Re: [Bug-wget] DLL conflict between wget and curl

[Ángel González]

El 28/04/12 16:47, Jeremy Nicoll - ml wget users escribió:
> Ángel González <address@hidden> wrote:
>
>> On 27/04/12 22:16, Jeremy Nicoll wrote:
>>> Win-32 XP Pro SP3
>>>
>>> A few hours ago I downloaded cURL, unpacked its zip, and moved the exe
>>> and necessary DLLs to the folder where I keep CLI programs.  That is:
> >From where have you doenloaded them?
>
> a) For curl, I looked at the list of packages specified at:
>
>    http://curl.haxx.se/download.html  
>
>    and chose the one described as:
>
>    "Win32 2000/XP  7.25.0  binary  SSL  SSH  Gunter Knauf  1.52 MB" 
Its build.txt file says
 requires : OpenSSL 0.9.8u DLLs (included)
And there are in fact references to "OpenSSL 0.9.8u" in the dll.

> b) for wget, the binaries & dependencies zips described at
>
>    http://gnuwin32.sourceforge.net/packages/wget.htm 
The gnuwin32 package is from 2008, openssl 0.9.8h
(these were the ones with version info 0.9.8.8)

So both are a bit disappointing, since the latest openssl version is 1.0.1b.
Or 0.9.8w if you wanted to stay in 0.9.8 branch.

>> libeay32.dll and libssl32.dll are providing openssl. It's security
>> sensitive (eg. suppose there was a vulnerability in https decoding leading
>> to code execution) so I'd always use the latest version. In this case,
>> both programs would probably work with both openssl versions (it's as
>> simple as trying with each combination and downloading from a https page),
>> but if one doesn't, I'd download a newer version of that.
> The sizes of the two versions of the two libs are significantly different,
> with the no-version-number ones being about 50% bigger than the versioned
> ones.  I would have thought that successive releases of these pretty
> standards libs (I've seen them embedded in other apps) would be of simialr
> sizes.  I wondered if one pair might have been compiled differently, if that
> makes sense.

One of them may be compiled with debugging symbols.
Although curl ones say they were "stripped to external PDB".

Or perhaps they have different modules enabled.