From: William A. Rowe Jr Date: Fri, 18 Jul 2014 15:33:11 +0000 (+0000) Subject: Vote up, two are promoted as accepted, defect identified in ylavic's patch X-Git-Tag: 2.2.28~25 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8c2123b1c5f6ba02c713253198bf4e6dd76b9aec;p=thirdparty%2Fapache%2Fhttpd.git Vote up, two are promoted as accepted, defect identified in ylavic's patch git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1611672 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/STATUS b/STATUS index ac16da68b40..38e92ccf6cc 100644 --- a/STATUS +++ b/STATUS @@ -99,23 +99,16 @@ RELEASE SHOWSTOPPERS: PATCHES ACCEPTED TO BACKPORT FROM TRUNK: [ start all new proposals below, under PATCHES PROPOSED. ] + * mod_deflate: Fix decompression of files larger than 4GB. According to RFC1952, + Input SIZE contains the size of the original input data modulo 2^32. + PR 56062. + trunk patch: http://svn.apache.org/r1572092 + http://svn.apache.org/r1603156 (partially, CHANGES update) + 2.4.x patch: http://svn.apache.org/r1604460 (2.4.10) + 2.2.x patch: http://people.apache.org/~ylavic/httpd-2.2.x-mod_deflate_4GB.patch + (modulo CHANGES) + +1: ylavic, breser, wrowe -PATCHES PROPOSED TO BACKPORT FROM TRUNK: - [ New proposals should be added at the end of the list ] - - - *) SECURITY: CVE-2013-5704 (cve.mitre.org) - core: HTTP trailers could be used to replace HTTP headers - late during request processing, potentially undoing or - otherwise confusing modules that examined or modified - request headers earlier. Adds "MergeTrailers" directive to restore - legacy behavior. - trunk patch: http://svn.apache.org/r1610814 - http://svn.apache.org/r1610686 (mod_log_config ^XX support) - http://svn.apache.org/r1610707 (mod_log_cofnig ^XX support) - 2.2.x patch: http://people.apache.org/~covener/patches/httpd-2.2.x-trailers-2.diff - +1: covener - * mod_proxy: Don't reuse a SSL backend connection whose SNI differs. PR 55782. This may happen when ProxyPreserveHost is on and the proxy-worker handles connections to different Hosts. @@ -125,12 +118,28 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: http://svn.apache.org/r1573229 2.4.x patch: http://svn.apache.org/r1587201 (2.4.10) 2.2.x patch: http://people.apache.org/~ylavic/httpd-2.2.x-mod_proxy_sni_reuse3.patch - +1: ylavic, rpluem + +1: ylavic, rpluem, wrowe ylavic: MMN bump in patch #3 ylavic: Changelog is missing in the above patches, it was added in 2.4.x by r1599597 (with others...) and fixed by r1610670 (missing "mod_proxy:" prefix). + +PATCHES PROPOSED TO BACKPORT FROM TRUNK: + [ New proposals should be added at the end of the list ] + + *) SECURITY: CVE-2013-5704 (cve.mitre.org) + core: HTTP trailers could be used to replace HTTP headers + late during request processing, potentially undoing or + otherwise confusing modules that examined or modified + request headers earlier. Adds "MergeTrailers" directive to restore + legacy behavior. + trunk patch: http://svn.apache.org/r1610814 + http://svn.apache.org/r1610686 (mod_log_config ^XX support) + http://svn.apache.org/r1610707 (mod_log_cofnig ^XX support) + 2.2.x patch: http://people.apache.org/~covener/patches/httpd-2.2.x-trailers-2.diff + +1: covener, wrowe + * mod_deflate: Fix reentrance in output and input filters (buffering of incomplete Zlib header or validation bytes). PR 46146. trunk patch: https://svn.apache.org/r1572655 @@ -150,16 +159,8 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: 2.2.x patch: http://people.apache.org/~ylavic/httpd-2.2.x-mod_deflate_reentrant_with_CHANGES.patch (modulo CHANGES) +1: ylavic - - * mod_deflate: Fix decompression of files larger than 4GB. According to RFC1952, - Input SIZE contains the size of the original input data modulo 2^32. - PR 56062. - trunk patch: http://svn.apache.org/r1572092 - http://svn.apache.org/r1603156 (partially, CHANGES update) - 2.4.x patch: http://svn.apache.org/r1604460 (2.4.10) - 2.2.x patch: http://people.apache.org/~ylavic/httpd-2.2.x-mod_deflate_4GB.patch - (modulo CHANGES) - +1: ylavic, breser, wrowe + wrowe notes: portability regression; fails to test for APR_HAVE_LIMITS_H + Use APR_INT32_MAX instead for simplicity? *) core: Detect incomplete request and response bodies, log an error and forward it to the underlying filters. PR 55475 [Yann Ylavic] @@ -167,7 +168,7 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: 2.4.x patch: http://svn.apache.org/r1570324 (2.4.8) 2.2.x patch: http://people.apache.org/~ylavic/2.2.x-http_filter_incomplete.patch (modulo CHANGES) - +1: ylavic + +1: ylavic, wrowe * mpm_winnt service.c: Accept utf-8 service names/descriptions for i18n. trunk patches: http://svn.apache.org/r1611165 @@ -175,6 +176,7 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: 2.2.x patch: http://people.apache.org/~wrowe/httpd-2.2-utf8-servicename.patch +1: wrowe + PATCHES/ISSUES THAT ARE STALLED * mod_cache: Realign the cache_quick_handler() to behave identically