Re: [PATCH] http.c security

Hi again,

patch comitted to cvs.

Am 25.10.2006, 22:06 Uhr, schrieb Alexander Malysh <[email protected]>:

> Hi All,
>
> please find attached security bug fix for http.c. We have issue when we
> use keep alive connections with our connection pool.
> Just imagine such scenario without a patch:
>
> 1) http_start_request(..., ssl=0,certkeyfile=NULL,our_host=NULL)
> 2) http_start_request(..., ssl=1,certkeyfile=XYZ,our_host=XYZ)
>
> in (2) we will get from conn_pool_get connection from (1)!
>
> Votes please?
>



-- 
Thanks,
Alex