Subject: ANNOUNCE: mod_ssl 2.3.5

From: "Ralf S. Engelschall" <[email-masked]>
Date: Tue, 22 Jun 1999 18:07:58 +0200

Oouuuaaaa... he had a really nasty bug in the shared memory session cache
variant: Once the session cache was filled the hash table library adjusted it
and there it used plain heap-based calloc() instead of the MM variant
of calloc(). This later caused the session cache related core dumps, of
course.  Thanks to all who discovered these core dumps. 

I needed the whole day to found this subtle bug, but after I've fixed the
calloc() problem my development machine no longer dumped core. Hope it's now
also fixed for you.  BTW, while debugging today I've also found a mutex
related bug in MM. It's now also fixed with MM 1.0.7.  So all of you are
encouraged to upgrade to mod_ssl 2.3.5 plus MM 1.0.7.

Greetings,
                                       Ralf S. Engelschall
                                       [email-masked]
                                       www.engelschall.com

  Changes with mod_ssl 2.3.5 (18-Jun-1999 to 22-Jun-1999)

   *) Rewritten the DBM and SHM expiration functions in ssl_engine_scache.c to
      avoid problematic situation where one deletes an entry before the
      iteration counter was incremented. This was perhaps also another reasons
      for the session cache related core dumps.

   *) Fixed a nasty bug in ssl_util_table.c: A static (heap-based) calloc()
      call was forgotten to be converted to a dynamic (shared memory based)
      table->calloc() call. This leaded to various core dumps once the session
      cache's hash table was filled as had to be resized (which occured
      only after some time of operation, of course).

   *) Now mod_ssl displays an info logfile entry when the server certificate
      is a SCG one and warning logfile entries when the server certificate has
      BasicConstraints CA:TRUE or pathlen>0.

   *) Fixed FakeBasicAuth handling: ssl::client::dn wasn't
      set correctly and wasn't set at all in renegotiation context.

   *) Fixed HowTo example with +FakeBasicAuth: AuthName was
      missing and typos
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
Official Announcement Mailing List          [email-masked]
Automated List Manager                            [email-masked]