Re: bugs/inappropriate coding practice discovered by interproceduralcode analysis for version 2.2.8 of Apache

2008-05-16 Thread Jim Jagielski
On May 15, 2008, at 3:00 PM, Ruediger Pluem wrote: On 05/15/2008 05:29 AM, BOYA SUN wrote: Here is another potential bug we've just discovered, and it seems to be occured in several places. Please also take a look at it if interested, thanks a lot! Boya --- Bug#7

Debian gaffe (DSA-1571-1, CVE-2008-016)

2008-05-16 Thread Dirk-Willem van Gulik
The debian gaffe also affects any 'req's or self-signed certs created on the affected platform. Unfortunately the blacklists generated by folks are not quite complete (yet) -- which took me a while to get confirmed and checked for. As a result of that process - and for your entertainment:

Re: mod_proxy race condition bug #37770

2008-05-16 Thread Adam Woodworth
So I have some more information about this, but this time related to having keepalives OFF in mod_proxy. I tried using the SetEnv proxy-nokeepalive 1 option in httpd.conf, and it cleared up the proxy errors that I was having with an IIS backend server, and it may have decreased the proxy errors

Re: getgrgid

2008-05-16 Thread Roy T. Fielding
On May 13, 2008, at 12:30 PM, Ruediger Pluem wrote: On 05/13/2008 04:21 AM, [EMAIL PROTECTED] wrote: -gid = atoi(target_gname); -actual_gname = strdup(target_gname); +if ((gr = getgrgid(atoi(target_gname))) == NULL) { Don't we need to check if getgrgid is available on

Re: getgrgid

2008-05-16 Thread Roy T. Fielding
On May 16, 2008, at 3:46 PM, Roy T. Fielding wrote: On May 13, 2008, at 12:30 PM, Ruediger Pluem wrote: On 05/13/2008 04:21 AM, [EMAIL PROTECTED] wrote: -gid = atoi(target_gname); -actual_gname = strdup(target_gname); +if ((gr = getgrgid(atoi(target_gname))) == NULL)

Re: httpd lib depencies

2008-05-16 Thread William A. Rowe, Jr.
Philip M. Gollucci wrote: Is this close ? The only way I found to figure this out is to unpack each http distribution and look in 'CHANGES' This is of use to mod_perl, so I've CC'ed them here, please drop them in replies unless its useful. Well, bottom line is that httpd 2.2 - any apr 1.2,