backported the patch to the nginx core for the latest SPDY security vulnerability (CVE-2014-0133).

patches/patch.2014.spdy2.txt

@@ -0,0 +1,11 @@
+--- src/http/ngx_http_spdy.c
++++ src/http/ngx_http_spdy.c
+@@ -1849,7 +1849,7 @@ static u_char *
+ ngx_http_spdy_state_save(ngx_http_spdy_connection_t *sc,
+     u_char *pos, u_char *end, ngx_http_spdy_handler_pt handler)
+ {
+-#if (NGX_DEBUG)
++#if 1
+     if (end - pos > NGX_SPDY_STATE_BUFFER_SIZE) {
+         ngx_log_error(NGX_LOG_ALERT, sc->connection->log, 0,
+                       "spdy state buffer overflow: "

util/mirror-tarballs

@@ -32,6 +32,10 @@ cd nginx-$ver || exit 1
 
 # patch the patch
 
+echo "$info_txt applying the patch for nginx security advisory (CVE-2014-0133)"
+patch -p0 < $root/patches/patch.2014.spdy2.txt || exit 1
+echo
+
 echo "$info_txt applying the upstream-pipelining patch for nginx"
 patch -p1 < $root/patches/nginx-$main_ver-upstream_pipelining.patch || exit 1
 echo

util/ver

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 main_ver=1.5.11
-minor_ver=1rc2
+minor_ver=1rc3
 version=$main_ver.$minor_ver
 echo $version