Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:77738
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.176 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <54251F2E.3010408@sugarcrm.com>
References: <CAH8MpnkkYEAR38ujdjsa+RUzAhzLmp62vTFJio0+XUmJzba6qQ@mail.gmail.com>
 <541C5EB5.6090001@fedoraproject.org> <5423BD7F.5070800@sugarcrm.com>
 <5423C2B4.8030706@fedoraproject.org> <54251F2E.3010408@sugarcrm.com>
Date: Wed, 1 Oct 2014 17:50:18 +0200
Message-ID: <CAMUwpuTrTFa9F8CzEioYCw2EvegQ+DmsLjsjm_QnP8uRLZTtCQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Remi Collet <remi@fedoraproject.org>, PHP Internals <internals@lists.php.net>, 
	Daniel Lowrey <rdlowrey@php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: OpenSSL bug in 5.4.33 and 5.5.17
From: jpauli@php.net (Julien Pauli)

On Fri, Sep 26, 2014 at 10:09 AM, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
> Hi!
>
>> In released 5.4.33 (and 5.5.17) you have 6569db8 + 84a4041 + 32be79d
>> (notice I have revert these 3 patches for downstream)
>>
>> In 5.4/5.5/5.6 you have 6569db8 + 84a4041 + 32be79d + f86b219 + 3728449
>> (all reverted in 5.6.1)
>>
>> As you said, "5.4 is now supposed to be security-only" so I rather
>> think we should revert to 5.4.32 code and have the upcoming fix only
>> in 5.5+ (so in 5.5.18RC and 5.6.2RC)
>
> So, I have reverted the code for xp_ssl.c in 5.4 to it's status as of
> 5.4.32, and left 5.5 and above as is. Hopefully, this improves the
> situation. I'd like to ask everybody involved to verify if there are no
> more regressions caused by this.

Just to let you know, I reverted the commits for our next 5.5.18RC1.

I leaved the commits into PHP-5.5, so Daniel you still can finish your
WIP. As your WIP is an improvement and not a security fix (AFAIK), I
think you should take 5.5 as base branch and merge upwards as usual.
5.4 is in security only state. See that with Stas if needed.

Don't forget to ping us (RMs) when you hit a stable state, so that we
can together decide what we do for next releases (finally have a clean
fix , or revert everything in master branches and forget about this
issue and regression).

Julien.Pauli