11–20 of 32 posts
Earlier quoted context omitted.
Usual reason for mistakes like this is: someone was debugging something then (partially) forgot to clean up before committing. Once that is done it's incredibly easy for these kind of bugs to go un-noticed for a long time.
Assuming you don't have a test for it, sure. And don't fuzz everything on a regular basis.
It said it affected 1.3.15 to 1.5.11 but the fix is available in nginx 1.5.12, 1.4.7 . So for those who are using legacy version are they going to rely on distro vendor to push the patch? Just curious, even though I guess the number of users who have activated this experimental SPDY is low and people who actually have it enabled probably know how to fix it themselves.
As far as I'm aware, all the major distros backport nginx stable release
Patch is pretty interesting. Why was buffer overflow protection behind a debug flag? http://nginx.org/download/patch.2014.spdy2.txt
And why leave in a #if when patching too?
Earlier quoted context omitted.
Usual reason for mistakes like this is: someone was debugging something then (partially) forgot to clean up before committing. Once that is done it's incredibly easy for these kind of bugs to go un-noticed for a long time.
Assuming you don't have a test for it, sure. And don't fuzz everything on a regular basis.
It appears my Ubuntu server only updates nginx mainline to 1.5.11. I've disabled spdy support in my listen directive for now as an easier work around.