Re: mod_ssl and OPENSSL_NO_SSL_INTERN (Re: mod_ssl in trunk with OpenSSL 0.9.7 as a minimum requirement?)

2011-12-22 Thread Kaspar Brand
On 22.12.2011 17:53, Dr Stephen Henson wrote: > I've added a few new controls and one new function which should resolve this, > see last few commits. > > I deleted a couple of functions duplicating functionality too. > > Let me know if you need further details or it needs fixing. Thanks for the

Re: mod_ssl and OPENSSL_NO_SSL_INTERN (Re: mod_ssl in trunk with OpenSSL 0.9.7 as a minimum requirement?)

2011-12-22 Thread Dr Stephen Henson
On 22/12/2011 10:59, Kaspar Brand wrote: > On 05.08.2011 07:41, Kaspar Brand wrote: >> On 03.08.2011 19:29, Dr Stephen Henson wrote: >>> In OpenSSL 1.0.1 (unreleased) and later there is a feature to make all SSL >>> related structures opaque and only allow them to be accessed through >>> functions

mod_ssl and OPENSSL_NO_SSL_INTERN (Re: mod_ssl in trunk with OpenSSL 0.9.7 as a minimum requirement?)

2011-12-22 Thread Kaspar Brand
On 05.08.2011 07:41, Kaspar Brand wrote: > On 03.08.2011 19:29, Dr Stephen Henson wrote: >> In OpenSSL 1.0.1 (unreleased) and later there is a feature to make all SSL >> related structures opaque and only allow them to be accessed through >> functions. >> This is enabled by setting OPENSSL_NO_SSL_

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-22 Thread Stefan Fritsch
On Wed, 21 Dec 2011, Greg Ames wrote: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@ #define IS_SLASH(s) (s ==