.txt

@@ -4,6 +4,23 @@ HTTrack Website Copier release history:
 
 This file lists all changes and fixes that have been made for HTTrack
 
+3.49-12
++ New: --why explains which filter rule accepts or rejects a given URL, then exits (#505)
++ Fixed: links carrying raw UTF-8 bytes were fetched double-encoded and 404'd (#516)
++ Fixed: an uncompressed body mislabeled as gzip no longer loses the page (#515)
++ Fixed: remote stack overflow and uninitialized read in Content-Type/-Encoding parsing (#506)
++ Fixed: several over-reads and a leak in the filter, URL and IDNA parsers (#499)
++ Fixed: bound the cache-index (.ndx) parser to its buffer (#507)
++ Fixed: catastrophic backtracking on '*'-heavy filter patterns (#513)
++ Fixed: cookies.txt was created world-readable (#511)
++ Fixed: a single corrupt cache entry no longer aborts the whole mirror (#494)
++ Fixed: cache-reconcile policy was broken for zip caches (#491, #493, #495)
++ Fixed: cancelling a crawl mid type-check no longer orphans .delayed placeholders (#496)
++ Fixed: detect URLs after the first inline script and in mid-tag attributes (#497)
++ Changed: build with _FORTIFY_SOURCE and -fstack-protector-strong (#504)
++ Changed: removed the pre-3.31 (.dat/.ndx) cache import (#512)
++ Changed: multiple internal hardening and build improvements (libFuzzer harnesses, CodeQL, dead-code removal)
+
 3.49-11
 + New: parse robots.txt Allow rules and path wildcards per RFC 9309 (#452)
 + New: advertise deflate in Accept-Encoding and decode deflate responses (#450)

html/faq.html

@@ -609,10 +609,9 @@ most mirrors do work. We still are working to improve the mirror quality of HTTr
 <br>
 
 </a><a NAME="Q2b">Q: <strong>Some Java applets do not work properly!</strong><br>
-A: <em>Java applets may not work in some cases, for example if HTTrack failed to detect all included classes
+A: <em>Java applets may not work in some cases, because HTTrack does not parse compiled class files to find
-or files called within the class file. Sometimes, Java applets need to be online, because remote files are
+the resources they load. Java applets often need to be online anyway, since remote files are fetched directly
-directly caught. Finally, the site structure can be incompatible with the class (always try to keep the original site structure
+at runtime.<br>
-when you want to get Java classes)<br>
 If there is no way to make some classes work properly, you can exclude them with the filters. 
 They will be available, but only online.
 </em>

html/fcguide.html

@@ -243,7 +243,7 @@ Build options:
 Spider options:
   bN accept cookies in cookies.txt (0=do not accept,* 1=accept) (--cookies[=N])
   u  check document type if unknown (cgi,asp..) (u0 don't check, * u1 check but /, u2 check always) (--check-type[=N])
-  j *parse Java Classes (j0 don't parse) (--parse-java[=N])
+  j *parse scripts (j0 don't parse) (--parse-java[=N])
   sN follow robots.txt and meta robots tags (0=never,1=sometimes,* 2=always) (--robots[=N])
  %h  force HTTP/1.0 requests (reduce update features, only for old servers or proxies) (--http-10)
  %B  tolerant requests (accept bogus responses on some servers, but not standard!) (--tolerant)
@@ -417,7 +417,7 @@ site. Specifically, the defauls are:
   X *purge old files after update (X0 keep delete)
   bN  accept cookies in cookies.txt (0=do not accept,* 1=accept)
   u check document type if unknown (cgi,asp..) (u0 don't check, * u1 check but /, u2 check always)
-  j *parse Java Classes (j0 don't parse)
+  j *parse scripts (j0 don't parse)
   sN  follow robots.txt and meta robots tags (0=never,1=sometimes,* 2=always)
   C  create/use a cache for updates and retries (C0 no cache,C1 cache is prioritary,* C2 test update before)
   f *log file mode
@@ -497,9 +497,9 @@ about your browser retaining them.
 <p align=justify> This causes different document types to be analyzed
 differently.
 
-<pre><b><i>  j *parse Java Classes (j0 don't parse) </i></b></pre>
+<pre><b><i>  j *parse scripts (j0 don't parse) </i></b></pre>
 
-<p align=justify> This causes Java class files to be parsed looking for
+<p align=justify> This causes scripts to be parsed looking for
 URLs.
 
 <pre><b><i>  sN  follow robots.txt and meta robots tags (0=never,1=sometimes,* 2=always) </i></b></pre>
@@ -1178,7 +1178,7 @@ accepted and sent back in order to allow access.
 Spider options:
  bN  accept cookies in cookies.txt (0=do not accept,* 1=accept)
  u   check document type if unknown (cgi,asp..) (u0 don't check, * u1 check but /, u2 check always)
- j   *parse Java Classes (j0 don't parse)
+ j   *parse scripts (j0 don't parse)
  sN  follow robots.txt and meta robots tags (0=never,1=sometimes,* 2=always)
  %h  force HTTP/1.0 requests (reduce update features, only for old servers or proxies)
  %B  tolerant requests (accept bogus responses on some servers, but not standard!)
@@ -2451,12 +2451,10 @@ work.  We still are working to improve the mirror quality of HTTrack.
 
 <p align=justify><b>Q: Some Java applets do not work properly! </b>
 
-<p align=justify> A: Java applets may not work in some cases, for
+<p align=justify> A: Java applets may not work in some cases, because
-example if HTTrack failed to detect all included classes or files called
+HTTrack does not parse compiled class files to find the resources they
-within the class file.  Sometimes, Java applets need to be online,
+load.  Java applets often need to be online anyway, since remote files
-because remote files are directly caught.  Finally, the site structure
+are fetched directly at runtime.
-can be incompatible with the class (always try to keep the original site
-structure when you want to get Java classes)
 
 <p align=justify> If there is no way to make some classes work properly,
 you can exclude them with the filters.  They will be available, but only

html/httrack.man.html

@@ -764,9 +764,9 @@ check, * u1 check but /, u2 check always)
 <td width="78%">
 
 
-<p>*parse Java Classes (j0 don t parse, bitmask: |1 parse
+<p>*parse scripts (j0 don t parse, bitmask: |1 parse
-default, |2 don t parse .class |4 don t parse .js |8 don t
+default, |4 don t parse .js |8 don t be aggressive)
-be aggressive) (--parse-java[=N])</p></td></tr>
+(--parse-java[=N])</p></td></tr>
 <tr valign="top" align="left">
 <td width="11%"></td>
 <td width="6%">
@@ -889,8 +889,8 @@ only) (--protocol[=N])</p></td></tr>
 <td width="78%">
 
 
-<p>disable a specific external mime module (-%w htsswf -%w
+<p>disable a specific external mime module (-%w
-htsjava) (--disable-module &lt;param&gt;)</p></td></tr>
+httrack-plugin) (--disable-module &lt;param&gt;)</p></td></tr>
 </table>
 
 <p style="margin-left:11%; margin-top: 1em"><b>Browser
@@ -2175,10 +2175,6 @@ Several scripts generating complex filenames may not find
 them (ex:
 img.src=&rsquo;image&rsquo;+a+Mobj.dst+&rsquo;.gif&rsquo;)</small></p>
 
-<p style="margin-left:11%; margin-top: 1em"><small>- Some
-java classes may not find some files on them (class
-included)</small></p>
-
 <p style="margin-left:11%; margin-top: 1em"><small>-
 Cgi-bin links may not work properly in some cases
 (parameters needed). To avoid them: use filters like

html/options.html

@@ -288,8 +288,8 @@ This option define whether the engine has to abandon a host if a timeout/"too sl
 &P extended parsing, attempt to parse all links (even in unknown tags or Javascript)
 This option activates the extended parsing, that attempt to find links in unknown Html code/javascript
 
-j *parse Java Classes (j0 don't parse)
+j *parse scripts (j0 don't parse)
-This option define whether the engine has to parse java files or not to catch included files
+This option defines whether the engine has to parse scripts or not to catch included files
 
 I *make an index (I0 don't make)
 This option define whether the engine has to generate an index.html on the top directory

html/plug.html

@@ -126,7 +126,6 @@ Note: the <i>Initialization</i>, <i>Main functions</i>, <i>Options handling</i>
 <li>the <tt>htsdefines.h</tt> prototype file, which describes callback function prototypes</li>
 <li>the <tt>htsopt.h</tt> prototype file, which describes the full httrackp* structure</li>
 <li>the <tt>callbacks-example*.c</tt> files given in the httrack archive</li>
-<li>the <tt>htsjava.c</tt> source file (the java class plugin ; overrides 'detect' and 'parse')</li>
 <li>the example given at the end of this document</li>
 </ul>
 

html/step9_opt6.html

@@ -118,8 +118,8 @@ h4 { margin: 0;  font-weight: bold;  font-size: 1.18em; }
   <br>Avoid "never", because the local mirror could be bogus
   </small><br><br>
 <!-- -->
-  <li>Parse java files</li>
+  <li>Parse scripts</li>
-  <br><small>Must the engine parse .java files (java classes) to seek included filenames?
+  <br><small>Must the engine parse scripts to seek included filenames?
   <br>It is checked by default
   </small><br><br>
 <!-- -->

m4/ax_add_fortify_source.m4

@@ -0,0 +1,119 @@
+# ===========================================================================
+#  https://www.gnu.org/software/autoconf-archive/ax_add_fortify_source.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   AX_ADD_FORTIFY_SOURCE
+#
+# DESCRIPTION
+#
+#   Check whether -D_FORTIFY_SOURCE=2 can be added to CPPFLAGS without macro
+#   redefinition warnings, other cpp warnings or linker. Some distributions
+#   (such as Ubuntu or Gentoo Linux) enable _FORTIFY_SOURCE globally in
+#   their compilers, leading to unnecessary warnings in the form of
+#
+#     <command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
+#     <built-in>: note: this is the location of the previous definition
+#
+#   which is a problem if -Werror is enabled. This macro checks whether
+#   _FORTIFY_SOURCE is already defined, and if not, adds -D_FORTIFY_SOURCE=2
+#   to CPPFLAGS.
+#
+#   Newer mingw-w64 msys2 package comes with a bug in
+#   headers-git-7.0.0.5546.d200317d-1. It broke -D_FORTIFY_SOURCE support,
+#   and would need -lssp or -fstack-protector.  See
+#   https://github.com/msys2/MINGW-packages/issues/5803. Try to actually
+#   link it.
+#
+# LICENSE
+#
+#   Copyright (c) 2017 David Seifert <soap@gentoo.org>
+#   Copyright (c) 2019, 2023 Reini Urban <rurban@cpan.org>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.  This file is offered as-is, without any
+#   warranty.
+
+#serial 10
+
+AC_DEFUN([AX_ADD_FORTIFY_SOURCE],[
+    ac_save_cflags=$CFLAGS
+    ac_cwerror_flag=yes
+    AX_CHECK_COMPILE_FLAG([-Werror],[CFLAGS="$CFLAGS -Werror"])
+    ax_add_fortify_3_failed=
+    AC_MSG_CHECKING([whether to add -D_FORTIFY_SOURCE=3 to CPPFLAGS])
+    AC_LINK_IFELSE([
+        AC_LANG_PROGRAM([],
+            [[
+                #ifndef _FORTIFY_SOURCE
+                    return 0;
+                #else
+                    _FORTIFY_SOURCE_already_defined;
+                #endif
+            ]]
+        )],
+        AC_LINK_IFELSE([
+            AC_LANG_SOURCE([[
+                #define _FORTIFY_SOURCE 3
+                #include <string.h>
+                int main(void) {
+                    char *s = " ";
+                    strcpy(s, "x");
+                    return strlen(s)-1;
+                }
+              ]]
+            )],
+            [
+              AC_MSG_RESULT([yes])
+              CFLAGS=$ac_save_cflags
+              CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCE=3"
+            ], [
+              AC_MSG_RESULT([no])
+              ax_add_fortify_3_failed=1
+            ],
+        ),
+        [
+          AC_MSG_RESULT([no])
+          ax_add_fortify_3_failed=1
+        ])
+    if test -n "$ax_add_fortify_3_failed"
+    then
+    AC_MSG_CHECKING([whether to add -D_FORTIFY_SOURCE=2 to CPPFLAGS])
+    AC_LINK_IFELSE([
+        AC_LANG_PROGRAM([],
+            [[
+                #ifndef _FORTIFY_SOURCE
+                    return 0;
+                #else
+                    _FORTIFY_SOURCE_already_defined;
+                #endif
+            ]]
+        )],
+        AC_LINK_IFELSE([
+            AC_LANG_SOURCE([[
+                #define _FORTIFY_SOURCE 2
+                #include <string.h>
+                int main(void) {
+                    char *s = " ";
+                    strcpy(s, "x");
+                    return strlen(s)-1;
+                }
+              ]]
+            )],
+            [
+              AC_MSG_RESULT([yes])
+              CFLAGS=$ac_save_cflags
+              CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCE=2"
+            ], [
+              AC_MSG_RESULT([no])
+              CFLAGS=$ac_save_cflags
+            ],
+        ),
+        [
+          AC_MSG_RESULT([no])
+          CFLAGS=$ac_save_cflags
+        ])
+    fi
+])

m4/check_codecs.m4

@@ -0,0 +1,66 @@
+dnl @synopsis CHECK_BROTLI()
+dnl @synopsis CHECK_ZSTD()
+dnl
+dnl Look for libbrotlidec and libzstd, the decoders for the "br" and "zstd"
+dnl HTTP content codings. Both are optional: a missing library only drops the
+dnl coding from Accept-Encoding. --with-brotli=DIR / --with-zstd=DIR point at a
+dnl prefix; --without-brotli / --without-zstd disable the coding; the default
+dnl is to use the library when it is found.
+dnl
+dnl Define HTS_USEBROTLI / HTS_USEZSTD to 1 or 0, and substitute BROTLI_LIBS /
+dnl ZSTD_LIBS.
+
+dnl CHECK_CODEC(name, NAME, header, library, symbol, companion-libs)
+AC_DEFUN([CHECK_CODEC], [
+AC_ARG_WITH([$1],
+	[AS_HELP_STRING([--with-$1@<:@=DIR@:>@],[Enable the $1 content coding @<:@default=auto@:>@])],
+	[codec_want=$withval], [codec_want=auto])
+$2_LIBS=""
+codec_have=no
+if test "$codec_want" != "no"; then
+	codec_old_cppflags="$CPPFLAGS"
+	codec_old_ldflags="$LDFLAGS"
+	codec_dir=no
+	if test "$codec_want" != "yes" -a "$codec_want" != "auto"; then
+		codec_dir=yes
+		# An explicit prefix is authoritative: if the header is not under
+		# it, error rather than silently pick a system copy.
+		if test ! -f "$codec_want/include/$3"; then
+			AC_MSG_ERROR([$1 requested at $codec_want but $codec_want/include/$3 is missing])
+		fi
+		CPPFLAGS="$CPPFLAGS -I$codec_want/include"
+		LDFLAGS="$LDFLAGS -L$codec_want/lib"
+	fi
+	AC_CHECK_HEADER([$3], [codec_h=yes], [codec_h=no])
+	AC_CHECK_LIB([$4], [$5], [codec_lib=yes], [codec_lib=no], [$6])
+	CPPFLAGS="$codec_old_cppflags"
+	LDFLAGS="$codec_old_ldflags"
+	if test "$codec_h" = "yes" -a "$codec_lib" = "yes"; then
+		codec_have=yes
+		$2_LIBS="-l$4 $6"
+		if test "$codec_dir" = "yes"; then
+			$2_LIBS="-L$codec_want/lib -l$4 $6"
+			# The rest of configure still needs the header path.
+			CPPFLAGS="$CPPFLAGS -I$codec_want/include"
+		fi
+	elif test "$codec_want" != "auto"; then
+		AC_MSG_ERROR([$1 requested but lib$4/$3 not found])
+	fi
+fi
+AC_MSG_CHECKING([whether to enable the $1 content coding])
+AC_MSG_RESULT([$codec_have])
+if test "$codec_have" = "yes"; then
+	AC_DEFINE([HTS_USE$2], [1], [Define to 1 to decode the $1 content coding])
+else
+	AC_DEFINE([HTS_USE$2], [0], [Define to 1 to decode the $1 content coding])
+fi
+AC_SUBST([$2_LIBS])
+AC_SUBST([$2_ENABLED], [$codec_have])
+])
+
+dnl brotlidec needs brotlicommon (the static dictionary) for a fully-static link.
+AC_DEFUN([CHECK_BROTLI],
+	[CHECK_CODEC([brotli], [BROTLI], [brotli/decode.h], [brotlidec], [BrotliDecoderDecompressStream], [-lbrotlicommon])])
+
+AC_DEFUN([CHECK_ZSTD],
+	[CHECK_CODEC([zstd], [ZSTD], [zstd.h], [zstd], [ZSTD_decompressStream], [])])

man/httrack.1

@@ -3,7 +3,7 @@
 .\"
 .\" This file is generated by man/makeman.sh; do not edit by hand.
 .\" SPDX-License-Identifier: GPL-3.0-or-later
-.TH httrack 1 "27 June 2026" "httrack website copier"
+.TH httrack 1 "14 July 2026" "httrack website copier"
 .SH NAME
 httrack \- offline browser : copy websites to a local directory
 .SH SYNOPSIS
@@ -51,6 +51,7 @@ httrack \- offline browser : copy websites to a local directory
 [ \fB\-%T, \-\-utf8\-conversion\fR ]
 [ \fB\-bN, \-\-cookies[=N]\fR ]
 [ \fB\-%K, \-\-cookies\-file\fR ]
+[ \fB\-%Y, \-\-why\fR ]
 [ \fB\-u, \-\-check\-type[=N]\fR ]
 [ \fB\-j, \-\-parse\-java[=N]\fR ]
 [ \fB\-sN, \-\-robots[=N]\fR ]
@@ -134,7 +135,7 @@ continue an interrupted mirror using the cache (\-\-continue)
 mirror ALL links located in the first level pages (mirror links) (\-\-mirrorlinks)
 .SS Proxy options:
 .IP \-P
-proxy use (\-P proxy:port or \-P user:pass@proxy:port) (\-\-proxy <param>)
+proxy use (\-P [socks5://][user:pass@]proxy:port) (\-\-proxy <param>)
 .IP \-%f
 *use proxy for ftp (f0 don't use) (\-\-httpproxy\-ftp[=N])
 .IP \-%b
@@ -218,10 +219,12 @@ links conversion to UTF\-8 (\-\-utf8\-conversion)
 accept cookies in cookies.txt (0=do not accept,* 1=accept) (\-\-cookies[=N])
 .IP \-%K
 load extra cookies from a Netscape cookies.txt (\-\-cookies\-file <param>)
+.IP \-%Y
+explain which filter rule accepts or rejects a URL, then exit (\-\-why <param>)
 .IP \-u
 check document type if unknown (cgi,asp..) (u0 don't check, * u1 check but /, u2 check always) (\-\-check\-type[=N])
 .IP \-j
-*parse Java Classes (j0 don't parse, bitmask: |1 parse default, |2 don't parse .class |4 don't parse .js |8 don't be aggressive) (\-\-parse\-java[=N])
+*parse scripts (j0 don't parse, bitmask: |1 parse default, |4 don't parse .js |8 don't be aggressive) (\-\-parse\-java[=N])
 .IP \-sN
 follow robots.txt and meta robots tags (0=never,1=sometimes,* 2=always, 3=always (even strict rules)) (\-\-robots[=N])
 .IP \-%h
@@ -245,7 +248,7 @@ can also be used to force a specific file type: \-\-assume foo.cgi=text/html
 .IP \-@iN
 internet protocol (0=both ipv6+ipv4, 4=ipv4 only, 6=ipv6 only) (\-\-protocol[=N])
 .IP \-%w
-disable a specific external mime module (\-%w htsswf \-%w htsjava) (\-\-disable\-module <param>)
+disable a specific external mime module (\-%w httrack\-plugin) (\-\-disable\-module <param>)
 .SS Browser ID:
 .IP \-F
 user\-agent field sent in HTTP headers (\-F "user\-agent name") (\-\-user\-agent <param>)
@@ -511,8 +514,6 @@ that would have solved them.
 .SM
 \- Several scripts generating complex filenames may not find them (ex: img.src='image'+a+Mobj.dst+'.gif')
 .SM
-\- Some java classes may not find some files on them (class included)
-.SM
 \- Cgi\-bin links may not work properly in some cases (parameters needed). To avoid them: use filters like \-*cgi\-bin*
 .SH BUGS
 Please reports bugs to

src/Makefile.am

@@ -44,7 +44,7 @@ httrack_LDFLAGS = $(AM_LDFLAGS) $(LDFLAGS_PIE)
 proxytrack_LDFLAGS = $(AM_LDFLAGS) $(LDFLAGS_PIE)
 htsserver_LDFLAGS = $(AM_LDFLAGS) $(LDFLAGS_PIE)
 
-lib_LTLIBRARIES = libhttrack.la libhtsjava.la
+lib_LTLIBRARIES = libhttrack.la
 
 htsserver_SOURCES = htsserver.c htsserver.h htsweb.c htsweb.h
 proxytrack_SOURCES = proxy/main.c \
@@ -61,7 +61,7 @@ libhttrack_la_SOURCES =  htscore.c htsparse.c htsback.c htscache.c \
 	htshelp.c htslib.c htscoremain.c \
 	htsname.c htsrobots.c htstools.c htswizard.c \
 	htsalias.c htsthread.c htsindex.c htsbauth.c \
-	htsmd5.c htszlib.c htswrap.c htsconcat.c \
+	htsmd5.c htscodec.c htsproxy.c htszlib.c htswrap.c htsconcat.c \
 	htsmodules.c htscharset.c punycode.c htsencoding.c htssniff.c \
 	md5.c \
 	minizip/ioapi.c minizip/mztools.c minizip/unzip.c minizip/zip.c \
@@ -72,25 +72,20 @@ libhttrack_la_SOURCES =  htscore.c htsparse.c htsback.c htscache.c \
 	htshelp.h htsindex.h htslib.h htsmd5.h \
 	htsmodules.h htsname.h htsnet.h htssniff.h \
 	htsopt.h htsrobots.h htsthread.h  \
-	htstools.h htswizard.h htswrap.h htszlib.h  \
+	htstools.h htswizard.h htswrap.h htscodec.h htsproxy.h htszlib.h  \
 	htsstrings.h htsarrays.h httrack-library.h \
 	htscharset.h punycode.h htsencoding.h \
 	htsentities.h htsentities.sh htsbasiccharsets.sh htscodepages.h \
 	md5.h coucal/murmurhash3.h \
 	minizip/crypt.h minizip/ioapi.h minizip/mztools.h minizip/unzip.h minizip/zip.h
-libhttrack_la_LIBADD = $(THREADS_LIBS) $(ZLIB_LIBS) $(OPENSSL_LIBS) $(DL_LIBS) $(SOCKET_LIBS) $(ICONV_LIBS)
+libhttrack_la_LIBADD = $(THREADS_LIBS) $(ZLIB_LIBS) $(BROTLI_LIBS) $(ZSTD_LIBS) $(OPENSSL_LIBS) $(DL_LIBS) $(SOCKET_LIBS) $(ICONV_LIBS)
 libhttrack_la_CFLAGS = $(AM_CFLAGS) -DLIBHTTRACK_EXPORTS -DZLIB_CONST
 libhttrack_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(VERSION_INFO)
 
-libhtsjava_la_SOURCES = htsjava.c htsjava.h
-libhtsjava_la_LIBADD = $(THREADS_LIBS) $(DL_LIBS) libhttrack.la
-# This thin JNI wrapper reaches libc only through libhttrack, so the direct
-# libc edge is dropped from DT_NEEDED (library-not-linked-against-libc). Force
-# libc back as a dependency; configure gates the flag since only a GNU-style
-# linker accepts it (LIBC_FORCE_LINK is empty on e.g. macOS).
-libhtsjava_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(VERSION_INFO) $(LIBC_FORCE_LINK)
-
 EXTRA_DIST = httrack.h webhttrack \
+		version.rc \
+		libhttrack.rc \
+		httrack.rc \
 		coucal/murmurhash3.h.diff \
 		coucal/murmurhash3.h.orig \
 		minizip/iowin32.c \
@@ -113,13 +108,13 @@ EXTRA_DIST = httrack.h webhttrack \
 		proxy/proxystrings.h \
 		proxy/proxytrack.h \
 		proxy/store.h \
-		proxy/proxytrack.vcproj \
 		coucal/LICENSE \
 		coucal/Makefile \
 		coucal/README.md \
 		coucal/sample.c \
 		coucal/tests.c \
-		htsjava.vcproj \
+		vcpkg.json \
-		httrack.dsp httrack.dsw httrack.vcproj \
+		httrack.vcxproj \
-		libhttrack.dsp libhttrack.dsw libhttrack.vcproj \
+		libhttrack.vcxproj \
-		webhttrack.dsp webhttrack.dsw webhttrack.vcproj
+		proxytrack.vcxproj \
+		webhttrack.vcxproj

src/htsalias.c

@@ -114,6 +114,8 @@ const char *hts_optalias[][4] = {
    "strip [host/pattern=]key1,key2,... from URLs"},
   {"cookies-file", "-%K", "param1",
    "load extra cookies from a Netscape cookies.txt"},
+  {"why", "-%Y", "param1",
+   "explain which filter rule accepts or rejects a URL, then exit"},
   {"pause", "-%G", "param1",
    "random pause of MIN[:MAX] seconds between files"},
   {"generate-errors", "-o", "single", ""},

src/htsback.c

@@ -44,6 +44,8 @@ Please visit our Website: http://www.httrack.com
 #include "htsback.h"
 
 #include "htsftp.h"
+#include "htscodec.h"
+#include "htsproxy.h"
 #if HTS_USEZLIB
 #include "htszlib.h"
 #else
@@ -68,6 +70,15 @@ static int slot_can_be_cached_on_disk(const lien_back * back);
 static int slot_can_be_cleaned(const lien_back * back);
 static int slot_can_be_finalized(httrackp * opt, const lien_back * back);
 
+/* Which hard quota, if any, is currently aborting the mirror. */
+typedef enum {
+  HTS_MIRROR_LIMIT_NONE = 0,
+  HTS_MIRROR_LIMIT_SIZE,
+  HTS_MIRROR_LIMIT_TIME,
+} hts_mirror_limit;
+
+static hts_mirror_limit back_mirror_limit(httrackp *opt);
+
 struct_back *back_new(httrackp *opt, int back_max) {
   int i;
   struct_back *sback = calloct(1, sizeof(struct_back));
@@ -524,12 +535,13 @@ int back_nsoc_overall(const struct_back * sback) {
 
 /* generate temporary file on lien_back */
 /* Note: utf-8 */
-static int create_back_tmpfile(httrackp * opt, lien_back *const back) {
+static int create_back_tmpfile(httrackp *opt, lien_back *const back,
+                               const char *ext) {
   // do not use tempnam() but a regular filename
   back->tmpfile_buffer[0] = '\0';
   if (back->url_sav != NULL && back->url_sav[0] != '\0') {
-    snprintf(back->tmpfile_buffer, sizeof(back->tmpfile_buffer), "%s.z", 
+    snprintf(back->tmpfile_buffer, sizeof(back->tmpfile_buffer), "%s.%s",
-             back->url_sav);
+             back->url_sav, ext);
     back->tmpfile = back->tmpfile_buffer;
     if (structcheck(back->tmpfile) != 0) {
       hts_log_print(opt, LOG_WARNING, "can not create directory to %s",
@@ -537,9 +549,8 @@ static int create_back_tmpfile(httrackp * opt, lien_back *const back) {
       return -1;
     }
   } else {
-    snprintf(back->tmpfile_buffer, sizeof(back->tmpfile_buffer),
+    snprintf(back->tmpfile_buffer, sizeof(back->tmpfile_buffer), "%s/tmp%d.%s",
-             "%s/tmp%d.z", StringBuff(opt->path_html_utf8),
+             StringBuff(opt->path_html_utf8), opt->state.tmpnameid++, ext);
-             opt->state.tmpnameid++);
     back->tmpfile = back->tmpfile_buffer;
   }
   /* OK */
@@ -547,6 +558,39 @@ static int create_back_tmpfile(httrackp * opt, lien_back *const back) {
   return 0;
 }
 
+/* Move src onto dst; RENAME does not clobber an existing target on Windows. */
+static hts_boolean replace_file(const char *src, const char *dst) {
+  if (RENAME(src, dst) == 0)
+    return HTS_TRUE;
+  (void) UNLINK(dst);
+  return RENAME(src, dst) == 0 ? HTS_TRUE : HTS_FALSE;
+}
+
+/* Commit or restore a re-fetch backup (#77 follow-up): a re-fetch over an
+   existing file moved the good copy to back->tmpfile before truncating url_sav.
+   commit keeps the new file and drops the backup; else restore it so an aborted
+   transfer leaves the previous copy intact. Skips the zlib .z temp. */
+static void back_finalize_backup(httrackp *opt, lien_back *const back,
+                                 const hts_boolean commit) {
+  if (back->tmpfile == NULL || back->r.compressed)
+    return;
+  if (commit) {
+    (void) UNLINK(back->tmpfile); /* new copy is good; drop the backup */
+  } else {
+    if (back->r.out != NULL) {
+      fclose(back->r.out);
+      back->r.out = NULL;
+    }
+    /* On failure keep the backup: an orphaned temp beats losing the good copy.
+     */
+    if (!replace_file(back->tmpfile, back->url_sav))
+      hts_log_print(opt, LOG_WARNING | LOG_ERRNO,
+                    "could not restore %s; previous copy kept as %s",
+                    back->url_sav, back->tmpfile);
+  }
+  back->tmpfile = NULL;
+}
+
 // objet (lien) téléchargé ou transféré depuis le cache
 //
 // fermer les paramètres de transfert,
@@ -582,6 +626,7 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
                       LLintP " got " LLintP "): %s%s", back[p].r.totalsize,
                       back[p].r.size, back[p].url_adr, back[p].url_fil);
       }
+      back_finalize_backup(opt, &back[p], HTS_FALSE);
       return -1;
     }
 
@@ -591,8 +636,7 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
       if (!back[p].testmode) {  // not test mode
         const char *state = "unknown";
 
-        /* décompression */
+        /* Undo the content coding */
-#if HTS_USEZLIB
         if (back[p].r.compressed) {
           if (back[p].r.size > 0) {
             // stats
@@ -600,7 +644,7 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
             // en mémoire -> passage sur disque
             if (!back[p].r.is_write) {
               // do not use tempnam() but a regular filename
-              if (create_back_tmpfile(opt, &back[p]) == 0) {
+              if (create_back_tmpfile(opt, &back[p], "z") == 0) {
                 assertf(back[p].tmpfile != NULL);
                 /* note: tmpfile is utf-8 */
                 back[p].r.out = FOPEN(back[p].tmpfile, "wb");
@@ -638,28 +682,67 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
             // décompression
             if (back[p].tmpfile != NULL) {
               if (back[p].url_sav[0]) {
+                const hts_codec codec =
+                    hts_codec_parse(back[p].r.contentencoding);
+                /* Never decode over url_sav: a failed decode would destroy the
+                   copy an --update re-fetch is supposed to refresh (#557). */
+                char BIGSTK unpacked[HTS_URLMAXSIZE * 2 + 4]; // room for ".u"
                 LLint size;
 
-                file_notify(opt, back[p].url_adr, back[p].url_fil,
+                snprintf(unpacked, sizeof(unpacked), "%s.u", back[p].url_sav);
-                            back[p].url_sav, 1, 1, back[p].r.notmodified);
+                if ((size = hts_codec_unpack(codec, back[p].tmpfile,
-                filecreateempty(&opt->state.strc, back[p].url_sav);     // filenote & co
+                                             unpacked)) >= 0) {
-                if ((size = hts_zunpack(back[p].tmpfile, back[p].url_sav)) >= 0) {
                   back[p].r.size = back[p].r.totalsize = size;
-                  // fichier -> mémoire
                   if (!back[p].r.is_write) {
+                    // fichier -> mémoire ; le fichier est écrit plus tard
                     deleteaddr(&back[p].r);
-                    back[p].r.adr = readfile_utf8(back[p].url_sav);
+                    back[p].r.adr = readfile_utf8(unpacked);
                     if (!back[p].r.adr) {
                       back[p].r.statuscode = STATUSCODE_INVALID;
                       strcpybuff(back[p].r.msg,
                                  "Read error when decompressing");
                     }
-                    UNLINK(back[p].url_sav);
+                    UNLINK(unpacked);
+                  } else if (replace_file(unpacked, back[p].url_sav)) {
+                    /* The temp bypassed filecreate(), which is what chmods. */
+#ifndef _WIN32
+                    chmod(back[p].url_sav, HTS_ACCESS_FILE);
+#endif
+                    file_notify(opt, back[p].url_adr, back[p].url_fil,
+                                back[p].url_sav, 1, 1, back[p].r.notmodified);
+                    filenote(&opt->state.strc, back[p].url_sav, NULL);
+                  } else {
+                    back[p].r.statuscode = STATUSCODE_INVALID;
+                    strcpybuff(back[p].r.msg,
+                               "Write error when decompressing (can not rename "
+                               "the temporary file)");
+                    /* Keep the decoded body: the failed replace may have
+                       removed the previous copy, leaving this as the only one.
+                     */
+                    hts_log_print(
+                        opt, LOG_WARNING | LOG_ERRNO,
+                        "could not replace %s; decoded copy kept as %s",
+                        back[p].url_sav, unpacked);
                   }
                 } else {
                   back[p].r.statuscode = STATUSCODE_INVALID;
-                  strcpybuff(back[p].r.msg, "Error when decompressing");
+                  snprintf(back[p].r.msg, sizeof(back[p].r.msg),
+                           codec == HTS_CODEC_UNSUPPORTED
+                               ? "Unsupported Content-Encoding (%s)"
+                               : "Error when decompressing (%s)",
+                           back[p].r.contentencoding);
+                  /* Drop the undecoded body so the writer can't commit the
+                     coded bytes as the page; url_sav is left untouched. */
+                  if (!back[p].r.is_write)
+                    deleteaddr(&back[p].r);
+                  UNLINK(unpacked);
                 }
+                /* A failed decode keeps the previously-mirrored copy: note it,
+                   or the update purge (in old.lst, absent from new.lst) would
+                   delete what we just took care not to overwrite. */
+                if (back[p].r.statuscode == STATUSCODE_INVALID &&
+                    fexist_utf8(back[p].url_sav))
+                  filenote(&opt->state.strc, back[p].url_sav, NULL);
               }
               /* ensure that no remaining temporary file exists */
               unlink(back[p].tmpfile);
@@ -672,7 +755,9 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
             // unflag
           }
         }
-#endif
+        /* Body fully received: keep the freshly written url_sav, drop the
+           backup of the previous copy. */
+        back_finalize_backup(opt, &back[p], HTS_TRUE);
         /* Write mode to disk */
         if (back[p].r.is_write && back[p].r.adr != NULL) {
           freet(back[p].r.adr);
@@ -768,7 +853,7 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
           else
             strcatbuff(flags, "-");
           if (back[p].r.compressed)
-            strcatbuff(flags, "Z");     // gzip
+            strcatbuff(flags, "Z"); // content coding
           else
             strcatbuff(flags, "-");
           /* Err I had to split these.. */
@@ -777,9 +862,7 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
           fprintf(cache->txt, LLintP, (LLint) back[p].r.totalsize);
           fprintf(cache->txt, "\t%s\t", flags);
         }
-#if HTS_USEZLIB
         back[p].r.compressed = 0;
-#endif
 
         if (back[p].r.statuscode == HTTP_OK) {
           if (back[p].r.size >= 0) {
@@ -901,6 +984,9 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
       }
     }
   }
+  /* Aborted, error, or not ready: url_sav (if written) is broken; restore the
+     previous copy from the backup. */
+  back_finalize_backup(opt, &back[p], HTS_FALSE);
   return -1;
 }
 
@@ -1646,138 +1732,104 @@ int back_add(struct_back * sback, httrackp * opt, cache_back * cache, const char
       }
     }
     // tester cache
-    if ((strcmp(adr, "file://"))        /* pas fichier */
+    if ((strcmp(adr, "file://")) /* pas fichier */
-        &&((!test) || (cache->type == 1))       /* cache prioritaire, laisser passer en test! */
+        && ((!test) ||
-        &&((strnotempty(save)) || (strcmp(fil, "/robots.txt") == 0))) { // si en test on ne doit pas utiliser le cache sinon telescopage avec le 302..
+            (cache->type == 1)) /* cache prioritaire, laisser passer en test! */
-#if HTS_FAST_CACHE
+        &&
+        ((strnotempty(save)) || (strcmp(fil, "/robots.txt") ==
+                                 0))) { // si en test on ne doit pas utiliser le
+                                        // cache sinon telescopage avec le 302..
       intptr_t hash_pos;
       int hash_pos_return = 0;
-#else
+
-      char *a = NULL;
-#endif
-#if HTS_FAST_CACHE
       if (cache->hashtable) {
-#else
-      if (cache->use) {
-#endif
         char BIGSTK buff[HTS_URLMAXSIZE * 4];
 
-#if HTS_FAST_CACHE
         strcpybuff(buff, adr);
         strcatbuff(buff, fil);
         hash_pos_return = coucal_read(cache->hashtable, buff, &hash_pos);
-#else
-        buff[0] = '\0';
-        strcatbuff(buff, "\n");
-        strcatbuff(buff, adr);
-        strcatbuff(buff, "\n");
-        strcatbuff(buff, fil);
-        strcatbuff(buff, "\n");
-        a = strstr(cache->use, buff);
-#endif
 
-        // Ok, noté en cache->. mais bien présent dans le cache ou sur disque?
-#if HTS_FAST_CACHE
         // negative values when data is not in cache
         if (hash_pos_return < 0) {
-#else
+          if (!test) { // not test mode
-        if (a) {
+            /* note: no check with IS_DELAYED_EXT() enabled - postcheck by
-#endif
+             * client please! */
-          if (!test) {          // non mode test
+            if (save[0] != '\0' && !IS_DELAYED_EXT(save) &&
-#if HTS_FAST_CACHE==0
+                fsize_utf8(fconv(catbuff, sizeof(catbuff), save)) <=
-            int pos = -1;
+                    0) { // final file missing or empty
+              int found = 0;
 
-            a += strlen(buff);
+              /* It is possible that the file has been moved due to changes in
-            sscanf(a, "%d", &pos);      // lire position
+               * build structure */
-#endif
+              {
+                char BIGSTK previous_save[HTS_URLMAXSIZE * 2];
+                htsblk r;
 
-#if HTS_FAST_CACHE==0
+                previous_save[0] = '\0';
-            if (pos < 0) {      // pas de mise en cache data, vérifier existence
+                r = cache_readex(opt, cache, adr, fil, /*head */ NULL,
-#endif
-              /* note: no check with IS_DELAYED_EXT() enabled - postcheck by client please! */
-              if (save[0] != '\0' && !IS_DELAYED_EXT(save) && fsize_utf8(fconv(catbuff, sizeof(catbuff), save)) <= 0) {  // fichier final n'existe pas ou est vide!
-                int found = 0;
-
-                /* It is possible that the file has been moved due to changes in build structure */
-                {
-                  char BIGSTK previous_save[HTS_URLMAXSIZE * 2];
-                  htsblk r;
-
-                  previous_save[0] = '\0';
-                  r =
-                    cache_readex(opt, cache, adr, fil, /*head */ NULL,
                                  /*bound to back[p] (temporary) */
                                  back[p].location_buffer, previous_save, /*ro */
                                  1);
-                  /* Is supposed to be on disk only */
+                /* Is supposed to be on disk only */
-                  if (r.is_write && previous_save[0] != '\0') {
+                if (r.is_write && previous_save[0] != '\0') {
-                    /* Exists, but with another (old) filename: rename (almost) silently */
+                  /* Exists, but with another (old) filename: rename (almost)
-                    if (strcmp(previous_save, save) != 0
+                   * silently */
-                        && fexist_utf8(fconv(catbuff, sizeof(catbuff), previous_save))) {
+                  if (strcmp(previous_save, save) != 0 &&
-                      rename(fconv(catbuff, sizeof(catbuff), previous_save),
+                      fexist_utf8(
-                             fconv(catbuff2, sizeof(catbuff2), save));
+                          fconv(catbuff, sizeof(catbuff), previous_save))) {
-                      if (fexist_utf8(fconv(catbuff, sizeof(catbuff), save))) {
+                    rename(fconv(catbuff, sizeof(catbuff), previous_save),
-                        found = 1;
+                           fconv(catbuff2, sizeof(catbuff2), save));
-                        hts_log_print(opt, LOG_DEBUG,
+                    if (fexist_utf8(fconv(catbuff, sizeof(catbuff), save))) {
-                                      "File '%s' has been renamed since last mirror to '%s' ; applying changes",
+                      found = 1;
-                                      previous_save, save);
+                      hts_log_print(opt, LOG_DEBUG,
-                      } else {
+                                    "File '%s' has been renamed since last "
-                        hts_log_print(opt, LOG_ERROR,
+                                    "mirror to '%s' ; applying changes",
-                                      "Could not rename '%s' to '%s' ; will have to retransfer it",
+                                    previous_save, save);
-                                      previous_save, save);
+                    } else {
-                      }
+                      hts_log_print(opt, LOG_ERROR,
+                                    "Could not rename '%s' to '%s' ; will have "
+                                    "to retransfer it",
+                                    previous_save, save);
                     }
                   }
-                  back[p].location_buffer[0] = '\0';
                 }
+                back[p].location_buffer[0] = '\0';
+              }
 
-                /* Not found ? */
+              /* Not found ? */
-                if (!found) {
+              if (!found) {
-#if HTS_FAST_CACHE
+                // invalidate: gone from disk, force a refetch
-                  hash_pos_return = 0;
+                hash_pos_return = 0;
-#else
+                if (opt->norecatch) {
-                  a = NULL;
+                  if (!fexist_utf8(fconv(
-#endif
+                          catbuff, sizeof(catbuff),
-                  // dévalider car non présent sur disque dans structure originale!!!
+                          save))) { // declared but missing: user erased it
-                  // sinon, le fichier est ok à priori, mais on renverra un if-modified-since pour
+                    FILE *fp =
-                  // en être sûr
+                        FOPEN(fconv(catbuff, sizeof(catbuff), save), "wb");
-                  if (opt->norecatch) { // tester norecatch
-                    if (!fexist_utf8(fconv(catbuff, sizeof(catbuff), save))) {   // fichier existe pas mais déclaré: on l'a effacé
-                      FILE *fp = FOPEN(fconv(catbuff, sizeof(catbuff), save), "wb");
 
-                      if (fp)
+                    if (fp)
-                        fclose(fp);
+                      fclose(fp);
-                      hts_log_print(opt, LOG_WARNING,
-                                    "Previous file '%s' not found (erased by user ?), ignoring: %s%s",
-                                    save, back[p].url_adr, back[p].url_fil);
-                    }
-                  } else {
                     hts_log_print(opt, LOG_WARNING,
-                                  "Previous file '%s' not found (erased by user ?), recatching: %s%s",
+                                  "Previous file '%s' not found (erased by "
+                                  "user ?), ignoring: %s%s",
                                   save, back[p].url_adr, back[p].url_fil);
                   }
+                } else {
+                  hts_log_print(opt, LOG_WARNING,
+                                "Previous file '%s' not found (erased by user "
+                                "?), recatching: %s%s",
+                                save, back[p].url_adr, back[p].url_fil);
                 }
-              }                 // fsize() <= 0
+              }
-#if HTS_FAST_CACHE==0
+            } // fsize() <= 0
-            }
-#endif
           }
         }
         //
       } else {
-#if HTS_FAST_CACHE
         hash_pos_return = 0;
-#else
-        a = NULL;
-#endif
       }
 
-      // Existe pas en cache, ou bien pas de cache présent
+      if (hash_pos_return) { // in cache, with data
-#if HTS_FAST_CACHE
-      if (hash_pos_return) {    // OK existe en cache (et données aussi)!
-#else
-      if (a != NULL) {          // OK existe en cache (et données aussi)!
-#endif
         const int cache_is_prioritary = cache->type == 1
           || opt->state.stop != 0;
         if (cache_is_prioritary) {      // cache prioritaire (pas de test if-modified..)
@@ -1898,7 +1950,8 @@ int back_add(struct_back * sback, httrackp * opt, cache_back * cache, const char
 #endif
         }
       }
-      /* Not in cache ; maybe in temporary cache ? Warning: non-movable "url_sav" */
+      /* Not in cache ; maybe in temporary cache ? Warning: non-movable
+         "url_sav" */
       else if (back_unserialize_ref(opt, adr, fil, &itemback) == 0) {
         const off_t file_size = fsize_utf8(itemback->url_sav);
 
@@ -2059,6 +2112,17 @@ int back_add(struct_back * sback, httrackp * opt, cache_back * cache, const char
                         "error: forbidden test with ftp link for back_add");
           return -1;            // erreur pas de test permis
         }
+        // the ftp client dials the origin itself: over socks that would bypass
+        // the proxy, so fail the link rather than leak the connection (#563)
+        if (back[p].r.req.proxy.active &&
+            hts_proxy_is_socks(back[p].r.req.proxy.name)) {
+          back[p].r.statuscode = STATUSCODE_NON_FATAL;
+          strcpybuff(back[p].r.msg,
+                     "ftp:// is not supported over a SOCKS proxy");
+          back[p].status = STATUS_READY;
+          back_set_finished(sback, p);
+          return 0;
+        }
         if (!(back[p].r.req.proxy.active && opt->ftp_proxy)) {  // connexion directe, gérée en thread
           FTPDownloadStruct *str =
             (FTPDownloadStruct *) malloc(sizeof(FTPDownloadStruct));
@@ -2083,13 +2147,9 @@ int back_add(struct_back * sback, httrackp * opt, cache_back * cache, const char
 
       if (!back_trylive(opt, cache, sback, p)) {
 #if HTS_XGETHOST
-#if HDEBUG
+        back[p].status = STATUS_WAIT_DNS; // host name resolution attempt
-        printf("back_solve..\n");
+        soc = INVALID_SOCKET;             // not opened yet
-#endif
+        if (host_wait(opt, &back[p])) {   // ready (file, or cached dns)
-        back[p].status = STATUS_WAIT_DNS;       // tentative de résolution du nom de host
-        soc = INVALID_SOCKET;   // pas encore ouverte
-        back_solve(opt, &back[p]);      // préparer
-        if (host_wait(opt, &back[p])) { // prêt, par ex fichier ou dispo dans dns
 #if HDEBUG
           printf("ok, dns cache ready..\n");
 #endif
@@ -2232,37 +2292,9 @@ int back_add(struct_back * sback, httrackp * opt, cache_back * cache, const char
 }
 
 #if HTS_XGETHOST
-// attendre que le host (ou celui du proxy) ait été résolu
+// Resolution is synchronous inside the connect path; no pre-resolve step, so
-// si c'est un fichier, la résolution est immédiate
+// the host is always immediately ready.
-// idem pour ftp://
+int host_wait(httrackp *opt, lien_back *back) { return 1; }
-void back_solve(httrackp * opt, lien_back * back) {
-  assertf(opt != NULL);
-  assertf(back != NULL);
-  if ((!strfield(back->url_adr, "file://"))
-      && !strfield(back->url_adr, "ftp://")
-    ) {
-    const char *a;
-
-    if (!(back->r.req.proxy.active))
-      a = back->url_adr;
-    else
-      a = back->r.req.proxy.name;
-    assertf(a != NULL);
-    a = jump_protocol_const(a);
-    if (check_hostname_dns(a)) {
-      hts_log_print(opt, LOG_DEBUG, "resolved: %s", a);
-    } else {
-      hts_log_print(opt, LOG_DEBUG, "failed to resolve: %s", a);
-    }
-  }
-}
-
-// détermine si le host a pu être résolu
-int host_wait(httrackp * opt, lien_back * back) {
-  // Always synchronous. No more background DNS resolution
-  // (does not really improve performances)
-  return 1;
-}
 #endif
 
 // élimine les fichiers non html en backing (anticipation)
@@ -2449,9 +2481,15 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
   back_clean(opt, cache, sback);
 #endif
 
-  /* Time limit exceeded past grace: abort in-flight transfers so no wait loop
+  /* Time/size limit exceeded past grace: abort in-flight transfers so no wait
-     starves (#481). FTP slots stay, their thread owns the socket. */
+     loop starves (#481, #77). FTP slots stay, their thread owns the socket. */
   if (!back_checkmirror(opt)) {
+    const hts_mirror_limit limit = back_mirror_limit(opt);
+    const char *const reason =
+        (limit == HTS_MIRROR_LIMIT_SIZE) ? "size limit" : "time limit";
+    const char *const slotmsg = (limit == HTS_MIRROR_LIMIT_SIZE)
+                                    ? "Mirror Size Limit"
+                                    : "Mirror Time Out";
     int aborted = 0;
     unsigned int i;
 
@@ -2465,15 +2503,15 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
         if (back[i].r.is_write && IS_DELAYED_EXT(back[i].url_sav))
           back_delayed_discard(opt, &back[i]);
         back[i].r.statuscode = STATUSCODE_TIMEOUT;
-        strcpybuff(back[i].r.msg, "Mirror Time Out");
+        strcpybuff(back[i].r.msg, slotmsg);
         back[i].status = STATUS_READY;
         back_set_finished(sback, i);
         aborted++;
       }
     }
     if (aborted > 0)
-      hts_log_print(opt, LOG_WARNING,
+      hts_log_print(opt, LOG_WARNING, "%s reached, %d transfer(s) aborted",
-                    "time limit reached, %d transfer(s) aborted", aborted);
+                    reason, aborted);
     return;
   }
 
@@ -2687,13 +2725,40 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
           }
           busy_state = 1;
 
+          // socks5: tunnel to the origin before anything is written, for http
+          // as well as https. Skip on a reused keep-alive socket (already
+          // tunneled) and on the post-TLS re-entry (ssl_con set) (#563).
+          if (back[i].r.req.proxy.active &&
+              hts_proxy_is_socks(back[i].r.req.proxy.name) &&
+              !back[i].r.keep_alive
+#if HTS_USEOPENSSL
+              && back[i].r.ssl_con == NULL
+#endif
+          ) {
+            const int timeout = back[i].timeout > 0 ? back[i].timeout : 30;
+
+            if (!socks5_handshake(opt, &back[i].r, back[i].url_adr, timeout)) {
+              if (!strnotempty(back[i].r.msg))
+                strcpybuff(back[i].r.msg, "SOCKS5 handshake failed");
+              deletehttp(&back[i].r);
+              back[i].r.soc = INVALID_SOCKET;
+              back[i].r.statuscode = STATUSCODE_NON_FATAL;
+              back[i].status = STATUS_READY;
+              back_set_finished(sback, i);
+              continue;
+            }
+          }
+
 #if HTS_USEOPENSSL
           /* SSL mode */
           if (back[i].r.ssl) {
             int tunnel_ok = 1;
 
-            // https via proxy: CONNECT-tunnel before TLS (#85)
+            // https via an http proxy: CONNECT-tunnel before TLS (#85); socks
-            if (back[i].r.req.proxy.active && back[i].r.ssl_con == NULL) {
+            // already carries the origin connection
+            if (back[i].r.req.proxy.active &&
+                !hts_proxy_is_socks(back[i].r.req.proxy.name) &&
+                back[i].r.ssl_con == NULL) {
               const int timeout = back[i].timeout > 0 ? back[i].timeout : 30;
 
               tunnel_ok =
@@ -2958,12 +3023,15 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                             int last_errno = 0;
 
                             back[i].r.is_write = 1;     // écrire
+                            /* a .gz/.br/.zst saved under its own coding stays
+                               packed on disk */
                             if (back[i].r.compressed &&
-                                /* .gz are *NOT* depacked!! */
+                                !hts_codec_is_archive_ext(
-                                strfield(get_ext(catbuff, sizeof(catbuff), back[i].url_sav), "gz") == 0
+                                    hts_codec_parse(back[i].r.contentencoding),
-                                && strfield(get_ext(catbuff, sizeof(catbuff), back[i].url_sav), "tgz") == 0
+                                    get_ext(catbuff, sizeof(catbuff),
-                              ) {
+                                            back[i].url_sav))) {
-                              if (create_back_tmpfile(opt, &back[i]) == 0) {
+                              if (create_back_tmpfile(opt, &back[i], "z") ==
+                                  0) {
                                 assertf(back[i].tmpfile != NULL);
                                 /* note: tmpfile is utf-8 */
                                 if ((back[i].r.out =
@@ -2976,6 +3044,20 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                           back[i].url_sav, 1, 1,
                                           back[i].r.notmodified);
                               back[i].r.compressed = 0;
+                              /* Re-fetch over an existing file (#77 follow-up):
+                                 move the good copy aside before truncating it
+                                 so an aborted transfer can restore it. url_sav
+                                 is still written normally (file list intact).
+                               */
+                              back[i].tmpfile = NULL;
+                              if (fexist_utf8(back[i].url_sav)) {
+                                if (create_back_tmpfile(opt, &back[i], "bak") !=
+                                        0 ||
+                                    RENAME(back[i].url_sav, back[i].tmpfile) !=
+                                        0) {
+                                  back[i].tmpfile = NULL;
+                                }
+                              }
                               if ((back[i].r.out =
                                    filecreate(&opt->state.strc,
                                               back[i].url_sav)) == NULL) {
@@ -3514,6 +3596,11 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                     continue;
                   }
 
+                  // The server really sent 304 here; the *-hacks below force
+                  // NOT_MODIFIED only after confirming the file is complete.
+                  const hts_boolean server_sent_304 =
+                      (back[i].r.statuscode == HTTP_NOT_MODIFIED);
+
                   /*
                      Solve "false" 416 problems
                    */
@@ -3542,22 +3629,20 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                   if (back[i].r.statuscode == 406) {    // 'Not Acceptable'
                     back[i].r.statuscode = HTTP_OK;
                   }
-                  // 'do not erase already downloaded file'
+                  // On update, keep the good copy on error (mask as 304); skip
-                  // on an updated file
+                  // resume paths so a stale-partial 416 still re-fetches.
-                  // with an error : consider a 304 error
+                  if (HTTP_IS_ERROR(back[i].r.statuscode) &&
-                  if (!opt->delete_old) {
+                      back[i].is_update && !back[i].testmode &&
-                    if (HTTP_IS_ERROR(back[i].r.statuscode) && back[i].is_update
+                      back[i].range_req_size == 0 && back[i].url_sav[0] &&
-                        && !back[i].testmode) {
+                      fexist_utf8(back[i].url_sav)) {
-                      if (back[i].url_sav[0] && fexist_utf8(back[i].url_sav)) {
+                    hts_log_print(opt, LOG_DEBUG,
-                        hts_log_print(opt, LOG_DEBUG,
+                                  "Error %d (%s) ignored on update, keeping "
-                                      "Error ignored %d (%s) because of 'no purge' option for %s%s",
+                                  "existing copy: %s%s",
-                                      back[i].r.statuscode, back[i].r.msg,
+                                  back[i].r.statuscode, back[i].r.msg,
-                                      back[i].url_adr, back[i].url_fil);
+                                  back[i].url_adr, back[i].url_fil);
-                        back[i].r.statuscode = HTTP_NOT_MODIFIED;
+                    back[i].r.statuscode = HTTP_NOT_MODIFIED;
-                        deletehttp(&back[i].r);
+                    deletehttp(&back[i].r);
-                        back[i].r.soc = INVALID_SOCKET;
+                    back[i].r.soc = INVALID_SOCKET;
-                      }
-                    }
                   }
                   // Various hacks to limit re-transfers when updating a mirror
                   // Force update if same size detected
@@ -3610,7 +3695,7 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                       if (back[i].r.statuscode == HTTP_OK && !back[i].testmode) {       // 'OK'
                         if (!is_hypertext_mime(opt, back[i].r.contenttype, back[i].url_fil)) {  // not HTML
                           if (strnotempty(back[i].url_sav)) {   // target found
-                            int size = fsize_utf8(back[i].url_sav);     // target size
+                            off_t size = fsize_utf8(back[i].url_sav);
 
                             if (size >= 0) {
                               if (back[i].r.totalsize == size) {        // same size!
@@ -3705,6 +3790,21 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                     }
                   }
 
+                  // Out-of-protocol 304 to a Range resume: the file is still
+                  // partial, so drop it and refetch instead of trusting it.
+                  if (server_sent_304 && back[i].range_req_size > 0) {
+                    url_savename_refname_remove(opt, back[i].url_adr,
+                                                back[i].url_fil);
+                    UNLINK(back[i].url_sav);
+                    deletehttp(&back[i].r);
+                    back[i].r.soc = INVALID_SOCKET;
+                    back[i].r.statuscode = STATUSCODE_NON_FATAL;
+                    strcpybuff(back[i].r.msg,
+                               "Bogus 304 on resume, restarting");
+                    back[i].status = STATUS_READY;
+                    back_set_finished(sback, i);
+                  }
+
                   /* sinon, continuer */
                   /* if (back[i].r.soc!=INVALID_SOCKET) {   // ok récupérer body? */
                   // head: terminé
@@ -3823,7 +3923,7 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                       const hts_boolean range_ok =
                           back[i].r.crange > 0 && resume >= 0 &&
                           resume <= (LLint) sz &&
-                          back[i].r.crange_end + 1 == back[i].r.crange &&
+                          back[i].r.crange_end == back[i].r.crange - 1 &&
                           (back[i].r.totalsize < 0 ||
                            back[i].r.totalsize ==
                                back[i].r.crange_end - resume + 1);
@@ -3852,8 +3952,9 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                               // drop bytes past the resume point; a silent
                               // failure could leave a stale tail, so on error
                               // drop the partial and refetch the whole file
-                              if (HTS_FTRUNCATE(back[i].r.out,
+                              /* not (off_t): 32-bit on MSVC, wrapping a resume
-                                                (off_t) resume) != 0) {
+                                 past 2GB */
+                              if (HTS_FTRUNCATE(back[i].r.out, resume) != 0) {
                                 fclose(back[i].r.out);
                                 back[i].r.out = NULL;
                                 url_savename_refname_remove(
@@ -3865,7 +3966,9 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                            "Can not truncate partial file, "
                                            "restarting");
                               } else {
-                                fseeko(back[i].r.out, (off_t) resume, SEEK_SET);
+                                /* not (off_t): 32-bit on MSVC, truncating a
+                                   resume past 2GB */
+                                fseeko(back[i].r.out, resume, SEEK_SET);
                                 /* create a temporary reference file in case of
                                  * broken mirror */
                                 if (back_serialize_ref(opt, &back[i]) != 0) {
@@ -3892,11 +3995,20 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                           if (fp) {
                             LLint alloc_mem = resume + 1;
 
-                            if (back[i].r.totalsize >= 0)
+                            // Bound the in-memory buffer to a 32-bit size (real
+                            // in-RAM resources are far smaller); a hostile
+                            // Content-Length that would overflow the add or the
+                            // (size_t) cast is dropped and refetched instead.
+                            if (back[i].r.totalsize > INT32_MAX - alloc_mem) {
+                              url_savename_refname_remove(opt, back[i].url_adr,
+                                                          back[i].url_fil);
+                              UNLINK(back[i].url_sav);
+                              alloc_mem = -1;
+                            } else if (back[i].r.totalsize >= 0)
                               alloc_mem += back[i].r.totalsize; // AJOUTER RESTANT!
-                            if (deleteaddr(&back[i].r)
+                            if (alloc_mem >= 0 && deleteaddr(&back[i].r) &&
-                                && (back[i].r.adr =
+                                (back[i].r.adr =
-                                    (char *) malloct((size_t) alloc_mem))) {
+                                     (char *) malloct((size_t) alloc_mem))) {
                               back[i].r.size = resume;
                               if (back[i].r.totalsize >= 0)
                                 back[i].r.totalsize += resume; // -> full size
@@ -4178,38 +4290,46 @@ static int back_maxtime_grace(const int maxtime) {
   return maximum(5, minimum(30, maxtime / 10));
 }
 
-int back_checkmirror(httrackp * opt) {
+/* Bytes the smooth stop may overrun before in-flight transfers are aborted.
-  // Check max size
+   No floor (unlike the time grace): a size overrun should abort promptly. */
-  if ((opt->maxsite > 0) && (HTS_STAT.stat_bytes >= opt->maxsite)) {
+static LLint back_maxsize_grace(const LLint maxsite) { return maxsite / 10; }
-    if (!opt->state.stop) {     /* not yet stopped */
+
-      hts_log_print(opt, LOG_ERROR,
+/* Which cap has overrun its grace and must hard-stop the mirror (#77, #481).
-                    "More than " LLintP
+   -M measures received volume (HTS_TOTAL_RECV), not saved 200-only stat_bytes
-                    " bytes have been transferred.. giving up",
+   which undercounts redirect/error-heavy crawls (#520). */
-                    (LLint) opt->maxsite);
+static hts_mirror_limit back_mirror_limit(httrackp *opt) {
-      /* cancel mirror smoothly */
+  if (opt->maxsite > 0 && HTS_STAT.HTS_TOTAL_RECV >= opt->maxsite &&
-      hts_request_stop(opt, 0);
+      HTS_STAT.HTS_TOTAL_RECV - opt->maxsite >=
-    }
+          back_maxsize_grace(opt->maxsite))
-    return 1;                   /* don'k break mirror too sharply for size limits, but stop requested */
+    return HTS_MIRROR_LIMIT_SIZE;
-    /*return 0;
-     */
-  }
-  // Check max time
   if (opt->maxtime > 0) {
     const TStamp elapsed = time_local() - HTS_STAT.stat_timestart;
 
-    if (elapsed >= opt->maxtime) {
+    if (elapsed >= opt->maxtime &&
-      if (!opt->state.stop) { /* not yet stopped */
+        elapsed - opt->maxtime >= back_maxtime_grace(opt->maxtime))
-        hts_log_print(opt, LOG_ERROR, "More than %d seconds passed.. giving up",
+      return HTS_MIRROR_LIMIT_TIME;
-                      opt->maxtime);
-        /* cancel mirror smoothly */
-        hts_request_stop(opt, 0);
-      }
-      /* smooth stop starved past the grace period: stop waiting (#481) */
-      if (elapsed - opt->maxtime >= back_maxtime_grace(opt->maxtime))
-        return 0;
-    }
   }
-  return 1;                     /* Ok, go on */
+  return HTS_MIRROR_LIMIT_NONE;
+}
+
+int back_checkmirror(httrackp *opt) {
+  /* request a smooth stop the first time each cap is reached */
+  if (opt->maxsite > 0 && HTS_STAT.HTS_TOTAL_RECV >= opt->maxsite &&
+      !opt->state.stop) {
+    hts_log_print(opt, LOG_ERROR,
+                  "More than " LLintP
+                  " bytes have been transferred.. giving up",
+                  (LLint) opt->maxsite);
+    hts_request_stop(opt, 0);
+  }
+  if (opt->maxtime > 0 && !opt->state.stop &&
+      (time_local() - HTS_STAT.stat_timestart) >= opt->maxtime) {
+    hts_log_print(opt, LOG_ERROR, "More than %d seconds passed.. giving up",
+                  opt->maxtime);
+    hts_request_stop(opt, 0);
+  }
+  /* hard stop once a cap overruns its grace (callers must stop waiting) */
+  return back_mirror_limit(opt) == HTS_MIRROR_LIMIT_NONE;
 }
 
 // octets transférés + add

src/htsback.h

@@ -138,12 +138,11 @@ LLint back_transferred(LLint add, struct_back * sback);
 
 // hostback
 #if HTS_XGETHOST
-void back_solve(httrackp * opt, lien_back * sback);
 int host_wait(httrackp * opt, lien_back * sback);
 #endif
 int back_checksize(httrackp * opt, lien_back * eback, int check_only_totalsize);
-/* Enforce -M/-E quotas: requests a smooth stop when reached; returns 0 once
+/* Enforce -M/-E quotas: smooth-stops when reached; returns 0 once the -M cap
-   the -E deadline overran its grace period (callers must stop waiting). */
+   or -E deadline overruns its grace period (callers must stop waiting). */
 int back_checkmirror(httrackp * opt);
 
 #endif

src/htsbauth.c

@@ -307,14 +307,25 @@ int cookie_load(t_cookie * cookie, const char *fpath, const char *name) {
   return -1;
 }
 
-// écrire cookies.txt
+/* Write cookies.txt; returns 0 on success. The jar holds live session
-// !=0 : erreur
+   cookies, so keep it owner-only on Unix (Windows inherits folder ACLs). */
 int cookie_save(t_cookie * cookie, const char *name) {
   char catbuff[CATBUFF_SIZE];
 
   if (strnotempty(cookie->data)) {
     char BIGSTK line[8192];
+#ifdef _WIN32
     FILE *fp = fopen(fconv(catbuff, sizeof(catbuff), name), "wb");
+#else
+    const int fd = open(fconv(catbuff, sizeof(catbuff), name),
+                        O_WRONLY | O_CREAT | O_TRUNC, HTS_PROTECT_FILE);
+    FILE *fp = fd != -1 ? fdopen(fd, "wb") : NULL;
+
+    if (fd != -1 && fp == NULL)
+      close(fd);    /* fdopen failed: don't leak the descriptor */
+    if (fp != NULL) /* O_CREAT's mode skips pre-existing jars: tighten those */
+      (void) fchmod(fd, HTS_PROTECT_FILE);
+#endif
 
     if (fp) {
       char *a = cookie->data;

src/htscache.h

@@ -89,14 +89,11 @@ typedef enum {
    the involved files are absent. */
 void hts_cache_reconcile(httrackp *opt, hts_cache_reconcile_mode mode);
 
-int cache_writedata(FILE * cache_ndx, FILE * cache_dat, const char *str1,
-                    const char *str2, char *outbuff, int len);
-int cache_readdata(cache_back * cache, const char *str1, const char *str2,
-                   char **inbuff, int *len);
-
 void cache_rstr(FILE *fp, char *s, size_t s_size);
 char *cache_rstr_addr(FILE * fp);
 int cache_brstr(char *adr, char *s, size_t s_size);
+/* binput over a NUL-terminated buffer, bounded: no read starts at/past end. */
+int cache_binput(char *adr, const char *end, char *s, int max);
 int cache_brint(char *adr, int *i);
 void cache_rint(FILE * fp, int *i);
 void cache_rLLint(FILE * fp, LLint * i);

src/htscache_selftest.c

@@ -78,14 +78,6 @@ static void selftest_open_for_read(cache_back *cache, httrackp *opt) {
 }
 
 static void selftest_close(cache_back *cache) {
-  if (cache->dat != NULL) {
-    fclose(cache->dat);
-    cache->dat = NULL;
-  }
-  if (cache->ndx != NULL) {
-    fclose(cache->ndx);
-    cache->ndx = NULL;
-  }
   if (cache->zipOutput != NULL) {
     zipClose(cache->zipOutput,
              "Created by HTTrack Website Copier (cache self-test)");
@@ -240,11 +232,10 @@ static int disk_fallback_selftest(httrackp *opt) {
   static const char body[] = "BINARY-on-disk-body-0123456789-no-trailing-nul";
   const size_t body_len = sizeof(body) - 1;
 
-  /* X-Save must start with path_html_utf8 so the reader resolves it verbatim
+  /* a DOS-ified X-Save loses the path_html_utf8 prefix the reader matches on,
-     (otherwise it re-roots it as a pre-3.40 relative path); then the body we
+     and gets re-rooted as a pre-3.40 relative path; fconv() only on access */
-     create at fconv(save) is exactly where cache_readex looks for it. */
+  concat(save, sizeof(save), StringBuff(opt->path_html_utf8),
-  fconcat(save, sizeof(save), StringBuff(opt->path_html_utf8),
+         "example.com/blob.bin");
-          "example.com/blob.bin");
 
   /* write only the header (X-In-Cache: 0); the body stays on disk */
   selftest_open_for_write(&cache, opt);
@@ -989,26 +980,15 @@ int cache_reconcile_selftest(httrackp *opt, const char *dir) {
   failures +=
       reconcile_expect(opt, "hts-cache/old.zip", SOLID, "promote-zip-noop");
 
-  /* PROMOTE: a pure-legacy old generation is promoted too (was dead when no
+  /* PROMOTE: the removed pre-3.31 legacy pair is left alone */
-     zip cache existed) */
   reconcile_wipe(opt);
   reconcile_put(opt, "hts-cache/old.dat", SOLID);
   reconcile_put(opt, "hts-cache/old.ndx", TINY);
   hts_cache_reconcile(opt, CACHE_RECONCILE_PROMOTE);
-  failures += reconcile_expect(opt, "hts-cache/new.dat", SOLID, "promote-dat");
+  failures += reconcile_expect(opt, "hts-cache/new.dat", -1, "promote-dat");
-  failures += reconcile_expect(opt, "hts-cache/new.ndx", TINY, "promote-dat");
+  failures += reconcile_expect(opt, "hts-cache/new.ndx", -1, "promote-dat");
-  failures += reconcile_expect(opt, "hts-cache/old.dat", -1, "promote-dat");
+  failures += reconcile_expect(opt, "hts-cache/old.dat", SOLID, "promote-dat");
-
+  failures += reconcile_expect(opt, "hts-cache/old.ndx", TINY, "promote-dat");
-  /* PROMOTE: a half-written legacy new pair is replaced by the old pair */
-  reconcile_wipe(opt);
-  reconcile_put(opt, "hts-cache/new.dat", TINY);
-  reconcile_put(opt, "hts-cache/old.dat", SOLID);
-  reconcile_put(opt, "hts-cache/old.ndx", TINY);
-  hts_cache_reconcile(opt, CACHE_RECONCILE_PROMOTE);
-  failures +=
-      reconcile_expect(opt, "hts-cache/new.dat", SOLID, "promote-dat-partial");
-  failures +=
-      reconcile_expect(opt, "hts-cache/new.ndx", TINY, "promote-dat-partial");
 
   /* INTERRUPTED: no lock file, no action */
   reconcile_wipe(opt);
@@ -1058,7 +1038,7 @@ int cache_reconcile_selftest(httrackp *opt, const char *dir) {
   failures +=
       reconcile_expect(opt, "hts-cache/new.zip", MID, "interrupted-bignew");
 
-  /* INTERRUPTED: the legacy pair follows the same size rule (was dead code) */
+  /* INTERRUPTED: the removed pre-3.31 legacy pair is left alone */
   reconcile_wipe(opt);
   reconcile_put(opt, "hts-in_progress.lock", 0);
   reconcile_put(opt, "hts-cache/new.dat", TINY);
@@ -1067,9 +1047,13 @@ int cache_reconcile_selftest(httrackp *opt, const char *dir) {
   reconcile_put(opt, "hts-cache/old.ndx", MID);
   hts_cache_reconcile(opt, CACHE_RECONCILE_INTERRUPTED);
   failures +=
-      reconcile_expect(opt, "hts-cache/new.dat", SOLID, "interrupted-dat");
+      reconcile_expect(opt, "hts-cache/new.dat", TINY, "interrupted-dat");
   failures +=
-      reconcile_expect(opt, "hts-cache/new.ndx", MID, "interrupted-dat");
+      reconcile_expect(opt, "hts-cache/new.ndx", TINY, "interrupted-dat");
+  failures +=
+      reconcile_expect(opt, "hts-cache/old.dat", SOLID, "interrupted-dat");
+  failures +=
+      reconcile_expect(opt, "hts-cache/old.ndx", MID, "interrupted-dat");
 
   /* ROLLBACK: the old zip generation is restored (a zip cache used to lose
      its only good generation here) */
@@ -1089,17 +1073,18 @@ int cache_reconcile_selftest(httrackp *opt, const char *dir) {
   failures += reconcile_expect(opt, "hts-cache/new.lst", MID, "rollback-lst");
   failures += reconcile_expect(opt, "hts-cache/new.txt", MID, "rollback-txt");
 
-  /* ROLLBACK: full legacy generation incl. sidecars (historical behavior) */
+  /* ROLLBACK: sidecars restored, the removed pre-3.31 pair left alone */
   reconcile_wipe(opt);
   reconcile_put(opt, "hts-cache/new.dat", TINY);
-  reconcile_put(opt, "hts-cache/new.ndx", TINY);
   reconcile_put(opt, "hts-cache/old.dat", SOLID);
   reconcile_put(opt, "hts-cache/old.ndx", MID);
   reconcile_put(opt, "hts-cache/old.lst", MID);
   reconcile_put(opt, "hts-cache/old.txt", MID);
   hts_cache_reconcile(opt, CACHE_RECONCILE_ROLLBACK);
-  failures += reconcile_expect(opt, "hts-cache/new.dat", SOLID, "rollback-dat");
+  failures += reconcile_expect(opt, "hts-cache/new.dat", TINY, "rollback-dat");
-  failures += reconcile_expect(opt, "hts-cache/new.ndx", MID, "rollback-dat");
+  failures += reconcile_expect(opt, "hts-cache/new.ndx", -1, "rollback-dat");
+  failures += reconcile_expect(opt, "hts-cache/old.dat", SOLID, "rollback-dat");
+  failures += reconcile_expect(opt, "hts-cache/old.ndx", MID, "rollback-dat");
   failures += reconcile_expect(opt, "hts-cache/new.lst", MID, "rollback-dat");
   failures += reconcile_expect(opt, "hts-cache/new.txt", MID, "rollback-dat");
 
@@ -1113,6 +1098,101 @@ int cache_reconcile_selftest(httrackp *opt, const char *dir) {
   return failures;
 }
 
+/* The pre-3.31 .dat/.ndx import was removed: cache_init must refuse the
+   legacy pair, leave the files in place, and not flag an update run. */
+int cache_legacy_refused_selftest(httrackp *opt, const char *dir) {
+  int failures = 0;
+  int variant;
+
+  selftest_tag = "cache-legacy";
+  golden_setup(opt, dir);
+#ifdef _WIN32
+  mkdir(reconcile_st_path(opt, "hts-cache"));
+#else
+  mkdir(reconcile_st_path(opt, "hts-cache"), HTS_PROTECT_FOLDER);
+#endif
+
+  /* variant 0: old.dat/old.ndx (--update layout); 1: new.dat/new.ndx (ro) */
+  for (variant = 0; variant < 2; variant++) {
+    cache_back cache;
+    const char *const dat =
+        variant == 0 ? "hts-cache/old.dat" : "hts-cache/new.dat";
+    const char *const ndx =
+        variant == 0 ? "hts-cache/old.ndx" : "hts-cache/new.ndx";
+
+    reconcile_wipe(opt);
+    reconcile_put(opt, dat, 4096);
+    reconcile_put(opt, ndx, 4096);
+    opt->is_update = 0;
+    selftest_open(&cache, opt, /*ro*/ variant == 1);
+    if (cache_readable(&cache)) {
+      printf("cache-legacy: variant %d imported a removed format\n", variant);
+      failures++;
+    }
+    if (coucal_nitems(cache.hashtable) != 0) { /* no phantom index entries */
+      printf("cache-legacy: variant %d imported index entries\n", variant);
+      failures++;
+    }
+    if (opt->is_update) {
+      printf("cache-legacy: variant %d flagged an update\n", variant);
+      failures++;
+    }
+    if (fsize(reconcile_st_path(opt, dat)) != 4096 ||
+        fsize(reconcile_st_path(opt, ndx)) != 4096) {
+      printf("cache-legacy: variant %d touched the legacy files\n", variant);
+      failures++;
+    }
+    if (cache.lst != NULL) {
+      fclose(cache.lst);
+      cache.lst = NULL;
+    }
+    if (cache.txt != NULL) {
+      fclose(cache.txt);
+      cache.txt = NULL;
+    }
+    selftest_close(&cache);
+  }
+
+  /* a healthy zip must win over stray legacy files, with no refusal */
+  {
+    cache_back cache;
+    const char *const body = "<html>zip wins</html>";
+
+    reconcile_wipe(opt);
+    selftest_open_for_write(&cache, opt);
+    store_entry(opt, &cache, "example.com", "/", "example.com/index.html", 200,
+                "OK", "text/html", "utf-8", "", "", "", "", body, strlen(body));
+    selftest_close(&cache);
+    reconcile_put(opt, "hts-cache/old.ndx", 4096);
+    reconcile_put(opt, "hts-cache/old.dat", 4096);
+    selftest_open_for_read(&cache, opt);
+    if (!cache_readable(&cache)) {
+      printf("cache-legacy: stray legacy files shadowed the zip cache\n");
+      failures++;
+    }
+    failures +=
+        check_entry(opt, &cache, "example.com", "/", 200, "OK", "text/html",
+                    "utf-8", "", "", "", "", body, strlen(body));
+    if (fsize(reconcile_st_path(opt, "hts-cache/old.ndx")) != 4096 ||
+        fsize(reconcile_st_path(opt, "hts-cache/old.dat")) != 4096) {
+      printf("cache-legacy: zip-wins pass touched the legacy files\n");
+      failures++;
+    }
+    if (cache.lst != NULL) {
+      fclose(cache.lst);
+      cache.lst = NULL;
+    }
+    if (cache.txt != NULL) {
+      fclose(cache.txt);
+      cache.txt = NULL;
+    }
+    selftest_close(&cache);
+  }
+
+  reconcile_wipe(opt);
+  return failures;
+}
+
 /* --- read-side corruption injection --------------------------------------- */
 
 /* canary read back intact after each corruption; victim gets the byte surgery
@@ -1172,8 +1252,9 @@ static void corrupt_build_disk(httrackp *opt) {
   memset(corrupt_body_a, 'a', sizeof(corrupt_body_a) - 1);
   remove(reconcile_st_path(opt, "hts-cache/new.zip"));
   remove(reconcile_st_path(opt, "hts-cache/old.zip"));
-  fconcat(save, sizeof(save), StringBuff(opt->path_html_utf8),
+  /* X-Save stored verbatim: see disk_fallback_selftest */
-          CORRUPT_ADR "/victim.bin");
+  concat(save, sizeof(save), StringBuff(opt->path_html_utf8),
+         CORRUPT_ADR "/victim.bin");
   selftest_open_for_write(&cache, opt);
   store_entry(opt, &cache, CORRUPT_ADR, "/canary.html", "canary.html", 200,
               "OK", "text/html", "utf-8", "", "", "", "", corrupt_body_a,

src/htscache_selftest.h

@@ -60,6 +60,10 @@ int cache_write_failure_selftest(httrackp *opt, const char *dir);
    under <dir>. Returns the failed-check count. */
 int cache_reconcile_selftest(httrackp *opt, const char *dir);
 
+/* Verify cache_init refuses a pre-3.31 .dat/.ndx cache without touching it.
+   Returns the number of failed checks (0 = pass). */
+int cache_legacy_refused_selftest(httrackp *opt, const char *dir);
+
 /* Inject read-side corruption (zip byte surgery: bad size, header, deflate)
    under <dir> and assert every case degrades to STATUSCODE_INVALID without
    tainting a sibling entry. */

src/htscharset.c

@@ -84,7 +84,7 @@ static int hts_equalsAlphanum(const char *a, const char *b) {
 
 /* Copy the memory region [s .. s + size - 1 ] as a \0-terminated string. */
 static char *hts_stringMemCopy(const char *s, size_t size) {
-  char *dest = malloc(size + 1);
+  char *dest = malloct(size + 1);
 
   if (dest != NULL) {
     memcpy(dest, s, size);
@@ -549,42 +549,6 @@ char *hts_convertStringFromUTF8(const char *s, size_t size, const char *charset)
 
 #endif
 
-HTS_STATIC char *hts_getCharsetFromContentType(const char *mime) {
-  /* text/html; charset=utf-8 */
-  const char *const charset = "charset";
-  char *pos = strstr(mime, charset);
-
-  if (pos != NULL) {
-    /* Skip spaces */
-    int eq = 0;
-
-    for(pos += strlen(charset);
-        *pos == ' ' || *pos == '=' || *pos == '"' || *pos == '\''; pos++) {
-      if (*pos == '=') {
-        eq = 1;
-      }
-    }
-    if (eq == 1) {
-      int len;
-
-      for(len = 0;
-          pos[len] == ' ' || pos[len] == ';' || pos[len] == '"' || *pos == '\'';
-          pos++) ;
-      if (len != 0) {
-        char *const s = malloc(len + 1);
-        int i;
-
-        for(i = 0; i < len; i++) {
-          s[i] = pos[i];
-        }
-        s[len] = '\0';
-        return s;
-      }
-    }
-  }
-  return NULL;
-}
-
 #ifdef _WIN32
 #define strcasecmp(a,b) stricmp(a,b)
 #define strncasecmp(a,b,n) strnicmp(a,b,n)
@@ -644,58 +608,106 @@ int hts_isCharsetUTF8(const char *charset) {
          || strcasecmp(charset, "utf8") == 0 );
 }
 
+/* Extract X from a "text/html; charset=X" content= attribute value. */
+static char *charset_from_content(const char *s, size_t len) {
+  size_t i;
+
+  for (i = 0; i + 7 < len; i++) {
+    if ((i == 0 || is_space(s[i - 1]) || s[i - 1] == ';') &&
+        strncasecmp(&s[i], "charset", 7) == 0 && is_space_or_equal(s[i + 7])) {
+      size_t j, val;
+
+      for (j = i + 7; j < len && is_space_or_equal_or_quote(s[j]); j++)
+        ;
+      for (val = j; j < len && s[j] != '"' && s[j] != '\'' && s[j] != ';' &&
+                    !is_space(s[j]);
+           j++)
+        ;
+      if (j != val) {
+        return hts_stringMemCopy(&s[val], j - val);
+      }
+    }
+  }
+  return NULL;
+}
+
 char *hts_getCharsetFromMeta(const char *html, size_t size) {
-  int i;
+  size_t i;
 
-  /* <META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8" > */
+  /* HTML5 <meta charset=X> or legacy
-  for(i = 0; i < size; i++) {
+     <meta http-equiv="Content-Type" content="text/html; charset=X">,
-    if (html[i] == '<' && strncasecmp(&html[i + 1], "meta", 4) == 0
+     attributes in any order; first resolvable tag wins. */
-        && is_space(html[i + 5])) {
+  for (i = 0; i + 6 < size; i++) {
-      /* Skip spaces */
+    size_t j;
-      for(i += 5; is_space(html[i]); i++) ;
+    const char *equiv = NULL, *content = NULL;
-      if (strncasecmp(&html[i], "HTTP-EQUIV", 10) == 0
+    size_t equiv_len = 0, content_len = 0;
-          && is_space_or_equal(html[i + 10])) {
-        for(i += 10; is_space_or_equal_or_quote(html[i]); i++) ;
-        if (strncasecmp(&html[i], "CONTENT-TYPE", 12) == 0) {
-          for(i += 12; is_space_or_equal_or_quote(html[i]); i++) ;
-          if (strncasecmp(&html[i], "CONTENT", 7) == 0
-              && is_space_or_equal(html[i + 7])) {
-            for(i += 7; is_space_or_equal_or_quote(html[i]); i++) ;
-            /* Skip content-type */
-            for(;
-                i < size && html[i] != ';' && html[i] != '"' && html[i] != '\'';
-                i++) ;
-            /* Expect charset attribute here */
-            if (html[i] == ';') {
-              for(i++; is_space(html[i]); i++) ;
-              /* Look for charset */
-              if (strncasecmp(&html[i], "charset", 7) == 0
-                  && is_space_or_equal(html[i + 7])) {
-                int len;
 
-                for(i += 7; is_space_or_equal(html[i]) || html[i] == '\'';
+    if (html[i] != '<' || strncasecmp(&html[i + 1], "meta", 4) != 0 ||
-                    i++) ;
+        !is_space(html[i + 5])) {
-                /* Charset */
+      continue;
-                for(len = 0;
+    }
-                    i + len < size && html[i + len] != '"'
+    /* Attribute scan, strictly bounded by size. */
-                    && html[i + len] != '\'' && html[i + len] != ' '; len++) ;
+    for (j = i + 6; j < size && html[j] != '>';) {
-                /* No error ? */
+      size_t name, name_len, val = 0, val_len = 0;
-                if (len != 0 && i < size) {
-                  char *const s = malloc(len + 1);
-                  int j;
 
-                  for(j = 0; j < len; j++) {
+      if (is_space(html[j]) || html[j] == '/') {
-                    s[j] = html[i + j];
+        j++;
-                  }
+        continue;
-                  s[len] = '\0';
+      }
-                  return s;
+      for (name = j; j < size && html[j] != '=' && html[j] != '>' &&
-                }
+                     html[j] != '/' && !is_space(html[j]);
-              }
+           j++)
-            }
+        ;
+      name_len = j - name;
+      for (; j < size && is_space(html[j]); j++)
+        ;
+      if (j < size && html[j] == '=') {
+        for (j++; j < size && is_space(html[j]); j++)
+          ;
+        if (j < size && (html[j] == '"' || html[j] == '\'')) {
+          const char quote = html[j++];
+
+          for (val = j; j < size && html[j] != quote; j++)
+            ;
+          if (j >= size) /* unterminated quote: drop the tag */
+            break;
+          val_len = j++ - val;
+        } else {
+          /* unquoted: ends at whitespace or '>' only (HTML5 prescan); '/'
+             belongs to the value except as the tail of a self-close */
+          for (val = j; j < size && !is_space(html[j]) && html[j] != '>'; j++)
+            ;
+          val_len = j - val;
+          if (val_len != 0 && j < size && html[j] == '>' &&
+              html[val + val_len - 1] == '/') {
+            val_len--;
           }
         }
       }
+      /* first occurrence of each attribute wins, as in browsers */
+      if (val_len != 0) {
+        if (name_len == 7 && strncasecmp(&html[name], "charset", 7) == 0) {
+          return hts_stringMemCopy(&html[val], val_len);
+        } else if (equiv == NULL && name_len == 10 &&
+                   strncasecmp(&html[name], "http-equiv", 10) == 0) {
+          equiv = &html[val];
+          equiv_len = val_len;
+        } else if (content == NULL && name_len == 7 &&
+                   strncasecmp(&html[name], "content", 7) == 0) {
+          content = &html[val];
+          content_len = val_len;
+        }
+      }
     }
+    if (equiv_len == 12 && strncasecmp(equiv, "content-type", 12) == 0 &&
+        content != NULL) {
+      char *const s = charset_from_content(content, content_len);
+
+      if (s != NULL) {
+        return s;
+      }
+    }
+    i = j;
   }
   return NULL;
 }
@@ -1140,17 +1152,45 @@ int hts_isStringUTF8(const char *s, size_t size) {
   const unsigned char *const data = (const unsigned char*) s;
   size_t i;
 
+  /* Strict RFC 3629: reject overlongs, surrogates, > U+10FFFF, 5/6-byte. */
   for(i = 0 ; i < size ; ) {
-    /* Reader: can read bytes up to j */
+    const unsigned char c = data[i];
-#define RD ( i < size ? data[i++] : -1 )
+    size_t len, k;
+    hts_UCS4 uc, min;
 
-    /* Writer: a malformed sequence means the string is not UTF-8 (return 0) */
+    if (c < 0x80) {
-#define WR(C) if ((C) == -1) { return 0; }
+      i++;
+      continue;
+    } else if (c >= 0xc2 && c <= 0xdf) {
+      len = 2;
+      min = 0x80;
+      uc = c & 0x1f;
+    } else if (c >= 0xe0 && c <= 0xef) {
+      len = 3;
+      min = 0x800;
+      uc = c & 0x0f;
+    } else if (c >= 0xf0 && c <= 0xf4) {
+      len = 4;
+      min = 0x10000;
+      uc = c & 0x07;
+    } else { /* continuation byte, overlong C0/C1, or F5..FF lead */
+      return 0;
+    }
+    if (size - i < len) {
+      return 0;
+    }
+    for (k = 1; k < len; k++) {
+      const unsigned char cc = data[i + k];
 
-    /* Read Unicode character. */
+      if ((cc & 0xc0) != 0x80) {
-    READ_UNICODE(RD, WR);
+        return 0;
-#undef RD
+      }
-#undef WR
+      uc = (uc << 6) | (cc & 0x3f);
+    }
+    if (uc < min || uc > 0x10FFFF || (uc >= 0xD800 && uc <= 0xDFFF)) {
+      return 0;
+    }
+    i += len;
   }
 
   return 1;

src/htscharset.h

@@ -76,7 +76,8 @@ extern char *hts_convertStringIDNAToUTF8(const char *s, size_t size);
 extern int hts_isStringIDNA(const char *s, size_t size);
 
 /**
- * Extract the charset from the HTML buffer "html"
+ * Extract the <meta> charset from the HTML buffer "html" (HTML5 charset= or
+ * legacy http-equiv form). Returns a malloc'ed string, or NULL if none.
  **/
 extern char *hts_getCharsetFromMeta(const char *html, size_t size);
 
@@ -86,7 +87,8 @@ extern char *hts_getCharsetFromMeta(const char *html, size_t size);
 extern int hts_isStringAscii(const char *s, size_t size);
 
 /**
- * Is the given string an UTF-8 string ?
+ * Is the given string valid UTF-8 ? Strict RFC 3629: overlong forms,
+ * surrogates, codepoints above U+10FFFF and 5/6-byte sequences are rejected.
  **/
 extern int hts_isStringUTF8(const char *s, size_t size);
 

src/htscodec.c

@@ -0,0 +1,366 @@
+/* ------------------------------------------------------------ */
+/*
+HTTrack Website Copier, Offline Browser for Windows and Unix
+Copyright (C) 2026 Xavier Roche and other contributors
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+Ethical use: we kindly ask that you NOT use this software to harvest email
+addresses or to collect any other private information about people. Doing so
+would dishonor our work and waste the many hours we have spent on it.
+
+Please visit our Website: http://www.httrack.com
+*/
+
+/* ------------------------------------------------------------ */
+/* File: HTTP content codings (gzip/deflate, brotli, zstd)      */
+/* Author: Xavier Roche                                         */
+/* ------------------------------------------------------------ */
+
+/* Internal engine bytecode */
+#define HTS_INTERNAL_BYTECODE
+
+#include "htsbase.h"
+#include "htscore.h"
+#include "htscodec.h"
+#include "htszlib.h"
+
+#if HTS_USEBROTLI
+#include <brotli/decode.h>
+#endif
+
+#if HTS_USEZSTD
+#include <zstd.h>
+/* 8 MB, the window an HTTP zstd decoder must honor (RFC 9659); libzstd
+   defaults to 128 MB. */
+#define HTS_ZSTD_WINDOWLOG_MAX 23
+#endif
+
+/* Decoded-size budget, bounding a bomb: brotli and zstd reach a million to one.
+   Deflate cannot pass 1032x, so it only meets this at the 2 GiB ceiling. */
+#define HTS_CODEC_MAX_RATIO 4096
+#define HTS_CODEC_MIN_MAXOUT (1024 * 1024)
+
+LLint hts_codec_maxout(LLint in_size) {
+  LLint maxout;
+
+  if (in_size <= 0 || in_size > INT_MAX / HTS_CODEC_MAX_RATIO)
+    maxout = INT_MAX;
+  else
+    maxout = in_size * HTS_CODEC_MAX_RATIO;
+  if (maxout < HTS_CODEC_MIN_MAXOUT)
+    maxout = HTS_CODEC_MIN_MAXOUT;
+  return maxout;
+}
+
+hts_codec hts_codec_parse(const char *encoding) {
+  if (encoding == NULL || encoding[0] == '\0' ||
+      strfield2(encoding, "identity"))
+    return HTS_CODEC_IDENTITY;
+  if (strfield2(encoding, "gzip") || strfield2(encoding, "x-gzip") ||
+      strfield2(encoding, "deflate") || strfield2(encoding, "x-deflate"))
+    return HTS_USEZLIB ? HTS_CODEC_DEFLATE : HTS_CODEC_UNSUPPORTED;
+  if (strfield2(encoding, "br"))
+    return HTS_USEBROTLI ? HTS_CODEC_BROTLI : HTS_CODEC_UNSUPPORTED;
+  if (strfield2(encoding, "zstd"))
+    return HTS_USEZSTD ? HTS_CODEC_ZSTD : HTS_CODEC_UNSUPPORTED;
+  if (strfield2(encoding, "compress") || strfield2(encoding, "x-compress"))
+    return HTS_CODEC_UNSUPPORTED; /* LZW: never advertised, no decoder here */
+  /* Not a coding at all: broken servers put charsets and the like here, and
+     the plain body they sent must survive it. */
+  return HTS_CODEC_IDENTITY;
+}
+
+#if HTS_USEBROTLI
+#define HTS_AE_BROTLI ", br"
+#else
+#define HTS_AE_BROTLI ""
+#endif
+#if HTS_USEZSTD
+#define HTS_AE_ZSTD ", zstd"
+#else
+#define HTS_AE_ZSTD ""
+#endif
+
+const char *hts_acceptencoding(hts_boolean compressible, hts_boolean secure) {
+  if (!compressible)
+    return "identity";
+#if HTS_USEZLIB
+  /* br and zstd over TLS only, as browsers do: a cleartext intermediary that
+     rewrites a coding it can not read would corrupt the mirror. */
+  if (secure)
+    return "gzip, deflate" HTS_AE_BROTLI HTS_AE_ZSTD ", identity;q=0.9";
+  return "gzip, deflate, identity;q=0.9";
+#else
+  (void) secure;
+  return "identity";
+#endif
+}
+
+hts_boolean hts_codec_is_archive_ext(hts_codec codec, const char *ext) {
+  if (ext == NULL || ext[0] == '\0')
+    return HTS_FALSE;
+  switch (codec) {
+  case HTS_CODEC_DEFLATE:
+    return strfield2(ext, "gz") || strfield2(ext, "tgz") ? HTS_TRUE : HTS_FALSE;
+  case HTS_CODEC_BROTLI:
+    return strfield2(ext, "br") ? HTS_TRUE : HTS_FALSE;
+  case HTS_CODEC_ZSTD:
+    return strfield2(ext, "zst") || strfield2(ext, "tzst") ? HTS_TRUE
+                                                           : HTS_FALSE;
+  default:
+    return HTS_FALSE;
+  }
+}
+
+#if HTS_USEBROTLI || HTS_USEZSTD
+/* Append produced bytes to out under the decoded-size budget, advancing *total.
+   HTS_FALSE on a short write or once the budget is exceeded (a bomb); the
+   over-budget bytes are never written. */
+static hts_boolean codec_sink(FILE *out, const void *buf, size_t produced,
+                              LLint *total, LLint maxout) {
+  if (produced == 0)
+    return HTS_TRUE;
+  *total += (LLint) produced;
+  if (*total > maxout)
+    return HTS_FALSE;
+  return fwrite(buf, 1, produced, out) == produced ? HTS_TRUE : HTS_FALSE;
+}
+#endif
+
+#if HTS_USEBROTLI
+static int codec_unpack_brotli(FILE *in, FILE *out, LLint maxout) {
+  BrotliDecoderState *const state =
+      BrotliDecoderCreateInstance(NULL, NULL, NULL);
+  hts_boolean ok = HTS_TRUE, done = HTS_FALSE;
+  LLint total = 0;
+
+  if (state == NULL)
+    return -1;
+  while (ok && !done) {
+    unsigned char BIGSTK inbuf[8192];
+    size_t avail_in = fread(inbuf, 1, sizeof(inbuf), in);
+    const uint8_t *next_in = inbuf;
+
+    if (avail_in == 0)
+      break; /* EOF; a stream still hungry for input is truncated */
+    for (;;) {
+      unsigned char BIGSTK outbuf[8192];
+      uint8_t *next_out = outbuf;
+      size_t avail_out = sizeof(outbuf);
+      size_t produced;
+      BrotliDecoderResult res;
+
+      res = BrotliDecoderDecompressStream(state, &avail_in, &next_in,
+                                          &avail_out, &next_out, NULL);
+      produced = sizeof(outbuf) - avail_out;
+      if (!codec_sink(out, outbuf, produced, &total, maxout)) {
+        ok = HTS_FALSE;
+        break;
+      }
+      if (res == BROTLI_DECODER_RESULT_ERROR) {
+        ok = HTS_FALSE;
+        break;
+      }
+      if (res == BROTLI_DECODER_RESULT_SUCCESS) {
+        done = HTS_TRUE;
+        break;
+      }
+      if (res == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT)
+        break;
+    }
+    if (ferror(in))
+      ok = HTS_FALSE;
+  }
+  BrotliDecoderDestroyInstance(state);
+  return (ok && done && !ferror(in)) ? (int) total : -1;
+}
+
+static size_t codec_head_brotli(const void *in, size_t in_len, void *out,
+                                size_t out_len) {
+  BrotliDecoderState *const state =
+      BrotliDecoderCreateInstance(NULL, NULL, NULL);
+  const uint8_t *next_in = (const uint8_t *) in;
+  uint8_t *next_out = (uint8_t *) out;
+  size_t avail_in = in_len, avail_out = out_len;
+  BrotliDecoderResult res;
+
+  if (state == NULL)
+    return 0;
+  res = BrotliDecoderDecompressStream(state, &avail_in, &next_in, &avail_out,
+                                      &next_out, NULL);
+  BrotliDecoderDestroyInstance(state);
+  return (res != BROTLI_DECODER_RESULT_ERROR) ? out_len - avail_out : 0;
+}
+#endif
+
+#if HTS_USEZSTD
+static int codec_unpack_zstd(FILE *in, FILE *out, LLint maxout) {
+  ZSTD_DStream *const zds = ZSTD_createDStream();
+  hts_boolean ok = HTS_TRUE, eof = HTS_FALSE;
+  size_t zret = 1; /* 0 once a frame is fully flushed */
+  LLint total = 0;
+
+  if (zds == NULL)
+    return -1;
+  if (ZSTD_isError(ZSTD_DCtx_setParameter(zds, ZSTD_d_windowLogMax,
+                                          HTS_ZSTD_WINDOWLOG_MAX))) {
+    ZSTD_freeDStream(zds);
+    return -1;
+  }
+  while (ok && !eof) {
+    unsigned char BIGSTK inbuf[8192];
+    ZSTD_inBuffer input;
+
+    input.src = inbuf;
+    input.size = fread(inbuf, 1, sizeof(inbuf), in);
+    input.pos = 0;
+    if (input.size == 0) {
+      eof = HTS_TRUE;
+      break;
+    }
+    while (input.pos < input.size) {
+      unsigned char BIGSTK outbuf[8192];
+      ZSTD_outBuffer output;
+
+      output.dst = outbuf;
+      output.size = sizeof(outbuf);
+      output.pos = 0;
+      zret = ZSTD_decompressStream(zds, &output, &input);
+      if (ZSTD_isError(zret)) {
+        ok = HTS_FALSE;
+        break;
+      }
+      if (!codec_sink(out, outbuf, output.pos, &total, maxout)) {
+        ok = HTS_FALSE;
+        break;
+      }
+    }
+    if (ferror(in))
+      ok = HTS_FALSE;
+  }
+  ZSTD_freeDStream(zds);
+  /* zret != 0 at EOF: the last frame never completed */
+  return (ok && zret == 0 && !ferror(in)) ? (int) total : -1;
+}
+
+static size_t codec_head_zstd(const void *in, size_t in_len, void *out,
+                              size_t out_len) {
+  ZSTD_DStream *const zds = ZSTD_createDStream();
+  ZSTD_inBuffer input;
+  ZSTD_outBuffer output;
+  size_t zret;
+
+  if (zds == NULL)
+    return 0;
+  if (ZSTD_isError(ZSTD_DCtx_setParameter(zds, ZSTD_d_windowLogMax,
+                                          HTS_ZSTD_WINDOWLOG_MAX))) {
+    ZSTD_freeDStream(zds);
+    return 0;
+  }
+  input.src = in;
+  input.size = in_len;
+  input.pos = 0;
+  output.dst = out;
+  output.size = out_len;
+  output.pos = 0;
+  zret = ZSTD_decompressStream(zds, &output, &input);
+  ZSTD_freeDStream(zds);
+  return ZSTD_isError(zret) ? 0 : output.pos;
+}
+#endif
+
+LLint hts_codec_coded_size(FILE *in) {
+  long size;
+
+  if (fseek(in, 0, SEEK_END) != 0)
+    return -1;
+  size = ftell(in);
+  if (size < 0 || fseek(in, 0, SEEK_SET) != 0)
+    return -1;
+  return (LLint) size;
+}
+
+int hts_codec_unpack(hts_codec codec, const char *filename,
+                     const char *newfile) {
+  if (filename == NULL || newfile == NULL || !filename[0] || !newfile[0])
+    return -1;
+  switch (codec) {
+  case HTS_CODEC_DEFLATE:
+#if HTS_USEZLIB
+    return hts_zunpack(filename, newfile);
+#else
+    return -1;
+#endif
+  case HTS_CODEC_BROTLI:
+  case HTS_CODEC_ZSTD:
+    break;
+  default: /* IDENTITY never reaches the unpacker; UNSUPPORTED must fail */
+    return -1;
+  }
+#if HTS_USEBROTLI || HTS_USEZSTD
+  {
+    char catbuff[CATBUFF_SIZE];
+    FILE *out, *in = FOPEN(fconv(catbuff, sizeof(catbuff), filename), "rb");
+    LLint maxout;
+    int ret = -1;
+
+    if (in == NULL)
+      return -1;
+    maxout = hts_codec_maxout(hts_codec_coded_size(in));
+    out = FOPEN(fconv(catbuff, sizeof(catbuff), newfile), "wb");
+    if (out == NULL) {
+      fclose(in);
+      return -1;
+    }
+#if HTS_USEBROTLI
+    if (codec == HTS_CODEC_BROTLI)
+      ret = codec_unpack_brotli(in, out, maxout);
+#endif
+#if HTS_USEZSTD
+    if (codec == HTS_CODEC_ZSTD)
+      ret = codec_unpack_zstd(in, out, maxout);
+#endif
+    fclose(out);
+    fclose(in);
+    return ret;
+  }
+#else
+  return -1;
+#endif
+}
+
+size_t hts_codec_head(hts_codec codec, const void *in, size_t in_len, void *out,
+                      size_t out_len) {
+  if (in == NULL || in_len == 0 || out == NULL || out_len == 0)
+    return 0;
+  switch (codec) {
+#if HTS_USEZLIB
+  case HTS_CODEC_DEFLATE:
+    return hts_zhead(in, in_len, out, out_len);
+#endif
+#if HTS_USEBROTLI
+  case HTS_CODEC_BROTLI:
+    return codec_head_brotli(in, in_len, out, out_len);
+#endif
+#if HTS_USEZSTD
+  case HTS_CODEC_ZSTD:
+    return codec_head_zstd(in, in_len, out, out_len);
+#endif
+  default:
+    return 0;
+  }
+}

src/htscodec.h

@@ -0,0 +1,79 @@
+/* ------------------------------------------------------------ */
+/*
+HTTrack Website Copier, Offline Browser for Windows and Unix
+Copyright (C) 2026 Xavier Roche and other contributors
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+Ethical use: we kindly ask that you NOT use this software to harvest email
+addresses or to collect any other private information about people. Doing so
+would dishonor our work and waste the many hours we have spent on it.
+
+Please visit our Website: http://www.httrack.com
+*/
+
+/* ------------------------------------------------------------ */
+/* File: HTTP content codings (gzip/deflate, brotli, zstd)      */
+/* Author: Xavier Roche                                         */
+/* ------------------------------------------------------------ */
+
+#ifndef HTS_DEFCODEC
+#define HTS_DEFCODEC
+
+#include "htsglobal.h"
+
+/* Content codings we may meet in a Content-Encoding header. */
+typedef enum {
+  HTS_CODEC_IDENTITY = 0, /**< no coding, or a token we treat as none */
+  HTS_CODEC_DEFLATE,      /**< gzip, x-gzip, deflate, x-deflate */
+  HTS_CODEC_BROTLI,       /**< br */
+  HTS_CODEC_ZSTD,         /**< zstd */
+  HTS_CODEC_UNSUPPORTED   /**< a real coding we can not decode */
+} hts_codec;
+
+#ifdef HTS_INTERNAL_BYTECODE
+
+/* Codec for a Content-Encoding token. A known coding we can not decode is
+   UNSUPPORTED; an unrecognized token is IDENTITY (servers do emit junk). */
+extern hts_codec hts_codec_parse(const char *encoding);
+
+/* Accept-Encoding value to advertise; secure (TLS) also offers br and zstd. */
+extern const char *hts_acceptencoding(hts_boolean compressible,
+                                      hts_boolean secure);
+
+/* HTS_TRUE if ext is the codec's own archive extension: a foo.gz served as
+   Content-Encoding: gzip stays packed on disk. */
+extern hts_boolean hts_codec_is_archive_ext(hts_codec codec, const char *ext);
+
+/* Decode filename into newfile. Returns the decoded size, or -1 on a truncated
+   or corrupt stream, an unsupported coding, a bomb over the budget, or I/O. */
+extern int hts_codec_unpack(hts_codec codec, const char *filename,
+                            const char *newfile);
+
+/* Decode up to out_len leading bytes of a coded body for the MIME sniffer;
+   0 when nothing could be decoded. */
+extern size_t hts_codec_head(hts_codec codec, const void *in, size_t in_len,
+                             void *out, size_t out_len);
+
+/* Ceiling on the decoded size of a body of in_size coded bytes. */
+extern LLint hts_codec_maxout(LLint in_size);
+
+/* Coded size of an open stream, left rewound; -1 if unknown. */
+extern LLint hts_codec_coded_size(FILE *in);
+
+#endif
+
+#endif

src/htsconfig.h

@@ -76,9 +76,6 @@ Please visit our Website: http://www.httrack.com
 // always direct-to-disk (0/1)
 #define HTS_DIRECTDISK_ALWAYS 1
 
-// fast cache (build hash table)
-#define HTS_FAST_CACHE 1
-
 // le > peut être considéré comme un tag de fermeture de commentaire (<!-- > est
 // valide)
 #define GT_ENDS_COMMENT 1

src/htscore.c

@@ -134,18 +134,6 @@ RUN_CALLBACK0(opt, end); \
     back_delete_all(opt, &cache, sback);                                       \
     back_free(&sback);                                                         \
     checkrobots_free(&robots);                                                 \
-    if (cache.use) {                                                           \
-      freet(cache.use);                                                        \
-      cache.use = NULL;                                                        \
-    }                                                                          \
-    if (cache.dat) {                                                           \
-      fclose(cache.dat);                                                       \
-      cache.dat = NULL;                                                        \
-    }                                                                          \
-    if (cache.ndx) {                                                           \
-      fclose(cache.ndx);                                                       \
-      cache.ndx = NULL;                                                        \
-    }                                                                          \
     if (cache.zipOutput) {                                                     \
       zipClose(cache.zipOutput,                                                \
                "Created by HTTrack Website Copier/" HTTRACK_VERSION);          \
@@ -155,10 +143,6 @@ RUN_CALLBACK0(opt, end); \
       unzClose(cache.zipInput);                                                \
       cache.zipInput = NULL;                                                   \
     }                                                                          \
-    if (cache.olddat) {                                                        \
-      fclose(cache.olddat);                                                    \
-      cache.olddat = NULL;                                                     \
-    }                                                                          \
     if (cache.lst) {                                                           \
       fclose(cache.lst);                                                       \
       cache.lst = opt->state.strc.lst = NULL;                                  \
@@ -488,32 +472,11 @@ void hts_finish_makeindex(httrackp *opt, int *makeindex_done,
   *makeindex_done = 1;
 }
 
-/* Flush the parsed HTML output buffer to disk, skipping the rewrite when the
+/* Flush the parsed HTML output buffer to disk. */
- * on-disk MD5 is unchanged. */
 void hts_finish_html_file(httrackp *opt, cache_back *cache, htsblk *r,
                           FILE **fp, const char *ht_buff, size_t ht_len,
                           const char *adr, const char *fil, const char *save) {
-  char digest[32 + 2];
+  {
-  off_t fsize_old =
-      fsize(fconv(OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt), save));
-  int ok = 0;
-
-  digest[0] = '\0';
-  domd5mem(ht_buff, ht_len, digest, 1);
-  if (fsize_old == (off_t) ht_len) {
-    int mlen = 0;
-    char *mbuff;
-
-    cache_readdata(cache, "//[HTML-MD5]//", save, &mbuff, &mlen);
-    if (mlen)
-      mbuff[mlen] = '\0';
-    if ((mlen == 32) && (strcmp(((mbuff != NULL) ? mbuff : ""), digest) == 0)) {
-      ok = 1;
-      hts_log_print(opt, LOG_DEBUG, "File not re-written (md5): %s", save);
-    }
-    freet(mbuff);
-  }
-  if (!ok) {
     file_notify(opt, adr, fil, save, 1, 1, r->notmodified);
     *fp = filecreate(&opt->state.strc, save);
     if (*fp) {
@@ -545,13 +508,7 @@ void hts_finish_html_file(httrackp *opt, cache_back *cache, htsblk *r,
       if (fcheck)
         hts_log_print(opt, LOG_ERROR, "* * Fatal write error, giving up");
     }
-  } else {
-    file_notify(opt, adr, fil, save, 0, 0, r->notmodified);
-    filenote(&opt->state.strc, save, NULL);
   }
-  if (cache->ndx)
-    cache_writedata(cache->ndx, cache->dat, "//[HTML-MD5]//", save, digest,
-                    (int) strlen(digest));
 }
 
 /* does it look like XML ? (SVG et al.) */
@@ -846,6 +803,52 @@ int httpmirror(char *url1, httrackp * opt) {
       }
     }                           // while
 
+    /* --why: print which filter rule decides for this URL, then stop */
+    if (StringNotEmpty(opt->why_url)) {
+      char BIGSTK url[HTS_URLMAXSIZE * 2];
+      lien_adrfil af;
+
+      if (strstr(StringBuff(opt->why_url), ":/") == NULL)
+        snprintf(url, sizeof(url), "http://%s", StringBuff(opt->why_url));
+      else
+        strcpybuff(url, StringBuff(opt->why_url));
+      if (ident_url_absolute(url, &af) < 0) {
+        printf("--why: unable to parse URL %s" LF, StringBuff(opt->why_url));
+      } else {
+        char BIGSTK l[HTS_URLMAXSIZE * 2], lfull[HTS_URLMAXSIZE * 2];
+        int jok, jokDepth = 0;
+
+        /* the two forms the wizard tests */
+        strcpybuff(l, jump_identification_const(af.adr));
+        if (*af.fil != '/')
+          strcatbuff(l, "/");
+        strcatbuff(l, af.fil);
+        if (!link_has_authority(af.adr))
+          strcpybuff(lfull, "http://");
+        else
+          lfull[0] = '\0';
+        strcatbuff(lfull, af.adr);
+        if (*af.fil != '/')
+          strcatbuff(lfull, "/");
+        strcatbuff(lfull, af.fil);
+        jok = fa_strjoker_dual(/*url */ 0, filters, filptr, lfull, l, NULL,
+                               NULL, &jokDepth);
+        if (jok > 0)
+          printf("%s: accepted by rule #%d (%s)" LF, url, jokDepth + 1,
+                 filters[jokDepth]);
+        else if (jok < 0)
+          printf("%s: rejected by rule #%d (%s)" LF, url, jokDepth + 1,
+                 filters[jokDepth]);
+        else
+          printf("%s: no filter rule matches; the wizard decides "
+                 "(same-site links are followed by default)" LF,
+                 url);
+      }
+      freet(primary);
+      XH_extuninit;
+      return 1;
+    }
+
     /* load URL file list */
     /* OPTIMIZED for fast load */
     if (StringNotEmpty(opt->filelist)) {
@@ -1902,7 +1905,10 @@ int httpmirror(char *url1, httrackp * opt) {
           }
 
           // ATTENTION C'EST ICI QU'ON SAUVE LE FICHIER!!
-          if (r.adr != NULL || r.size == 0) {
+          // An empty body must not overwrite the file when the transfer failed
+          // (statuscode <= 0, e.g. an -M hard-stop): it would truncate a good
+          // copy to 0 (#77 follow-up).
+          if (r.adr != NULL || (r.size == 0 && r.statuscode > 0)) {
             file_notify(opt, urladr(), urlfil(), savename(), 1, 1, r.notmodified);
             if (filesave(opt, r.adr, (int) r.size, savename(), urladr(), urlfil()) !=
                 0) {
@@ -1923,7 +1929,6 @@ int httpmirror(char *url1, httrackp * opt) {
                */
             }
           }
-
         }
 
         /* Parsing of other media types (java, ram..) */
@@ -3870,7 +3875,6 @@ void voidf(void) {
   a = "|                      HTTrack Website Copier   |" CRLF;
   a = "|Code:         Windows Interface Xavier Roche   |" CRLF;
   a = "|                    HTS/HTTrack Xavier Roche   |" CRLF;
-  a = "|                .class Parser Yann Philippot   |" CRLF;
   a = "|                                               |" CRLF;
   a = "|Tested on:                 Windows95,98,NT,2K  |" CRLF;
   a = "|                           Linux PC            |" CRLF;

src/htscore.h

@@ -193,8 +193,7 @@ struct cache_back {
   /* */
   int type;
   int ro;                   /**< read-only: no new cache is written */
-  FILE *dat, *ndx, *olddat; /**< new data, new index, old data files */
+
-  char *use;                /**< in-memory list of cached adr+fil keys */
   FILE *lst;                /**< file list, used for purge */
   FILE *txt;                /**< human-readable file list (info) */
   char lastmodified[256];
@@ -288,12 +287,12 @@ struct filecreate_params {
 
 /* True if a new cache is being written (plain or zip backend). */
 HTS_STATIC int cache_writable(cache_back * cache) {
-  return (cache != NULL && (cache->dat != NULL || cache->zipOutput != NULL));
+  return (cache != NULL && cache->zipOutput != NULL);
 }
 
 /* True if an old cache is available to read (plain or zip backend). */
 HTS_STATIC int cache_readable(cache_back * cache) {
-  return (cache != NULL && (cache->olddat != NULL || cache->zipInput != NULL));
+  return (cache != NULL && cache->zipInput != NULL);
 }
 
 #endif

src/htscoremain.c

@@ -1452,7 +1452,7 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                 if ((na + 1 >= argc) || (argv[na + 1][0] == '-')) {
                   HTS_PANIC_PRINTF
                     ("Option %w needs to be followed by a blank space, and a module name");
-                  printf("Example: -%%w htsswf\n");
+                  printf("Example: -%%w httrack-plugin\n");
                   htsmain_free();
                   return -1;
                 } else {
@@ -1803,6 +1803,23 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                   StringCopy(opt->cookies_file, argv[na]);
                 }
                 break;
+              case 'Y': // why: explain the filter verdict for a URL, no crawl
+                if ((na + 1 >= argc) || (argv[na + 1][0] == '-')) {
+                  HTS_PANIC_PRINTF("Option why needs a blank space and a URL");
+                  printf(
+                      "Example: --why \"http://www.example.com/file.zip\"\n");
+                  htsmain_free();
+                  return -1;
+                } else {
+                  na++;
+                  if (strlen(argv[na]) >= HTS_URLMAXSIZE) {
+                    HTS_PANIC_PRINTF("why URL too long");
+                    htsmain_free();
+                    return -1;
+                  }
+                  StringCopy(opt->why_url, argv[na]);
+                }
+                break;
               case 'G': // pause: randomized inter-file delay MIN[:MAX] seconds
                 if ((na + 1 >= argc) || (argv[na + 1][0] == '-')) {
                   HTS_PANIC_PRINTF("Option pause needs a blank space and a "
@@ -1936,18 +1953,20 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                     char BIGSTK url[HTS_URLMAXSIZE * 2];
                     char linepos[256];
                     int pos;
-                    char *cacheNdx =
+                    LLint cacheNdxLen = 0;
-                      readfile(fconcat
+                    char *cacheNdx = readfile2(
-                               (OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt), StringBuff(opt->path_log),
+                        fconcat(OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt),
-                                "hts-cache/new.ndx"));
+                                StringBuff(opt->path_log), "hts-cache/new.ndx"),
+                        &cacheNdxLen);
                     cache_init(&cache, opt);    /* load cache */
                     if (cacheNdx != NULL) {
                       char firstline[256];
                       char *a = cacheNdx;
+                      const char *const end = cacheNdx + cacheNdxLen;
 
                       a += cache_brstr(a, firstline, sizeof(firstline));
                       a += cache_brstr(a, firstline, sizeof(firstline));
-                      while(a != NULL) {
+                      while (a != NULL && a < end) {
                         a = strchr(a + 1, '\n');        /* start of line */
                         if (a) {
                           htsblk r;
@@ -1955,15 +1974,15 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                           /* */
                           a++;
                           /* read "host/file" */
-                          a += binput(a, afs.af.adr, HTS_URLMAXSIZE);
+                          a += cache_binput(a, end, afs.af.adr, HTS_URLMAXSIZE);
-                          a += binput(a, afs.af.fil, HTS_URLMAXSIZE);
+                          a += cache_binput(a, end, afs.af.fil, HTS_URLMAXSIZE);
                           url[0] = '\0';
                           if (!link_has_authority(afs.af.adr))
                             strcatbuff(url, "http://");
                           strcatbuff(url, afs.af.adr);
                           strcatbuff(url, afs.af.fil);
                           /* read position */
-                          a += binput(a, linepos, 200);
+                          a += cache_binput(a, end, linepos, 200);
                           sscanf(linepos, "%d", &pos);
                           if (!hasFilter
                               || (strjoker(url, filter, NULL, NULL) != NULL)
@@ -2234,21 +2253,12 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
               htsmain_free();
               return -1;
             } else {
-              char *a;
+              char BIGSTK pname[HTS_URLMAXSIZE * 2];
 
               na++;
               opt->proxy.active = 1;
-              // Rechercher MAIS en partant de la fin à cause de user:pass@proxy:port
+              hts_parse_proxy(argv[na], pname, sizeof(pname), &opt->proxy.port);
-              a = argv[na] + strlen(argv[na]) - 1;
+              StringCopy(opt->proxy.name, pname);
-              while((a > argv[na]) && (*a != ':') && (*a != '@'))
-                a--;
-              if (*a == ':') {  // un port est présent, <proxy>:port
-                sscanf(a + 1, "%d", &opt->proxy.port);
-                StringCopyN(opt->proxy.name, argv[na], (int) (a - argv[na]));
-              } else {          // <proxy>
-                opt->proxy.port = 8080;
-                StringCopy(opt->proxy.name, argv[na]);
-              }
             }
             break;
           case 'F':            // user-agent field

src/htsdefines.h

@@ -70,7 +70,7 @@ typedef struct t_hts_callbackarg t_hts_callbackarg;
 #endif
 
 /* Marks a symbol an external wrapper module exports back to the engine.
-   Must override -fvisibility=hidden on ELF, or dlopen()ed plugins (htsjava)
+   Must override -fvisibility=hidden on ELF, or dlopen()ed plugins
    hide their own hts_plug()/hts_unplug() entry points. */
 #ifndef EXTERNAL_FUNCTION
 #ifdef _WIN32

src/htsdns_selftest.c

@@ -133,9 +133,10 @@ static struct addrinfo *mock_mkai(const mock_addr *a) {
   return ai;
 }
 
-static int mock_getaddrinfo(const char *node, const char *service,
+static int HTS_RESOLVER_CALL mock_getaddrinfo(const char *node,
-                            const struct addrinfo *hints,
+                                              const char *service,
-                            struct addrinfo **res) {
+                                              const struct addrinfo *hints,
+                                              struct addrinfo **res) {
   mock_host *const h = mock_find(node);
   const int want = (hints != NULL) ? hints->ai_family : PF_UNSPEC;
   struct addrinfo *head = NULL, *tail = NULL;
@@ -164,7 +165,7 @@ static int mock_getaddrinfo(const char *node, const char *service,
   return 0;
 }
 
-static void mock_freeaddrinfo(struct addrinfo *res) {
+static void HTS_RESOLVER_CALL mock_freeaddrinfo(struct addrinfo *res) {
   while (res != NULL) {
     struct addrinfo *const next = res->ai_next;
 
@@ -297,6 +298,26 @@ int dns_selftests(httrackp *opt) {
     IPV6_resolver = 0;
   }
 
+  /* "host:port" resolves as the bare host: the cache/connect path strips
+     ":port" before both the backend and the cache key (#181). */
+  mock_reset_calls();
+  {
+    SOCaddr a;
+    char ip[64];
+    const char *err = NULL;
+
+    /* cache miss: the backend is hit with the stripped host, not "host:port" */
+    CHECK(hts_dns_resolve2(opt, "v6only.test:8080", &a, &err) != NULL);
+    CHECK(mock_find("v6only.test")->calls == 1);
+    /* the bare host shares that one cache entry (stripped key) */
+    CHECK(hts_dns_resolve2(opt, "v6only.test", &a, &err) != NULL);
+    CHECK(mock_find("v6only.test")->calls == 1);
+    /* a port variant of an already-cached host also hits, right address */
+    CHECK(hts_dns_resolve2(opt, "v4only.test:1234", &a, &err) != NULL);
+    SOCaddr_inetntoa(ip, sizeof(ip), a);
+    CHECK(strcmp(ip, "1.2.3.4") == 0);
+  }
+
   /* newhttp_addr() must connect to the addr_index-th address, not always the
      first: this is what back_connect_next relies on to reach the fallback. */
   {

src/htsfilters.c

@@ -48,6 +48,7 @@ Please visit our Website: http://www.httrack.com
 #include "htsbase.h"
 #include "htslib.h"
 #include <ctype.h>
+#include <stdint.h>
 /* END specific definitions */
 
 // à partir d'un tableau de {"+*.toto","-*.zip","+*.tata"} définit si nom est autorisé
@@ -94,16 +95,141 @@ int fa_strjoker(int type, char **filters, int nfil, const char *nom, LLint * siz
   return verdict;
 }
 
-// supercomparateur joker (tm)
+int fa_strjoker_dual(int type, char **filters, int nfil, const char *nom1,
-// compare a et b (b=avec joker dedans), case insensitive [voir CI]
+                     const char *nom2, LLint *size, int *size_flag,
-// renvoi l'adresse de la première lettre de la chaine
+                     int *depth) {
-// (càd *[..]toto.. renvoi adresse de toto dans la chaine)
+  int depth1 = 0, depth2 = 0;
-// accepte les délires du genre www.*.*/ * / * truc*.*
+  int flag1 = 0, flag2 = 0;
-// cet algo est 'un peu' récursif mais ne consomme pas trop de tm
+  LLint sz1 = 0, sz2 = 0;
-// * = toute lettre
+  int jok1, jok2, use1;
-// --?-- : spécifique à HTTrack et aux ?
+
+  if (size) {
+    sz1 = *size;
+    sz2 = *size;
+  }
+  jok1 = fa_strjoker(type, filters, nfil, nom1, size ? &sz1 : NULL,
+                     size_flag ? &flag1 : NULL, &depth1);
+  jok2 = fa_strjoker(type, filters, nfil, nom2, size ? &sz2 : NULL,
+                     size_flag ? &flag2 : NULL, &depth2);
+  use1 = jok2 == 0 || (jok1 != 0 && depth1 >= depth2);
+  if (size)
+    *size = use1 ? sz1 : sz2;
+  if (size_flag)
+    *size_flag = use1 ? flag1 : flag2;
+  if (depth)
+    *depth = use1 ? depth1 : depth2;
+  return use1 ? jok1 : jok2;
+}
+
+/* Real filters/URLs fit HTS_URLMAXSIZE*2; past it a hostile pattern recurses
+   O(len) deep or runs O(n^2*stars). Cap length (depth) and steps (work). */
+#define STRJOKER_MAXLEN (HTS_URLMAXSIZE * 2)
+#define STRJOKER_MAXSTEPS 2000000u
+
+/* Failure memo for the recursive matcher: one bit per (chaine, joker) offset
+   pair keeps star-heavy patterns polynomial instead of exponential (#501). */
+typedef struct strjoker_memo {
+  const char *chaine0, *joker0; /* offsets are relative to these bases */
+  size_t stride;                /* strlen(joker0) + 1 */
+  unsigned char *failed;        /* failed-pair bitmap; NULL: no memo */
+  size_t *nsteps; /* shared work counter; NULL: unbounded (oracle) */
+} strjoker_memo;
+
+static const char *strjoker_impl(const strjoker_memo *memo, const char *chaine,
+                                 const char *joker, LLint *size,
+                                 int *size_flag);
+
+/* A pair that failed once fails forever (*size is only written on the success
+   path), so record NULL results and cut the re-exploration. */
+static const char *strjoker_rec(const strjoker_memo *memo, const char *chaine,
+                                const char *joker, LLint *size,
+                                int *size_flag) {
+  size_t bit = 0;
+  const char *adr;
+
+  if (memo->nsteps != NULL && ++*memo->nsteps > STRJOKER_MAXSTEPS)
+    return NULL; /* work budget spent: fail the match safely */
+  if (memo->failed) {
+    bit = (size_t) (chaine - memo->chaine0) * memo->stride +
+          (size_t) (joker - memo->joker0);
+    if (memo->failed[bit >> 3] & (unsigned char) (1u << (bit & 7)))
+      return NULL;
+  }
+  adr = strjoker_impl(memo, chaine, joker, size, size_flag);
+  if (adr == NULL && memo->failed)
+    memo->failed[bit >> 3] |= (unsigned char) (1u << (bit & 7));
+  return adr;
+}
+
+/* Match chaine against joker with a shared work budget *nsteps (a strjokerfind
+   sweep passes one counter, bounding the whole scan). */
+static const char *strjoker_bounded(const char *chaine, const char *joker,
+                                    LLint *size, int *size_flag,
+                                    size_t *nsteps) {
+  strjoker_memo memo = {chaine, joker, 0, NULL, nsteps};
+  unsigned char stackbits[2048];
+  hts_boolean onheap = HTS_FALSE;
+  const char *adr;
+
+  if (chaine != NULL && joker != NULL) {
+    const size_t l1 = strlen(chaine), l2 = strlen(joker);
+
+    if (l1 > STRJOKER_MAXLEN || l2 > STRJOKER_MAXLEN)
+      return NULL; /* beyond any real filter/URL: bound depth+work */
+    memo.stride = l2 + 1;
+    if (l1 + 1 <= (SIZE_MAX - 7) / memo.stride) { // overflow-safe bitmap size
+      const size_t bytes = ((l1 + 1) * memo.stride + 7) / 8;
+
+      if (bytes <= sizeof(stackbits)) {
+        memset(stackbits, 0, bytes);
+        memo.failed = stackbits;
+      } else {
+        memo.failed = (unsigned char *) calloct(bytes, 1);
+        onheap = memo.failed != NULL ? HTS_TRUE : HTS_FALSE;
+      }
+    }
+  }
+  adr = strjoker_rec(&memo, chaine, joker, size, size_flag);
+  if (onheap)
+    freet(memo.failed);
+  return adr;
+}
+
+// wildcard comparator: match chaine against joker (pattern), case-insensitive
+// returns the address of the first matched letter past any leading joker
+// (ie. *[..]toto.. returns the address of toto within chaine), NULL on mismatch
 HTS_INLINE const char *strjoker(const char *chaine, const char *joker,
                                 LLint *size, int *size_flag) {
+  size_t nsteps = 0;
+
+  return strjoker_bounded(chaine, joker, size, size_flag, &nsteps);
+}
+
+/* Test-only oracle: the same matcher without the failure memo. */
+const char *strjoker_nomemo(const char *chaine, const char *joker, LLint *size,
+                            int *size_flag) {
+  const strjoker_memo memo = {chaine, joker, 0, NULL};
+
+  return strjoker_rec(&memo, chaine, joker, size, size_flag);
+}
+
+/* Test-only: strjoker() reporting the work-budget steps spent and the cap, so a
+   self-test can prove the budget bounds a hostile pattern's work. */
+const char *strjoker_steps(const char *chaine, const char *joker,
+                           size_t *nsteps_out, size_t *maxsteps_out) {
+  size_t nsteps = 0;
+  const char *r = strjoker_bounded(chaine, joker, NULL, NULL, &nsteps);
+
+  if (nsteps_out != NULL)
+    *nsteps_out = nsteps;
+  if (maxsteps_out != NULL)
+    *maxsteps_out = STRJOKER_MAXSTEPS;
+  return r;
+}
+
+static const char *strjoker_impl(const strjoker_memo *memo, const char *chaine,
+                                 const char *joker, LLint *size,
+                                 int *size_flag) {
   if (strnotempty(joker) == 0) {        // fin de chaine joker
     if (strnotempty(chaine) == 0)       // fin aussi pour la chaine: ok
       return chaine;
@@ -277,7 +403,7 @@ HTS_INLINE const char *strjoker(const char *chaine, const char *joker,
 
       // tester sans le joker (pas ()+ mais ()*)
       if (!unique) {
-        if ((adr = strjoker(chaine, joker + jmp, size, size_flag))) {
+        if ((adr = strjoker_rec(memo, chaine, joker + jmp, size, size_flag))) {
           return adr;
         }
       }
@@ -289,7 +415,8 @@ HTS_INLINE const char *strjoker(const char *chaine, const char *joker,
         max = strnotempty(chaine) ? 1 : 0; /* empty chaine: no char to eat */
       while(i < (int) max) {
         if (pass[(int) (unsigned char) chaine[i]]) {    // caractère autorisé
-          if ((adr = strjoker(chaine + i + 1, joker + jmp, size, size_flag))) {
+          if ((adr = strjoker_rec(memo, chaine + i + 1, joker + jmp, size,
+                                  size_flag))) {
             return adr;
           }
           i++;
@@ -299,7 +426,8 @@ HTS_INLINE const char *strjoker(const char *chaine, const char *joker,
 
       // tester chaîne vide
       if (i != max + 2)         // avant c'est ok
-        if ((adr = strjoker(chaine + max, joker + jmp, size, size_flag)))
+        if ((adr = strjoker_rec(memo, chaine + max, joker + jmp, size,
+                                size_flag)))
           return adr;
 
       return NULL;              // perdu
@@ -321,7 +449,7 @@ HTS_INLINE const char *strjoker(const char *chaine, const char *joker,
       // comparaison ok?
       if (ok) {
         // continuer la comparaison.
-        if (strjoker(chaine + jmp, joker + jmp, size, size_flag))
+        if (strjoker_rec(memo, chaine + jmp, joker + jmp, size, size_flag))
           return chaine;        // retourner 1e lettre
       }
 
@@ -337,12 +465,18 @@ HTS_INLINE const char *strjoker(const char *chaine, const char *joker,
 // d'un strcpy sur une variable ayant un nom en lettres et copiant une chaine de chiffres
 // ATTENTION!! Eviter les jokers en début, où gare au temps machine!
 const char *strjokerfind(const char *chaine, const char *joker) {
+  size_t nsteps = 0; /* one budget for the whole scan */
   const char *adr;
 
+  if (chaine != NULL && strlen(chaine) > STRJOKER_MAXLEN)
+    return NULL;
   while(*chaine) {
-    if ((adr = strjoker(chaine, joker, NULL, NULL))) {  // ok trouvé
+    if ((adr = strjoker_bounded(chaine, joker, NULL, NULL,
+                                &nsteps))) { // ok trouvé
       return adr;
     }
+    if (nsteps > STRJOKER_MAXSTEPS) // scan budget spent: no match
+      return NULL;
     chaine++;
   }
   return NULL;

src/htsfilters.h

@@ -41,8 +41,21 @@ Please visit our Website: http://www.httrack.com
 
 int fa_strjoker(int type, char **filters, int nfil, const char *nom, LLint * size,
                 int *size_flag, int *depth);
+/* fa_strjoker() on both URL forms the engine builds (nom1 full, nom2 without
+   scheme); the match latest in the list wins, a "don't know" verdict defers.
+   Returns the merged verdict; the out-params carry the winner's values. */
+int fa_strjoker_dual(int type, char **filters, int nfil, const char *nom1,
+                     const char *nom2, LLint *size, int *size_flag, int *depth);
 HTS_INLINE const char *strjoker(const char *chaine, const char *joker, LLint * size,
                           int *size_flag);
+/* strjoker() without the failure memo (exponential worst case); test-only
+   oracle for the memoized matcher. */
+const char *strjoker_nomemo(const char *chaine, const char *joker, LLint *size,
+                            int *size_flag);
+/* strjoker() reporting the work-budget steps it spent and the cap; test-only,
+   lets a self-test assert the budget bounds a hostile pattern's work. */
+const char *strjoker_steps(const char *chaine, const char *joker,
+                           size_t *nsteps_out, size_t *maxsteps_out);
 const char *strjokerfind(const char *chaine, const char *joker);
 #endif
 

src/htsglobal.h

@@ -43,8 +43,8 @@ Please visit our Website: http://www.httrack.com
    configure.ac, decoupled from these). VERSION is the display form, VERSIONID
    the dotted numeric form, AFF_VERSION the short form shown in footers,
    LIB_VERSION the data/cache format generation. */
-#define HTTRACK_VERSION "3.49-11"
+#define HTTRACK_VERSION "3.49-12"
-#define HTTRACK_VERSIONID "3.49.11"
+#define HTTRACK_VERSIONID "3.49.12"
 #define HTTRACK_AFF_VERSION "3.x"
 #define HTTRACK_LIB_VERSION "2.0"
 
@@ -56,6 +56,10 @@ Please visit our Website: http://www.httrack.com
 // Platform detection (sizes, feature macros)
 #include "htsconfig.h"
 
+// Fixed-width integer types + PRI* format macros for the LLint/TStamp typedefs
+#include <stdint.h>
+#include <inttypes.h>
+
 // WIN32 types
 #ifdef _WIN32
 #ifndef SIZEOF_LONG
@@ -111,29 +115,6 @@ Please visit our Website: http://www.httrack.com
 #define HTS_DO_NOT_USE_UID
 #endif
 
-#ifndef HTS_LONGLONG
-#ifdef SIZEOF_LONG_LONG
-#if SIZEOF_LONG_LONG == 8
-#define HTS_LONGLONG 1
-#endif
-#endif
-
-#ifndef HTS_LONGLONG
-#ifdef __sun
-#define HTS_LONGLONG 0
-#endif
-#ifdef __osf__
-#define HTS_LONGLONG 0
-#endif
-#ifdef __linux
-#define HTS_LONGLONG 1
-#endif
-#ifdef _WIN32
-#define HTS_LONGLONG 1
-#endif
-#endif
-#endif
-
 #ifdef DLLIB
 #define HTS_DLOPEN 1
 #else
@@ -159,6 +140,15 @@ Please visit our Website: http://www.httrack.com
 #define HTS_USEZLIB 1
 #endif
 
+// brotli and zstd content codings; off unless the build opted in (configure,
+// or the Visual Studio projects, which link the vcpkg libraries)
+#ifndef HTS_USEBROTLI
+#define HTS_USEBROTLI 0
+#endif
+#ifndef HTS_USEZSTD
+#define HTS_USEZSTD 0
+#endif
+
 #ifndef HTS_INET6
 #define HTS_INET6 0
 #endif
@@ -326,59 +316,11 @@ typedef int hts_tristate;
 #define HTS_DEPRECATED(msg)
 #endif
 
-#ifndef HTS_LONGLONG
+/* LLint/TStamp: signed exact-width 64-bit; -1 is a sentinel engine-wide. */
-#ifdef HTS_NO_64_BIT
+typedef int64_t LLint;
-#define HTS_LONGLONG 0
+typedef int64_t TStamp;
-#else
+/* Full printf conversion, '%' included (PRId64 has none): "X: " LLintP. */
-#define HTS_LONGLONG 1
+#define LLintP "%" PRId64
-#endif
-#endif
-
-/* Wide integer types, chosen per platform.
-   LLint:  signed 64-bit counter for byte counts and large sizes (falls back to
-           plain int where 64-bit is unavailable).
-   TStamp: timestamp/duration in the same width (a double in the no-64-bit
-           fallback).
-   LLintP: the printf conversion for an LLint. */
-#if HTS_LONGLONG
-#ifdef LLINT_FORMAT
-typedef LLINT_TYPE LLint;
-
-typedef LLINT_TYPE TStamp;
-
-#define LLintP LLINT_FORMAT
-#else
-
-#ifdef _WIN32
-typedef __int64 LLint;
-
-typedef __int64 TStamp;
-
-#define LLintP "%I64d"
-#elif (defined(_LP64) || defined(__x86_64__) || defined(__powerpc64__) ||      \
-       defined(__64BIT__))
-
-typedef long int LLint;
-
-typedef long int TStamp;
-
-#define LLintP "%ld"
-#else
-typedef long long int LLint;
-
-typedef long long int TStamp;
-
-#define LLintP "%lld"
-#endif
-
-#endif /* HTS_LONGLONG */
-
-#else
-typedef int LLint;
-
-#define LLintP "%d"
-typedef double TStamp;
-#endif
 
 /* Integer type for file offsets/sizes passed to the C library. Widens to
    LLint (with HTS_FSEEKO for fseeko/ftello) under large-file support, plain
@@ -422,9 +364,10 @@ typedef int T_SOC;
 #endif
 
 /* Permission bits for created folders and files (mkdir and chmod).
-   PROTECT_FOLDER is owner-only. With HTS_ACCESS set (the default) the ACCESS_
+   PROTECT_FOLDER/FILE are owner-only. With HTS_ACCESS set (the default) the
-   modes also grant group/other read; otherwise they stay owner-only. */
+   ACCESS_ modes also grant group/other read; otherwise they stay owner-only. */
 #define HTS_PROTECT_FOLDER (S_IRUSR | S_IWUSR | S_IXUSR)
+#define HTS_PROTECT_FILE (S_IRUSR | S_IWUSR)
 
 #if HTS_ACCESS
 #define HTS_ACCESS_FILE (S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)

src/htshelp.c

@@ -477,7 +477,7 @@ void help(const char *app, int more) {
     ("  Y   mirror ALL links located in the first level pages (mirror links)");
   infomsg("");
   infomsg("Proxy options:");
-  infomsg("  P  proxy use (-P proxy:port or -P user:pass@proxy:port)");
+  infomsg("  P  proxy use (-P [socks5://][user:pass@]proxy:port)");
   infomsg(" %f *use proxy for ftp (f0 don't use)");
   infomsg(" %b  use this local hostname to make/send requests (-%b hostname)");
   infomsg("");
@@ -543,10 +543,11 @@ void help(const char *app, int more) {
   infomsg("Spider options:");
   infomsg("  bN accept cookies in cookies.txt (0=do not accept,* 1=accept)");
   infomsg(" %K  load extra cookies from a Netscape cookies.txt");
+  infomsg(" %Y  explain which filter rule accepts or rejects a URL, then exit");
   infomsg
     ("  u  check document type if unknown (cgi,asp..) (u0 don't check, * u1 check but /, u2 check always)");
-  infomsg
+  infomsg("  j *parse scripts (j0 don't parse, bitmask: |1 parse default, |4 "
-    ("  j *parse Java Classes (j0 don't parse, bitmask: |1 parse default, |2 don't parse .class |4 don't parse .js |8 don't be aggressive)");
+          "don't parse .js |8 don't be aggressive)");
   infomsg
     ("  sN follow robots.txt and meta robots tags (0=never,1=sometimes,* 2=always, 3=always (even strict rules))");
   infomsg
@@ -570,8 +571,7 @@ void help(const char *app, int more) {
     ("     can also be used to force a specific file type: --assume foo.cgi=text/html");
   infomsg
     (" @iN internet protocol (0=both ipv6+ipv4, 4=ipv4 only, 6=ipv6 only)");
-  infomsg
+  infomsg(" %w  disable a specific external mime module (-%w httrack-plugin)");
-    (" %w  disable a specific external mime module (-%w htsswf -%w htsjava)");
   infomsg("");
   infomsg("Browser ID:");
   infomsg

src/htsjava.c

@@ -1,517 +0,0 @@
-/* ------------------------------------------------------------ */
-/*
-HTTrack Website Copier, Offline Browser for Windows and Unix
-Copyright (C) 1998 Xavier Roche and other contributors
-
-SPDX-License-Identifier: GPL-3.0-or-later
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-Ethical use: we kindly ask that you NOT use this software to harvest email
-addresses or to collect any other private information about people. Doing so
-would dishonor our work and waste the many hours we have spent on it.
-
-Please visit our Website: http://www.httrack.com
-*/
-
-/* ------------------------------------------------------------ */
-/* File: Java classes parser                                    */
-/* Author: Yann Philippot                                       */
-/* ------------------------------------------------------------ */
-
-/* Version: Oct/2000 */
-/* Fixed: problems with class structure (10/2000) */
-
-// htsjava.c - Parseur de classes java
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#if ( defined(_WIN32) ||defined(HAVE_SYS_TYPES_H) )
-#include <sys/types.h>
-#endif
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-
-/* Standard httrack module includes */
-#include "httrack-library.h"
-#include "htsopt.h"
-#include "htsdefines.h"
-
-/* Module structures */
-#include "htsmodules.h"
-
-/* We link to libhttrack, we can use its functions */
-#include "httrack-library.h"
-
-/* This file */
-#include "htsjava.h"
-
-/* calloct/freet wrappers */
-#include "htssafe.h"
-
-static int reverse_endian(void) {
-  int endian = 1;
-
-  return (*((char *) &endian) == 1);
-}
-
-/* big/little endian swap */
-#define hts_swap16(A) ( (((A) & 0xFF)<<8) | (((A) & 0xFF00)>>8) )
-#define hts_swap32(A) ( (( (hts_swap16(A)) & 0xFFFF)<<16) | (( (hts_swap16(A>>16)) & 0xFFFF)) )
-
-/* Static definitions */
-static RESP_STRUCT readtable(htsmoduleStruct * str, FILE * fp, RESP_STRUCT,
-                             int *);
-static unsigned short int readshort(FILE * fp);
-static int tris(httrackp * opt, char *);
-static char *printname(char[1024], char[1024]);
-
-// ** HTS_xx sinon pas pris par VC++
-#define HTS_CLASS  7
-#define HTS_FIELDREF  9
-#define HTS_METHODREF  10
-#define HTS_STRING  8
-#define HTS_INTEGER  3
-#define HTS_FLOAT  4
-#define HTS_LONG  5
-#define HTS_DOUBLE  6
-#define HTS_INTERFACE  11
-#define HTS_NAMEANDTYPE  12
-#define HTS_ASCIZ  1
-#define HTS_UNICODE  2
-
-#define JAVADEBUG 0
-
-static const char *libName = "htsjava";
-
-#ifdef _WIN32
-#define strcasecmp(a,b) stricmp(a,b)
-#define strncasecmp(a,b,n) strnicmp(a,b,n)
-#endif
-
-static int detect_mime(htsmoduleStruct * str) {
-  const char *savename = str->filename;
-
-  if (savename) {
-    int len = (int) strlen(savename);
-
-    if (len > 6 && strcasecmp(savename + len - 6, ".class") == 0) {
-      return 1;
-    }
-  }
-  return 0;
-}
-
-static int hts_detect_java(t_hts_callbackarg * carg, httrackp * opt,
-                           htsmoduleStruct * str) {
-  /* Call parent functions if multiple callbacks are chained. */
-  if (CALLBACKARG_PREV_FUN(carg, detect) != NULL) {
-    if (CALLBACKARG_PREV_FUN(carg, detect)
-        (CALLBACKARG_PREV_CARG(carg), opt, str)) {
-      return 1;                 /* Found before us, let them have the priority */
-    }
-  }
-
-  /* Check MIME */
-  if (detect_mime(str)) {
-    str->wrapper_name = libName;        /* Our ID */
-    return 1;                   /* Known format, we take it */
-  }
-
-  return 0;                     /* Unknown format */
-}
-
-static off_t fsize(const char *s) {
-  STRUCT_STAT st;
-
-  if (STAT(s, &st) == 0 && S_ISREG(st.st_mode)) {
-    return st.st_size;
-  } else {
-    return -1;
-  }
-}
-
-static int hts_parse_java(t_hts_callbackarg * carg, httrackp * opt,
-                          htsmoduleStruct * str) {
-  /* The wrapper_name memebr has changed: not for us anymore */
-  if (str->wrapper_name == NULL || strcmp(str->wrapper_name, libName) != 0) {
-    /* Call parent functions if multiple callbacks are chained. */
-    if (CALLBACKARG_PREV_FUN(carg, parse) != NULL) {
-      return CALLBACKARG_PREV_FUN(carg, parse) (CALLBACKARG_PREV_CARG(carg),
-                                                opt, str);
-    }
-    strcpy(str->err_msg,
-           "unexpected error: bad wrapper_name and no previous wrapper");
-    return 0;                   /* Unexpected error */
-  } else {
-    if (detect_mime(str)) {
-
-      /* (Legacy code) */
-      char catbuff[CATBUFF_SIZE];
-      FILE *fpout;
-      JAVA_HEADER header;
-      RESP_STRUCT *tab;
-      const char *file = str->filename;
-
-      str->relativeToHtmlLink = 1;
-
-#if JAVADEBUG
-      printf("fopen\n");
-#endif
-      if ((fpout = FOPEN(fconv(catbuff, sizeof(catbuff), file), "r+b")) ==
-          NULL) {
-        sprintf(str->err_msg, "Unable to open file %s", file);
-        return 0;               // une erreur..
-      }
-#if JAVADEBUG
-      printf("fread\n");
-#endif
-      if (fread(&header, 1, 10, fpout) != 10) { // pas complet..
-        fclose(fpout);
-        sprintf(str->err_msg, "File header too small (file len = " LLintP ")",
-                (LLint) fsize(file));
-        return 0;
-      }
-#if JAVADEBUG
-      printf("header\n");
-#endif
-      // tester en tête
-      if (reverse_endian()) {
-        header.magic = hts_swap32(header.magic);
-        header.count = hts_swap16(header.count);
-      }
-      if (header.magic != 0xCAFEBABE) {
-        sprintf(str->err_msg, "non java file");
-        if (fpout) {
-          fclose(fpout);
-          fpout = NULL;
-        }
-        return 0;
-      }
-
-      /* A constant-pool entry is >= 1 byte on disk; reject a count exceeding
-         the file size (hostile .class ~68 MB alloc DoS). */
-      if (!hts_count_fits(header.count, (LLint) fsize(file))) {
-        fclose(fpout);
-        sprintf(str->err_msg,
-                "Invalid constant pool count %u (file len " LLintP ")",
-                (unsigned) header.count, (LLint) fsize(file));
-        return 0;
-      }
-      tab = (RESP_STRUCT *) calloct(header.count, sizeof(RESP_STRUCT));
-      if (!tab) {
-        sprintf(str->err_msg, "Unable to alloc %d bytes",
-                (int) sizeof(RESP_STRUCT));
-        if (fpout) {
-          fclose(fpout);
-          fpout = NULL;
-        }
-        return 0;               // erreur..
-      }
-#if JAVADEBUG
-      printf("calchead\n");
-#endif
-      {
-        int i;
-
-        for(i = 1; i < header.count; i++) {
-          int err = 0;          // ++    
-
-          tab[i] = readtable(str, fpout, tab[i], &err);
-          if (!err) {
-            if ((tab[i].type == HTS_LONG) || (tab[i].type == HTS_DOUBLE))
-              i++;              //2 element si double ou float
-          } else {              // ++ une erreur est survenue!
-            if (strnotempty(str->err_msg) == 0)
-              strcpy(str->err_msg, "Internal readtable error");
-            freet(tab);
-            if (fpout) {
-              fclose(fpout);
-              fpout = NULL;
-            }
-            return 0;
-          }
-        }
-
-      }
-
-#if JAVADEBUG
-      printf("addfiles\n");
-#endif
-      {
-        unsigned int Class;
-        unsigned int SClass;
-        int i;
-
-        Class = readshort(fpout);
-        SClass = readshort(fpout);
-
-        for(i = 1; i < header.count; i++) {
-
-          if (tab[i].type == HTS_CLASS) {
-
-            if ((tab[i].index1 < header.count) && (tab[i].index1 >= 0)) {
-
-              if ((tab[i].index1 != SClass) && (tab[i].index1 != Class)
-                  && (tab[tab[i].index1].name[0] != '[')) {
-
-                if (!strstr(tab[tab[i].index1].name, "java/")) {
-                  char BIGSTK tempo[1024];
-
-                  tempo[0] = '\0';
-
-                  snprintf(tempo, sizeof(tempo), "%s.class", tab[tab[i].index1].name);
-#if JAVADEBUG
-                  printf("add %s\n", tempo);
-#endif
-                  if (tab[tab[i].index1].file_position >= 0)
-                    str->addLink(str, tempo);   /* tab[tab[i].index1].file_position */
-                }
-
-              }
-            } else {
-              i = header.count; // exit 
-            }
-          }
-
-        }
-      }
-
-#if JAVADEBUG
-      printf("end\n");
-#endif
-      freet(tab);
-      if (fpout) {
-        fclose(fpout);
-        fpout = NULL;
-      }
-      return 1;
-
-    } else {
-      strcpy(str->err_msg, "bad MIME type");
-    }
-  }
-  return 0;                     /* Error */
-}
-
-/*
-module entry point 
-*/
-EXTERNAL_FUNCTION int hts_plug(httrackp * opt, const char *argv);
-EXTERNAL_FUNCTION int hts_plug(httrackp * opt, const char *argv) {
-  /* Plug callback functions */
-  CHAIN_FUNCTION(opt, detect, hts_detect_java, NULL);
-  CHAIN_FUNCTION(opt, parse, hts_parse_java, NULL);
-
-  return 1;                     /* success */
-}
-
-// error: !=0 si erreur fatale
-static RESP_STRUCT readtable(htsmoduleStruct * str, FILE * fp,
-                             RESP_STRUCT trans, int *error) {
-  char rname[1024];
-  unsigned short int length;
-  int j;
-
-  *error = 0;                   // pas d'erreur
-  trans.file_position = -1;
-  trans.type = (int) (unsigned char) fgetc(fp);
-  switch (trans.type) {
-  case HTS_CLASS:
-    strcpy(trans.name, "Class");
-    trans.index1 = readshort(fp);
-    break;
-
-  case HTS_FIELDREF:
-    strcpy(trans.name, "Field Reference");
-    trans.index1 = readshort(fp);
-    readshort(fp);
-    break;
-
-  case HTS_METHODREF:
-    strcpy(trans.name, "Method Reference");
-    trans.index1 = readshort(fp);
-    readshort(fp);
-    break;
-
-  case HTS_INTERFACE:
-    strcpy(trans.name, "Interface Method Reference");
-    trans.index1 = readshort(fp);
-    readshort(fp);
-    break;
-  case HTS_NAMEANDTYPE:
-    strcpy(trans.name, "Name and Type");
-    trans.index1 = readshort(fp);
-    readshort(fp);
-    break;
-
-  case HTS_STRING:             // CONSTANT_String
-    strcpy(trans.name, "String");
-    trans.index1 = readshort(fp);
-    break;
-
-  case HTS_INTEGER:
-    strcpy(trans.name, "Integer");
-    for(j = 0; j < 4; j++)
-      fgetc(fp);
-    break;
-
-  case HTS_FLOAT:
-    strcpy(trans.name, "Float");
-    for(j = 0; j < 4; j++)
-      fgetc(fp);
-    break;
-
-  case HTS_LONG:
-    strcpy(trans.name, "Long");
-    for(j = 0; j < 8; j++)
-      fgetc(fp);
-    break;
-  case HTS_DOUBLE:
-    strcpy(trans.name, "Double");
-    for(j = 0; j < 8; j++)
-      fgetc(fp);
-    break;
-
-  case HTS_ASCIZ:
-  case HTS_UNICODE:
-
-    if (trans.type == HTS_ASCIZ)
-      strcpy(trans.name, "HTS_ASCIZ");
-    else
-      strcpy(trans.name, "HTS_UNICODE");
-
-    {
-      char BIGSTK buffer[1024];
-      char *p;
-
-      p = &buffer[0];
-
-      trans.file_position = ftell(fp);
-      length = readshort(fp);
-      if (length < HTS_URLMAXSIZE) {
-        while(length > 0) {
-          *p++ = fgetc(fp);
-
-          length--;
-        }
-        *p = '\0';
-
-        if (tris(str->opt, buffer) == 1)
-          str->addLink(str, buffer);    /* trans.file_position */
-        else if (tris(str->opt, buffer) == 2)
-          str->addLink(str, printname(rname, buffer));
-
-        strcpy(trans.name, buffer);
-      } else { // gros pb
-        while((length > 0) && (!feof(fp))) {
-          fgetc(fp);
-          length--;
-        }
-        if (!feof(fp)) {
-          trans.type = -1;
-        } else {
-          sprintf(str->err_msg, "Internal structure error (ASCII)");
-          *error = 1;
-        }
-        return (trans);
-      }
-    }
-    break;
-  default:
-    // on arrête tout 
-    sprintf(str->err_msg, "Internal structure unknown (type %d)", trans.type);
-    *error = 1;
-    return (trans);
-    break;
-  }
-  return (trans);
-}
-
-static unsigned short int readshort(FILE * fp) {
-  unsigned short int valint;
-
-  if (fread(&valint, sizeof(valint), 1, fp) == 1) {
-    if (reverse_endian())
-      return hts_swap16(valint);
-    else
-      return valint;
-  } else {
-    return 0;
-  }
-
-}
-
-static int tris(httrackp * opt, char *buffer) {
-  char catbuff[CATBUFF_SIZE];
-
-  //
-  // Java
-  if ((buffer[0] == '[') && buffer[1] == 'L' && (!strstr(buffer, "java/")))
-    return 2;
-  if (strstr(buffer, ".gif") || strstr(buffer, ".jpg")
-      || strstr(buffer, ".jpeg") || strstr(buffer, ".au"))
-    return 1;
-  // Ajouts R.X: test type
-  // Autres fichiers
-  {
-    char type[256];
-
-    if (get_httptype_sized(opt, type, sizeof(type), buffer,
-                           0)) // recognized type
-      return 1;
-    // ajout RX 05/2001
-    else if (is_dyntype(get_ext(catbuff, sizeof(catbuff), buffer)))      // asp,cgi...
-      return 1;
-  }
-  return 0;
-}
-
-static char *printname(char rname[1024], char name[1024]) {
-  char *p;
-  char *p1;
-  size_t j;
-
-  rname[0] = '\0';
-  //
-
-  p = &name[0];
-
-  if (*p != '[') {
-    return rname;  // ""
-  }
-  p += 2;
-  p1 = rname;
-  for(j = 0; name[j] != '\0'; j++, p++) {
-    if (*p == '/')
-      *p1 = '.';
-    if (*p == ';') {
-      *p1 = '\0';
-      strcat(rname, ".class");
-      return rname;
-    } else
-      *p1 = *p;
-    p1++;
-  }
-  p1 -= 3;
-  *p1 = '\0';
-  return rname;
-
-}

src/htsjava.h

@@ -1,70 +0,0 @@
-/* ------------------------------------------------------------ */
-/*
-HTTrack Website Copier, Offline Browser for Windows and Unix
-Copyright (C) 1998 Xavier Roche and other contributors
-
-SPDX-License-Identifier: GPL-3.0-or-later
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-Ethical use: we kindly ask that you NOT use this software to harvest email
-addresses or to collect any other private information about people. Doing so
-would dishonor our work and waste the many hours we have spent on it.
-
-Please visit our Website: http://www.httrack.com
-*/
-
-/* ------------------------------------------------------------ */
-/* File: Java classes parser .h                                 */
-/* Author: Yann Philippot                                       */
-/* ------------------------------------------------------------ */
-
-#ifndef HTSJAVA_DEFH
-#define HTSJAVA_DEFH
-
-#include <stdint.h>
-
-#ifndef HTS_DEF_FWSTRUCT_JAVA_HEADER
-#define HTS_DEF_FWSTRUCT_JAVA_HEADER
-typedef struct JAVA_HEADER JAVA_HEADER;
-#endif
-/* 10-byte on-disk .class header image, fread() directly: fields need exact
-   widths (LP64's 8-byte 'unsigned long' magic never matched 0xCAFEBABE). */
-struct JAVA_HEADER {
-  uint32_t magic;
-  uint16_t minor;
-  uint16_t major;
-  uint16_t count;
-};
-
-#ifndef HTS_DEF_FWSTRUCT_RESP_STRUCT
-#define HTS_DEF_FWSTRUCT_RESP_STRUCT
-typedef struct RESP_STRUCT RESP_STRUCT;
-#endif
-struct RESP_STRUCT {
-  int file_position;
-  //
-  unsigned int index1;
-  unsigned int type;
-  char name[1024];
-};
-
-/* Library internal definictions */
-#ifdef HTS_INTERNAL_BYTECODE
-
-EXTERNAL_FUNCTION int hts_plug_java(httrackp * opt, const char *argv);
-
-#endif
-
-#endif

src/htsjava.vcproj

@@ -1,373 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="9,00"
-	Name="htsjava"
-	ProjectGUID="{2F353408-2C6C-4D31-9AC0-08BDC064DF64}"
-	RootNamespace="htsjava"
-	Keyword="Win32Proj"
-	TargetFrameworkVersion="131072"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-		<Platform
-			Name="x64"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			OutputDirectory="C:\temp\htsjava\Debug"
-			IntermediateDirectory="C:\temp\htsjava\Debug"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				AdditionalIncludeDirectories="C:\Dev\openssl-1.0.1j\include"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="1"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="4"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				OutputFile="C:\temp\httrack\htsjava.dll"
-				LinkIncremental="2"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="$(OutDir)/htsjava.pdb"
-				SubSystem="2"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				ImportLibrary="$(OutDir)/htsjava.lib"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				AdditionalIncludeDirectories="C:\Dev\openssl-1.0.1j\include"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="1"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="3"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				OutputFile="C:\temp\httrack64\htsjava.dll"
-				LinkIncremental="2"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="$(OutDir)/htsjava.pdb"
-				SubSystem="2"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				ImportLibrary="$(OutDir)/htsjava.lib"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="C:\temp\htsjava\Release"
-			IntermediateDirectory="C:\temp\htsjava\Release"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="C:\Dev\openssl-1.0.1j\include"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				RuntimeLibrary="0"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				OutputFile="O:\HTTrack\httrack\htsjava.dll"
-				LinkIncremental="1"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\htsjava.pdb"
-				SubSystem="2"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				ImportLibrary="$(OutDir)/htsjava.lib"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="&quot;C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool.exe&quot; sign /f &quot;Z:\Mes Documents\certificats\httrack-com\httrack-signing-certificate.pfx&quot; /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath)&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="C:\Dev\openssl-1.0.1j\include"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				RuntimeLibrary="0"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				OutputFile="O:\HTTrack\httrack\x64\htsjava.dll"
-				LinkIncremental="1"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\x64\htsjava.pdb"
-				SubSystem="2"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				ImportLibrary="$(OutDir)/htsjava.lib"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="&quot;C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool.exe&quot; sign /f &quot;Z:\Mes Documents\certificats\httrack-com\httrack-signing-certificate.pfx&quot; /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath)&#x0D;&#x0A;"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx"
-			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
-			>
-			<File
-				RelativePath="htsjava.c"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Header Files"
-			Filter="h;hpp;hxx;hm;inl;inc;xsd"
-			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
-			>
-			<File
-				RelativePath="htsjava.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Resource Files"
-			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx"
-			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
-			>
-		</Filter>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>

src/htslib.c

@@ -48,6 +48,7 @@ Please visit our Website: http://www.httrack.com
 #include "htsmodules.h"
 #include "htscharset.h"
 #include "htsencoding.h"
+#include "htscodec.h"
 
 #ifdef _WIN32
 #include <direct.h>
@@ -648,165 +649,6 @@ T_SOC http_fopen(httrackp * opt, const char *adr, const char *fil, htsblk * reto
   return http_xfopen(opt, 0, 1, 1, NULL, adr, fil, retour);
 }
 
-// Read a CRLF line from a non-blocking socket (waits up to timeout per recv).
-// Returns the line length (0 = empty), or -1 on timeout/EOF/error.
-static int proxy_getline(T_SOC soc, char *s, int max, int timeout) {
-  int j = 0;
-
-  for (;;) {
-    unsigned char ch;
-    int n;
-
-    if (!check_readinput_t(soc, timeout))
-      return -1; // timed out waiting for data
-    n = (int) recv(soc, &ch, 1, 0);
-    if (n == 1) {
-      if (ch == 13) // CR
-        continue;
-      if (ch == 10) // LF: end of line
-        break;
-      if (j >= max - 1)
-        return -1; // line too long: bound the read against a hostile proxy
-      s[j++] = (char) ch;
-    } else if (n == 0) {
-      return -1; // connection closed
-    } else {
-#ifdef _WIN32
-      if (WSAGetLastError() == WSAEWOULDBLOCK)
-        continue;
-#else
-      if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)
-        continue;
-#endif
-      return -1;
-    }
-  }
-  s[j] = '\0';
-  return j;
-}
-
-int http_proxy_tunnel(httrackp *opt, htsblk *retour, const char *adr,
-                      int timeout) {
-  const T_SOC soc = retour->soc;
-  const char *const host = jump_identification_const(adr); // host[:port]
-  const char *const portsep = jump_toport_const(adr);      // ":port" or NULL
-  char BIGSTK authority[HTS_URLMAXSIZE * 2];
-  char BIGSTK req[HTS_URLMAXSIZE * 4 + 1100];
-  char line[1024];
-  int code;
-
-  if (soc == INVALID_SOCKET)
-    return 0;
-
-  // CONNECT needs an explicit host:port; default the https port
-  authority[0] = '\0';
-  if (portsep != NULL)
-    strlcatbuff(authority, host, sizeof(authority)); // already host:port
-  else
-    snprintf(authority, sizeof(authority), "%s:%d", host, 443);
-
-  // backstop: never let a stray CR/LF in the host smuggle a second line into
-  // the CONNECT request (the host is already sanitized upstream)
-  {
-    const char *c;
-
-    for (c = authority; *c != '\0'; c++) {
-      if ((unsigned char) *c < ' ') {
-        strcpybuff(retour->msg, "proxy CONNECT: invalid host");
-        return 0;
-      }
-    }
-  }
-
-  snprintf(req, sizeof(req), "CONNECT %s HTTP/1.0" H_CRLF "Host: %s" H_CRLF,
-           authority, authority);
-
-  // creds go on the CONNECT, not the tunneled origin request
-  if (link_has_authorization(retour->req.proxy.name)) {
-    const char *a = jump_identification_const(retour->req.proxy.name);
-    const char *astart = jump_protocol_const(retour->req.proxy.name);
-    char autorisation[1100];
-    char user_pass[256];
-
-    autorisation[0] = user_pass[0] = '\0';
-    strncatbuff(user_pass, astart, (int) (a - astart) - 1);
-    strcpybuff(user_pass, unescape_http(OPT_GET_BUFF(opt),
-                                        OPT_GET_BUFF_SIZE(opt), user_pass));
-    code64((unsigned char *) user_pass, (int) strlen(user_pass),
-           (unsigned char *) autorisation, 0);
-    strlcatbuff(req, "Proxy-Authorization: Basic ", sizeof(req));
-    strlcatbuff(req, autorisation, sizeof(req));
-    strlcatbuff(req, H_CRLF, sizeof(req));
-  }
-  strlcatbuff(req, H_CRLF, sizeof(req)); // end of request headers
-
-  // raw send: ssl is set, so sendc() would route to TLS
-  {
-    const char *p = req;
-    size_t remain = strlen(req);
-    int stalls = 0;
-
-    while (remain > 0) {
-      const int n = (int) send(soc, p, (int) remain, 0);
-
-      if (n > 0) {
-        p += n;
-        remain -= (size_t) n;
-        stalls = 0;
-      } else {
-#ifdef _WIN32
-        const int wouldblock = (WSAGetLastError() == WSAEWOULDBLOCK);
-#else
-        const int wouldblock =
-            (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR);
-#endif
-        // don't spin forever on a fatal error or an unwritable socket
-        if (!wouldblock || !check_writeinput_t(soc, timeout) ||
-            ++stalls > 100) {
-          strcpybuff(retour->msg, "proxy CONNECT: write error");
-          return 0;
-        }
-      }
-    }
-  }
-
-  // proxy status line: "HTTP/1.x <code> ..."
-  if (proxy_getline(soc, line, sizeof(line), timeout) < 0) {
-    strcpybuff(retour->msg, "proxy CONNECT: no response");
-    return 0;
-  }
-  if (sscanf(line, "HTTP/%*d.%*d %d", &code) < 1)
-    code = 0;
-  if (code < 200 || code >= 300) {
-    snprintf(retour->msg, sizeof(retour->msg), "proxy CONNECT refused: %s",
-             strnotempty(line) ? line : "(no status)");
-    return 0;
-  }
-
-  // drain headers to the blank line; cap the count so a flooding proxy can't
-  // stall the crawl
-  {
-    int headers = 0;
-
-    for (;;) {
-      const int n = proxy_getline(soc, line, sizeof(line), timeout);
-
-      if (n < 0) {
-        strcpybuff(retour->msg, "proxy CONNECT: truncated response");
-        return 0;
-      }
-      if (n == 0)
-        break; // blank line: tunnel ready
-      if (++headers > 64) {
-        strcpybuff(retour->msg, "proxy CONNECT: too many response headers");
-        return 0;
-      }
-    }
-  }
-
-  return 1;
-}
-
 // ouverture d'une liaison http, envoi d'une requète
 // mode: 0 GET  1 HEAD  [2 POST]
 // treat: traiter header?
@@ -1059,10 +901,10 @@ static int append_cookie_header(buff_struct *bstr, t_cookie *cookie,
   return cook;
 }
 
-/* Self-test entry for append_cookie_header(): build the request Cookie line
+/* Build the request Cookie line for domain/path into dst (always
-   into dst (always NUL-terminated). Returns the number of cookies emitted. */
+   NUL-terminated). Returns the number of cookies emitted. */
-int http_cookie_header_selftest(t_cookie *cookie, const char *domain,
+int http_cookie_header(t_cookie *cookie, const char *domain, const char *path,
-                                const char *path, char *dst, size_t dst_size) {
+                       char *dst, size_t dst_size) {
   buff_struct bstr = {dst, dst_size, 0};
 
   assertf(dst != NULL && dst_size > 0);
@@ -1105,8 +947,9 @@ int http_sendhead(httrackp * opt, t_cookie * cookie, int mode,
           /* widths bound method[256], url[HTS_URLMAXSIZE*2], protocol[256] */
           if (sscanf(line, "%255s %2047s %255s", method, url, protocol) == 3) {
             size_t ret;
-            // selon que l'on a ou pas un proxy
+            // absolute-URI for an http proxy; a socks tunnel takes origin-form
-            if (retour->req.proxy.active) {
+            if (retour->req.proxy.active &&
+                !hts_proxy_is_socks(retour->req.proxy.name)) {
               print_buffer(&bstr,
                       "%s http://%s%s %s\r\n", method, adr, url,
                       protocol);
@@ -1142,8 +985,10 @@ int http_sendhead(httrackp * opt, t_cookie * cookie, int mode,
         print_buffer(&bstr, "HEAD ");
     }
 
-    // si on gère un proxy, il faut une Absolute URI: on ajoute avant http://www.adr.dom
+    // an http proxy needs an absolute URI; a socks tunnel does not
-    if (retour->req.proxy.active && (strncmp(adr, "https://", 8) != 0)) {
+    if (retour->req.proxy.active &&
+        !hts_proxy_is_socks(retour->req.proxy.name) &&
+        (strncmp(adr, "https://", 8) != 0)) {
       if (!link_has_authority(adr)) {   // default http
 #if HDEBUG
         printf("Proxy Use: for %s%s proxy %d port %d\n", adr, fil,
@@ -1187,8 +1032,11 @@ int http_sendhead(httrackp * opt, t_cookie * cookie, int mode,
     if (xsend)
       print_buffer(&bstr, "%s", xsend);  // éventuelles autres lignes
 
-    // for https, auth rides the CONNECT (the tunneled GET would leak it)
+    // for https, auth rides the CONNECT (the tunneled GET would leak it); for
-    if (retour->req.proxy.active && strncmp(adr, "https://", 8) != 0) {
+    // socks, the handshake
+    if (retour->req.proxy.active &&
+        !hts_proxy_is_socks(retour->req.proxy.name) &&
+        strncmp(adr, "https://", 8) != 0) {
       if (link_has_authorization(retour->req.proxy.name)) {     // et hop, authentification proxy!
         const char *a = jump_identification_const(retour->req.proxy.name);
         const char *astart = jump_protocol_const(retour->req.proxy.name);
@@ -1279,11 +1127,16 @@ int http_sendhead(httrackp * opt, t_cookie * cookie, int mode,
       // Compression accepted ?
       if (retour->req.http11) {
         hts_boolean compressible = HTS_FALSE;
+        hts_boolean secure = HTS_FALSE;
+
 #if HTS_USEZLIB
         compressible = (!retour->req.range_used && !retour->req.nocompression);
+#endif
+#if HTS_USEOPENSSL
+        secure = retour->ssl ? HTS_TRUE : HTS_FALSE;
 #endif
         print_buffer(&bstr, "Accept-Encoding: %s" H_CRLF,
-                     hts_acceptencoding(compressible));
+                     hts_acceptencoding(compressible, secure));
       }
 
       /* Authentification */
@@ -1562,7 +1415,7 @@ void treathead(t_cookie * cookie, const char *adr, const char *fil, htsblk * ret
       }
       // An empty/whitespace Content-Type value yields no token: keep the
       // sentinel default rather than reading an uninitialized tempo.
-      if (sscanf(rcvd + p, "%s", tempo) == 1) {
+      if (sscanf(rcvd + p, "%1099s", tempo) == 1) { // tempo[1100], server data
         if (strlen(tempo) < sizeof(retour->contenttype) - 2) // pas trop long!!
           strcpybuff(retour->contenttype, tempo);
         else
@@ -1586,7 +1439,7 @@ void treathead(t_cookie * cookie, const char *adr, const char *fil, htsblk * ret
         a = strchr(rcvd + p, '/');
         if (a != NULL) {
           a++;
-          if (sscanf(a, LLintP, &retour->crange) == 1) {
+          if (sscanf(a, LLintP, &retour->crange) == 1 && retour->crange >= 0) {
             retour->crange_start = 0;
             retour->crange_end = retour->crange - 1;
           } else {
@@ -1594,6 +1447,12 @@ void treathead(t_cookie * cookie, const char *adr, const char *fil, htsblk * ret
           }
         }
       }
+      // A valid Content-Range has no negative field; reject hostile values so
+      // the crange +/- 1 arithmetic downstream cannot sign-overflow (UB).
+      if (retour->crange_start < 0 || retour->crange_end < 0 ||
+          retour->crange < 0) {
+        retour->crange_start = retour->crange_end = retour->crange = 0;
+      }
     }
   } else if ((p = strfield(rcvd, "Connection:")) != 0) {
     char *a = rcvd + p;
@@ -1657,27 +1516,15 @@ void treathead(t_cookie * cookie, const char *adr, const char *fil, htsblk * ret
         if (a)
           *a = '\0';
       }
-      sscanf(a, "%s", tempo);
+      // Bound to tempo[1100]; no token => leave empty, don't read uninit tempo.
-      if (strlen(tempo) < 64)   // pas trop long!!
+      if (sscanf(a, "%1099s", tempo) == 1 && strlen(tempo) < 64)
         strcpybuff(retour->contentencoding, tempo);
       else
-        retour->contentencoding[0] = '\0';      // erreur
+        retour->contentencoding[0] = '\0';
-#if HTS_USEZLIB
+      /* A coding to undo (or one we can not undo, which must fail the fetch
-      /* Check known encodings */
+         rather than save the coded bytes as the page) */
-      if (retour->contentencoding[0]) {
+      if (hts_codec_parse(retour->contentencoding) != HTS_CODEC_IDENTITY)
-        if ((strfield2(retour->contentencoding, "gzip"))
+        retour->compressed = 1;
-            || (strfield2(retour->contentencoding, "x-gzip"))
-            /*
-               || (strfield2(retour->contentencoding, "compress"))
-               || (strfield2(retour->contentencoding, "x-compress"))
-             */
-            || (strfield2(retour->contentencoding, "deflate"))
-            || (strfield2(retour->contentencoding, "x-deflate"))
-          ) {
-          retour->compressed = 1;
-        }
-      }
-#endif
     }
   } else if ((p = strfield(rcvd, "Location:")) != 0) {
     if (retour) {
@@ -1702,6 +1549,9 @@ void treathead(t_cookie * cookie, const char *adr, const char *fil, htsblk * ret
 #if DEBUG_COOK
     printf("set-cookie detected\n");
 #endif
+    /* Over-long host overflows the fail-safe domain[] copy (abort); drop it. */
+    if (adr && strlen(jump_identification_const(adr)) >= sizeof(domain))
+      return;
     while(*a) {
       char *token_st, *token_end;
       char *value_st, *value_end;
@@ -1998,6 +1848,15 @@ LLint http_xfread1(htsblk * r, int bufl) {
 
   if (bufl > 0) {
     if (!r->is_write) {         // stocker en mémoire
+      // In-memory content must fit a 32-bit index (allocs below add 1, reads
+      // use int offsets): reject a hostile Content-Length or endless stream.
+      const LLint inmem_want =
+          (r->totalsize >= 0) ? r->totalsize : (r->size + bufl);
+      if (inmem_want >= INT32_MAX) {
+        r->statuscode = STATUSCODE_INVALID;
+        strcpybuff(r->msg, "In-memory content too large");
+        return READ_ERROR;
+      }
       if (r->totalsize >= 0) {  // totalsize déterminé ET ALLOUE
         if (r->adr == NULL) {
           r->adr = (char *) malloct((size_t) r->totalsize + 1);
@@ -2560,6 +2419,11 @@ int ident_url_absolute(const char *url, lien_adrfil *adrfil) {
     // recopier adrfil->adresse www..
     strncatbuff(adrfil->adr, p, ((int) (q - p)));
     // *( adrfil->adr+( ((int) q) - ((int) p) ) )=0;  // faut arrêter la fumette!
+
+    // fil[] holds the path plus a possible leading '/' the top strlen() misses.
+    if (strlen(q) >= sizeof(adrfil->fil) - (q[0] != '/' ? 1 : 0))
+      return -1;
+
     // recopier chemin /pub/..
     if (q[0] != '/')            // page par défaut (/)
       strcatbuff(adrfil->fil, "/");
@@ -3038,12 +2902,11 @@ HTSEXT_API char *int2char(strc_int2bytes2 * strc, int n) {
 /* See http://physics.nist.gov/cuu/Units/binary.html */
 #define ToLLint(a) ((LLint)(a))
 #define ToLLintKiB (ToLLint(1024))
-#define ToLLintMiB (ToLLintKiB*ToLLintKiB)
+#define ToLLintMiB (ToLLintKiB * ToLLintKiB)
-#ifdef HTS_LONGLONG
+#define ToLLintGiB (ToLLintKiB * ToLLintKiB * ToLLintKiB)
-#define ToLLintGiB (ToLLintKiB*ToLLintKiB*ToLLintKiB)
+#define ToLLintTiB (ToLLintKiB * ToLLintKiB * ToLLintKiB * ToLLintKiB)
-#define ToLLintTiB (ToLLintKiB*ToLLintKiB*ToLLintKiB*ToLLintKiB)
+#define ToLLintPiB                                                             \
-#define ToLLintPiB (ToLLintKiB*ToLLintKiB*ToLLintKiB*ToLLintKiB*ToLLintKiB)
+  (ToLLintKiB * ToLLintKiB * ToLLintKiB * ToLLintKiB * ToLLintKiB)
-#endif
 HTSEXT_API char **int2bytes2(strc_int2bytes2 * strc, LLint n) {
   if (n < ToLLintKiB) {
     sprintf(strc->buff1, "%d", (int) (LLint) n);
@@ -3052,9 +2915,7 @@ HTSEXT_API char **int2bytes2(strc_int2bytes2 * strc, LLint n) {
     sprintf(strc->buff1, "%d,%02d", (int) ((LLint) (n / ToLLintKiB)),
             (int) ((LLint) ((n % ToLLintKiB) * 100) / ToLLintKiB));
     strcpybuff(strc->buff2, "KiB");
-  }
+  } else if (n < ToLLintGiB) {
-#ifdef HTS_LONGLONG
-  else if (n < ToLLintGiB) {
     sprintf(strc->buff1, "%d,%02d", (int) ((LLint) (n / (ToLLintMiB))),
             (int) ((LLint) (((n % (ToLLintMiB)) * 100) / (ToLLintMiB))));
     strcpybuff(strc->buff2, "MiB");
@@ -3071,13 +2932,6 @@ HTSEXT_API char **int2bytes2(strc_int2bytes2 * strc, LLint n) {
             (int) ((LLint) (((n % (ToLLintPiB)) * 100) / (ToLLintPiB))));
     strcpybuff(strc->buff2, "PiB");
   }
-#else
-  else {
-    sprintf(strc->buff1, "%d,%02d", (int) ((LLint) (n / (ToLLintMiB))),
-            (int) ((LLint) (((n % (ToLLintMiB)) * 100) / (ToLLintMiB))));
-    strcpybuff(strc->buff2, "MiB");
-  }
-#endif
   strc->buffadr[0] = strc->buff1;
   strc->buffadr[1] = strc->buff2;
   return strc->buffadr;
@@ -3859,6 +3713,10 @@ const char *jump_protocol_const(const char *source) {
     source += p;
   else if ((p = strfield(source, "file:")))
     source += p;
+  else if ((p = strfield(source, "socks5h:")))
+    source += p;
+  else if ((p = strfield(source, "socks5:")))
+    source += p;
   // net_path
   if (strncmp(source, "//", 2) == 0)
     source += 2;
@@ -3867,6 +3725,48 @@ const char *jump_protocol_const(const char *source) {
 
 DECLARE_NON_CONST_VERSION(jump_protocol)
 
+hts_boolean hts_proxy_is_socks(const char *name) {
+  if (name == NULL)
+    return HTS_FALSE;
+  return (strfield(name, "socks5h:") || strfield(name, "socks5:")) ? HTS_TRUE
+                                                                   : HTS_FALSE;
+}
+
+// default proxy port for a -P argument, keyed on the scheme
+static int proxy_default_port(const char *arg) {
+  return hts_proxy_is_socks(arg) ? 1080 : 8080;
+}
+
+void hts_parse_proxy(const char *arg, char *name, size_t name_size, int *port) {
+  const char *authority = strstr(arg, "://");
+  const char *a;
+  size_t namelen;
+
+  if (name_size == 0)
+    return;
+  // scan back to the port ':' (or userinfo '@'), but never past the authority,
+  // so a scheme's own colon is not read as a port separator; inspect a[-1] from
+  // one-past-end so no pointer below the string is ever formed
+  authority = (authority != NULL) ? authority + 3 : arg;
+  a = arg + strlen(arg);
+  while (a > authority && a[-1] != ':' && a[-1] != '@')
+    a--;
+  if (a > authority && a[-1] == ':') {
+    int p = -1;
+
+    sscanf(a, "%d", &p);
+    *port = (p > 0) ? p : proxy_default_port(arg);
+    namelen = (size_t) (a - 1 - arg);
+  } else {
+    *port = proxy_default_port(arg);
+    namelen = strlen(arg);
+  }
+  if (namelen >= name_size) // arg is user-controlled: truncate, don't overflow
+    namelen = name_size - 1;
+  memcpy(name, arg, namelen);
+  name[namelen] = '\0';
+}
+
 // codage base 64 a vers b
 void code64(unsigned char *a, int size_a, unsigned char *b, int crlf) {
   int i1 = 0, i2 = 0, i3 = 0, i4 = 0;
@@ -4352,11 +4252,6 @@ HTSEXT_API void get_httptype(httrackp *opt, char *s, const char *fil,
   (void) get_httptype_sized(opt, s, HTS_MIMETYPE_SIZE, fil, flag);
 }
 
-/* Advertised Accept-Encoding; gzip and deflate both decode via hts_zunpack */
-const char *hts_acceptencoding(hts_boolean compressible) {
-  return compressible ? "gzip, deflate, identity;q=0.9" : "identity";
-}
-
 // get type of fil (php)
 // s: buffer (text/html) or NULL
 // return: 1 if known by user
@@ -5005,7 +4900,7 @@ static struct addrinfo *resolver_make_ai(const char *ip, int want_family) {
   return ai;
 }
 
-static void override_freeaddrinfo(struct addrinfo *res) {
+static void HTS_RESOLVER_CALL override_freeaddrinfo(struct addrinfo *res) {
   while (res != NULL) {
     struct addrinfo *const next = res->ai_next;
 
@@ -5015,9 +4910,10 @@ static void override_freeaddrinfo(struct addrinfo *res) {
   }
 }
 
-static int override_getaddrinfo(const char *node, const char *service,
+static int HTS_RESOLVER_CALL override_getaddrinfo(const char *node,
-                                const struct addrinfo *hints,
+                                                  const char *service,
-                                struct addrinfo **res) {
+                                                  const struct addrinfo *hints,
+                                                  struct addrinfo **res) {
   const char *const spec = getenv("HTTRACK_DEBUG_RESOLVE");
   const int want = (hints != NULL) ? hints->ai_family : PF_UNSPEC;
   const char *colon;
@@ -5913,17 +5809,7 @@ int multipleStringMatch(const char *s, const char *match) {
 }
 
 HTSEXT_API httrackp *hts_create_opt(void) {
-#if ( defined(_WIN32) || defined(__ANDROID__) )
+  static const char *defaultModules[] = {"httrack-plugin", NULL};
-  static const char *defaultModules[] = {
-    "htsswf", "htsjava", "httrack-plugin", NULL
-  };
-#else
-#ifndef HTS_LIBHTSJAVA_NAME
-#define HTS_LIBHTSJAVA_NAME "libhtsjava.so" /* non-autoconf fallback */
-#endif
-  static const char *defaultModules[] = {"libhtsswf.so.1", HTS_LIBHTSJAVA_NAME,
-                                         "httrack-plugin", NULL};
-#endif
   httrackp *opt = malloc(sizeof(httrackp));
 
   /* default options */
@@ -6006,6 +5892,7 @@ HTSEXT_API httrackp *hts_create_opt(void) {
   StringCopy(opt->footer, HTS_DEFAULT_FOOTER);
   StringCopy(opt->strip_query, "");
   StringCopy(opt->cookies_file, "");
+  StringCopy(opt->why_url, "");
   opt->pause_min_ms = 0;
   opt->pause_max_ms = 0;
   opt->ftp_proxy = HTS_TRUE;
@@ -6153,6 +6040,7 @@ HTSEXT_API void hts_free_opt(httrackp * opt) {
     StringFree(opt->mod_blacklist);
     StringFree(opt->strip_query);
     StringFree(opt->cookies_file);
+    StringFree(opt->why_url);
 
     StringFree(opt->path_html);
     StringFree(opt->path_html_utf8);

src/htslib.h

@@ -184,10 +184,10 @@ int http_sendhead(httrackp * opt, t_cookie * cookie, int mode, const char *xsend
                   const char *referer_adr, const char *referer_fil,
                   htsblk * retour);
 /* Build the request "Cookie:" header line for stored cookies matching
-   domain/path into dst (NUL-terminated). Exposed for the -#Q self-test;
+   domain/path into dst (NUL-terminated), wrapping the logic http_sendhead()
-   wraps the same logic http_sendhead() uses. Returns cookies emitted. */
+   uses. Returns cookies emitted. */
-int http_cookie_header_selftest(t_cookie *cookie, const char *domain,
+int http_cookie_header(t_cookie *cookie, const char *domain, const char *path,
-                                const char *path, char *dst, size_t dst_size);
+                       char *dst, size_t dst_size);
 
 T_SOC newhttp(httrackp * opt, const char *iadr, htsblk * retour, int port,
               int waitconnect);
@@ -207,15 +207,9 @@ int check_readinput(htsblk * r);
 int check_readinput_t(T_SOC soc, int timeout);
 int check_writeinput_t(T_SOC soc, int timeout);
 
-/* Open an HTTP CONNECT tunnel through the active proxy for an https request:
+/* TRUE if this -P proxy name (which keeps its scheme) is a SOCKS5 proxy. */
-   `retour->soc` must already be TCP-connected to the proxy, and `adr` is the
+hts_boolean hts_proxy_is_socks(const char *name);
-   origin authority (url_adr, e.g. "https://host:port"). Sends the CONNECT
+
-   request (with Proxy-Authorization when the proxy carries credentials) and
-   reads the proxy's status line, so the caller's TLS handshake then runs
-   end-to-end with the origin. Blocks up to `timeout` seconds. Returns 1 on a
-   2xx tunnel, 0 on failure (retour->msg/statuscode set). */
-int http_proxy_tunnel(httrackp *opt, htsblk *retour, const char *adr,
-                      int timeout);
 void treathead(t_cookie * cookie, const char *adr, const char *fil, htsblk * retour,
                char *rcvd);
 void treatfirstline(htsblk * retour, const char *rcvd);
@@ -283,15 +277,18 @@ int ishttperror(int err);
 int get_userhttptype(httrackp * opt, char *s, const char *fil);
 int give_mimext(char *s, size_t ssize, const char *st);
 
-/* Advertised Accept-Encoding value (no header name/CRLF); see htslib.c. */
-const char *hts_acceptencoding(hts_boolean compressible);
-
 int may_bogus_multiple(httrackp * opt, const char *mime, const char *filename);
 int may_unknown2(httrackp * opt, const char *mime, const char *filename);
 
 const char *strrchr_limit(const char *s, char c, const char *limit);
 char *jump_protocol(char *source);
 const char *jump_protocol_const(const char *source);
+
+/* Split a -P proxy argument "[scheme://][user:pass@]host[:port]" into the proxy
+   host string (scheme and any user:pass kept, for later stripping and auth),
+   written NUL-terminated into name[name_size] (truncated to fit), and the port
+   in *port. The port defaults by scheme: 1080 for socks5/socks5h, else 8080. */
+void hts_parse_proxy(const char *arg, char *name, size_t name_size, int *port);
 void code64(unsigned char *a, int size_a, unsigned char *b, int crlf);
 
 #define copychar(catbuff,a) concat(catbuff,(a),NULL)
@@ -493,6 +490,14 @@ HTS_STATIC int strcmpnocase(const char *a, const char *b) {
 #define snprintf _snprintf
 #endif
 
+/* MSVC ships these POSIX functions under other names. Kept out of the installed
+   headers: they would rewrite the same identifiers in a consumer's own code. */
+#ifdef _MSC_VER
+#define fseeko _fseeki64
+#define ftello _ftelli64
+#define timegm _mkgmtime
+#endif
+
 #define strfield2(f,s) ( (strlen(f)!=strlen(s)) ? 0 : (strfield(f,s)) )
 
 // is this MIME an hypertext MIME (text/html), html/js-style or other script/text type?

src/htsname.c

@@ -42,6 +42,7 @@ Please visit our Website: http://www.httrack.com
 #include "htscharset.h"
 #include "htsencoding.h"
 #include "htssniff.h"
+#include "htscodec.h"
 #if HTS_USEZLIB
 #include "htszlib.h"
 #endif
@@ -151,29 +152,6 @@ typedef struct sniff_src {
   const char *prev_save; /* previous run's save name (cache X-Save) */
 } sniff_src;
 
-#if HTS_USEZLIB
-/* Inflate the head of a gzip/zlib stream; 0 when undecodable. */
-static size_t sniff_inflate_head(const void *in, size_t in_len, void *out,
-                                 size_t out_len) {
-  z_stream zs;
-  size_t n = 0;
-  int err;
-
-  memset(&zs, 0, sizeof(zs));
-  if (inflateInit2(&zs, 47) != Z_OK) /* 47: gzip or zlib, autodetected */
-    return 0;
-  zs.next_in = (const Bytef *) in;
-  zs.avail_in = (uInt) in_len;
-  zs.next_out = (Bytef *) out;
-  zs.avail_out = (uInt) out_len;
-  err = inflate(&zs, Z_SYNC_FLUSH);
-  if (err == Z_OK || err == Z_STREAM_END || err == Z_BUF_ERROR)
-    n = out_len - zs.avail_out;
-  inflateEnd(&zs);
-  return n;
-}
-#endif
-
 static size_t sniff_read_head(const char *path, void *buf, size_t len) {
   char catbuff[CATBUFF_SIZE];
   FILE *const fp = FOPEN(fconv(catbuff, sizeof(catbuff), path), "rb");
@@ -205,16 +183,12 @@ static size_t sniff_slot_head(const lien_back *slot, void *buf, size_t len) {
       n = sniff_read_head(slot->tmpfile, buf, len);
   }
   if (n > 0 && r->compressed) {
-#if HTS_USEZLIB
     unsigned char raw[HTS_SNIFF_LEN];
 
     if (n > sizeof(raw))
       n = sizeof(raw);
     memcpy(raw, buf, n);
-    n = sniff_inflate_head(raw, n, buf, len);
+    n = hts_codec_head(hts_codec_parse(r->contentencoding), raw, n, buf, len);
-#else
-    n = 0;
-#endif
   }
   return n;
 }

src/htsnet.h

@@ -309,10 +309,19 @@ typedef socklen_t SOClen;
     self-test can script DNS answers (families, multiplicity, errors)
     in-process. The free function must match its getaddrinfo (a fake allocates
     its own chain), hence the pair. */
+/* Winsock's resolver is __stdcall; a plain pointer only compiles on x64, where
+   there is one convention. Backend implementations must carry this too. */
+#ifdef _WIN32
+#define HTS_RESOLVER_CALL WSAAPI
+#else
+#define HTS_RESOLVER_CALL
+#endif
+
 typedef struct hts_resolver_backend {
-  int (*getaddrinfo)(const char *node, const char *service,
+  int(HTS_RESOLVER_CALL *getaddrinfo)(const char *node, const char *service,
-                     const struct addrinfo *hints, struct addrinfo **res);
+                                      const struct addrinfo *hints,
-  void (*freeaddrinfo)(struct addrinfo *res);
+                                      struct addrinfo **res);
+  void(HTS_RESOLVER_CALL *freeaddrinfo)(struct addrinfo *res);
 } hts_resolver_backend;
 
 /** Install a resolver backend for the process; NULL restores the libc default.

src/htsopt.h

@@ -328,8 +328,8 @@ typedef enum hts_wizard {
 
 typedef enum hts_robots {
   HTS_ROBOTS_NEVER = 0,        /**< ignore robots rules */
-  HTS_ROBOTS_SOMETIMES = 1,    /**< partial obedience (default) */
+  HTS_ROBOTS_SOMETIMES = 1,    /**< partial obedience, set by -s */
-  HTS_ROBOTS_ALWAYS = 2,       /**< obey robots rules */
+  HTS_ROBOTS_ALWAYS = 2,       /**< obey robots rules (default) */
   HTS_ROBOTS_ALWAYS_STRICT = 3 /**< obey even strict rules */
 } hts_robots;
 #endif
@@ -536,6 +536,8 @@ struct httrackp {
                                  (--cookies-file) */
   int pause_min_ms; /**< inter-file pause lower bound, ms (0=off, #185) */
   int pause_max_ms; /**< inter-file pause upper bound, ms */
+  String why_url;   /**< URL to diagnose (--why): print the deciding filter rule
+                         and exit without crawling */
 };
 
 /* Running statistics for a mirror. */

src/htsparse.c

@@ -2007,7 +2007,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
 
                 /* Unescape/escape %20 and other   */
                 {
-                  // Note: always true (iso-8859-1 as default)
+                  // NULL when UTF-8 conversion is off (-%T0)
                   const char *const charset = str->page_charset_;
                   const int hasCharset = charset != NULL 
                     && *charset != '\0';
@@ -2031,10 +2031,11 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                   // Force to encode non-printable chars (should never happend)
                   escape_remove_control(lien);
 
-                  // charset conversion for the URI filename, 
+                  // charset conversion for the URI filename (not the query
-                  // and not already UTF-8
+                  // string), unless the bytes already are valid UTF-8:
-                  // (note: not for the query string!)
+                  // converting those would double-encode them (#180)
-                  if (hasCharset && !hts_isCharsetUTF8(charset)) {
+                  if (hasCharset && !hts_isCharsetUTF8(charset) &&
+                      !hts_isStringUTF8(lien, strlen(lien))) {
                     char *const s = hts_convertStringToUTF8(lien, strlen(lien), charset);
                     if (s != NULL) {
                       hts_log_print(opt, LOG_DEBUG,
@@ -4310,6 +4311,8 @@ int hts_wait_delayed(htsmoduleStruct * str, lien_adrfilsave *afs,
       *forbidden_url == 0 && IS_DELAYED_EXT(afs->save) && !opt->state.stop) {
     int loops;
     int continue_loop;
+    char BIGSTK
+        cookie_before[16384]; /* #15: this URL's Cookie header, pre-request */
 
     hts_log_print(opt, LOG_DEBUG, "Waiting for type to be known: %s%s", afs->af.adr,
                   afs->af.fil);
@@ -4318,6 +4321,12 @@ int hts_wait_delayed(htsmoduleStruct * str, lien_adrfilsave *afs,
     for(loops = 0, continue_loop = 1;
         IS_DELAYED_EXT(afs->save) && continue_loop && loops < 7; loops++) {
       continue_loop = 0;
+      /* #15: snapshot the Cookie header THIS url would send, so only its own
+         self-redirect Set-Cookie trips the retry, not a concurrent slot's. */
+      cookie_before[0] = '\0';
+      if (opt->accept_cookie && opt->cookie != NULL)
+        http_cookie_header(opt->cookie, jump_identification_const(afs->af.adr),
+                           afs->af.fil, cookie_before, sizeof(cookie_before));
 
       /* Wait for an available slot */
       if (!hts_wait_available_socket(sback, opt, cache, ptr))
@@ -4515,6 +4524,17 @@ int hts_wait_delayed(htsmoduleStruct * str, lien_adrfilsave *afs,
           /* Moved! */
           else if (HTTP_IS_REDIRECT(back[b].r.statuscode)) {
             char BIGSTK mov_url[HTS_URLMAXSIZE * 2];
+            char BIGSTK cookie_after[16384];
+            hts_boolean cookies_changed;
+
+            /* #15: cookie-wall signal: this URL's own Cookie header changed
+               across its self-redirect (a Set-Cookie it just set). */
+            cookie_after[0] = '\0';
+            if (opt->accept_cookie && opt->cookie != NULL)
+              http_cookie_header(
+                  opt->cookie, jump_identification_const(afs->af.adr),
+                  afs->af.fil, cookie_after, sizeof(cookie_after));
+            cookies_changed = strcmp(cookie_before, cookie_after) != 0;
 
             mov_url[0] = '\0';
             strcpybuff(mov_url, back[b].r.location);    // copier URL
@@ -4584,11 +4604,24 @@ int hts_wait_delayed(htsmoduleStruct * str, lien_adrfilsave *afs,
                   url_savename(afs, former, heap(ptr)->adr, heap(ptr)->fil, 
                                opt, sback, cache, hash, ptr, numero_passe,
                                &delayed_back);
+                } else if (cookies_changed) {
+                  // #15: cookie-wall self-redirect; evict the cached
+                  // fast-header so the re-issue refetches with the cookie.
+                  if (cache->cached_tests != NULL)
+                    coucal_remove(cache->cached_tests,
+                                  concat(OPT_GET_BUFF(opt),
+                                         OPT_GET_BUFF_SIZE(opt), afs->af.adr,
+                                         afs->af.fil));
+                  afs->save[0] = '\0';
+                  url_savename(afs, former, heap(ptr)->adr, heap(ptr)->fil, opt,
+                               sback, cache, hash, ptr, numero_passe,
+                               &delayed_back);
+                  continue_loop = 1;
                 } else {
                   hts_log_print(opt, LOG_WARNING,
                                 "Unable to test %s%s (loop to same filename)",
                                 afs->af.adr, afs->af.fil);
-                }               // loop to same location
+                } // loop to same location
               }                 // ident_url_relatif()
             }                   // location
           }                     // redirect

src/htsproxy.c

@@ -0,0 +1,539 @@
+/* ------------------------------------------------------------ */
+/*
+HTTrack Website Copier, Offline Browser for Windows and Unix
+Copyright (C) 2026 Xavier Roche and other contributors
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+Ethical use: we kindly ask that you NOT use this software to harvest email
+addresses or to collect any other private information about people. Doing so
+would dishonor our work and waste the many hours we have spent on it.
+
+Please visit our Website: http://www.httrack.com
+*/
+
+/* ------------------------------------------------------------ */
+/* File: Proxy tunneling (HTTP CONNECT, SOCKS5)                 */
+/* Author: Xavier Roche                                         */
+/* ------------------------------------------------------------ */
+
+/* Internal engine bytecode */
+#define HTS_INTERNAL_BYTECODE
+
+#include "htscore.h"
+
+#include "htslib.h"
+#include "htsproxy.h"
+
+#include <string.h>
+
+// Read a CRLF line from a non-blocking socket (waits up to timeout per recv).
+// Returns the line length (0 = empty), or -1 on timeout/EOF/error.
+static int proxy_getline(T_SOC soc, char *s, int max, int timeout) {
+  int j = 0;
+
+  for (;;) {
+    unsigned char ch;
+    int n;
+
+    if (!check_readinput_t(soc, timeout))
+      return -1; // timed out waiting for data
+    n = (int) recv(soc, &ch, 1, 0);
+    if (n == 1) {
+      if (ch == 13) // CR
+        continue;
+      if (ch == 10) // LF: end of line
+        break;
+      if (j >= max - 1)
+        return -1; // line too long: bound the read against a hostile proxy
+      s[j++] = (char) ch;
+    } else if (n == 0) {
+      return -1; // connection closed
+    } else {
+#ifdef _WIN32
+      if (WSAGetLastError() == WSAEWOULDBLOCK)
+        continue;
+#else
+      if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)
+        continue;
+#endif
+      return -1;
+    }
+  }
+  s[j] = '\0';
+  return j;
+}
+
+int http_proxy_tunnel(httrackp *opt, htsblk *retour, const char *adr,
+                      int timeout) {
+  const T_SOC soc = retour->soc;
+  const char *const host = jump_identification_const(adr); // host[:port]
+  const char *const portsep = jump_toport_const(adr);      // ":port" or NULL
+  char BIGSTK authority[HTS_URLMAXSIZE * 2];
+  char BIGSTK req[HTS_URLMAXSIZE * 4 + 1100];
+  char line[1024];
+  int code;
+
+  if (soc == INVALID_SOCKET)
+    return 0;
+
+  // CONNECT needs an explicit host:port; default the https port
+  authority[0] = '\0';
+  if (portsep != NULL)
+    strlcatbuff(authority, host, sizeof(authority)); // already host:port
+  else
+    snprintf(authority, sizeof(authority), "%s:%d", host, 443);
+
+  // backstop: never let a stray CR/LF in the host smuggle a second line into
+  // the CONNECT request (the host is already sanitized upstream)
+  {
+    const char *c;
+
+    for (c = authority; *c != '\0'; c++) {
+      if ((unsigned char) *c < ' ') {
+        strcpybuff(retour->msg, "proxy CONNECT: invalid host");
+        return 0;
+      }
+    }
+  }
+
+  snprintf(req, sizeof(req), "CONNECT %s HTTP/1.0" H_CRLF "Host: %s" H_CRLF,
+           authority, authority);
+
+  // creds go on the CONNECT, not the tunneled origin request
+  if (link_has_authorization(retour->req.proxy.name)) {
+    const char *a = jump_identification_const(retour->req.proxy.name);
+    const char *astart = jump_protocol_const(retour->req.proxy.name);
+    char autorisation[1100];
+    char user_pass[256];
+
+    autorisation[0] = user_pass[0] = '\0';
+    strncatbuff(user_pass, astart, (int) (a - astart) - 1);
+    strcpybuff(user_pass, unescape_http(OPT_GET_BUFF(opt),
+                                        OPT_GET_BUFF_SIZE(opt), user_pass));
+    code64((unsigned char *) user_pass, (int) strlen(user_pass),
+           (unsigned char *) autorisation, 0);
+    strlcatbuff(req, "Proxy-Authorization: Basic ", sizeof(req));
+    strlcatbuff(req, autorisation, sizeof(req));
+    strlcatbuff(req, H_CRLF, sizeof(req));
+  }
+  strlcatbuff(req, H_CRLF, sizeof(req)); // end of request headers
+
+  // raw send: ssl is set, so sendc() would route to TLS
+  {
+    const char *p = req;
+    size_t remain = strlen(req);
+    int stalls = 0;
+
+    while (remain > 0) {
+      const int n = (int) send(soc, p, (int) remain, 0);
+
+      if (n > 0) {
+        p += n;
+        remain -= (size_t) n;
+        stalls = 0;
+      } else {
+#ifdef _WIN32
+        const int wouldblock = (WSAGetLastError() == WSAEWOULDBLOCK);
+#else
+        const int wouldblock =
+            (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR);
+#endif
+        // don't spin forever on a fatal error or an unwritable socket
+        if (!wouldblock || !check_writeinput_t(soc, timeout) ||
+            ++stalls > 100) {
+          strcpybuff(retour->msg, "proxy CONNECT: write error");
+          return 0;
+        }
+      }
+    }
+  }
+
+  // proxy status line: "HTTP/1.x <code> ..."
+  if (proxy_getline(soc, line, sizeof(line), timeout) < 0) {
+    strcpybuff(retour->msg, "proxy CONNECT: no response");
+    return 0;
+  }
+  if (sscanf(line, "HTTP/%*d.%*d %d", &code) < 1)
+    code = 0;
+  if (code < 200 || code >= 300) {
+    snprintf(retour->msg, sizeof(retour->msg), "proxy CONNECT refused: %s",
+             strnotempty(line) ? line : "(no status)");
+    return 0;
+  }
+
+  // drain headers to the blank line; cap the count so a flooding proxy can't
+  // stall the crawl
+  {
+    int headers = 0;
+
+    for (;;) {
+      const int n = proxy_getline(soc, line, sizeof(line), timeout);
+
+      if (n < 0) {
+        strcpybuff(retour->msg, "proxy CONNECT: truncated response");
+        return 0;
+      }
+      if (n == 0)
+        break; // blank line: tunnel ready
+      if (++headers > 64) {
+        strcpybuff(retour->msg, "proxy CONNECT: too many response headers");
+        return 0;
+      }
+    }
+  }
+
+  return 1;
+}
+
+/* SOCKS5 client (RFC 1928, RFC 1929 auth), hostname mode only: the proxy
+   resolves the origin name (remote DNS, curl's socks5h). The stream is the
+   proxy socket, or a scripted buffer under -#test=socks5. */
+
+#define SOCKS5_VERSION 0x05
+#define SOCKS5_AUTH_VERSION 0x01
+#define SOCKS5_METHOD_NONE 0x00
+#define SOCKS5_METHOD_USERPASS 0x02
+#define SOCKS5_METHOD_NOACCEPTABLE 0xFF
+#define SOCKS5_CMD_CONNECT 0x01
+#define SOCKS5_ATYP_IPV4 0x01
+#define SOCKS5_ATYP_DOMAIN 0x03
+#define SOCKS5_ATYP_IPV6 0x04
+#define SOCKS5_MAXFIELD 255 /* one length byte: host, user and password */
+
+typedef struct socks5_stream {
+  T_SOC soc; /* INVALID_SOCKET when scripted (self-test) */
+  int timeout;
+  socks5_test_io *io;
+} socks5_stream;
+
+static int socks5_fail(char *msg, size_t msgsize, const char *text) {
+  if (msgsize != 0)
+    strlcpybuff(msg, text, msgsize);
+  return 0;
+}
+
+/* Read exactly n bytes, or fail: SOCKS frames are not self-delimiting, so a
+   short read would desync the stream shared with the origin traffic. */
+static int socks5_read_n(socks5_stream *st, unsigned char *buf, size_t n) {
+  size_t got = 0;
+  int stalls = 0;
+
+  if (st->soc == INVALID_SOCKET) { /* scripted */
+    socks5_test_io *const io = st->io;
+
+    if (n > io->reply_len - io->consumed)
+      return 0;
+    memcpy(buf, io->reply + io->consumed, n);
+    io->consumed += n;
+    return 1;
+  }
+  while (got < n) {
+    const int r = (int) recv(st->soc, (char *) buf + got, (int) (n - got), 0);
+
+    if (r > 0) {
+      got += (size_t) r;
+      stalls = 0;
+    } else if (r == 0) {
+      return 0; // proxy closed mid-frame
+    } else {
+#ifdef _WIN32
+      const int wouldblock = (WSAGetLastError() == WSAEWOULDBLOCK);
+#else
+      const int wouldblock =
+          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR);
+#endif
+      if (!wouldblock || !check_readinput_t(st->soc, st->timeout) ||
+          ++stalls > 100)
+        return 0;
+    }
+  }
+  return 1;
+}
+
+static int socks5_write_all(socks5_stream *st, const unsigned char *buf,
+                            size_t len) {
+  size_t remain = len;
+  int stalls = 0;
+
+  if (st->soc == INVALID_SOCKET) { /* scripted */
+    socks5_test_io *const io = st->io;
+
+    if (len > sizeof(io->sent) - io->sent_len)
+      return 0;
+    memcpy(io->sent + io->sent_len, buf, len);
+    io->sent_len += len;
+    return 1;
+  }
+  while (remain > 0) {
+    // raw send: the socket is still plain here, sendc() would route to TLS
+    const int n = (int) send(st->soc, (const char *) buf, (int) remain, 0);
+
+    if (n > 0) {
+      buf += n;
+      remain -= (size_t) n;
+      stalls = 0;
+    } else {
+#ifdef _WIN32
+      const int wouldblock = (WSAGetLastError() == WSAEWOULDBLOCK);
+#else
+      const int wouldblock =
+          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR);
+#endif
+      if (!wouldblock || !check_writeinput_t(st->soc, st->timeout) ||
+          ++stalls > 100)
+        return 0;
+    }
+  }
+  return 1;
+}
+
+static const char *socks5_rep_message(unsigned char rep) {
+  switch (rep) {
+  case 0x01:
+    return "general failure";
+  case 0x02:
+    return "connection not allowed by ruleset";
+  case 0x03:
+    return "network unreachable";
+  case 0x04:
+    return "host unreachable";
+  case 0x05:
+    return "connection refused";
+  case 0x06:
+    return "TTL expired";
+  case 0x07:
+    return "command not supported";
+  case 0x08:
+    return "address type not supported";
+  default:
+    return "unknown error";
+  }
+}
+
+/* The reply's BND.ADDR is variable-length: consume exactly what ATYP says, or
+   the leftover bytes prepend to the first origin (or TLS) read. */
+static int socks5_read_reply(socks5_stream *st, char *msg, size_t msgsize) {
+  unsigned char head[4];
+  unsigned char addr[SOCKS5_MAXFIELD + 2];
+  size_t addrlen;
+
+  if (!socks5_read_n(st, head, sizeof(head)))
+    return socks5_fail(msg, msgsize, "SOCKS5: no reply from proxy");
+  if (head[0] != SOCKS5_VERSION)
+    return socks5_fail(msg, msgsize, "SOCKS5: bad version in reply");
+  if (head[1] != 0x00) {
+    snprintf(msg, msgsize, "SOCKS5 connect failed: %s",
+             socks5_rep_message(head[1]));
+    return 0;
+  }
+  switch (head[3]) {
+  case SOCKS5_ATYP_IPV4:
+    addrlen = 4;
+    break;
+  case SOCKS5_ATYP_IPV6:
+    addrlen = 16;
+    break;
+  case SOCKS5_ATYP_DOMAIN: {
+    unsigned char len;
+
+    if (!socks5_read_n(st, &len, 1))
+      return socks5_fail(msg, msgsize, "SOCKS5: truncated reply");
+    addrlen = len; // <= 255, always fits addr[]
+    break;
+  }
+  default: // unknown length: the stream cannot be resynchronized
+    return socks5_fail(msg, msgsize, "SOCKS5: unknown address type in reply");
+  }
+  if (addrlen != 0 && !socks5_read_n(st, addr, addrlen))
+    return socks5_fail(msg, msgsize, "SOCKS5: truncated reply address");
+  if (!socks5_read_n(st, addr, 2)) // BND.PORT, unused
+    return socks5_fail(msg, msgsize, "SOCKS5: truncated reply port");
+  return 1;
+}
+
+static int socks5_negotiate(socks5_stream *st, const char *host, size_t hostlen,
+                            int port, const char *user, size_t userlen,
+                            const char *pass, size_t passlen, int want_auth,
+                            char *msg, size_t msgsize) {
+  unsigned char frame[3 + SOCKS5_MAXFIELD + SOCKS5_MAXFIELD];
+  unsigned char rep[2];
+
+  /* greeting */
+  frame[0] = SOCKS5_VERSION;
+  frame[1] = (unsigned char) (want_auth ? 2 : 1);
+  frame[2] = SOCKS5_METHOD_NONE;
+  frame[3] = SOCKS5_METHOD_USERPASS;
+  if (!socks5_write_all(st, frame, (size_t) 2 + frame[1]))
+    return socks5_fail(msg, msgsize, "SOCKS5: write error");
+  if (!socks5_read_n(st, rep, sizeof(rep)))
+    return socks5_fail(msg, msgsize, "SOCKS5: no method reply from proxy");
+  if (rep[0] != SOCKS5_VERSION)
+    return socks5_fail(msg, msgsize, "SOCKS5: bad version in method reply");
+  switch (rep[1]) {
+  case SOCKS5_METHOD_NONE:
+    break;
+  case SOCKS5_METHOD_USERPASS:
+    if (!want_auth)
+      return socks5_fail(msg, msgsize,
+                         "SOCKS5: proxy requires authentication, none given");
+    /* RFC 1929 sub-negotiation; its version byte is 0x01, not 0x05 */
+    frame[0] = SOCKS5_AUTH_VERSION;
+    frame[1] = (unsigned char) userlen;
+    memcpy(frame + 2, user, userlen);
+    frame[2 + userlen] = (unsigned char) passlen;
+    memcpy(frame + 3 + userlen, pass, passlen);
+    if (!socks5_write_all(st, frame, 3 + userlen + passlen))
+      return socks5_fail(msg, msgsize, "SOCKS5: write error");
+    if (!socks5_read_n(st, rep, sizeof(rep)))
+      return socks5_fail(msg, msgsize, "SOCKS5: no authentication reply");
+    if (rep[1] != 0x00)
+      return socks5_fail(msg, msgsize, "SOCKS5: authentication failed");
+    break;
+  case SOCKS5_METHOD_NOACCEPTABLE:
+    return socks5_fail(
+        msg, msgsize,
+        "SOCKS5: proxy accepts no authentication method we offer");
+  default:
+    return socks5_fail(msg, msgsize,
+                       "SOCKS5: proxy selected an unknown method");
+  }
+
+  /* CONNECT to the origin, by name */
+  frame[0] = SOCKS5_VERSION;
+  frame[1] = SOCKS5_CMD_CONNECT;
+  frame[2] = 0x00; // RSV
+  frame[3] = SOCKS5_ATYP_DOMAIN;
+  frame[4] = (unsigned char) hostlen;
+  memcpy(frame + 5, host, hostlen);
+  frame[5 + hostlen] = (unsigned char) (port >> 8);
+  frame[6 + hostlen] = (unsigned char) (port & 0xFF);
+  if (!socks5_write_all(st, frame, 7 + hostlen))
+    return socks5_fail(msg, msgsize, "SOCKS5: write error");
+
+  return socks5_read_reply(st, msg, msgsize);
+}
+
+/* Decode the proxy userinfo into the two RFC 1929 fields. Split on the first
+   colon of the still-escaped string, so a %3A stays inside the username. */
+static int socks5_credentials(httrackp *opt, const char *proxy_name, char *user,
+                              size_t user_size, size_t *userlen, char *pass,
+                              size_t pass_size, size_t *passlen, char *msg,
+                              size_t msgsize) {
+  const char *const a = jump_identification_const(proxy_name); // past the '@'
+  const char *const astart = jump_protocol_const(proxy_name);
+  char userinfo[1024];
+  char *colon;
+
+  if (a <= astart || (size_t) (a - astart) - 1 >= sizeof(userinfo))
+    return socks5_fail(msg, msgsize, "SOCKS5: credentials too long");
+  userinfo[0] = '\0';
+  strncatbuff(userinfo, astart, (int) (a - astart) - 1);
+  colon = strchr(userinfo, ':');
+  if (colon != NULL)
+    *colon++ = '\0';
+  strlcpybuff(
+      user, unescape_http(OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt), userinfo),
+      user_size);
+  strlcpybuff(pass,
+              colon != NULL ? unescape_http(OPT_GET_BUFF(opt),
+                                            OPT_GET_BUFF_SIZE(opt), colon)
+                            : "",
+              pass_size);
+  *userlen = strlen(user);
+  *passlen = strlen(pass);
+  // reject, never truncate: a clipped secret would authenticate as another one
+  if (*userlen > SOCKS5_MAXFIELD || *passlen > SOCKS5_MAXFIELD)
+    return socks5_fail(msg, msgsize, "SOCKS5: credentials too long");
+  if (*userlen == 0)
+    return socks5_fail(msg, msgsize, "SOCKS5: empty proxy username");
+  return 1;
+}
+
+static int socks5_handshake_stream(httrackp *opt, socks5_stream *st,
+                                   const char *adr, const char *proxy_name,
+                                   int ssl, char *msg, size_t msgsize) {
+  const char *const host = jump_identification_const(adr);
+  const char *const portsep = jump_toport_const(adr);
+  const size_t hostlen =
+      portsep != NULL ? (size_t) (portsep - host) : strlen(host);
+  // sized for the whole userinfo: decoding shrinks, so an over-long credential
+  // lands intact and is rejected below rather than silently clipped
+  char user[1024];
+  char pass[1024];
+  size_t userlen = 0, passlen = 0;
+  int want_auth = 0;
+  int port = ssl ? 443 : 80;
+  size_t i;
+
+  if (hostlen == 0 || hostlen > SOCKS5_MAXFIELD)
+    return socks5_fail(msg, msgsize, "SOCKS5: invalid origin host");
+  if (host[0] == '[') // ATYP=domain cannot carry an IPv6 literal
+    return socks5_fail(msg, msgsize,
+                       "SOCKS5: IPv6 literal origin is not supported");
+  for (i = 0; i < hostlen; i++) {
+    if ((unsigned char) host[i] < ' ')
+      return socks5_fail(msg, msgsize, "SOCKS5: invalid origin host");
+  }
+  if (portsep != NULL) {
+    int p = -1;
+
+    sscanf(portsep + 1, "%d", &p);
+    if (p <= 0 || p > 65535)
+      return socks5_fail(msg, msgsize, "SOCKS5: invalid origin port");
+    port = p;
+  }
+  if (link_has_authorization(proxy_name)) {
+    if (!socks5_credentials(opt, proxy_name, user, sizeof(user), &userlen, pass,
+                            sizeof(pass), &passlen, msg, msgsize))
+      return 0;
+    want_auth = 1;
+  }
+  return socks5_negotiate(st, host, hostlen, port, user, userlen, pass, passlen,
+                          want_auth, msg, msgsize);
+}
+
+int socks5_handshake(httrackp *opt, htsblk *retour, const char *adr,
+                     int timeout) {
+  socks5_stream st;
+#if HTS_USEOPENSSL
+  const int ssl = retour->ssl;
+#else
+  const int ssl = 0;
+#endif
+
+  if (retour->soc == INVALID_SOCKET)
+    return 0;
+  st.soc = retour->soc;
+  st.timeout = timeout;
+  st.io = NULL;
+  return socks5_handshake_stream(opt, &st, adr, retour->req.proxy.name, ssl,
+                                 retour->msg, sizeof(retour->msg));
+}
+
+int socks5_handshake_scripted(httrackp *opt, const char *adr,
+                              const char *proxy_name, socks5_test_io *io) {
+  socks5_stream st;
+
+  st.soc = INVALID_SOCKET;
+  st.timeout = 0;
+  st.io = io;
+  io->consumed = 0;
+  io->sent_len = 0;
+  io->msg[0] = '\0';
+  return socks5_handshake_stream(opt, &st, adr, proxy_name, 0, io->msg,
+                                 sizeof(io->msg));
+}

src/htsproxy.h

@@ -0,0 +1,82 @@
+/* ------------------------------------------------------------ */
+/*
+HTTrack Website Copier, Offline Browser for Windows and Unix
+Copyright (C) 2026 Xavier Roche and other contributors
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+Ethical use: we kindly ask that you NOT use this software to harvest email
+addresses or to collect any other private information about people. Doing so
+would dishonor our work and waste the many hours we have spent on it.
+
+Please visit our Website: http://www.httrack.com
+*/
+
+/* ------------------------------------------------------------ */
+/* File: Proxy tunneling (HTTP CONNECT, SOCKS5) .h              */
+/* Author: Xavier Roche                                         */
+/* ------------------------------------------------------------ */
+
+#ifndef HTS_DEFPROXY
+#define HTS_DEFPROXY
+
+#include "htsglobal.h"
+
+/* Forward definitions */
+#ifndef HTS_DEF_FWSTRUCT_httrackp
+#define HTS_DEF_FWSTRUCT_httrackp
+typedef struct httrackp httrackp;
+#endif
+#ifndef HTS_DEF_FWSTRUCT_htsblk
+#define HTS_DEF_FWSTRUCT_htsblk
+typedef struct htsblk htsblk;
+#endif
+
+/* Open an HTTP CONNECT tunnel through the active proxy for an https request:
+   `retour->soc` must already be TCP-connected to the proxy, and `adr` is the
+   origin authority (url_adr, e.g. "https://host:port"). Sends the CONNECT
+   request (with Proxy-Authorization when the proxy carries credentials) and
+   reads the proxy's status line, so the caller's TLS handshake then runs
+   end-to-end with the origin. Blocks up to `timeout` seconds. Returns 1 on a
+   2xx tunnel, 0 on failure (retour->msg/statuscode set). */
+int http_proxy_tunnel(httrackp *opt, htsblk *retour, const char *adr,
+                      int timeout);
+
+/* SOCKS5 (RFC 1928, RFC 1929 auth) handshake on the raw proxy socket, before
+   any TLS: `retour->soc` must be TCP-connected to the proxy and `adr` is the
+   origin (url_adr). The origin name is sent verbatim (ATYP=domain), so the
+   proxy resolves it; a bracketed IPv6 literal origin is rejected. Blocks up to
+   `timeout` seconds. Returns 1 with the stream positioned on the first origin
+   byte, 0 on failure (retour->msg set). */
+int socks5_handshake(httrackp *opt, htsblk *retour, const char *adr,
+                     int timeout);
+
+/* Self-test hook (-#test=socks5): run the handshake against `reply`, a scripted
+   server byte stream, instead of a socket. `sent` captures the client frames,
+   `consumed` the reply bytes eaten (the frame-desync guard). */
+typedef struct socks5_test_io {
+  const unsigned char *reply;
+  size_t reply_len;
+  size_t consumed;
+  unsigned char sent[1024];
+  size_t sent_len;
+  char msg[256];
+} socks5_test_io;
+
+int socks5_handshake_scripted(httrackp *opt, const char *adr,
+                              const char *proxy_name, socks5_test_io *io);
+
+#endif

src/htssafe.h

@@ -456,13 +456,6 @@ static HTS_INLINE HTS_UNUSED const char *htsbuff_str(const htsbuff *b) {
   return b->buf;
 }
 
-/** True if 'count' records of >= 1 byte each fit in 'available' bytes; guards
-    an attacker-controlled count driving a large allocation. */
-static HTS_INLINE HTS_UNUSED hts_boolean hts_count_fits(size_t count,
-                                                        LLint available) {
-  return (available >= 0 && (LLint) count <= available) ? HTS_TRUE : HTS_FALSE;
-}
-
 /* Thin aliases over the libc allocator/memcpy (historical "t" suffix); no
    added bounds checking. freet() also NULLs the freed pointer and tolerates
    NULL. memcpybuff() despite the name is a raw memcpy: the caller owns the

src/htsselftest.c

@@ -46,6 +46,7 @@ Please visit our Website: http://www.httrack.com
 #include "htsdefines.h"
 #include "htslib.h"
 #include "htsparse.h"
+#include "htscache.h"
 #include "htscache_selftest.h"
 #include "htsdns_selftest.h"
 #include "htscharset.h"
@@ -53,9 +54,14 @@ Please visit our Website: http://www.httrack.com
 #include "htsftp.h"
 #include "htsmd5.h"
 #include "htssniff.h"
+#include "htscodec.h"
+#include "htsproxy.h"
 #if HTS_USEZLIB
 #include "htszlib.h"
 #endif
+#if HTS_USEZSTD
+#include <zstd.h>
+#endif
 #include "coucal/coucal.h"
 
 #include <ctype.h>
@@ -620,6 +626,163 @@ static int st_filtersize(httrackp *opt, int argc, char **argv) {
   return 0;
 }
 
+/* Mime-type filter verdict via fa_strjoker(type=1): only mime: rules apply. */
+static int st_filtermime(httrackp *opt, int argc, char **argv) {
+  int verdict;
+
+  (void) opt;
+  if (argc < 2) {
+    fprintf(stderr, "filtermime: needs <mime> <filter> [filter...]\n");
+    return 1;
+  }
+  verdict = fa_strjoker(1, &argv[1], argc - 1, argv[0], NULL, NULL, NULL);
+  printf("verdict=%s\n", verdict > 0   ? "allowed"
+                         : verdict < 0 ? "forbidden"
+                                       : "unknown");
+  return 0;
+}
+
+/* SplitMix64: deterministic, platform-independent case generator. */
+static uint64_t st_mix64(uint64_t *state) {
+  uint64_t z = (*state += UINT64_C(0x9E3779B97F4A7C15));
+
+  z = (z ^ (z >> 30)) * UINT64_C(0xBF58476D1CE4B5B9);
+  z = (z ^ (z >> 27)) * UINT64_C(0x94D049BB133111EB);
+  return z ^ (z >> 31);
+}
+
+/* Differential test: memoized strjoker vs the no-memo oracle on seeded random
+   pattern/subject/size cases must agree on result, *size and *size_flag. */
+static int st_filtermemo(httrackp *opt, int argc, char **argv) {
+  static const char *const pieces[] = {
+      "a",       "b",        "A",    "c",      ".",       "/",
+      "?",       "*",        "*[a]", "*[ab]",  "*[a-c]",  "*[A-Z]",
+      "*[<5]",   "*[>5]",    "*(a)", "*(a,b)", "*[file]", "*[path]",
+      "*[name]", "*[param]", "*[]",  "*[\\a]", "*[a-"};
+  static const char subject_chars[] = "abAc./?";
+  uint64_t rng = UINT64_C(0x501);
+  int iters = 20000, matched = 0, unmatched = 0;
+  int it;
+
+  (void) opt;
+  if (argc >= 1)
+    sscanf(argv[0], "%d", &iters);
+  for (it = 0; it < iters; it++) {
+    char pat[64], str[16];
+    size_t pl = 0;
+    const int npieces = (int) (st_mix64(&rng) % 5);
+    const int slen = (int) (st_mix64(&rng) % 13);
+    const int szsel = (int) (st_mix64(&rng) % 4); /* none/unknown/3/20 */
+    LLint sz1, sz2, off1, off2;
+    int i, flag1 = 0, flag2 = 0;
+    char *hpat, *hstr;
+    const char *adr;
+
+    for (i = 0; i < npieces; i++) {
+      const char *p =
+          pieces[st_mix64(&rng) % (sizeof(pieces) / sizeof(pieces[0]))];
+      const size_t len = strlen(p);
+
+      if (len >= sizeof(pat) - pl)
+        break;
+      memcpy(pat + pl, p, len);
+      pl += len;
+    }
+    pat[pl] = '\0';
+    for (i = 0; i < slen; i++)
+      str[i] = subject_chars[st_mix64(&rng) % (sizeof(subject_chars) - 1)];
+    str[slen] = '\0';
+    sz1 = sz2 = (szsel <= 1) ? -1 : (szsel == 2) ? 3 : 20;
+    /* exact-size heap copies per run so a sanitizer traps any over-read */
+    hpat = strdupt(pat);
+    hstr = strdupt(str);
+    adr = strjoker(hstr, hpat, szsel ? &sz1 : NULL, szsel ? &flag1 : NULL);
+    off1 = adr != NULL ? (LLint) (adr - hstr) : -1;
+    freet(hpat);
+    freet(hstr);
+    hpat = strdupt(pat);
+    hstr = strdupt(str);
+    adr =
+        strjoker_nomemo(hstr, hpat, szsel ? &sz2 : NULL, szsel ? &flag2 : NULL);
+    off2 = adr != NULL ? (LLint) (adr - hstr) : -1;
+    freet(hpat);
+    freet(hstr);
+    if (off1 != off2 || sz1 != sz2 || flag1 != flag2) {
+      printf("filtermemo MISMATCH pat=[%s] str=[%s] szsel=%d: "
+             "off %d/%d size %d/%d flag %d/%d\n",
+             pat, str, szsel, (int) off1, (int) off2, (int) sz1, (int) sz2,
+             flag1, flag2);
+      return 1;
+    }
+    if (off1 >= 0)
+      matched++;
+    else
+      unmatched++;
+  }
+  /* both polarities must actually occur or the test proves nothing */
+  assertf(matched > 0 && unmatched > 0);
+  printf("filtermemo: %d cases OK\n", iters);
+  return 0;
+}
+
+/* Merged two-form filter verdict via fa_strjoker_dual (see htsfilters.h). */
+static int st_filterdual(httrackp *opt, int argc, char **argv) {
+  int depth = -1, verdict;
+
+  (void) opt;
+  if (argc < 3) {
+    fprintf(stderr,
+            "filterdual: needs <string1> <string2> <filter> [filter...]\n");
+    return 1;
+  }
+  verdict = fa_strjoker_dual(0, &argv[2], argc - 2, argv[0], argv[1], NULL,
+                             NULL, &depth);
+  printf("verdict=%s rule=%d\n",
+         verdict > 0   ? "allowed"
+         : verdict < 0 ? "forbidden"
+                       : "unknown",
+         depth);
+  return 0;
+}
+
+/* Length/work caps stop a hostile pattern stack-overflowing or hanging the
+   process (OSS-Fuzz 5060751291908096 / 5745936014573568). */
+static int st_filterbounds(httrackp *opt, int argc, char **argv) {
+  const size_t big = 100000; /* well past the length cap */
+  const size_t stars = 1023; /* pattern len 2047, under the length cap */
+  const size_t subjlen = 2048;
+  char *subj = malloct(big + 1);
+  char *pat = malloct(2 * stars + 2);
+  size_t steps = 0, maxsteps = 0, i;
+
+  (void) opt;
+  (void) argc;
+  (void) argv;
+  memset(subj, 'a', big);
+  subj[big] = '\0';
+  /* '*' matches anything, but an over-length subject trips the length cap */
+  assertf(strjoker(subj, "*", NULL, NULL) == NULL);
+  assertf(strjokerfind(subj, "*") == NULL);
+  /* Star-heavy dead-end at the length cap: unbounded it runs ~1.26e9 memo-steps
+     (~6s). */
+  for (i = 0; i < stars; i++) {
+    pat[2 * i] = '*';
+    pat[2 * i + 1] = 'a';
+  }
+  pat[2 * stars] = 'b'; /* never matches an all-'a' subject */
+  pat[2 * stars + 1] = '\0';
+  subj[subjlen] = '\0';
+  /* Budget must fire and hold: steps > cap (deleting the budget zeroes the
+     counter that is the enforcement), steps < 10*cap (unbudgeted ~1.26e9). */
+  assertf(strjoker_steps(subj, pat, &steps, &maxsteps) == NULL);
+  assertf(steps > maxsteps && steps < 10 * maxsteps);
+  assertf(strjokerfind(subj, pat) == NULL);
+  freet(pat);
+  freet(subj);
+  printf("filterbounds: OK\n");
+  return 0;
+}
+
 static int st_simplify(httrackp *opt, int argc, char **argv) {
   (void) opt;
   if (argc < 1) {
@@ -668,6 +831,30 @@ static int st_charset(httrackp *opt, int argc, char **argv) {
   return 0;
 }
 
+static int st_metacharset(httrackp *opt, int argc, char **argv) {
+  char *s;
+
+  (void) opt;
+  if (argc < 1) {
+    fprintf(stderr, "metacharset: needs an html string\n");
+    return 1;
+  }
+  s = hts_getCharsetFromMeta(argv[0], strlen(argv[0]));
+  printf("%s\n", s != NULL ? s : "(none)");
+  freet(s);
+  return 0;
+}
+
+static int st_isutf8(httrackp *opt, int argc, char **argv) {
+  (void) opt;
+  if (argc < 1) {
+    fprintf(stderr, "isutf8: needs a string\n");
+    return 1;
+  }
+  printf("%d\n", hts_isStringUTF8(argv[0], strlen(argv[0])) ? 1 : 0);
+  return 0;
+}
+
 static int st_idna_encode(httrackp *opt, int argc, char **argv) {
   char *s;
 
@@ -1122,6 +1309,186 @@ static int st_identurl(httrackp *opt, int argc, char **argv) {
   return 0;
 }
 
+static int st_proxyurl(httrackp *opt, int argc, char **argv) {
+  char BIGSTK name[HTS_URLMAXSIZE * 2];
+  int port = -1;
+
+  (void) opt;
+  if (argc < 1) {
+    fprintf(stderr, "proxyurl: needs a proxy argument\n");
+    return 1;
+  }
+  hts_parse_proxy(argv[0], name, sizeof(name), &port);
+  // host= is what the connect actually resolves (scheme + user:pass stripped)
+  printf("name=%s port=%d host=%s\n", name, port,
+         jump_identification_const(name));
+  return 0;
+}
+
+/* Scripted SOCKS5 server: no-auth method reply, then a success CONNECT reply
+   carrying the given ATYP address, then a sentinel origin byte the handshake
+   must leave unread (an off-by-one in the reply framing eats it). */
+static size_t socks5_reply(unsigned char *buf, unsigned char atyp,
+                           const unsigned char *addr, size_t addrlen) {
+  size_t n = 0;
+
+  buf[n++] = 0x05;
+  buf[n++] = 0x00; /* method: no authentication */
+  buf[n++] = 0x05;
+  buf[n++] = 0x00; /* REP: succeeded */
+  buf[n++] = 0x00;
+  buf[n++] = atyp;
+  memcpy(buf + n, addr, addrlen);
+  n += addrlen;
+  buf[n++] = 0x1f;
+  buf[n++] = 0x90; /* BND.PORT */
+  buf[n++] = 0xAA; /* sentinel */
+  return n;
+}
+
+#define SOCKS5_SENTINEL_LEFT(io, len) ((io).consumed == (len) - 1)
+
+static int st_socks5(httrackp *opt, int argc, char **argv) {
+  static const unsigned char v4[4] = {127, 0, 0, 1};
+  static const unsigned char v6[16] = {0};
+  static const unsigned char domain[6] = {5, 'p', 'r', 'o', 'x', 'y'};
+  const char *const proxy = "socks5://127.0.0.1";
+  unsigned char script[64];
+  socks5_test_io io;
+  size_t len;
+
+  (void) argc;
+  (void) argv;
+
+  /* each reply address type is drained exactly, sentinel untouched */
+  len = socks5_reply(script, 0x01, v4, sizeof(v4));
+  io.reply = script;
+  io.reply_len = len;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 1);
+  assertf(SOCKS5_SENTINEL_LEFT(io, len));
+  /* the greeting offers no-auth only, and the origin goes out by name, port 80
+   */
+  assertf(io.sent_len == 3 + 7 + 11);
+  assertf(memcmp(io.sent, "\x05\x01\x00", 3) == 0);
+  assertf(memcmp(io.sent + 3, "\x05\x01\x00\x03\x0borigin.test\x00\x50", 18) ==
+          0);
+
+  len = socks5_reply(script, 0x04, v6, sizeof(v6));
+  io.reply = script;
+  io.reply_len = len;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 1);
+  assertf(SOCKS5_SENTINEL_LEFT(io, len));
+
+  len = socks5_reply(script, 0x03, domain, sizeof(domain));
+  io.reply = script;
+  io.reply_len = len;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 1);
+  assertf(SOCKS5_SENTINEL_LEFT(io, len));
+
+  /* an unknown address type has no known length: fail, never guess */
+  len = socks5_reply(script, 0x02, v4, sizeof(v4));
+  io.reply = script;
+  io.reply_len = len;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 0);
+
+  /* truncated frames (here: no BND.PORT) fail instead of over-reading */
+  len = socks5_reply(script, 0x01, v4, sizeof(v4)) - 3;
+  io.reply = script;
+  io.reply_len = len;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 0);
+
+  /* explicit origin port is encoded big-endian (8443 = 0x20fb) */
+  len = socks5_reply(script, 0x01, v4, sizeof(v4));
+  io.reply = script;
+  io.reply_len = len;
+  assertf(socks5_handshake_scripted(opt, "origin.test:8443", proxy, &io) == 1);
+  assertf(memcmp(io.sent + io.sent_len - 2, "\x20\xfb", 2) == 0);
+
+  /* credentials: split on the first colon of the escaped userinfo, so %3a stays
+     inside the username and a colon in the password is not a delimiter */
+  {
+    static const unsigned char auth_script[] = {
+        0x05, 0x02,             /* method: user/pass */
+        0x01, 0x00,             /* auth: success */
+        0x05, 0x00, 0x00, 0x01, /* REP: succeeded, ATYP ipv4 */
+        127,  0,    0,    1,    0x1f, 0x90, 0xAA};
+
+    io.reply = auth_script;
+    io.reply_len = sizeof(auth_script);
+    assertf(socks5_handshake_scripted(opt, "origin.test",
+                                      "socks5://us%3aer:p:ass@127.0.0.1",
+                                      &io) == 1);
+    assertf(SOCKS5_SENTINEL_LEFT(io, sizeof(auth_script)));
+    assertf(memcmp(io.sent, "\x05\x02\x00\x02", 4) == 0);
+    assertf(memcmp(io.sent + 4, "\x01\x05us:er\x05p:ass", 13) == 0);
+  }
+
+  /* a proxy demanding auth we cannot provide, and one refusing every method */
+  io.reply = (const unsigned char *) "\x05\x02";
+  io.reply_len = 2;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 0);
+  io.reply = (const unsigned char *) "\x05\xff";
+  io.reply_len = 2;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 0);
+
+  /* a refused CONNECT is an error, not a tunnel */
+  io.reply = (const unsigned char
+                  *) "\x05\x00\x05\x05\x00\x01\x7f\x00\x00\x01\x1f\x90";
+  io.reply_len = 12;
+  assertf(socks5_handshake_scripted(opt, "origin.test", proxy, &io) == 0);
+
+  /* over-long host or credentials are rejected before anything is sent */
+  {
+    char host[512];
+    char name[1024];
+    size_t i;
+
+    host[0] = '\0';
+    for (i = 0; i < 256; i++)
+      strcatbuff(host, "a");
+    io.reply = script;
+    io.reply_len = len;
+    assertf(socks5_handshake_scripted(opt, host, proxy, &io) == 0);
+    assertf(io.sent_len == 0);
+
+    strcpybuff(name, "socks5://user:");
+    for (i = 0; i < 256; i++)
+      strcatbuff(name, "p");
+    strcatbuff(name, "@127.0.0.1");
+    io.reply = script;
+    io.reply_len = len;
+    assertf(socks5_handshake_scripted(opt, "origin.test", name, &io) == 0);
+    assertf(io.sent_len == 0);
+  }
+
+  printf("socks5 self-test OK\n");
+  return 0;
+}
+
+/* Regression for the one-byte fil[] overflow: a 2047-byte hostless "?"-URL used
+   to abort in strncat_safe_ when the missing leading '/' pushed fil to 2048. */
+static int st_identabs(httrackp *opt, int argc, char **argv) {
+  lien_adrfil af;
+  const size_t len =
+      sizeof(af.fil) - 1; /* 2047: max URL the top guard admits */
+  char *url = malloct(len + 1);
+
+  (void) opt;
+  (void) argc;
+  (void) argv;
+  url[0] = '?';
+  memset(url + 1, 'a', len - 1);
+  url[len] = '\0';
+  assertf(ident_url_absolute(url, &af) == -1);
+  freet(url);
+  /* valid URLs still parse, so the guard is not over-rejecting */
+  assertf(ident_url_absolute("http://www.example.com/a/b/c.html?x=1", &af) ==
+          0);
+  assertf(ident_url_absolute("www.foo.com?bar=1", &af) == 0);
+  printf("identabs self-test OK\n");
+  return 0;
+}
+
 /* Extra args are key=value: adr= cdispo= statuscode= status= strip= urlhack=
    no-www= no-slash= no-query= n83= type=, plus repeatable prior=adr|fil|sav
    registering an already-crawled link (dedup/collision paths). */
@@ -1143,6 +1510,102 @@ static int st_header(httrackp *opt, int argc, char **argv) {
     treathead(NULL, "www.example.com", "/", &r, line);
   }
   printf("contenttype=%s cdispo=%s\n", r.contenttype, r.cdispo);
+  printf("contentencoding=%s\n", r.contentencoding);
+  return 0;
+}
+
+/* An over-long header value must not overflow treathead's tempo[1100]. */
+static int st_headerlong(httrackp *opt, int argc, char **argv) {
+  htsblk r;
+  char BIGSTK line[HTS_URLMAXSIZE * 2];
+  const char *const name = argc >= 1 ? argv[0] : "Content-Type:";
+  const int pad = 1500; /* > tempo[1100] */
+  size_t n;
+
+  (void) opt;
+  memset(&r, 0, sizeof(r));
+  n = (size_t) snprintf(line, sizeof(line), "%s ", name);
+  memset(line + n, 'a', pad);
+  line[n + pad] = '\0';
+  treathead(NULL, "www.example.com", "/", &r, line);
+  printf("contenttype_len=%d contentencoding_len=%d\n",
+         (int) strlen(r.contenttype), (int) strlen(r.contentencoding));
+  return 0;
+}
+
+/* http_xfread1 must refuse an in-memory buffer whose size would exceed a 32-bit
+   index (hostile Content-Length or endless stream) rather than allocate it.
+   The guard returns before any socket read, so no real connection is needed. */
+static int st_xfread_limit(httrackp *opt, int argc, char **argv) {
+  htsblk r;
+
+  (void) opt;
+  (void) argc;
+  (void) argv;
+
+  // Content-Length just over 2 GiB.
+  memset(&r, 0, sizeof(r));
+  r.soc = INVALID_SOCKET;
+  r.totalsize = (LLint) INT32_MAX + 1;
+  printf("bylen: refused=%d adr=%s msg=%s\n",
+         http_xfread1(&r, 8192) == READ_ERROR, r.adr != NULL ? "alloc" : "null",
+         r.msg);
+  if (r.adr != NULL)
+    freet(r.adr);
+
+  // Unknown length, buffer already at the limit: the next read would exceed it.
+  memset(&r, 0, sizeof(r));
+  r.soc = INVALID_SOCKET;
+  r.totalsize = -1;
+  r.size = (LLint) INT32_MAX;
+  printf("bygrow: refused=%d adr=%s msg=%s\n",
+         http_xfread1(&r, 8192) == READ_ERROR, r.adr != NULL ? "alloc" : "null",
+         r.msg);
+  if (r.adr != NULL)
+    freet(r.adr);
+
+  // Exactly at the 2 GiB index (size + bufl == INT32_MAX): must also be
+  // refused, since the reallocs below add 1 (a `> INT32_MAX` check would let
+  // this through and overflow the int realloc size).
+  memset(&r, 0, sizeof(r));
+  r.soc = INVALID_SOCKET;
+  r.totalsize = -1;
+  r.size = (LLint) INT32_MAX - 8192;
+  http_xfread1(&r, 8192);
+  printf("boundary: msg=%s\n", r.msg);
+
+  // A legitimate small size must NOT be refused by the guard (the read then
+  // fails on the invalid socket, but the size-too-large msg must not be set).
+  memset(&r, 0, sizeof(r));
+  r.soc = INVALID_SOCKET;
+  r.totalsize = 1000;
+  http_xfread1(&r, 8192);
+  printf("accept: msg=%s\n", r.msg);
+  if (r.adr != NULL)
+    freet(r.adr);
+  return 0;
+}
+
+/* Parse a Content-Range header and print the sanitized triple. A hostile value
+   (negative or INT64 extreme) must clamp to 0 without signed-overflow UB. */
+static int st_crange(httrackp *opt, int argc, char **argv) {
+  int i;
+
+  (void) opt;
+  if (argc < 1) {
+    fprintf(stderr, "crange: needs at least one raw Content-Range line\n");
+    return 1;
+  }
+  for (i = 0; i < argc; i++) {
+    htsblk r;
+    char BIGSTK line[HTS_URLMAXSIZE * 2];
+
+    memset(&r, 0, sizeof(r));
+    strcpybuff(line, argv[i]);
+    treathead(NULL, "www.example.com", "/", &r, line);
+    printf("crange_start=" LLintP " crange_end=" LLintP " crange=" LLintP "\n",
+           (LLint) r.crange_start, (LLint) r.crange_end, (LLint) r.crange);
+  }
   return 0;
 }
 
@@ -1350,6 +1813,78 @@ static int st_cache(httrackp *opt, int argc, char **argv) {
   return err;
 }
 
+/* A corrupt cache index (.ndx) must not walk the length-prefixed scan past
+   the buffer. Checks the two primitives the loader is built from. */
+static int st_cacheindex(httrackp *opt, int argc, char **argv) {
+  int fail = 0;
+
+  (void) opt;
+  (void) argc;
+  (void) argv;
+
+  /* A length prefix that overstates the bytes present must bound the advance
+     to the buffer, not trust the declared length. */
+  {
+    static const char src[] = "32768\nCACHE-1.1";
+    const size_t len = sizeof(src) - 1;
+    char *buf = malloct(len + 1);
+    char s[256];
+    int off;
+
+    memcpy(buf, src, len + 1);
+    off = cache_brstr(buf, s, sizeof(s));
+    if (off > (int) len) {
+      printf("cacheindex: over-advance off=%d len=%d\n", off, (int) len);
+      fail = 1;
+    }
+    if (strcmp(s, "CACHE-1.1") != 0) {
+      printf("cacheindex: value=%s\n", s);
+      fail = 1;
+    }
+    freet(buf);
+  }
+
+  /* cache_binput reads a field while in bounds, but refuses one starting at
+     or past end-of-buffer. */
+  {
+    char buf[8] = "ab\ncd";
+    const char *const end = buf + 5;
+    char s[16];
+
+    if (cache_binput(buf, end, s, sizeof(s)) != 3 || strcmp(s, "ab") != 0)
+      fail = 1; /* normal read: "ab" then the '\n', 3 bytes consumed */
+    if (cache_binput(end, end, s, sizeof(s)) != 0 || s[0] != '\0')
+      fail = 1;
+  }
+
+  /* Drive the full loader scan over a truncated index: a declared length that
+     overshoots plus a half-written entry. ASan aborts here on the pre-fix
+     scan; the cursor must never leave the buffer. */
+  {
+    static const char src[] = "9\nCACHE-1.1\n99\nwww.example.com\n/a";
+    const size_t len = sizeof(src) - 1;
+    char *buf = malloct(len + 1);
+    const char *const end = buf + len;
+    char line[256];
+    char *a = buf;
+
+    memcpy(buf, src, len + 1);
+    a += cache_brstr(a, line, sizeof(line));
+    a += cache_brstr(a, line, sizeof(line));
+    while (a != NULL && a < end) {
+      a = strchr(a + 1, '\n');
+      if (a == NULL)
+        break;
+      a++;
+      a += cache_binput(a, end, line, sizeof(line));
+    }
+    freet(buf);
+  }
+
+  printf("cacheindex: %s\n", fail ? "FAIL" : "OK");
+  return fail;
+}
+
 static int st_cache_golden(httrackp *opt, int argc, char **argv) {
   int regen, err;
 
@@ -1387,6 +1922,18 @@ static int st_cache_corrupt(httrackp *opt, int argc, char **argv) {
   return err;
 }
 
+static int st_cache_legacy(httrackp *opt, int argc, char **argv) {
+  int err;
+
+  if (argc < 1) {
+    fprintf(stderr, "cache-legacy: needs a directory\n");
+    return 1;
+  }
+  err = cache_legacy_refused_selftest(opt, argv[0]);
+  printf("cache-legacy: %s\n", err ? "FAIL" : "OK");
+  return err;
+}
+
 static int st_reconcile(httrackp *opt, int argc, char **argv) {
   int err;
 
@@ -1431,13 +1978,54 @@ static int st_cookies(httrackp *opt, int argc, char **argv) {
     return 1;
   }
 
-  http_cookie_header_selftest(&cookie, dom, "/", hdr, sizeof(hdr));
+  http_cookie_header(&cookie, dom, "/", hdr, sizeof(hdr));
   if (strcmp(hdr, expected) != 0)
     err = 1;
+
+  /* A hostile over-long request host must not overflow domain[256] in
+     treathead's default-domain copy (that would abort the mirror). */
+  {
+    static t_cookie ck2;
+    htsblk r;
+    char host[600];
+
+    memset(&r, 0, sizeof(r));
+    memset(host, 'a', sizeof(host) - 1);
+    host[sizeof(host) - 1] = '\0';
+    ck2.max_len = (int) sizeof(ck2.data);
+    ck2.data[0] = '\0';
+    treathead(&ck2, host, "/", &r, "Set-Cookie: SID=1; path=/");
+    if (strnotempty(ck2.data)) // oversize-host cookie was not dropped
+      err = 1;
+    /* control: a normal host still yields a cookie through treathead */
+    treathead(&ck2, dom, "/", &r, "Set-Cookie: SID=1; path=/");
+    if (strstr(ck2.data, "SID") == NULL) // guard wrongly dropped a valid cookie
+      err = 1;
+  }
   if (strstr(hdr, "$Version") != NULL || strstr(hdr, "$Path") != NULL)
     err = 1;
   if (strstr(hdr, "junk") != NULL) // wrong-domain cookie leaked
     err = 1;
+#ifndef _WIN32
+  /* the jar holds live session cookies: cookie_save must keep it 0600 */
+  {
+    const char *jar = "st-cookies-jar.txt";
+    struct stat st;
+
+    (void) UNLINK(jar);
+    assertf(cookie_save(&cookie, jar) == 0);
+    assertf(stat(jar, &st) == 0);
+    assertf((st.st_mode & 07777) == HTS_PROTECT_FILE);
+    assertf(st.st_size > 0); /* mode-only checks would pass an empty jar */
+    /* a pre-existing world-readable jar must be tightened, not kept */
+    assertf(chmod(jar, 0644) == 0);
+    assertf(cookie_save(&cookie, jar) == 0);
+    assertf(stat(jar, &st) == 0);
+    assertf((st.st_mode & 07777) == HTS_PROTECT_FILE);
+    assertf(st.st_size > 0);
+    (void) UNLINK(jar);
+  }
+#endif
   printf("cookie-header: %s\n", err ? "FAIL" : "OK");
   if (err)
     printf("  got: %s\n", hdr);
@@ -1878,6 +2466,20 @@ static int ae_write_collision(const char *path, const unsigned char *src,
   freet(buf);
   return ok ? 0 : 1;
 }
+#endif
+
+/* Write src[0..len) to path as-is; 0 on success. */
+static int ae_write_raw(const char *path, const unsigned char *src,
+                        size_t len) {
+  FILE *const f = FOPEN(path, "wb");
+  int ok;
+
+  if (f == NULL)
+    return 1;
+  ok = fwrite(src, 1, len, f) == len;
+  fclose(f);
+  return ok ? 0 : 1;
+}
 
 /* Compare path's bytes to expect[0..len); 0 if equal. Streams (large files). */
 static int ae_check_decoded(const char *path, const unsigned char *expect,
@@ -1898,17 +2500,22 @@ static int ae_check_decoded(const char *path, const unsigned char *expect,
   fclose(f);
   return (off == len) ? 0 : 1;
 }
-#endif
 
 /* Accept-Encoding (#450): advertise gzip+deflate; both decode (hts_zunpack) */
 static int st_acceptencoding(httrackp *opt, int argc, char **argv) {
-  const char *off = hts_acceptencoding(HTS_FALSE);
+  const char *off = hts_acceptencoding(HTS_FALSE, HTS_TRUE);
-  const char *on = hts_acceptencoding(HTS_TRUE);
+  const char *on = hts_acceptencoding(HTS_TRUE, HTS_FALSE);
+  const char *tls = hts_acceptencoding(HTS_TRUE, HTS_TRUE);
 
   (void) opt;
   assertf(strcmp(off, "identity") == 0);
   assertf(strstr(on, "gzip") != NULL);
   assertf(strstr(on, "deflate") != NULL); /* fails on the old gzip-only list */
+  /* br and zstd ride on TLS only, so a cleartext proxy can not be handed a
+     coding it may try to rewrite */
+  assertf(strstr(on, "br") == NULL && strstr(on, "zstd") == NULL);
+  assertf((strstr(tls, ", br") != NULL) == (HTS_USEBROTLI != 0));
+  assertf((strstr(tls, "zstd") != NULL) == (HTS_USEZSTD != 0));
 #if HTS_USEZLIB
   if (argc >= 1) {
     static const int windowBits[] = {16 + MAX_WBITS, MAX_WBITS, -MAX_WBITS};
@@ -1946,6 +2553,46 @@ static int st_acceptencoding(httrackp *opt, int argc, char **argv) {
     assertf(ae_write_collision(inpath, body, 64) == 0);
     assertf(hts_zunpack(inpath, outpath) == 64);
     assertf(ae_check_decoded(outpath, body, 64) == 0);
+    /* Identity fallback (#47): a plain body mislabeled as compressed is kept
+       verbatim, small and multi-chunk (> one 8 KiB fread). */
+    assertf(ae_write_raw(inpath, small, slen) == 0);
+    assertf(hts_zunpack(inpath, outpath) == (int) slen);
+    assertf(ae_check_decoded(outpath, small, slen) == 0);
+    {
+      const size_t ilen = 16 * 1024;
+      unsigned char *idbody = malloct(ilen);
+
+      assertf(idbody != NULL);
+      for (i = 0; i < ilen; i++)
+        idbody[i] = small[i % slen];
+      assertf(ae_write_raw(inpath, idbody, ilen) == 0);
+      assertf(hts_zunpack(inpath, outpath) == (int) ilen);
+      assertf(ae_check_decoded(outpath, idbody, ilen) == 0);
+      freet(idbody);
+    }
+    /* Truncated gzip (CRC+ISIZE cut), zlib (ADLER32 cut) and raw deflate
+       must all still fail, not fall back to a verbatim copy. */
+    {
+      static const struct {
+        int wb;
+        size_t cut;
+      } tr[] = {{16 + MAX_WBITS, 8}, {MAX_WBITS, 4}, {-MAX_WBITS, 5}};
+
+      for (i = 0; i < sizeof(tr) / sizeof(tr[0]); i++) {
+        unsigned char z[512];
+        size_t zlen;
+        FILE *f;
+
+        assertf(ae_write_packed(inpath, tr[i].wb, small, slen) == 0);
+        f = FOPEN(inpath, "rb");
+        assertf(f != NULL);
+        zlen = fread(z, 1, sizeof(z), f);
+        fclose(f);
+        assertf(zlen > tr[i].cut && zlen < sizeof(z));
+        assertf(ae_write_raw(inpath, z, zlen - tr[i].cut) == 0);
+        assertf(hts_zunpack(inpath, outpath) < 0);
+      }
+    }
     freet(body);
   }
 #else
@@ -1956,6 +2603,115 @@ static int st_acceptencoding(httrackp *opt, int argc, char **argv) {
   return 0;
 }
 
+#if HTS_USEBROTLI
+/* No brotli encoder is linked, so the coded bytes are canned: brotli quality 9
+   over cc_text, and over 4 MiB of 'A' (14 bytes, ~300000x). */
+static const unsigned char cc_br_text[] = {
+    0x1b, 0x43, 0x00, 0x00, 0x44, 0xdd, 0x96, 0xea, 0xe8, 0x22, 0xdd, 0x90,
+    0xa4, 0x1b, 0x8a, 0xf7, 0x47, 0x0e, 0xc2, 0xc5, 0x3d, 0x09, 0x1b, 0x70,
+    0xe0, 0x1e, 0x60, 0xa0, 0x8b, 0xcc, 0xbe, 0xcb, 0xb0, 0x31, 0x76, 0x9e,
+    0xcf, 0x6e, 0x41, 0xb5, 0xe8, 0x2e, 0x56, 0x78, 0x08, 0x1b, 0xfa, 0x08,
+    0x8a, 0x50, 0x83, 0x4e, 0x62, 0x7f, 0xbf, 0x05, 0xf2, 0x22, 0x8f, 0xdf,
+    0x28, 0xdc, 0x9f, 0xa9, 0x90, 0x50, 0x37, 0x62, 0x56, 0x4f, 0xa8};
+static const unsigned char cc_br_bomb[] = {0x9b, 0xff, 0xff, 0x3f, 0x00,
+                                           0x24, 0x82, 0xe2, 0xb1, 0x40,
+                                           0x72, 0xef, 0x7f, 0x00};
+#endif
+
+static const unsigned char cc_text[] =
+    "content codings: HTTrack decodes gzip, brotli and zstd bodies alike.";
+
+/* Content codings: br and zstd decode, junk tokens stay identity, a coding we
+   can not undo fails the fetch, and a bomb never lands on disk. */
+static int st_contentcodings(httrackp *opt, int argc, char **argv) {
+  const size_t tlen = sizeof(cc_text) - 1;
+  char inpath[HTS_URLMAXSIZE], outpath[HTS_URLMAXSIZE];
+
+  (void) opt;
+  assertf(hts_codec_parse("gzip") == HTS_CODEC_DEFLATE);
+  assertf(hts_codec_parse("x-deflate") == HTS_CODEC_DEFLATE);
+  assertf(hts_codec_parse("") == HTS_CODEC_IDENTITY);
+  assertf(hts_codec_parse("identity") == HTS_CODEC_IDENTITY);
+  /* servers do label plain bodies with junk; the page must survive that */
+  assertf(hts_codec_parse("utf-8") == HTS_CODEC_IDENTITY);
+  /* a real coding with no decoder here: fail, never save the coded bytes */
+  assertf(hts_codec_parse("compress") == HTS_CODEC_UNSUPPORTED);
+  assertf(hts_codec_parse("br") ==
+          (HTS_USEBROTLI ? HTS_CODEC_BROTLI : HTS_CODEC_UNSUPPORTED));
+  assertf(hts_codec_parse("zstd") ==
+          (HTS_USEZSTD ? HTS_CODEC_ZSTD : HTS_CODEC_UNSUPPORTED));
+  assertf(hts_codec_is_archive_ext(HTS_CODEC_DEFLATE, "tgz"));
+  assertf(!hts_codec_is_archive_ext(HTS_CODEC_DEFLATE, "html"));
+  assertf(hts_codec_is_archive_ext(HTS_CODEC_BROTLI, "br"));
+  assertf(hts_codec_is_archive_ext(HTS_CODEC_ZSTD, "zst"));
+  /* decoded-size budget: 4096x, floor 1 MiB, ceiling INT_MAX */
+  assertf(hts_codec_maxout(1) == 1024 * 1024);
+  assertf(hts_codec_maxout(1024) == 4096 * 1024);
+  assertf(hts_codec_maxout(1024 * 1024) == INT_MAX);
+
+  if (argc >= 1) {
+    snprintf(inpath, sizeof(inpath), "%s/cc-in", argv[0]);
+    snprintf(outpath, sizeof(outpath), "%s/cc-out", argv[0]);
+#if HTS_USEBROTLI
+    {
+      unsigned char head[16];
+
+      assertf(ae_write_raw(inpath, cc_br_text, sizeof(cc_br_text)) == 0);
+      assertf(hts_codec_unpack(HTS_CODEC_BROTLI, inpath, outpath) ==
+              (int) tlen);
+      assertf(ae_check_decoded(outpath, cc_text, tlen) == 0);
+      assertf(hts_codec_head(HTS_CODEC_BROTLI, cc_br_text, sizeof(cc_br_text),
+                             head, sizeof(head)) == sizeof(head));
+      assertf(memcmp(head, cc_text, sizeof(head)) == 0);
+      /* truncated: must fail, not fall back to a verbatim copy */
+      assertf(ae_write_raw(inpath, cc_br_text, sizeof(cc_br_text) - 4) == 0);
+      assertf(hts_codec_unpack(HTS_CODEC_BROTLI, inpath, outpath) < 0);
+      /* cc_br_bomb is a valid stream that expands to 4 MiB; the budget, not a
+         corrupt frame, is what must reject it. */
+      assertf((LLint) (4 * 1024 * 1024) >
+              hts_codec_maxout((LLint) sizeof(cc_br_bomb)));
+      assertf(ae_write_raw(inpath, cc_br_bomb, sizeof(cc_br_bomb)) == 0);
+      assertf(hts_codec_unpack(HTS_CODEC_BROTLI, inpath, outpath) < 0);
+    }
+#endif
+#if HTS_USEZSTD
+    {
+      const size_t bomblen = 4 * 1024 * 1024;
+      const size_t bound = ZSTD_compressBound(bomblen);
+      unsigned char *bomb = malloct(bomblen);
+      unsigned char *zbuf = malloct(bound);
+      unsigned char head[16];
+      size_t zlen;
+
+      assertf(bomb != NULL && zbuf != NULL);
+      zlen = ZSTD_compress(zbuf, bound, cc_text, tlen, 6);
+      assertf(!ZSTD_isError(zlen));
+      assertf(ae_write_raw(inpath, zbuf, zlen) == 0);
+      assertf(hts_codec_unpack(HTS_CODEC_ZSTD, inpath, outpath) == (int) tlen);
+      assertf(ae_check_decoded(outpath, cc_text, tlen) == 0);
+      assertf(hts_codec_head(HTS_CODEC_ZSTD, zbuf, zlen, head, sizeof(head)) ==
+              sizeof(head));
+      assertf(memcmp(head, cc_text, sizeof(head)) == 0);
+      assertf(ae_write_raw(inpath, zbuf, zlen - 4) == 0);
+      assertf(hts_codec_unpack(HTS_CODEC_ZSTD, inpath, outpath) < 0);
+      memset(bomb, 'A', bomblen);
+      zlen = ZSTD_compress(zbuf, bound, bomb, bomblen, 6);
+      assertf(!ZSTD_isError(zlen));
+      /* the fixture must really be past the budget, whatever the ratio is */
+      assertf((LLint) bomblen > hts_codec_maxout((LLint) zlen));
+      assertf(ae_write_raw(inpath, zbuf, zlen) == 0);
+      assertf(hts_codec_unpack(HTS_CODEC_ZSTD, inpath, outpath) < 0);
+      freet(bomb);
+      freet(zbuf);
+    }
+#endif
+    /* a coding we can not undo yields no file at all */
+    assertf(hts_codec_unpack(HTS_CODEC_UNSUPPORTED, inpath, outpath) < 0);
+  }
+  printf("contentcodings self-test OK\n");
+  return 0;
+}
+
 /* Each call parses `txt` under a fresh host, then checkrobots() for `path`. */
 static int rb_decide(robots_wizard *r, const char *txt, const char *path) {
   static int n = 0;
@@ -2104,21 +2860,6 @@ static int st_ftpuser(httrackp *opt, int argc, char **argv) {
   return 0;
 }
 
-/* hts_count_fits caps the .class constant-pool entry count to the file size,
-   rejecting the ~68 MB-per-file calloc DoS. */
-static int st_java(httrackp *opt, int argc, char **argv) {
-  (void) opt;
-  (void) argc;
-  (void) argv;
-  assertf(hts_count_fits(10, 1000) == HTS_TRUE);
-  assertf(hts_count_fits(0, 10) == HTS_TRUE);
-  assertf(hts_count_fits(65535, 10) == HTS_FALSE);
-  assertf(hts_count_fits(1, 0) == HTS_FALSE);
-  assertf(hts_count_fits(1, -1) == HTS_FALSE);
-  printf("java constant-pool cap self-test OK\n");
-  return 0;
-}
-
 /* ------------------------------------------------------------ */
 /* Registry: name -> handler, with a usage hint and a one-line description. */
 /* ------------------------------------------------------------ */
@@ -2134,6 +2875,14 @@ static const struct selftest_entry {
     {"filtersize", "<size> <string> <filter>...",
      "size-aware filter verdict (negative size = unknown/scan time)",
      st_filtersize},
+    {"filtermime", "<mime> <filter>...",
+     "mime-type filter verdict (fa_strjoker type=1)", st_filtermime},
+    {"filtermemo", "[iterations]",
+     "memoized vs unmemoized matcher differential", st_filtermemo},
+    {"filterdual", "<string1> <string2> <filter>...",
+     "merged two-form filter verdict (fa_strjoker_dual)", st_filterdual},
+    {"filterbounds", "", "matcher length/work caps reject hostile patterns",
+     st_filterbounds},
     {"simplify", "<path>", "collapse ./ and ../ in a path", st_simplify},
     {"stripquery", "", "--strip-query pattern/key stripping self-test",
      st_stripquery},
@@ -2144,6 +2893,9 @@ static const struct selftest_entry {
     {"mime", "<filename>", "MIME type for a filename", st_mime},
     {"charset", "<charset> <string>",
      "convert a string to UTF-8 from a charset", st_charset},
+    {"metacharset", "<html>", "extract the <meta> charset from an HTML page",
+     st_metacharset},
+    {"isutf8", "<string>", "is the string valid UTF-8 (1/0)", st_isutf8},
     {"idna-encode", "<host>", "encode a hostname to IDNA/punycode",
      st_idna_encode},
     {"idna-decode", "<host>", "decode an IDNA/punycode hostname",
@@ -2161,19 +2913,36 @@ static const struct selftest_entry {
     {"resolve", "<link> <adr> <fil>", "resolve a link against an origin",
      st_resolve},
     {"identurl", "<url>", "split an absolute URL into (adr, fil)", st_identurl},
+    {"proxyurl", "<proxy-arg>", "parse a -P proxy URL into host/port",
+     st_proxyurl},
+    {"socks5", "", "SOCKS5 handshake framing and credential self-test",
+     st_socks5},
+    {"identabs", "", "ident_url_absolute one-byte fil[] overflow self-test",
+     st_identabs},
     {"header", "<raw-header-line> ...", "response header-line parsing",
      st_header},
+    {"headerlong", "[header-name:]",
+     "over-long header value must not overflow the parse scratch",
+     st_headerlong},
+    {"crange", "<raw-content-range-line> ...",
+     "Content-Range parse integer safety", st_crange},
+    {"xfread-limit", "", "in-memory receive buffer size bound",
+     st_xfread_limit},
     {"savename", "<fil> <content-type> [key=value ...]",
      "local save-name for a URL", st_savename},
     {"sniff", "<content-type> <hex:..|text>", "MIME magic consistency",
      st_sniff},
     {"cache", "<dir>", "cache read/write round-trip self-test", st_cache},
+    {"cacheindex", "", "cache-index (.ndx) parse must stay in bounds",
+     st_cacheindex},
     {"cache-golden", "<dir> [regen]", "frozen cache-format read self-test",
      st_cache_golden},
     {"cache-writefail", "<dir>", "cache write-failure handling self-test",
      st_cache_writefail},
     {"reconcile", "<dir>", "cache generation reconcile policy self-test",
      st_reconcile},
+    {"cache-legacy", "<dir>", "pre-3.31 legacy cache refusal self-test",
+     st_cache_legacy},
     {"cache-corrupt", "<dir>", "cache read-side corruption self-test",
      st_cache_corrupt},
     {"dns", "", "DNS resolver/cache self-test", st_dns},
@@ -2188,6 +2957,9 @@ static const struct selftest_entry {
     {"status", "", "HTTP status code -> reason phrase self-test", st_status},
     {"acceptencoding", "[dir]",
      "Accept-Encoding advertises gzip+deflate, both decode", st_acceptencoding},
+    {"contentcodings", "[dir]",
+     "brotli and zstd bodies decode; bombs and unknown codings are refused",
+     st_contentcodings},
     {"robots", "", "robots.txt RFC 9309 Allow/Disallow precedence self-test",
      st_robots},
 #ifndef _WIN32
@@ -2195,7 +2967,6 @@ static const struct selftest_entry {
      st_ftpline},
 #endif
     {"ftp-userpass", "", "ftp_split_userpass bounds URL userinfo", st_ftpuser},
-    {"java", "", "java .class constant-pool count cap self-test", st_java},
 };
 
 static void list_selftests(void) {

src/htswizard.c

@@ -524,28 +524,11 @@ static int hts_acceptlink_(httrackp * opt, int ptr,
 
         // filters, 0=sait pas 1=ok -1=interdit
         {
-          int jokDepth1 = 0, jokDepth2 = 0;
+          int jokDepth = 0;
-          int jok1 = 0, jok2 = 0;
 
-          jok1 =
+          jok = fa_strjoker_dual(/*url */ 0, _FILTERS, *_FILTERS_PTR, lfull, l,
-            fa_strjoker( /*url */ 0, _FILTERS, *_FILTERS_PTR, lfull, NULL, NULL,
+                                 NULL, NULL, &jokDepth);
-                        &jokDepth1);
+          mdepth = _FILTERS[jokDepth];
-          jok2 =
-            fa_strjoker( /*url */ 0, _FILTERS, *_FILTERS_PTR, l, NULL, NULL,
-                        &jokDepth2);
-          if (jok2 == 0) {      // #2 doesn't know
-            jok = jok1;         // then, use #1
-            mdepth = _FILTERS[jokDepth1];
-          } else if (jok1 == 0) {       // #1 doesn't know
-            jok = jok2;         // then, use #2
-            mdepth = _FILTERS[jokDepth2];
-          } else if (jokDepth1 >= jokDepth2) {  // #1 matching rule is "after" #2, then it is prioritary
-            jok = jok1;
-            mdepth = _FILTERS[jokDepth1];
-          } else {              // #2 matching rule is "after" #1, then it is prioritary
-            jok = jok2;
-            mdepth = _FILTERS[jokDepth2];
-          }
         }
 
         if (jok == 1) {         // autorisé
@@ -965,34 +948,10 @@ int hts_testlinksize(httrackp * opt, const char *adr, const char *fil, LLint siz
 
       // filters, 0=sait pas 1=ok -1=interdit
       {
-        int jokDepth1 = 0, jokDepth2 = 0;
+        sz = size;
-        int jok1 = 0, jok2 = 0;
+        jok = fa_strjoker_dual(/*url */ 0, *opt->filters.filters,
-        LLint sz1 = size, sz2 = size;
+                               *opt->filters.filptr, lfull, l, &sz, &size_flag,
-        int size_flag1 = 0, size_flag2 = 0;
+                               NULL);
-
-        jok1 =
-          fa_strjoker( /*url */ 0, *opt->filters.filters, *opt->filters.filptr,
-                      lfull, &sz1, &size_flag1, &jokDepth1);
-        jok2 =
-          fa_strjoker( /*url */ 0, *opt->filters.filters, *opt->filters.filptr,
-                      l, &sz2, &size_flag2, &jokDepth2);
-        if (jok2 == 0) {        // #2 doesn't know
-          jok = jok1;           // then, use #1
-          sz = sz1;
-          size_flag = size_flag1;
-        } else if (jok1 == 0) { // #1 doesn't know
-          jok = jok2;           // then, use #2
-          sz = sz2;
-          size_flag = size_flag2;
-        } else if (jokDepth1 >= jokDepth2) {    // #1 matching rule is "after" #2, then it is prioritary
-          jok = jok1;
-          sz = sz1;
-          size_flag = size_flag1;
-        } else {                // #2 matching rule is "after" #1, then it is prioritary
-          jok = jok2;
-          sz = sz2;
-          size_flag = size_flag2;
-        }
       }
 
       // log

src/htszlib.c

@@ -37,6 +37,7 @@ Please visit our Website: http://www.httrack.com
 /* specific definitions */
 #include "htsbase.h"
 #include "htscore.h"
+#include "htscodec.h"
 #include "htszlib.h"
 
 #if HTS_USEZLIB
@@ -46,12 +47,8 @@ Please visit our Website: http://www.httrack.com
 #include "htszlib.h"
 */
 
-/*
-  Unpack file into a new file (gzip, zlib RFC1950 or raw deflate RFC1951).
-  Return value: size of the new file, or -1 if an error occurred
-*/
 /* Note: utf-8 */
-int hts_zunpack(char *filename, char *newfile) {
+int hts_zunpack(const char *filename, const char *newfile) {
   int ret = -1;
 
   if (filename != NULL && newfile != NULL && filename[0] && newfile[0]) {
@@ -60,6 +57,7 @@ int hts_zunpack(char *filename, char *newfile) {
 
     if (in != NULL) {
       unsigned char BIGSTK inbuf[8192];
+      const LLint maxout = hts_codec_maxout(hts_codec_coded_size(in));
       size_t navail = fread(inbuf, 1, sizeof(inbuf), in);
       /* gzip/zlib headers -> +32 windowBits; else raw deflate (RFC1951) */
       const hts_boolean wrapped =
@@ -68,9 +66,14 @@ int hts_zunpack(char *filename, char *newfile) {
             ((inbuf[0] & 0x0f) == Z_DEFLATED &&
              (((unsigned) inbuf[0] << 8 | inbuf[1]) % 31) == 0)));
       int attempt;
+      /* not_deflate: the raw attempt hit a data error, so the body is in no
+         deflate framing at all. env_error: local I/O or memory failure. */
+      hts_boolean not_deflate = HTS_FALSE;
+      hts_boolean env_error = HTS_FALSE;
+      hts_boolean bomb = HTS_FALSE;
 
       /* deflate is ambiguous; on failure retry with the other windowBits */
-      for (attempt = 0; attempt < 2 && ret < 0; attempt++) {
+      for (attempt = 0; attempt < 2 && ret < 0 && !bomb; attempt++) {
         const int windowBits =
             (attempt == 0 ? wrapped : !wrapped) ? (32 + MAX_WBITS) : -MAX_WBITS;
         FILE *fpout;
@@ -78,21 +81,26 @@ int hts_zunpack(char *filename, char *newfile) {
 
         if (attempt > 0) {
           /* rewind input; reopening fpout "wb" discards the partial output */
-          if (fseek(in, 0, SEEK_SET) != 0)
+          if (fseek(in, 0, SEEK_SET) != 0) {
+            env_error = HTS_TRUE;
             break;
+          }
           navail = fread(inbuf, 1, sizeof(inbuf), in);
         }
         fpout = FOPEN(fconv(catbuff, sizeof(catbuff), newfile), "wb");
-        if (fpout == NULL)
+        if (fpout == NULL) {
+          env_error = HTS_TRUE;
           break;
+        }
         memset(&strm, 0, sizeof(strm));
         if (inflateInit2(&strm, windowBits) != Z_OK) {
+          env_error = HTS_TRUE;
           fclose(fpout);
           break;
         }
         {
           hts_boolean ok = HTS_TRUE;
-          int size = 0;
+          LLint size = 0;
           int zerr = Z_OK;
 
           /* chunked inflate; first chunk in inbuf, single member */
@@ -108,33 +116,85 @@ int hts_zunpack(char *filename, char *newfile) {
               zerr = inflate(&strm, Z_NO_FLUSH);
               if (zerr == Z_NEED_DICT || zerr == Z_DATA_ERROR ||
                   zerr == Z_MEM_ERROR || zerr == Z_STREAM_ERROR) {
+                if (zerr == Z_MEM_ERROR || zerr == Z_STREAM_ERROR)
+                  env_error = HTS_TRUE;
+                else if (windowBits < 0)
+                  not_deflate = HTS_TRUE;
                 ok = HTS_FALSE;
                 break;
               }
               produced = sizeof(outbuf) - strm.avail_out;
-              if (produced > 0 &&
+              size += (LLint) produced;
-                  fwrite(outbuf, 1, produced, fpout) != produced) {
+              if (size > maxout) { /* decompression bomb: no retry, no copy */
+                bomb = HTS_TRUE;
+                ok = HTS_FALSE;
+                break;
+              }
+              if (produced > 0 &&
+                  fwrite(outbuf, 1, produced, fpout) != produced) {
+                env_error = HTS_TRUE;
                 ok = HTS_FALSE;
                 break;
               }
-              size += (int) produced;
             } while (strm.avail_out == 0);
             if (!ok || zerr == Z_STREAM_END)
               break;
             navail = fread(inbuf, 1, sizeof(inbuf), in);
           } while (navail > 0);
           if (ok && zerr == Z_STREAM_END)
-            ret = size;
+            ret = (int) size;
         }
         inflateEnd(&strm);
         fclose(fpout);
       }
+      /* keep a mislabeled identity body verbatim only when provably not
+         deflate; truncation or a local failure must keep failing (#47) */
+      if (ret < 0 && !bomb && !wrapped && not_deflate && !env_error &&
+          !ferror(in)) {
+        FILE *const fpout =
+            FOPEN(fconv(catbuff, sizeof(catbuff), newfile), "wb");
+
+        if (fpout != NULL && fseek(in, 0, SEEK_SET) == 0) {
+          int size = 0;
+
+          while ((navail = fread(inbuf, 1, sizeof(inbuf), in)) > 0) {
+            if (fwrite(inbuf, 1, navail, fpout) != navail) {
+              size = -1;
+              break;
+            }
+            size += (int) navail;
+          }
+          if (size >= 0 && !ferror(in))
+            ret = size;
+        }
+        if (fpout != NULL)
+          fclose(fpout);
+      }
       fclose(in);
     }
   }
   return ret;
 }
 
+size_t hts_zhead(const void *in, size_t in_len, void *out, size_t out_len) {
+  z_stream zs;
+  size_t n = 0;
+  int err;
+
+  memset(&zs, 0, sizeof(zs));
+  if (inflateInit2(&zs, 47) != Z_OK) /* 47: gzip or zlib, autodetected */
+    return 0;
+  zs.next_in = (const Bytef *) in;
+  zs.avail_in = (uInt) in_len;
+  zs.next_out = (Bytef *) out;
+  zs.avail_out = (uInt) out_len;
+  err = inflate(&zs, Z_SYNC_FLUSH);
+  if (err == Z_OK || err == Z_STREAM_END || err == Z_BUF_ERROR)
+    n = out_len - zs.avail_out;
+  inflateEnd(&zs);
+  return n;
+}
+
 int hts_extract_meta(const char *path) {
   char catbuff[CATBUFF_SIZE];
   unzFile zFile = unzOpen(fconcat(catbuff, sizeof(catbuff), path, "hts-cache/new.zip"));

src/htszlib.h

@@ -44,7 +44,13 @@ Please visit our Website: http://www.httrack.com
 
 /* Library internal definictions */
 #ifdef HTS_INTERNAL_BYTECODE
-extern int hts_zunpack(char *filename, char *newfile);
+/* Inflate filename into newfile (gzip, zlib or raw deflate); decoded size, or
+   -1 on a corrupt/truncated stream, an over-budget body, or an I/O failure. A
+   body provably in no deflate framing is copied verbatim. */
+extern int hts_zunpack(const char *filename, const char *newfile);
+/* Inflate the head of a gzip/zlib stream, out_len max; 0 if undecodable */
+extern size_t hts_zhead(const void *in, size_t in_len, void *out,
+                        size_t out_len);
 extern int hts_extract_meta(const char *path);
 extern const char *hts_get_zerror(int err);
 #endif

src/httrack.c

@@ -919,9 +919,6 @@ static void signal_handlers(void) {
 #ifdef SIGSEGV
   signal(SIGSEGV, sig_fatal);   // segmentation violation
 #endif
-#ifdef SIGSTKFLT
-  signal(SIGSTKFLT, sig_fatal); // stack fault
-#endif
 }
 
 // fin routines de détournement de SIGHUP & co

src/httrack.dsp

@@ -1,127 +0,0 @@
-# Microsoft Developer Studio Project File - Name="httrack" - Package Owner=<4>
-# Microsoft Developer Studio Generated Build File, Format Version 6.00
-# ** DO NOT EDIT **
-
-# TARGTYPE "Win32 (x86) Console Application" 0x0103
-
-CFG=httrack - Win32 Debug
-!MESSAGE This is not a valid makefile. To build this project using NMAKE,
-!MESSAGE use the Export Makefile command and run
-!MESSAGE 
-!MESSAGE NMAKE /f "httrack.mak".
-!MESSAGE 
-!MESSAGE You can specify a configuration when running NMAKE
-!MESSAGE by defining the macro CFG on the command line. For example:
-!MESSAGE 
-!MESSAGE NMAKE /f "httrack.mak" CFG="httrack - Win32 Debug"
-!MESSAGE 
-!MESSAGE Possible choices for configuration are:
-!MESSAGE 
-!MESSAGE "httrack - Win32 Release" (based on "Win32 (x86) Console Application")
-!MESSAGE "httrack - Win32 Debug" (based on "Win32 (x86) Console Application")
-!MESSAGE "httrack - Win32 Release avec debug" (based on "Win32 (x86) Console Application")
-!MESSAGE 
-
-# Begin Project
-# PROP AllowPerConfigDependencies 0
-# PROP Scc_ProjName ""
-# PROP Scc_LocalPath ""
-CPP=cl.exe
-RSC=rc.exe
-
-!IF  "$(CFG)" == "httrack - Win32 Release"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 0
-# PROP BASE Output_Dir "Release"
-# PROP BASE Intermediate_Dir "Release"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 0
-# PROP Output_Dir "Release"
-# PROP Intermediate_Dir "c:\temp\vcpp"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
-# ADD CPP /nologo /MD /W3 /Gi /O2 /Op /Ob2 /I "C:\Dev\IPv6Kit\inc\\" /I "C:\Dev\zlib\\" /I "C:\Dev\openssl\include" /I "C:\Dev\Winhttrack" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "HTS_ANALYSTE_CONSOLE" /YX /FD /Zm200 /c
-# SUBTRACT CPP /Fr
-# ADD BASE RSC /l 0x40c /d "NDEBUG"
-# ADD RSC /l 0x409 /d "NDEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 wsock32.lib libhttrack.lib /nologo /subsystem:console /machine:I386 /out:"L:\HTTrack\httrack\httrack.exe" /libpath:"C:\Dev\openssl\lib" /libpath:"C:\Dev\zlib\dll32" /libpath:"C:\Dev\openssl\lib\out32dll" /libpath:"C:\temp\Releaselib"
-# SUBTRACT LINK32 /verbose
-
-!ELSEIF  "$(CFG)" == "httrack - Win32 Debug"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 1
-# PROP BASE Output_Dir "Debug"
-# PROP BASE Intermediate_Dir "Debug"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 1
-# PROP Output_Dir "Debug"
-# PROP Intermediate_Dir "c:\temp\vcpp"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /W3 /Gm /GX /Zi /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
-# ADD CPP /nologo /MDd /W3 /Gm /GR /ZI /Od /I "C:\Dev\IPv6Kit\inc\\" /I "C:\Dev\zlib\\" /I "C:\Dev\openssl\include" /I "C:\Dev\Winhttrack" /D "_DEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "HTS_ANALYSTE_CONSOLE" /FAcs /Fr /FD /Zm200 /c
-# ADD BASE RSC /l 0x40c /d "_DEBUG"
-# ADD RSC /l 0x409 /d "_DEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 wsock32.lib libhttrack.lib /nologo /subsystem:console /debug /debugtype:both /machine:I386 /out:"C:\temp\httrack.exe" /pdbtype:sept /libpath:"C:\Dev\openssl\lib" /libpath:"C:\Dev\zlib\dll32" /libpath:"C:\Dev\openssl\lib\out32dll" /libpath:"C:\temp\Debuglib"
-# SUBTRACT LINK32 /profile /map
-
-!ELSEIF  "$(CFG)" == "httrack - Win32 Release avec debug"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 0
-# PROP BASE Output_Dir "httrack___Win32_Release_avec_debug"
-# PROP BASE Intermediate_Dir "httrack___Win32_Release_avec_debug"
-# PROP BASE Ignore_Export_Lib 0
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 0
-# PROP Output_Dir "Release_avec_debug"
-# PROP Intermediate_Dir "c:\temp\vcpp"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /MT /W3 /GX /Ot /Oi /Oy /Ob2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
-# SUBTRACT BASE CPP /Ox /Oa /Ow /Og /Os
-# ADD CPP /nologo /MD /W3 /GX /Zi /Ot /Oi /Oy /Ob2 /I "C:\Dev\IPv6Kit\inc\\" /I "C:\Dev\zlib\\" /I "C:\Dev\openssl\include" /I "C:\Dev\Winhttrack" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "HTS_ANALYSTE_CONSOLE" /FAcs /FR /YX /FD /Zm200 /c
-# ADD BASE RSC /l 0x409 /d "NDEBUG"
-# ADD RSC /l 0x409 /d "NDEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 wsock32.lib /nologo /subsystem:console /machine:I386 /out:"c:\temp\httrack.exe"
-# SUBTRACT BASE LINK32 /verbose
-# ADD LINK32 wsock32.lib libhttrack.lib /nologo /subsystem:console /debug /machine:I386 /out:"L:\HTTrack\httrack\httrack.exe" /libpath:"C:\Dev\openssl\lib" /libpath:"C:\Dev\zlib\dll32" /libpath:"C:\Dev\openssl\lib\out32dll"
-# SUBTRACT LINK32 /verbose
-
-!ENDIF 
-
-# Begin Target
-
-# Name "httrack - Win32 Release"
-# Name "httrack - Win32 Debug"
-# Name "httrack - Win32 Release avec debug"
-# Begin Source File
-
-SOURCE=httrack.c
-# End Source File
-# Begin Source File
-
-SOURCE=httrack.h
-# End Source File
-# End Target
-# End Project

src/httrack.dsw

@@ -1,44 +0,0 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "httrack"=.\httrack.dsp - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-    Begin Project Dependency
-    Project_Dep_Name libhttrack
-    End Project Dependency
-}}}
-
-###############################################################################
-
-Project: "libhttrack"=.\libhttrack\libhttrack.dsp - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-

src/httrack.rc

@@ -0,0 +1,5 @@
+// Version resource for httrack.exe, the command line program. See version.rc.
+#define VER_FILE_DESCRIPTION "HTTrack Website Copier (command line)"
+#define VER_ORIGINAL_FILENAME "httrack.exe"
+#define VER_FILETYPE VFT_APP
+#include "version.rc"

src/httrack.vcproj

@@ -1,677 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="9,00"
-	Name="httrack"
-	ProjectGUID="{D0E894E7-F64C-4722-9807-9ABB1054D43A}"
-	RootNamespace="httrack"
-	TargetFrameworkVersion="131072"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-		<Platform
-			Name="x64"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Release avec debug|Win32"
-			OutputDirectory=".\Release_avec_debug"
-			IntermediateDirectory="c:\temp\vcpp"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TypeLibraryName=".\Release_avec_debug/httrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalOptions="/Zm200 "
-				Optimization="4"
-				InlineFunctionExpansion="2"
-				EnableIntrinsicFunctions="true"
-				FavorSizeOrSpeed="1"
-				OmitFramePointers="true"
-				AdditionalIncludeDirectories="&quot;C:\Dev\zlib-1.2.8\&quot;;&quot;C:\Dev\openssl-1.0.1j\include&quot;;coucal"
-				PreprocessorDefinitions="WIN32;_CONSOLE;HTS_ANALYSTE_CONSOLE;_CRT_SECURE_NO_WARNINGS"
-				RuntimeLibrary="2"
-				UsePrecompiledHeader="0"
-				PrecompiledHeaderFile="c:\temp\vcpp/httrack.pch"
-				AssemblerOutput="2"
-				AssemblerListingLocation="c:\temp\vcpp/"
-				ObjectFile="c:\temp\vcpp/"
-				ProgramDataBaseFileName="c:\temp\vcpp/"
-				BrowseInformation="1"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="3"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="NDEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="O:\HTTrack\httrack\httrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib,C:\Dev\zlib\dll32,C:\Dev\openssl\lib\out32dll"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile=".\Release_avec_debug/httrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release avec debug|x64"
-			OutputDirectory="$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-				TypeLibraryName=".\Release_avec_debug/httrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalOptions="/Zm200 "
-				Optimization="4"
-				InlineFunctionExpansion="2"
-				EnableIntrinsicFunctions="true"
-				FavorSizeOrSpeed="1"
-				OmitFramePointers="true"
-				AdditionalIncludeDirectories="&quot;C:\Dev\zlib-1.2.8\&quot;;&quot;C:\Dev\openssl-1.0.1j\include&quot;;coucal"
-				PreprocessorDefinitions="WIN32;_CONSOLE;HTS_ANALYSTE_CONSOLE"
-				RuntimeLibrary="2"
-				UsePrecompiledHeader="0"
-				PrecompiledHeaderFile="c:\temp\vcpp/httrack.pch"
-				AssemblerOutput="2"
-				AssemblerListingLocation="c:\temp\vcpp/"
-				ObjectFile="c:\temp\vcpp/"
-				ProgramDataBaseFileName="c:\temp\vcpp/"
-				BrowseInformation="1"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="3"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="NDEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="O:\HTTrack\httrack\httrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib,C:\Dev\zlib\dll32,C:\Dev\openssl\lib\out32dll"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile=".\Release_avec_debug/httrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug|Win32"
-			OutputDirectory="C:\temp\httrackcmd\Debug"
-			IntermediateDirectory="C:\temp\httrackcmd\Debug"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TypeLibraryName=".\Debug/httrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalOptions="/Zm200 "
-				Optimization="0"
-				AdditionalIncludeDirectories="&quot;C:\Dev\zlib-1.2.8\&quot;;&quot;C:\Dev\openssl-1.0.1j\include&quot;;coucal"
-				PreprocessorDefinitions="_DEBUG;WIN32;_CONSOLE;HTS_ANALYSTE_CONSOLE;_CRT_SECURE_NO_WARNINGS"
-				RuntimeLibrary="3"
-				BufferSecurityCheck="true"
-				RuntimeTypeInfo="true"
-				PrecompiledHeaderFile="c:\temp\vcpp/httrack.pch"
-				AssemblerOutput="2"
-				AssemblerListingLocation="c:\temp\vcpp/"
-				ObjectFile="c:\temp\vcpp/"
-				ProgramDataBaseFileName="c:\temp\vcpp/"
-				BrowseInformation="1"
-				BrowseInformationFile="c:\temp\vcpp/"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="4"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="_DEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="C:\temp\httrack\httrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib;C:\temp\release_libz;C:\Dev\openssl\lib\out32dll;C:\temp\Debuglib"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile=".\Debug/httrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug|x64"
-			OutputDirectory="C:\temp\httrackcmd\Debug"
-			IntermediateDirectory="C:\temp\httrackcmd\Debug"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-				TypeLibraryName=".\Debug/httrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalOptions="/Zm200 "
-				Optimization="0"
-				AdditionalIncludeDirectories="&quot;C:\Dev\zlib-1.2.8\&quot;;&quot;C:\Dev\openssl-1.0.1j\include&quot;;coucal"
-				PreprocessorDefinitions="_DEBUG;WIN32;_CONSOLE;HTS_ANALYSTE_CONSOLE;_CRT_SECURE_NO_WARNINGS"
-				RuntimeLibrary="3"
-				BufferSecurityCheck="true"
-				RuntimeTypeInfo="true"
-				PrecompiledHeaderFile="c:\temp\vcpp/httrack.pch"
-				AssemblerOutput="2"
-				AssemblerListingLocation="c:\temp\vcpp/"
-				ObjectFile="c:\temp\vcpp/"
-				ProgramDataBaseFileName="c:\temp\vcpp/"
-				BrowseInformation="1"
-				BrowseInformationFile="c:\temp\vcpp/"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="3"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="_DEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="C:\temp\httrack64\httrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib,C:\temp\zlib,C:\Dev\openssl\lib\out32dll,C:\temp\Debuglib"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile=".\Debug/httrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="C:\temp\httrackcmd\Release"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TypeLibraryName=".\Release/httrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalOptions="/Zm200 "
-				Optimization="3"
-				InlineFunctionExpansion="2"
-				AdditionalIncludeDirectories="&quot;C:\Dev\zlib-1.2.8\&quot;;&quot;C:\Dev\openssl-1.0.1j\include&quot;;coucal"
-				PreprocessorDefinitions="NDEBUG;WIN32;_CONSOLE;HTS_ANALYSTE_CONSOLE;_CRT_SECURE_NO_WARNINGS"
-				StringPooling="true"
-				RuntimeLibrary="2"
-				EnableFunctionLevelLinking="true"
-				UsePrecompiledHeader="0"
-				PrecompiledHeaderFile="c:\temp\vcpp/httrack.pch"
-				AssemblerListingLocation="c:\temp\vcpp/"
-				ObjectFile="c:\temp\vcpp/"
-				ProgramDataBaseFileName="c:\temp\vcpp/"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="NDEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="O:\HTTrack\httrack\httrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib,C:\temp\zlib,C:\Dev\openssl\lib\out32dll,C:\temp\Releaselib"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\httrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-				TypeLibraryName=".\Release/httrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalOptions="/Zm200 "
-				Optimization="3"
-				InlineFunctionExpansion="2"
-				AdditionalIncludeDirectories="&quot;C:\Dev\zlib-1.2.8\&quot;;&quot;C:\Dev\openssl-1.0.1j\include&quot;;coucal"
-				PreprocessorDefinitions="NDEBUG;WIN32;_CONSOLE;HTS_ANALYSTE_CONSOLE;_CRT_SECURE_NO_WARNINGS"
-				StringPooling="true"
-				RuntimeLibrary="2"
-				EnableFunctionLevelLinking="true"
-				UsePrecompiledHeader="0"
-				PrecompiledHeaderFile="c:\temp\vcpp/httrack.pch"
-				AssemblerListingLocation="c:\temp\vcpp64/"
-				ObjectFile="c:\temp\vcpp64/"
-				ProgramDataBaseFileName="c:\temp\vcpp64/"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="NDEBUG"
-				Culture="1033"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="O:\HTTrack\httrack\x64\httrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib,C:\temp\zlib,C:\Dev\openssl\lib\out32dll,C:\temp\Releaselib"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\x64\httrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath="httrack.c"
-			>
-			<FileConfiguration
-				Name="Release avec debug|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					AdditionalIncludeDirectories=""
-					PreprocessorDefinitions=""
-					BrowseInformation="1"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Release avec debug|x64"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					AdditionalIncludeDirectories=""
-					PreprocessorDefinitions=""
-					BrowseInformation="1"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Debug|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					Optimization="0"
-					AdditionalIncludeDirectories=""
-					PreprocessorDefinitions=""
-					BrowseInformation="1"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Debug|x64"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					Optimization="0"
-					AdditionalIncludeDirectories=""
-					PreprocessorDefinitions=""
-					BrowseInformation="1"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Release|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					Optimization="2"
-					AdditionalIncludeDirectories=""
-					PreprocessorDefinitions=""
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Release|x64"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					Optimization="2"
-					AdditionalIncludeDirectories=""
-					PreprocessorDefinitions=""
-				/>
-			</FileConfiguration>
-		</File>
-		<File
-			RelativePath=".\httrack.h"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>

src/httrack.vcxproj

@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>17.0</VCProjectVersion>
+    <ProjectGuid>{2F9E0E4C-2B5B-4B2E-9F6D-1C0A5E7B3D01}</ProjectGuid>
+    <RootNamespace>httrack</RootNamespace>
+    <WindowsTargetPlatformVersion Condition="'$(WindowsTargetPlatformVersion)'==''">10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+
+  <PropertyGroup Condition="'$(Configuration)'=='Debug'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)'=='Release'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+
+  <PropertyGroup>
+    <!-- No direct vcpkg dependency, but the triplet drives applocal deployment:
+         without it the OpenSSL and zlib DLLs libhttrack needs never land beside
+         httrack.exe. -->
+    <VcpkgEnableManifest>true</VcpkgEnableManifest>
+    <VcpkgTriplet Condition="'$(Platform)'=='Win32'">x86-windows</VcpkgTriplet>
+    <VcpkgTriplet Condition="'$(Platform)'=='x64'">x64-windows</VcpkgTriplet>
+    <OutDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\</OutDir>
+    <IntDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\obj\httrack\</IntDir>
+    <TargetName>httrack</TargetName>
+  </PropertyGroup>
+
+  <ItemDefinitionGroup>
+    <ClCompile>
+      <!-- No LIBHTTRACK_EXPORTS: HTSEXT_API is dllimport on this side. -->
+      <PreprocessorDefinitions>WIN32;_CONSOLE;_MBCS;WINVER=0x0601;_WIN32_WINNT=0x0601;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>$(MSBuildThisFileDirectory);$(MSBuildThisFileDirectory)coucal;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <WarningLevel>Level3</WarningLevel>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <!-- main() calls WSAStartup/WSACleanup itself. -->
+      <AdditionalDependencies>Ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Debug'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
+    <ClCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>MaxSpeed</Optimization>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <StringPooling>true</StringPooling>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemGroup>
+    <ClCompile Include="httrack.c" />
+  </ItemGroup>
+
+  <!-- Pulls in libhttrack.lib and builds it first. -->
+  <ItemGroup>
+    <ProjectReference Include="libhttrack.vcxproj">
+      <Project>{e76ad871-54c1-45e8-a657-6117adeffb46}</Project>
+    </ProjectReference>
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="httrack.rc" />
+  </ItemGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>

src/libhttrack.dsp

@@ -1,406 +0,0 @@
-# Microsoft Developer Studio Project File - Name="libhttrack" - Package Owner=<4>
-# Microsoft Developer Studio Generated Build File, Format Version 6.00
-# ** DO NOT EDIT **
-
-# TARGTYPE "Win32 (x86) Dynamic-Link Library" 0x0102
-
-CFG=libhttrack - Win32 Debug
-!MESSAGE This is not a valid makefile. To build this project using NMAKE,
-!MESSAGE use the Export Makefile command and run
-!MESSAGE 
-!MESSAGE NMAKE /f "libhttrack.mak".
-!MESSAGE 
-!MESSAGE You can specify a configuration when running NMAKE
-!MESSAGE by defining the macro CFG on the command line. For example:
-!MESSAGE 
-!MESSAGE NMAKE /f "libhttrack.mak" CFG="libhttrack - Win32 Debug"
-!MESSAGE 
-!MESSAGE Possible choices for configuration are:
-!MESSAGE 
-!MESSAGE "libhttrack - Win32 Release" (based on "Win32 (x86) Dynamic-Link Library")
-!MESSAGE "libhttrack - Win32 Debug" (based on "Win32 (x86) Dynamic-Link Library")
-!MESSAGE 
-
-# Begin Project
-# PROP AllowPerConfigDependencies 0
-# PROP Scc_ProjName ""
-# PROP Scc_LocalPath ""
-CPP=cl.exe
-MTL=midl.exe
-RSC=rc.exe
-
-!IF  "$(CFG)" == "libhttrack - Win32 Release"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 0
-# PROP BASE Output_Dir "Release"
-# PROP BASE Intermediate_Dir "Release"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 0
-# PROP Output_Dir "C:\temp\Releaselib"
-# PROP Intermediate_Dir "C:\temp\Releaselib"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /MT /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBHTTRACK_EXPORTS" /Yu"stdafx.h" /FD /c
-# ADD CPP /nologo /MD /W3 /GX /O2 /Ob2 /I "C:\Dev\IPv6Kit\inc" /I "C:\Dev\zlib\include" /D "NDEBUG" /D "WIN32" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBHTTRACK_EXPORTS" /D "ZLIB_DLL" /FD /c
-# SUBTRACT CPP /YX /Yc /Yu
-# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
-# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
-# ADD BASE RSC /l 0x40c /d "NDEBUG"
-# ADD RSC /l 0x40c /d "NDEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /machine:I386
-# ADD LINK32 wsock32.lib zdll.lib /nologo /dll /map /machine:I386 /out:"L:\HTTrack\httrack\libhttrack.dll" /libpath:"C:\Dev\zlib\lib"
-# SUBTRACT LINK32 /pdb:none
-
-!ELSEIF  "$(CFG)" == "libhttrack - Win32 Debug"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 1
-# PROP BASE Output_Dir "Debug"
-# PROP BASE Intermediate_Dir "Debug"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 1
-# PROP Output_Dir "C:\temp\Debuglib"
-# PROP Intermediate_Dir "C:\temp\Debuglib"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBHTTRACK_EXPORTS" /Yu"stdafx.h" /FD /GZ /c
-# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "C:\Dev\IPv6Kit\inc" /I "C:\Dev\zlib\include" /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBHTTRACK_EXPORTS" /D "ZLIB_DLL" /FD /GZ /c
-# SUBTRACT CPP /YX /Yc /Yu
-# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
-# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
-# ADD BASE RSC /l 0x40c /d "_DEBUG"
-# ADD RSC /l 0x40c /d "_DEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /dll /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 wsock32.lib zdll.lib /nologo /dll /map /debug /machine:I386 /out:"C:\temp\libhttrack.dll" /pdbtype:sept /libpath:"C:\Dev\zlib\lib"
-# SUBTRACT LINK32 /pdb:none
-
-!ENDIF 
-
-# Begin Target
-
-# Name "libhttrack - Win32 Release"
-# Name "libhttrack - Win32 Debug"
-# Begin Group "Source Files"
-
-# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
-# Begin Source File
-
-SOURCE=minizip\crypt.h
-# End Source File
-# Begin Source File
-
-SOURCE="hts-indextmpl.h"
-# End Source File
-# Begin Source File
-
-SOURCE=htsalias.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsalias.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsback.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsback.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsbase.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsbasenet.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsbauth.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsbauth.h
-# End Source File
-# Begin Source File
-
-SOURCE=htscache.c
-# End Source File
-# Begin Source File
-
-SOURCE=htscache.h
-# End Source File
-# Begin Source File
-
-SOURCE=htscatchurl.c
-# End Source File
-# Begin Source File
-
-SOURCE=htscatchurl.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsconfig.h
-# End Source File
-# Begin Source File
-
-SOURCE=htscore.c
-# End Source File
-# Begin Source File
-
-SOURCE=htscore.h
-# End Source File
-# Begin Source File
-
-SOURCE=htscoremain.c
-# End Source File
-# Begin Source File
-
-SOURCE=htscoremain.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsdefines.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsfilters.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsfilters.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsftp.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsftp.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsglobal.h
-# End Source File
-# Begin Source File
-
-SOURCE=htshash.c
-# End Source File
-# Begin Source File
-
-SOURCE=htshash.h
-# End Source File
-# Begin Source File
-
-SOURCE=htshelp.c
-# End Source File
-# Begin Source File
-
-SOURCE=htshelp.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsindex.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsindex.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsinthash.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsjava.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsjava.h
-# End Source File
-# Begin Source File
-
-SOURCE=htslib.c
-# End Source File
-# Begin Source File
-
-SOURCE=htslib.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsmd5.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsmd5.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsmodules.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsmodules.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsname.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsname.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsnet.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsnostatic.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsnostatic.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsopt.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsparse.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsparse.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsrobots.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsrobots.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsstrings.h
-# End Source File
-# Begin Source File
-
-SOURCE=htssystem.h
-# End Source File
-# Begin Source File
-
-SOURCE=htsthread.c
-# End Source File
-# Begin Source File
-
-SOURCE=htsthread.h
-# End Source File
-# Begin Source File
-
-SOURCE=htstools.c
-# End Source File
-# Begin Source File
-
-SOURCE=htstools.h
-# End Source File
-# Begin Source File
-
-SOURCE=htswizard.c
-# End Source File
-# Begin Source File
-
-SOURCE=htswizard.h
-# End Source File
-# Begin Source File
-
-SOURCE=htswrap.c
-# End Source File
-# Begin Source File
-
-SOURCE=htswrap.h
-# End Source File
-# Begin Source File
-
-SOURCE=htszlib.c
-# End Source File
-# Begin Source File
-
-SOURCE=htszlib.h
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\ioapi.c
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\ioapi.h
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\iowin32.c
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\iowin32.h
-# End Source File
-# Begin Source File
-
-SOURCE=md5.c
-# End Source File
-# Begin Source File
-
-SOURCE=md5.h
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\mztools.c
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\mztools.h
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\unzip.c
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\unzip.h
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\zip.c
-# End Source File
-# Begin Source File
-
-SOURCE=minizip\zip.h
-# End Source File
-# End Group
-# Begin Group "Header Files"
-
-# PROP Default_Filter "h;hpp;hxx;hm;inl"
-# Begin Source File
-
-# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
-# End Group
-# Begin Source File
-
-SOURCE=.\ReadMe.txt
-# End Source File
-# End Target
-# End Project

src/libhttrack.dsw

@@ -1,29 +0,0 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "libhttrack"=.\libhttrack.dsp - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-

src/libhttrack.rc

@@ -0,0 +1,5 @@
+// Version resource for libhttrack.dll. See version.rc.
+#define VER_FILE_DESCRIPTION "HTTrack Website Copier engine"
+#define VER_ORIGINAL_FILENAME "libhttrack.dll"
+#define VER_FILETYPE VFT_DLL
+#include "version.rc"

src/libhttrack.vcxproj

@@ -0,0 +1,150 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>17.0</VCProjectVersion>
+    <ProjectGuid>{E76AD871-54C1-45E8-A657-6117ADEFFB46}</ProjectGuid>
+    <RootNamespace>libhttrack</RootNamespace>
+    <WindowsTargetPlatformVersion Condition="'$(WindowsTargetPlatformVersion)'==''">10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+
+  <PropertyGroup Condition="'$(Configuration)'=='Debug'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)'=='Release'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+
+  <!-- OpenSSL 3.x and zlib come from vcpkg. Dynamic triplets: the DLLs ship with
+       the app, so an OpenSSL CVE is a DLL swap rather than a rebuild. -->
+  <PropertyGroup>
+    <VcpkgEnableManifest>true</VcpkgEnableManifest>
+    <VcpkgTriplet Condition="'$(Platform)'=='Win32'">x86-windows</VcpkgTriplet>
+    <VcpkgTriplet Condition="'$(Platform)'=='x64'">x64-windows</VcpkgTriplet>
+    <!-- WinHTTrack links ..\httrack\src\$(Platform)\$(Configuration)\libhttrack.lib -->
+    <OutDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\</OutDir>
+    <IntDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\obj\</IntDir>
+    <TargetName>libhttrack</TargetName>
+  </PropertyGroup>
+
+  <ItemDefinitionGroup>
+    <ClCompile>
+      <!-- LIBHTTRACK_EXPORTS turns HTSEXT_API into __declspec(dllexport); ZLIB_DLL
+           imports zlib from its DLL. HTS_USEBROTLI/HTS_USEZSTD enable the br and
+           zstd content codings. Windows 7 floor, matching WinHTTrack. -->
+      <PreprocessorDefinitions>WIN32;_WINDOWS;_MBCS;_USRDLL;LIBHTTRACK_EXPORTS;ZLIB_DLL;HTS_USEBROTLI=1;HTS_USEZSTD=1;WINVER=0x0601;_WIN32_WINNT=0x0601;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>$(MSBuildThisFileDirectory);$(MSBuildThisFileDirectory)coucal;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <WarningLevel>Level3</WarningLevel>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <!-- vcpkg auto-links libssl/libcrypto/zlib/brotli/zstd; only the OS import
+           lib is explicit. -->
+      <AdditionalDependencies>Ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Debug'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
+    <ClCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>MaxSpeed</Optimization>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <StringPooling>true</StringPooling>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemGroup>
+    <ClCompile Include="coucal\coucal.c" />
+    <ClCompile Include="htsalias.c" />
+    <ClCompile Include="htsback.c" />
+    <ClCompile Include="htsbauth.c" />
+    <ClCompile Include="htscache.c" />
+    <ClCompile Include="htscache_selftest.c" />
+    <ClCompile Include="htscatchurl.c" />
+    <ClCompile Include="htscharset.c" />
+    <ClCompile Include="htscodec.c" />
+    <ClCompile Include="htsconcat.c" />
+    <ClCompile Include="htscore.c" />
+    <ClCompile Include="htscoremain.c" />
+    <ClCompile Include="htsdns_selftest.c" />
+    <ClCompile Include="htsencoding.c" />
+    <ClCompile Include="htsfilters.c" />
+    <ClCompile Include="htsftp.c" />
+    <ClCompile Include="htshash.c" />
+    <ClCompile Include="htshelp.c" />
+    <ClCompile Include="htsindex.c" />
+    <ClCompile Include="htslib.c" />
+    <ClCompile Include="htsmd5.c" />
+    <ClCompile Include="htsmodules.c" />
+    <ClCompile Include="htsname.c" />
+    <ClCompile Include="htsparse.c" />
+    <ClCompile Include="htsproxy.c" />
+    <ClCompile Include="htsrobots.c" />
+    <ClCompile Include="htsselftest.c" />
+    <ClCompile Include="htssniff.c" />
+    <ClCompile Include="htsthread.c" />
+    <ClCompile Include="htstools.c" />
+    <ClCompile Include="htswizard.c" />
+    <ClCompile Include="htswrap.c" />
+    <ClCompile Include="htszlib.c" />
+    <ClCompile Include="md5.c" />
+    <ClCompile Include="minizip\ioapi.c" />
+    <ClCompile Include="minizip\iowin32.c" />
+    <ClCompile Include="minizip\mztools.c" />
+    <ClCompile Include="minizip\unzip.c" />
+    <ClCompile Include="minizip\zip.c" />
+    <ClCompile Include="punycode.c" />
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="libhttrack.rc" />
+  </ItemGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>

src/proxy/proxytrack.vcproj

@@ -1,438 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="9,00"
-	Name="proxytrack"
-	ProjectGUID="{4C31F79A-9DAB-44CE-88D6-0FF961599AAB}"
-	RootNamespace="proxytrack"
-	Keyword="Win32Proj"
-	TargetFrameworkVersion="131072"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-		<Platform
-			Name="x64"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			OutputDirectory="C:\temp\proxytrack\Debug"
-			IntermediateDirectory="C:\temp\proxytrack\Debug\int"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;&quot;C:\Dev\zlib-1.2.8&quot;;C:\Dev\minizip;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="NO_MALLOCT;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				BufferSecurityCheck="true"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="4"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib zlib1.lib"
-				OutputFile="c:\temp\httrack\proxytrack.exe"
-				LinkIncremental="2"
-				AdditionalLibraryDirectories="C:\temp\debug_libz"
-				IgnoreAllDefaultLibraries="false"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="$(OutDir)/proxytrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;&quot;C:\Dev\zlib-1.2.8&quot;;C:\Dev\minizip;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="NO_MALLOCT;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				MinimalRebuild="true"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				BufferSecurityCheck="true"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="3"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib zlib1.lib"
-				OutputFile="c:\temp\httrack64\proxytrack.exe"
-				LinkIncremental="2"
-				AdditionalLibraryDirectories="C:\temp\debug_libz64"
-				IgnoreAllDefaultLibraries="false"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="$(OutDir)/proxytrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="C:\temp\proxytrack\Release"
-			IntermediateDirectory="C:\temp\proxytrack\Release\int"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;&quot;C:\Dev\zlib-1.2.8&quot;;C:\Dev\minizip;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="NO_MALLOCT;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				RuntimeLibrary="0"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib zlib1.lib"
-				OutputFile="O:\HTTrack\httrack\proxytrack.exe"
-				LinkIncremental="1"
-				AdditionalLibraryDirectories="C:\temp\release_libz;C:\temp\Releaselib"
-				IgnoreAllDefaultLibraries="false"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\proxytrack.pdb"
-				SubSystem="1"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				OptimizeForWindows98="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				Description="Copying proxytrack to separate package"
-				CommandLine="&quot;C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool.exe&quot; sign /f &quot;Z:\Mes Documents\certificats\httrack-com\httrack-signing-certificate.pfx&quot; /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath)&#x0D;&#x0A;copy /Y &quot;O:\HTTrack\httrack\proxytrack.exe&quot; &quot;O:\ProxyTrack\proxytrack\proxytrack.exe&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.c&quot; &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.h&quot;  &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.vcproj&quot; &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.txt&quot; &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;&quot;C:\Dev\zlib-1.2.8&quot;;C:\Dev\minizip;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="NO_MALLOCT;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				RuntimeLibrary="0"
-				UsePrecompiledHeader="0"
-				WarningLevel="3"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib zlib1.lib"
-				OutputFile="O:\HTTrack\httrack\x64\proxytrack.exe"
-				LinkIncremental="1"
-				AdditionalLibraryDirectories="C:\temp\release_libz64;C:\temp\Releaselib64"
-				IgnoreAllDefaultLibraries="false"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\x64\proxytrack.pdb"
-				SubSystem="1"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				Description="Copying proxytrack to separate package"
-				CommandLine="&quot;C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool.exe&quot; sign /f &quot;Z:\Mes Documents\certificats\httrack-com\httrack-signing-certificate.pfx&quot; /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath)&#x0D;&#x0A;copy /Y &quot;O:\HTTrack\httrack\proxytrack.exe&quot; &quot;O:\ProxyTrack\proxytrack\proxytrack.exe&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.c&quot; &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.h&quot;  &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.vcproj&quot; &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;copy /Y &quot;C:\Dev\httrack\src\proxy\*.txt&quot; &quot;O:\ProxyTrack\proxytrack\src\&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx"
-			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
-			>
-			<File
-				RelativePath="..\coucal\coucal.c"
-				>
-			</File>
-			<File
-				RelativePath="..\htsmd5.c"
-				>
-			</File>
-			<File
-				RelativePath="..\minizip\ioapi.c"
-				>
-			</File>
-			<File
-				RelativePath="..\minizip\iowin32.c"
-				>
-			</File>
-			<File
-				RelativePath="main.c"
-				>
-			</File>
-			<File
-				RelativePath="..\md5.c"
-				>
-			</File>
-			<File
-				RelativePath="..\minizip\mztools.c"
-				>
-			</File>
-			<File
-				RelativePath="proxytrack.c"
-				>
-			</File>
-			<File
-				RelativePath="store.c"
-				>
-			</File>
-			<File
-				RelativePath="..\minizip\unzip.c"
-				>
-			</File>
-			<File
-				RelativePath="..\minizip\zip.c"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Header Files"
-			Filter="h;hpp;hxx;hm;inl;inc;xsd"
-			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
-			>
-			<File
-				RelativePath="proxystrings.h"
-				>
-			</File>
-			<File
-				RelativePath="proxytrack.h"
-				>
-			</File>
-			<File
-				RelativePath="store.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Resource Files"
-			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx"
-			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
-			>
-			<File
-				RelativePath=".\changelog.txt"
-				>
-			</File>
-		</Filter>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>

src/proxy/store.c

@@ -1938,6 +1938,9 @@ static time_t getGMT(struct tm *tm) {   /* hey, time_t is local! */
 #if (defined(BSD) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD_kernel__))
     time_t now = time(NULL);
     time_t timezone = -localtime(&now)->tm_gmtoff;
+#elif defined(_MSC_VER)
+    /* MSVC spells it _timezone */
+    const time_t timezone = _timezone;
 #endif
     return (time_t) (t - timezone);
   }

src/proxytrack.vcxproj

@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>17.0</VCProjectVersion>
+    <ProjectGuid>{2F9E0E4C-2B5B-4B2E-9F6D-1C0A5E7B3D03}</ProjectGuid>
+    <RootNamespace>proxytrack</RootNamespace>
+    <WindowsTargetPlatformVersion Condition="'$(WindowsTargetPlatformVersion)'==''">10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+
+  <PropertyGroup Condition="'$(Configuration)'=='Debug'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)'=='Release'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+
+  <PropertyGroup>
+    <VcpkgEnableManifest>true</VcpkgEnableManifest>
+    <VcpkgTriplet Condition="'$(Platform)'=='Win32'">x86-windows</VcpkgTriplet>
+    <VcpkgTriplet Condition="'$(Platform)'=='x64'">x64-windows</VcpkgTriplet>
+    <OutDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\</OutDir>
+    <IntDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\obj\proxytrack\</IntDir>
+    <TargetName>proxytrack</TargetName>
+  </PropertyGroup>
+
+  <ItemDefinitionGroup>
+    <ClCompile>
+      <!-- Matches proxytrack_CFLAGS in Makefile.am. Standalone: it does not link
+           libhttrack, it only borrows headers (hts_effective_mime is a macro). -->
+      <PreprocessorDefinitions>WIN32;_CONSOLE;_MBCS;NO_MALLOCT;ZLIB_CONST;HTS_INTHASH_USES_MD5;ZLIB_DLL;WINVER=0x0601;_WIN32_WINNT=0x0601;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>$(MSBuildThisFileDirectory);$(MSBuildThisFileDirectory)coucal;$(MSBuildThisFileDirectory)proxy;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <WarningLevel>Level3</WarningLevel>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <AdditionalDependencies>Ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Debug'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
+    <ClCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>MaxSpeed</Optimization>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <StringPooling>true</StringPooling>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemGroup>
+    <ClCompile Include="proxy\main.c" />
+    <ClCompile Include="proxy\proxytrack.c" />
+    <ClCompile Include="proxy\store.c" />
+    <ClCompile Include="coucal\coucal.c" />
+    <ClCompile Include="htsmd5.c" />
+    <ClCompile Include="md5.c" />
+    <ClCompile Include="minizip\ioapi.c" />
+    <ClCompile Include="minizip\iowin32.c" />
+    <ClCompile Include="minizip\mztools.c" />
+    <ClCompile Include="minizip\unzip.c" />
+    <ClCompile Include="minizip\zip.c" />
+  </ItemGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>

src/vcpkg.json

@@ -0,0 +1,12 @@
+{
+  "$schema":
+      "https://raw.githubusercontent.com/microsoft/vcpkg-tool/main/docs/vcpkg.schema.json",
+  "name": "libhttrack",
+  "version-string": "3.49",
+  "dependencies": [
+    "brotli",
+    "openssl",
+    "zlib",
+    "zstd"
+  ]
+}

src/version.rc

@@ -0,0 +1,50 @@
+// Version resource for libhttrack.dll and httrack.exe. Signing enforces that every
+// binary in a release names the same product and version, so both need one.
+// Spelled out here because a VERSIONINFO cannot take a version string apart;
+// tests/01_engine-version-macros.test fails if this drifts from htsglobal.h.
+// The per-binary parts come from libhttrack.rc / httrack.rc.
+
+#include <winver.h>
+
+#ifndef VER_FILE_DESCRIPTION
+#define VER_FILE_DESCRIPTION "HTTrack Website Copier"
+#endif
+#ifndef VER_ORIGINAL_FILENAME
+#define VER_ORIGINAL_FILENAME ""
+#endif
+#ifndef VER_FILETYPE
+#define VER_FILETYPE VFT_APP
+#endif
+
+VS_VERSION_INFO VERSIONINFO
+  FILEVERSION 3, 49, 12, 0
+  PRODUCTVERSION 3, 49, 12, 0
+  FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
+#ifdef _DEBUG
+  FILEFLAGS VS_FF_DEBUG
+#else
+  FILEFLAGS 0x0L
+#endif
+  FILEOS VOS_NT_WINDOWS32
+  FILETYPE VER_FILETYPE
+  FILESUBTYPE VFT2_UNKNOWN
+BEGIN
+  BLOCK "StringFileInfo"
+  BEGIN
+    BLOCK "040904b0"  // U.S. English, Unicode
+    BEGIN
+      VALUE "CompanyName", "Xavier Roche"
+      VALUE "FileDescription", VER_FILE_DESCRIPTION
+      VALUE "FileVersion", "3.49.12"
+      VALUE "InternalName", VER_ORIGINAL_FILENAME
+      VALUE "LegalCopyright", "Copyright (C) 1998-2026 Xavier Roche and other contributors. GNU GPL v3 or later."
+      VALUE "OriginalFilename", VER_ORIGINAL_FILENAME
+      VALUE "ProductName", "HTTrack Website Copier"
+      VALUE "ProductVersion", "3.49-12"
+    END
+  END
+  BLOCK "VarFileInfo"
+  BEGIN
+    VALUE "Translation", 0x409, 1200
+  END
+END

src/webhttrack

@@ -12,10 +12,9 @@ if test -n "${BROWSER}"; then
 fi
 # Patch for Darwin/Mac by Ross Williams
 if test "$(uname -s)" == "Darwin"; then
-    # Darwin/Mac OS X uses a system 'open' command to find
+    # Darwin's 'open -W' launches the default browser and waits for it to quit.
-    # the default browser. The -W flag causes it to wait for
+    # Keep it only as a fallback so a configured $BROWSER still wins the search.
-    # the browser to exit
+    BROWSEREXEFALLBACK="/usr/bin/open -W"
-    BROWSEREXE="/usr/bin/open -W"
 fi
 BINWD=$(dirname "$0")
 SRCHPATH=("$BINWD" /usr/local/bin /usr/share/bin /usr/bin /usr/lib/httrack /usr/local/lib/httrack /usr/local/share/httrack /opt/local/bin /sw/bin "${HOME}/usr/bin" "${HOME}/bin")
@@ -81,6 +80,7 @@ for i in "${SRCHBROWSEREXE[@]}"; do
     done
     test -n "$BROWSEREXE" && break
 done
+test -n "$BROWSEREXE" || BROWSEREXE="${BROWSEREXEFALLBACK}"
 test -n "$BROWSEREXE" || ! log "Could not find any suitable browser" || exit 1
 
 # "browse" command
@@ -132,12 +132,12 @@ function cleanup {
 }
 
 # Cleanup in case of emergency
-trap "cleanup now; exit" HUP INT QUIT ILL TRAP ABRT BUS FPE SEGV PIPE ALRM TERM STKFLT XCPU XFSZ
+trap "cleanup now; exit" HUP INT QUIT PIPE TERM
 
 # Got SRVURL, launch browser
 launch_browser "${BROWSEREXE}" "${SRVURL}"
 
 # That's all, folks!
-trap "" HUP INT QUIT ILL TRAP ABRT BUS FPE SEGV PIPE ALRM TERM STKFLT XCPU XFSZ
+trap "" HUP INT QUIT PIPE TERM
 cleanup
 exit 0

src/webhttrack.dsp

@@ -1,120 +0,0 @@
-# Microsoft Developer Studio Project File - Name="webhttrack" - Package Owner=<4>
-# Microsoft Developer Studio Generated Build File, Format Version 6.00
-# ** DO NOT EDIT **
-
-# TARGTYPE "Win32 (x86) Console Application" 0x0103
-
-CFG=webhttrack - Win32 Debug
-!MESSAGE This is not a valid makefile. To build this project using NMAKE,
-!MESSAGE use the Export Makefile command and run
-!MESSAGE 
-!MESSAGE NMAKE /f "webhttrack.mak".
-!MESSAGE 
-!MESSAGE You can specify a configuration when running NMAKE
-!MESSAGE by defining the macro CFG on the command line. For example:
-!MESSAGE 
-!MESSAGE NMAKE /f "webhttrack.mak" CFG="webhttrack - Win32 Debug"
-!MESSAGE 
-!MESSAGE Possible choices for configuration are:
-!MESSAGE 
-!MESSAGE "webhttrack - Win32 Release" (based on "Win32 (x86) Console Application")
-!MESSAGE "webhttrack - Win32 Debug" (based on "Win32 (x86) Console Application")
-!MESSAGE 
-
-# Begin Project
-# PROP AllowPerConfigDependencies 0
-# PROP Scc_ProjName ""
-# PROP Scc_LocalPath ""
-CPP=cl.exe
-RSC=rc.exe
-
-!IF  "$(CFG)" == "webhttrack - Win32 Release"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 0
-# PROP BASE Output_Dir "Release"
-# PROP BASE Intermediate_Dir "Release"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 0
-# PROP Output_Dir "Release"
-# PROP Intermediate_Dir "Release"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /Yu"stdafx.h" /FD /c
-# ADD CPP /nologo /MD /W3 /GX /O2 /I "C:\Dev\\" /I "C:\Dev\IPv6Kit\inc\\" /I "C:\Dev\zlib\\" /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /FR /FD /c
-# SUBTRACT CPP /YX /Yc /Yu
-# ADD BASE RSC /l 0x40c /d "NDEBUG"
-# ADD RSC /l 0x40c /d "NDEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 wsock32.lib libhttrack.lib /nologo /subsystem:console /pdb:none /machine:I386 /force /out:"L:\HTTrack\httrack\webhttrack.exe" /libpath:"C:\Dev\openssl\lib" /libpath:"C:\Dev\zlib\dll32" /libpath:"C:\Dev\openssl\lib\out32dll" /libpath:"C:\temp\Releaselib"
-
-!ELSEIF  "$(CFG)" == "webhttrack - Win32 Debug"
-
-# PROP BASE Use_MFC 0
-# PROP BASE Use_Debug_Libraries 1
-# PROP BASE Output_Dir "Debug"
-# PROP BASE Intermediate_Dir "Debug"
-# PROP BASE Target_Dir ""
-# PROP Use_MFC 0
-# PROP Use_Debug_Libraries 1
-# PROP Output_Dir "Debug"
-# PROP Intermediate_Dir "Debug"
-# PROP Ignore_Export_Lib 0
-# PROP Target_Dir ""
-# ADD BASE CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /Yu"stdafx.h" /FD /GZ /c
-# ADD CPP /nologo /MDd /W3 /Gm /GR /GX /ZI /Od /I "C:\Dev\\" /I "C:\Dev\IPv6Kit\inc\\" /I "C:\Dev\zlib\\" /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FAcs /FR /FD /GZ /c
-# SUBTRACT CPP /YX /Yc /Yu
-# ADD BASE RSC /l 0x40c /d "_DEBUG"
-# ADD RSC /l 0x40c /d "_DEBUG"
-BSC32=bscmake.exe
-# ADD BASE BSC32 /nologo
-# ADD BSC32 /nologo
-LINK32=link.exe
-# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 wsock32.lib libhttrack.lib /nologo /subsystem:console /debug /machine:I386 /out:"C:\temp\webhttrack.exe" /pdbtype:sept /libpath:"C:\Dev\openssl\lib" /libpath:"C:\Dev\zlib\dll32" /libpath:"C:\Dev\openssl\lib\out32dll" /libpath:"C:\temp\Releaselib"
-
-!ENDIF 
-
-# Begin Target
-
-# Name "webhttrack - Win32 Release"
-# Name "webhttrack - Win32 Debug"
-# Begin Group "Source Files"
-
-# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
-# Begin Source File
-
-SOURCE=.\htsserver.c
-# End Source File
-# Begin Source File
-
-SOURCE=.\htsweb.c
-# End Source File
-# End Group
-# Begin Group "Header Files"
-
-# PROP Default_Filter "h;hpp;hxx;hm;inl"
-# Begin Source File
-
-SOURCE=.\htsserver.h
-# End Source File
-# Begin Source File
-
-SOURCE=.\htsweb.h
-# End Source File
-# End Group
-# Begin Group "Resource Files"
-
-# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
-# End Group
-# Begin Source File
-
-SOURCE=.\ReadMe.txt
-# End Source File
-# End Target
-# End Project

src/webhttrack.dsw

@@ -1,44 +0,0 @@
-Microsoft Developer Studio Workspace File, Format Version 6.00
-# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
-
-###############################################################################
-
-Project: "libhttrack"=..\libhttrack\libhttrack.dsp - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-}}}
-
-###############################################################################
-
-Project: "webhttrack"=.\webhttrack.dsp - Package Owner=<4>
-
-Package=<5>
-{{{
-}}}
-
-Package=<4>
-{{{
-    Begin Project Dependency
-    Project_Dep_Name libhttrack
-    End Project Dependency
-}}}
-
-###############################################################################
-
-Global:
-
-Package=<5>
-{{{
-}}}
-
-Package=<3>
-{{{
-}}}
-
-###############################################################################
-

src/webhttrack.vcproj

@@ -1,443 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="9,00"
-	Name="webhttrack"
-	ProjectGUID="{B2A68D1B-3EB3-4B16-B634-8D36AC4266EC}"
-	RootNamespace="webhttrack"
-	TargetFrameworkVersion="131072"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-		<Platform
-			Name="x64"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			OutputDirectory="C:\temp\webhttrack\Debug"
-			IntermediateDirectory="C:\temp\webhttrack\Debug"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TypeLibraryName=".\Debug/webhttrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;C:\Dev\zlib\;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				BufferSecurityCheck="true"
-				RuntimeTypeInfo="true"
-				PrecompiledHeaderFile=".\Debug/webhttrack.pch"
-				AssemblerOutput="2"
-				AssemblerListingLocation=".\Debug/"
-				ObjectFile=".\Debug/"
-				ProgramDataBaseFileName=".\Debug/"
-				BrowseInformation="1"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="4"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="_DEBUG"
-				Culture="1036"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="C:\temp\httrack\webhttrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib;C:\temp\debug_libz;C:\Dev\openssl\lib\out32dll;C:\temp\Debuglib"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile=".\Debug/webhttrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-				TypeLibraryName=".\Debug/webhttrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="0"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;C:\Dev\zlib\;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				BasicRuntimeChecks="3"
-				RuntimeLibrary="3"
-				BufferSecurityCheck="true"
-				RuntimeTypeInfo="true"
-				PrecompiledHeaderFile=".\Debug/webhttrack.pch"
-				AssemblerOutput="2"
-				AssemblerListingLocation=".\Debug/"
-				ObjectFile=".\Debug/"
-				ProgramDataBaseFileName=".\Debug/"
-				BrowseInformation="1"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				DebugInformationFormat="3"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="_DEBUG"
-				Culture="1036"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="C:\temp\httrack64\webhttrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib;C:\temp\debug_libz64;C:\Dev\openssl\lib\out32dll;C:\temp\Debuglib"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile=".\Debug/webhttrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="C:\temp\webhttrack\Release"
-			IntermediateDirectory="C:\temp\webhttrack\Release"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TypeLibraryName=".\Release/webhttrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="3"
-				InlineFunctionExpansion="1"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;C:\Dev\zlib\;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				StringPooling="true"
-				RuntimeLibrary="2"
-				EnableFunctionLevelLinking="true"
-				PrecompiledHeaderFile=".\Release/webhttrack.pch"
-				AssemblerListingLocation="c:\temp\VCRelease/"
-				ObjectFile="c:\temp\VCRelease/"
-				ProgramDataBaseFileName="c:\temp\VCRelease/"
-				BrowseInformation="1"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="NDEBUG"
-				Culture="1036"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="O:\HTTrack\httrack\webhttrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib;C:\temp\release_libz;C:\Dev\openssl\lib\out32dll;C:\temp\Releaselib"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\webhttrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="1"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="&quot;C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool.exe&quot; sign /f &quot;Z:\Mes Documents\certificats\httrack-com\httrack-signing-certificate.pfx&quot; /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath)&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|x64"
-			OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
-			IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
-			ConfigurationType="1"
-			InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops"
-			UseOfMFC="0"
-			ATLMinimizesCRunTimeLibraryUsage="false"
-			CharacterSet="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-				TargetEnvironment="3"
-				TypeLibraryName=".\Release/webhttrack.tlb"
-				HeaderFileName=""
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				Optimization="3"
-				InlineFunctionExpansion="1"
-				AdditionalIncludeDirectories="C:\Dev\httrack\src;C:\Dev\zlib\;&quot;C:\Dev\openssl-1.0.1j\include&quot;;C:\Dev\httrack\src\coucal"
-				PreprocessorDefinitions="_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE"
-				StringPooling="true"
-				RuntimeLibrary="2"
-				EnableFunctionLevelLinking="true"
-				PrecompiledHeaderFile=".\Release/webhttrack.pch"
-				AssemblerListingLocation="c:\temp\VCRelease64/"
-				ObjectFile="c:\temp\VCRelease64/"
-				ProgramDataBaseFileName="c:\temp\VCRelease64/"
-				BrowseInformation="1"
-				WarningLevel="3"
-				SuppressStartupBanner="true"
-				Detect64BitPortabilityProblems="true"
-				CompileAs="0"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				PreprocessorDefinitions="NDEBUG"
-				Culture="1036"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="Ws2_32.lib libhttrack.lib"
-				OutputFile="O:\HTTrack\httrack\x64\webhttrack.exe"
-				LinkIncremental="1"
-				SuppressStartupBanner="true"
-				AdditionalLibraryDirectories="C:\Dev\openssl\lib;C:\temp\release_libz64;C:\Dev\openssl\lib\out32dll;C:\temp\Releaselib64"
-				GenerateDebugInformation="true"
-				ProgramDatabaseFile="O:\HTTrack\httrack\x64\webhttrack.pdb"
-				SubSystem="1"
-				RandomizedBaseAddress="1"
-				DataExecutionPrevention="0"
-				TargetMachine="17"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="&quot;C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin\signtool.exe&quot; sign /f &quot;Z:\Mes Documents\certificats\httrack-com\httrack-signing-certificate.pfx&quot; /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath)&#x0D;&#x0A;"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
-			>
-			<File
-				RelativePath="htsserver.c"
-				>
-			</File>
-			<File
-				RelativePath="htsweb.c"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Header Files"
-			Filter="h;hpp;hxx;hm;inl"
-			>
-		</Filter>
-		<Filter
-			Name="Resource Files"
-			Filter="ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
-			>
-			<File
-				RelativePath="htsserver.h"
-				>
-			</File>
-			<File
-				RelativePath="htsweb.h"
-				>
-			</File>
-		</Filter>
-		<File
-			RelativePath="ReadMe.txt"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>

src/webhttrack.vcxproj

@@ -0,0 +1,109 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>17.0</VCProjectVersion>
+    <ProjectGuid>{2F9E0E4C-2B5B-4B2E-9F6D-1C0A5E7B3D02}</ProjectGuid>
+    <RootNamespace>webhttrack</RootNamespace>
+    <WindowsTargetPlatformVersion Condition="'$(WindowsTargetPlatformVersion)'==''">10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+
+  <PropertyGroup Condition="'$(Configuration)'=='Debug'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)'=='Release'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+
+  <PropertyGroup>
+    <VcpkgEnableManifest>true</VcpkgEnableManifest>
+    <VcpkgTriplet Condition="'$(Platform)'=='Win32'">x86-windows</VcpkgTriplet>
+    <VcpkgTriplet Condition="'$(Platform)'=='x64'">x64-windows</VcpkgTriplet>
+    <OutDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\</OutDir>
+    <IntDir>$(MSBuildThisFileDirectory)$(Platform)\$(Configuration)\obj\webhttrack\</IntDir>
+    <TargetName>webhttrack</TargetName>
+  </PropertyGroup>
+
+  <ItemDefinitionGroup>
+    <ClCompile>
+      <!-- Matches htsserver_CFLAGS in Makefile.am. -->
+      <PreprocessorDefinitions>WIN32;_CONSOLE;_MBCS;ZLIB_CONST;HTS_INTHASH_USES_MD5;WINVER=0x0601;_WIN32_WINNT=0x0601;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_DEPRECATE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <AdditionalIncludeDirectories>$(MSBuildThisFileDirectory);$(MSBuildThisFileDirectory)coucal;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <WarningLevel>Level3</WarningLevel>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <CompileAs>CompileAsC</CompileAs>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <AdditionalDependencies>Ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Debug'">
+    <ClCompile>
+      <PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+  </ItemDefinitionGroup>
+
+  <ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
+    <ClCompile>
+      <PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <Optimization>MaxSpeed</Optimization>
+      <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <StringPooling>true</StringPooling>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+    </Link>
+  </ItemDefinitionGroup>
+
+  <ItemGroup>
+    <ClCompile Include="htsserver.c" />
+    <ClCompile Include="htsweb.c" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="libhttrack.vcxproj">
+      <Project>{e76ad871-54c1-45e8-a657-6117adeffb46}</Project>
+    </ProjectReference>
+  </ItemGroup>
+
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>

tests/01_engine-cacheindex.test

@@ -0,0 +1,10 @@
+#!/bin/bash
+#
+
+set -euo pipefail
+
+# Cache-index (.ndx) parse must stay inside the buffer on a corrupt length
+# prefix (ASan aborts here on the pre-fix binary; the OK check gates the
+# non-sanitized build too).
+
+test "$(httrack -O /dev/null -#test=cacheindex)" == 'cacheindex: OK'

tests/01_engine-charset.test

@@ -36,3 +36,64 @@ test "$(httrack -O /dev/null -#test=charset 'no-such-charset-xyz' 'café' 2>/dev
 # malformed UTF-8 (lone continuation byte, truncated lead byte) must not crash
 runs 'utf-8' $'\x80'
 runs 'utf-8' $'\xc3'
+
+# hts_getCharsetFromMeta: <meta> charset extraction, HTML5 and legacy forms.
+# -#test=metacharset <html> prints the charset, or "(none)".
+meta() {
+    test "$(httrack -O /dev/null -#test=metacharset "$1")" == "$2" || exit 1
+}
+
+# HTML5 form, quoting/spacing flavors
+meta '<meta charset="utf-8">' 'utf-8'
+meta "<meta charset='utf-8'>" 'utf-8'
+meta '<meta charset=utf-8>' 'utf-8'
+meta '<meta charset=utf-8 />' 'utf-8'
+meta '<meta charset=utf-8/>' 'utf-8'
+# charset labels are case-insensitive downstream; only require case-insensitive match
+test "$(httrack -O /dev/null -#test=metacharset '<META CHARSET=UTF-8>' | tr '[:upper:]' '[:lower:]')" == 'utf-8' || exit 1
+meta '<html><head><meta   charset = "utf-8"  ></head>' 'utf-8'
+
+# legacy http-equiv form, attributes in any order
+meta '<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">' 'iso-8859-1'
+meta '<meta content="text/html; charset=gb2312" http-equiv="content-type">' 'gb2312'
+meta '<meta http-equiv=Content-Type content="text/html;charset=euc-jp">' 'euc-jp'
+meta '<meta http-equiv="Content-Type" content="text/html; charset = koi8-r ">' 'koi8-r'
+meta '<meta http-equiv="Content-Type" content="text/html; charset=utf-8;">' 'utf-8'
+meta '<meta http-equiv=content-type content=text/html;charset=utf-8 />' 'utf-8'
+meta '<meta http-equiv=content-type content=text/html;charset=utf-8>' 'utf-8'
+
+# first resolvable meta wins; unrelated metas are skipped
+meta '<meta name="viewport" content="width=1"><meta charset="koi8-r">' 'koi8-r'
+meta '<meta charset="utf-8"><meta http-equiv="Content-Type" content="text/html; charset=gb2312">' 'utf-8'
+
+# duplicate attribute: first wins, as in browsers
+meta '<meta http-equiv="Content-Type" content="text/html; charset=big5" http-equiv="refresh">' 'big5'
+
+# negatives: wrong tag/attribute, empty value
+meta '<p>x</p>' '(none)'
+meta '<meta name="desc" content="charset=bogus">' '(none)'
+meta '<meta http-equiv="refresh" content="0; url=x.html">' '(none)'
+meta '<body charset="utf-8">' '(none)'
+meta '<meta charset="">' '(none)'
+
+# hostile truncations: no crash, no match
+meta '<meta charset="utf-8' '(none)'
+meta '<meta charset=' '(none)'
+meta '<meta ' '(none)'
+meta '<meta' '(none)'
+
+# hts_isStringUTF8: valid-UTF-8 probe (guards the #180 link conversion).
+utf8() {
+    test "$(httrack -O /dev/null -#test=isutf8 "$1")" == "$2" || exit 1
+}
+utf8 'plain' '1'
+utf8 'café' '1'
+utf8 '统计' '1'
+utf8 "$(printf 'caf\xe9')" '0'              # latin-1 accent
+utf8 "$(printf '\xc3')" '0'                 # truncated lead byte
+utf8 "$(printf '\xa9')" '0'                 # lone continuation byte
+utf8 "$(printf '\xf0\x9f\x98\x80')" '1'     # 4-byte emoji
+utf8 "$(printf '\xc0\xaf')" '0'             # overlong (latin-1 "À¯" must stay convertible)
+utf8 "$(printf '\xed\xa0\x80')" '0'         # UTF-16 surrogate
+utf8 "$(printf '\xf4\x90\x80\x80')" '0'     # above U+10FFFF
+utf8 "$(printf '\xf8\x88\x80\x80\x80')" '0' # legacy 5-byte form