diff options
| -rw-r--r-- | debian/changelog | 7 | ||||
| -rw-r--r-- | debian/patches/00list | 1 | ||||
| -rw-r--r-- | debian/patches/059_ssl_memleak_fix_PR44975.dpatch | 33 |
3 files changed, 41 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog index 866e75f7..d633aed8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +apache2 (2.2.8-4) unstable; urgency=high + + * Urgency high for DoS vulnerability fix. + * Fix memory leak in mod_ssl with zlib compression. + + -- Stefan Fritsch <sf@debian.org> Tue, 13 May 2008 22:31:37 +0200 + apache2 (2.2.8-3) unstable; urgency=low * mod_cache: Handle If-Range correctly if the cached resource was stale diff --git a/debian/patches/00list b/debian/patches/00list index d7da234a..41e8c487 100644 --- a/debian/patches/00list +++ b/debian/patches/00list @@ -21,3 +21,4 @@ 055_htpasswd_salt_generation.dpatch 056_mod_cache_IfRange.dpatch 057_disablemods.dpatch +059_ssl_memleak_fix_PR44975.dpatch diff --git a/debian/patches/059_ssl_memleak_fix_PR44975.dpatch b/debian/patches/059_ssl_memleak_fix_PR44975.dpatch new file mode 100644 index 00000000..82a826f5 --- /dev/null +++ b/debian/patches/059_ssl_memleak_fix_PR44975.dpatch @@ -0,0 +1,33 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: fix memleak in mod_ssl +## DP: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/224945 + +@DPATCH@ +--- trunk/modules/ssl/mod_ssl.c 2008/05/07 14:16:38 654118 ++++ trunk/modules/ssl/mod_ssl.c 2008/05/07 14:17:31 654119 +@@ -218,17 +218,18 @@ + #if HAVE_ENGINE_LOAD_BUILTIN_ENGINES + ENGINE_cleanup(); + #endif +-#ifdef HAVE_OPENSSL +-#if OPENSSL_VERSION_NUMBER >= 0x00907001 +- CRYPTO_cleanup_all_ex_data(); +-#endif +-#endif + ERR_remove_state(0); + + /* Don't call ERR_free_strings here; ERR_load_*_strings only + * actually load the error strings once per process due to static + * variable abuse in OpenSSL. */ + ++ /* Also don't call CRYPTO_cleanup_all_ex_data here; any registered ++ * ex_data indices may have been cached in static variables in ++ * OpenSSL; removing them may cause havoc. Notably, with OpenSSL ++ * versions >= 0.9.8f, COMP_CTX cleanups would not be run, which ++ * could result in a per-connection memory leak (!). */ ++ + /* + * TODO: determine somewhere we can safely shove out diagnostics + * (when enabled) at this late stage in the game: |