[mod_auth_digest] zombie code

2013-03-25 Thread Pascal Junod (Mailing Lists)
Dear Apache developpers, You might want to clean a bit the code of modules/aaa/mod_auth_digest.c This blog post http://crypto.junod.info/2013/03/25/awakening-zombie-code-in-apache-httpd/ explains why and how. Essentially, it is possible to make httpd crash by awakening code related to the MD5

Patches languishing in Bugzilla

2013-03-25 Thread Wim Lewis
There are a number of OK-looking patches in Bugzilla that have been sitting there with no action for a while. I just went through the recent "Bug report" looking for bugs of interest to me that have patches. All of the following bugs have a patch, and most of them address a pretty straightforwar

Re: mod_cache with Cache-Control no-cache= or private=

2013-03-25 Thread Roy T. Fielding
On Mar 13, 2013, at 10:20 AM, Graham Leggett wrote: > On 11 Mar 2013, at 12:50 PM, Yann Ylavic wrote: > >>> The way I read the spec, "the specified field-name(s) MUST NOT be sent in >>> the response to a subsequent request without successful revalidation with >>> the origin server". What this

Re: Proposed Lua backport for 2.4

2013-03-25 Thread Gregg Smith
On 3/13/2013 1:12 PM, Daniel Gruno wrote: On 03/13/2013 08:39 PM, Gregg Smith wrote: On 3/13/2013 4:44 AM, Daniel Gruno wrote: On 03/13/2013 02:50 AM, Gregg Smith wrote: Hi Daniel, I'm seeing segfaults on that dreadful Windows OS when using LuaMapHandler& LuaRoot together. The backtrace w