blog: Post for v0.11.5
http: Handle hex/base64 encodings properly

This is a backport of 6d3d60aced39d59eaa5e705b7d822c227d0d3dae for
v0.10.
crypto: fix memory leak in randomBytes() error path

This is the conceptual back-port of commit ec54873 from the master
branch.
npm: Upgrade to 1.3.8
2013.08.16, Version 0.10.16 (Stable)

* v8: back-port fix for CVE-2013-2882

* npm: Upgrade to 1.3.8

* crypto: fix assert() on malformed hex input (Ben Noordhuis)

* crypto: fix memory leak in randomBytes() error path (Ben Noordhuis)

* events: fix memory leak, don't leak event names (Ben Noordhuis)

* http: Handle hex/base64 encodings properly (isaacs)

* http: improve chunked res.write(buf) performance (Ben Noordhuis)

* stream: Fix double pipe error emit (Eran Hammer)
buffer: don't call ByteLength for simple encodings

For several encodings the byte length is simple arithmetic. Don't call
into C++ in those cases.
Merge branch 'v0.10.16-release' into v0.10
Now working on v0.10.17
blog: v0.10.16
readline: pause stdin before turning off terminal raw mode

On windows, libuv will immediately make a `ReadConsole` call (in the
thread pool) when a 'flowing' `uv_tty_t` handle is switched to
line-buffered mode. That causes an immediate issue for some users,
since libuv can't cancel the `ReadConsole` operation on Windows 8 /
Server 2012 and up if the program switches back to raw mode later.

But even if this will be fixed in libuv at some point, it's better to
avoid the overhead of starting work in the thread pool and immediately
cancelling it afther that.

See also f34f1e3, where the same change is made for the opposite
flow, e.g. move `resume()` after `_setRawMode(true)`.

Fixes #5927
Closes #5930
readline: pause stdin before turning off terminal raw mode

On windows, libuv will immediately make a `ReadConsole` call (in the
thread pool) when a 'flowing' `uv_tty_t` handle is switched to
line-buffered mode. That causes an immediate issue for some users,
since libuv can't cancel the `ReadConsole` operation on Windows 8 /
Server 2012 and up if the program switches back to raw mode later.

But even if this will be fixed in libuv at some point, it's better to
avoid the overhead of starting work in the thread pool and immediately
cancelling it afther that.

See also f34f1e3, where the same change is made for the opposite
flow, e.g. move `resume()` after `_setRawMode(true)`.

Fixes #5927

This is a backport of dfb0461 (see #5930) to the v0.10 branch.
dgram: fix assertion on bad send() arguments

Add range checks for the offset, length and port arguments to
dgram.Socket#send().  Fixes the following assertion:

    node: ../../src/udp_wrap.cc:264: static v8::Handle<v8::Value>
    node::UDPWrap::DoSend(const v8::Arguments&, int): Assertion
    `offset < Buffer::Length(buffer_obj)' failed.

And:

    node: ../../src/udp_wrap.cc:265: static v8::Handle<v8::Value>
    node::UDPWrap::DoSend(const v8::Arguments&, int): Assertion
    `length <= Buffer::Length(buffer_obj) - offset' failed.

Interestingly enough, a negative port number was accepted until now but
silently ignored.  (In other words, it would send the datagram to a
random port.)

This commit exposed a bug in the simple/test-dgram-close test which
has also been fixed.

This is a back-port of commit 41ec6d0 from the master branch.

Fixes #6025.
Merge remote-tracking branch 'ry/v0.10'

Conflicts:
	AUTHORS
	ChangeLog
	lib/dgram.js
	lib/http.js
	src/node_crypto.cc
	src/node_version.h
src: move includes inside include guard

Having the includes in src/node_buffer.h outside of the include guard
is not really harmful but it's inconsistent with other header files.
tls, crypto: deduplicate code

Commit 03e008d introduced src/tls_wrap.cc and src/tls_wrap.h but
said files copied on the order of 1 kLoC from src/node_crypto.cc
and src/node_crypto.h.  This commit undoes some of the duplication.

Fixes #6024.
stream: Throw on 'error' if listeners removed

In this situation:

    writable.on('error', handler);
    readable.pipe(writable);
    writable.removeListener('error', handler);
    writable.emit('error', new Error('boom'));

there is actually no error handler, but it doesn't throw, because of the
fix for stream.once('error', handler), in 23d92ec.

Note that simply reverting that change is not valid either, because
otherwise this will emit twice, being handled the first time, and then
throwing the second:

    writable.once('error', handler);
    readable.pipe(writable);
    writable.emit('error', new Error('boom'));

Fix this with a horrible hack to make the stream pipe onerror handler
added before any other userland handlers, so that our handler is not
affected by adding or removing any userland handlers.

Closes #6007.
crypto: don't touch ssl_ in Connection

`ssl_` is a property of SSLWrap class, don't touch it, and definitely
don't zero it in constructor.
buffer: lint
buffer: lint

This and b80d11d are my fault. An unrelated test was failing, which
prevents {js,cpp}lint from running automatically.
Merge remote-tracking branch 'ry/v0.10'