Offer a showstopper for 2.2.30 requiring one more reviewer/vote

RELEASE SHOWSTOPPERS:

  *) SECURITY: CVE-2015-3183 (cve.mitre.org)

     core: Fix chunk header parsing defect.

     Remove apr_brigade_flatten(), buffering and duplicated code from

     the HTTP_IN filter, parse chunks in a single pass with zero copy.

     Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext

     authorized characters.  [Graham Leggett, Yann Ylavic]

  Submitted by: graham, ylavic

  Reviewed by: ylavic, wrowe, jim

  Backports: 1484852, 1684513

  Reported by: Régis Leroy

  trunk

    https://svn.apache.org/r1484852

    https://svn.apache.org/r1684513

  2.4.x branch

    https://svn.apache.org/r1684515

  2.2.x branch

    https://svn.apache.org/repos/private/pmc/httpd/SECURITY/http_filter_chunked/httpd-2.2.x-ap_http_filter-chunked-v5.patch

  +1: ylavic, wrowe

  jim notes: test framework errors due to 413->400 error change [test adjusted]

PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]