diff -u apache2-2.2.14/debian/changelog apache2-2.2.14/debian/changelog
--- apache2-2.2.14/debian/changelog
+++ apache2-2.2.14/debian/changelog
@@ -1,3 +1,10 @@
+apache2 (2.2.14-5ubuntu8.1) lucid-proposed; urgency=low
+
+  * debian/patches/upstream-fix-for-lp-609290.patch: Backport fix for upstream bug PR 45444.
+    https://issues.apache.org/bugzilla/show_bug.cgi?id=45444. (LP: #609290, #589611, #595116)
+
+ -- Chuck Short <zulcss@ubuntu.com>  Fri, 06 Aug 2010 12:32:36 -0500
+
 apache2 (2.2.14-5ubuntu8) lucid; urgency=low
 
   * debian/patches/210-backport-mod-reqtimeout-ftbfs.dpatch: Add missing mod_reqtime.so
diff -u apache2-2.2.14/debian/patches/00list apache2-2.2.14/debian/patches/00list
--- apache2-2.2.14/debian/patches/00list
+++ apache2-2.2.14/debian/patches/00list
@@ -39,0 +40 @@
+upstream-fix-for-lp-609290.patch
only in patch2:
unchanged:
--- apache2-2.2.14.orig/debian/patches/upstream-fix-for-lp-609290.patch
+++ apache2-2.2.14/debian/patches/upstream-fix-for-lp-609290.patch
@@ -0,0 +1,32 @@
+diff -Naurp httpd-2.2.14.orig//modules/ssl/ssl_engine_io.c httpd-2.2.14//modules/ssl/ssl_engine_io.c
+--- httpd-2.2.14.orig//modules/ssl/ssl_engine_io.c	2009-05-19 06:44:59.000000000 -0500
++++ httpd-2.2.14//modules/ssl/ssl_engine_io.c	2010-08-06 12:37:15.092778320 -0500
+@@ -337,6 +337,12 @@ typedef struct {
+  * this char_buffer api might seem silly, but we don't need to copy
+  * any of this data and we need to remember the length.
+  */
++/* Copy up to INL bytes from the char_buffer BUFFER into IN. Note
++ * that due to the strange way this API is designed/used, the
++ * char_buffer object is used to cache a segment of inctx->buffer, and
++ * then this function called to copy (part of) that segment to the
++ * beginning of inctx->buffer. So the segments to copy cannot be
++ * presumed to be non-overlapping, and memmove must be used. */
+ static int char_buffer_read(char_buffer_t *buffer, char *in, int inl)
+ {
+     if (!buffer->length) {
+@@ -345,13 +351,13 @@ static int char_buffer_read(char_buffer_
+ 
+     if (buffer->length > inl) {
+         /* we have have enough to fill the caller's buffer */
+-        memcpy(in, buffer->value, inl);
++        memmove(in, buffer->value, inl);
+         buffer->value += inl;
+         buffer->length -= inl;
+     }
+     else {
+         /* swallow remainder of the buffer */
+-        memcpy(in, buffer->value, buffer->length);
++        memmove(in, buffer->value, buffer->length);
+         inl = buffer->length;
+         buffer->value = NULL;
+         buffer->length = 0;