Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:77783
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.171 as permitted sender)
Message-ID: <54306D97.8050900@gmail.Com>
Date: Sat, 04 Oct 2014 23:58:47 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:31.0) Gecko/20100101 Thunderbird/31.1.2
MIME-Version: 1.0
To: internals@lists.php.net
References: <CAH8Mpn=qMkbBjDZRe-BX2Y0yQt_yR+y+Hu_gRHu=0jFTEV0MuA@mail.gmail.com>
In-Reply-To: <CAH8Mpn=qMkbBjDZRe-BX2Y0yQt_yR+y+Hu_gRHu=0jFTEV0MuA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17
From: jocelyn.fournier@gmail.com (jocelyn fournier)

Hi,

It would perhaps be great to communicate on this nasty bug on the PHP 
website ?
For example code based on amqplib + ssl 
(https://github.com/videlalvaro/php-amqplib) is not working anymore as 
well, and it could be a headache to figure out why it's not working. I 
assume a lot more libs could be affected.

Thanks,
   Jocelyn


Le 23/09/2014 07:39, Daniel Lowrey a écrit :
>>> Hi,
>>>
>>> That's a bad thing we need to fix ASAP.
>>>
>>> I think for 5.6.1 we'll revert it , if not, we'll need an RC2, which
>>> is something we usually don't do (but as this could involve security,
>>> we may do it).
>>> The fix can be merged to 5.5.18RC1, next week, to have an RC cycle if
>>> not part of a 5.6.1RC2 (tag is tomorrow)
>>>
>>> 5.6 and 5.5 actually overlap in the release weeks. 5.6 is planned on
>>> odd weeks whereas 5.5 is on even weeks.
>>>
>>> Waiting for Ferenc's advice anyway.
>>>
>>> Julien.P
>>
>> I have no issues with reverting at this point as that's the best route to
>> get stable releases back on track. I thought I had fixed some really old
>> bugs with those commits but the medicine turned out to be worse than the
>> disease. My apologies again for letting those problems sneak into releases
>> :/
>
> I've got the necessary fixes lined up at this point, I just need to know
> how you guys would prefer to proceed on this.
>
> I can commit the relevant changes to 5.4, 5.5 and 5.6 and double-check with
> RMs to ensure they make it into this next set of releases or we can revert
> the previous commits and forget about the bug fixes altogether.
>
> Just let me know which you prefer. Thanks.
>