6 files changed, 43 insertions, 6 deletions
diff --git a/indra/lib/python/indra/base/llsd.py b/indra/lib/python/indra/base/llsd.py
index cc18dec268..9e636ea423 100644
--- a/indra/lib/python/indra/base/llsd.py
+++ b/indra/lib/python/indra/base/llsd.py
@@ -842,6 +842,16 @@ try:
 except:
     print "Couldn't import mulib.stacked, not registering LLSD converters"
 else:
+    def llsd_convert_json(llsd_stuff, request):
+        callback = request.get_header('callback')
+        if callback is not None:
+            ## See Yahoo's ajax documentation for information about using this
+            ## callback style of programming
+            ## http://developer.yahoo.com/common/json.html#callbackparam
+            req.write("%s(%s)" % (callback, simplejson.dumps(llsd_stuff)))
+        else:
+            req.write(simplejson.dumps(llsd_stuff))
+
     def llsd_convert_xml(llsd_stuff, request):
         request.write(format_xml(llsd_stuff))
 
@@ -849,6 +859,8 @@ else:
         request.write(format_binary(llsd_stuff))
 
     for typ in [LLSD, dict, list, tuple, str, int, float, bool, unicode, type(None)]:
+        stacked.add_producer(typ, llsd_convert_json, 'application/json')
+
         stacked.add_producer(typ, llsd_convert_xml, 'application/llsd+xml')
         stacked.add_producer(typ, llsd_convert_xml, 'application/xml')
         stacked.add_producer(typ, llsd_convert_xml, 'text/xml')
diff --git a/indra/llcommon/llsdutil.h b/indra/llcommon/llsdutil.h
index 17a881d9cb..9f73222bc3 100644
--- a/indra/llcommon/llsdutil.h
+++ b/indra/llcommon/llsdutil.h
@@ -101,4 +101,16 @@ BOOL compare_llsd_with_template(
 	const LLSD& template_llsd,
 	LLSD& resultant_llsd);
 
+// Simple function to copy data out of input & output iterators if
+// there is no need for casting.
+template<typename Input> LLSD llsd_copy_array(Input iter, Input end)
+{
+	LLSD dest;
+	for (; iter != end; ++iter)
+	{
+		dest.append(*iter);
+	}
+	return dest;
+}
+
 #endif // LL_LLSDUTIL_H
diff --git a/indra/llcommon/llversionserver.h b/indra/llcommon/llversionserver.h
index 3a53baf188..aeab793c9a 100644
--- a/indra/llcommon/llversionserver.h
+++ b/indra/llcommon/llversionserver.h
@@ -34,8 +34,8 @@
 
 const S32 LL_VERSION_MAJOR = 1;
 const S32 LL_VERSION_MINOR = 21;
-const S32 LL_VERSION_PATCH = 0;
-const S32 LL_VERSION_BUILD = 84509;
+const S32 LL_VERSION_PATCH = 1;
+const S32 LL_VERSION_BUILD = 85989;
 
 const char * const LL_CHANNEL = "Second Life Server";
 
diff --git a/indra/llmath/llvolume.cpp b/indra/llmath/llvolume.cpp
index 1eca954cd3..a0990c5fc1 100644
--- a/indra/llmath/llvolume.cpp
+++ b/indra/llmath/llvolume.cpp
@@ -3910,9 +3910,11 @@ BOOL LLVolumeParams::isConvex() const
 	F32 path_length = mPathParams.getEnd() - mPathParams.getBegin();
 	F32 hollow = mProfileParams.getHollow();
 	 
+	U8 path_type = mPathParams.getCurveType();
 	if ( path_length > MIN_CONCAVE_PATH_WEDGE
 		&& ( mPathParams.getTwist() != mPathParams.getTwistBegin()
-		     || hollow > 0.f ) )
+		     || (hollow > 0.f 
+				 && LL_PCODE_PATH_LINE != path_type) ) )
 	{
 		// twist along a "not too short" path is concave
 		return FALSE;
@@ -3942,7 +3944,6 @@ BOOL LLVolumeParams::isConvex() const
 		return FALSE;
 	}
 
-	U8 path_type = mPathParams.getCurveType();
 	if ( LL_PCODE_PATH_LINE == path_type )
 	{
 		// straight paths with convex profile
diff --git a/indra/llmessage/llhttpclient.h b/indra/llmessage/llhttpclient.h
index b011761f5f..6bc838bfd1 100644
--- a/indra/llmessage/llhttpclient.h
+++ b/indra/llmessage/llhttpclient.h
@@ -77,7 +77,12 @@ public:
 	static void postFile(const std::string& url, const LLUUID& uuid,
 		LLAssetType::EType asset_type, ResponderPtr responder, const F32 timeout=HTTP_REQUEST_EXPIRY_SECS);
 
-	// Blocking HTTP get that returns an LLSD map of status and body.
+	/**
+	 * @brief Blocking HTTP get that returns an LLSD map of status and body.
+	 *
+	 * @param url the complete serialized (and escaped) url to get
+	 * @return An LLSD of { 'status':status, 'body':payload }
+	 */
 	static LLSD blockingGet(const std::string& url);
 
 	static void del(const std::string& url, ResponderPtr, const F32 timeout=HTTP_REQUEST_EXPIRY_SECS);
diff --git a/indra/lscript/lscript_execute/lscript_execute.cpp b/indra/lscript/lscript_execute/lscript_execute.cpp
index 12b55c8ea8..6c8b1b40eb 100644
--- a/indra/lscript/lscript_execute/lscript_execute.cpp
+++ b/indra/lscript/lscript_execute/lscript_execute.cpp
@@ -3027,7 +3027,14 @@ BOOL run_return(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
 	if (b_print)
 		printf("[0x%X]\tRETURN\n", offset);
 	offset++;
-	S32 bp = lscript_pop_int(buffer);
+	
+	// SEC-53: babbage: broken instructions may allow inbalanced pushes and
+	// pops which can cause caller BP and return IP to be corrupted, so restore
+	// SP from BP before popping caller BP and IP.
+	S32 bp = get_register(buffer, LREG_BP);
+	set_sp(buffer, bp);
+	
+	bp = lscript_pop_int(buffer);
 	set_bp(buffer, bp);
 	offset = lscript_pop_int(buffer);
 	return FALSE;