Merge.
diff --git a/Lib/aifc.py b/Lib/aifc.py
index c2aad1b..12c665f 100644
--- a/Lib/aifc.py
+++ b/Lib/aifc.py
@@ -953,23 +953,27 @@
         sys.argv.append('/usr/demos/data/audio/bach.aiff')
     fn = sys.argv[1]
     f = open(fn, 'r')
-    print "Reading", fn
-    print "nchannels =", f.getnchannels()
-    print "nframes   =", f.getnframes()
-    print "sampwidth =", f.getsampwidth()
-    print "framerate =", f.getframerate()
-    print "comptype  =", f.getcomptype()
-    print "compname  =", f.getcompname()
-    if sys.argv[2:]:
-        gn = sys.argv[2]
-        print "Writing", gn
-        g = open(gn, 'w')
-        g.setparams(f.getparams())
-        while 1:
-            data = f.readframes(1024)
-            if not data:
-                break
-            g.writeframes(data)
-        g.close()
+    try:
+        print "Reading", fn
+        print "nchannels =", f.getnchannels()
+        print "nframes   =", f.getnframes()
+        print "sampwidth =", f.getsampwidth()
+        print "framerate =", f.getframerate()
+        print "comptype  =", f.getcomptype()
+        print "compname  =", f.getcompname()
+        if sys.argv[2:]:
+            gn = sys.argv[2]
+            print "Writing", gn
+            g = open(gn, 'w')
+            try:
+                g.setparams(f.getparams())
+                while 1:
+                    data = f.readframes(1024)
+                    if not data:
+                        break
+                    g.writeframes(data)
+            finally:
+                g.close()
+            print "Done."
+    finally:
         f.close()
-        print "Done."
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 563f929..9c33c8f 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -137,13 +137,21 @@
                    (('emailAddress', 'python-dev@python.org'),))
         self.assertEqual(p['subject'], subject)
         self.assertEqual(p['issuer'], subject)
-        self.assertEqual(p['subjectAltName'],
-                         (('DNS', 'altnull.python.org\x00example.com'),
-                         ('email', 'null@python.org\x00user@example.org'),
-                         ('URI', 'http://null.python.org\x00http://example.org'),
-                         ('IP Address', '192.0.2.1'),
-                         ('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
-                        )
+        if ssl.OPENSSL_VERSION_INFO >= (0, 9, 8):
+            san = (('DNS', 'altnull.python.org\x00example.com'),
+                   ('email', 'null@python.org\x00user@example.org'),
+                   ('URI', 'http://null.python.org\x00http://example.org'),
+                   ('IP Address', '192.0.2.1'),
+                   ('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
+        else:
+            # OpenSSL 0.9.7 doesn't support IPv6 addresses in subjectAltName
+            san = (('DNS', 'altnull.python.org\x00example.com'),
+                   ('email', 'null@python.org\x00user@example.org'),
+                   ('URI', 'http://null.python.org\x00http://example.org'),
+                   ('IP Address', '192.0.2.1'),
+                   ('IP Address', '<invalid>'))
+
+        self.assertEqual(p['subjectAltName'], san)
 
     def test_DER_to_PEM(self):
         with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f:
diff --git a/Misc/NEWS b/Misc/NEWS
index e93858a..f7e9372 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -32,6 +32,9 @@
 Library
 -------
 
+- Issue #11973: Fix a problem in kevent. The flags and fflags fields are now
+  properly handled as unsigned.
+
 - Issue #16809: Fixed some tkinter incompabilities with Tcl/Tk 8.6.
 
 - Issue #16809: Tkinter's splitlist() and split() methods now accept Tcl_Obj
@@ -44,7 +47,7 @@
   module will be called in a deterministic order.
 
 - Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork.
-  A pthread_atfork() parent handler is used to seeded the PRNG with pid, time
+  A pthread_atfork() parent handler is used to seed the PRNG with pid, time
   and some stack data.
 
 - Issue #8865: Concurrent invocation of select.poll.poll() now raises a
@@ -138,6 +141,8 @@
 Tools/Demos
 -----------
 
+- Issue #18817: Fix a resource warning in Lib/aifc.py demo.
+
 - Issue #18439: Make patchcheck work on Windows for ACKS, NEWS.
 
 - Issue #18448: Fix a typo in Demo/newmetaclasses/Eiffel.py.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 1839dc0..5ddbb1d 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -1629,7 +1629,7 @@
 /* Seed OpenSSL's PRNG at fork(), http://bugs.python.org/issue18747
  *
  * The parent handler seeds the PRNG from pseudo-random data like pid, the
- * current time (miliseconds or seconds) and an uninitialized arry.
+ * current time (miliseconds or seconds) and an uninitialized array.
  * The array contains stack variables that are impossible to predict
  * on most systems, e.g. function return address (subject to ASLR), the
  * stack protection canary and automatic variables.
@@ -1638,7 +1638,7 @@
  * Note:
  * The code uses pthread_atfork() until Python has a proper atfork API. The
  * handlers are not removed from the child process. A parent handler is used
- * instead of a child handler because fork() is suppose to be async-signal
+ * instead of a child handler because fork() is supposed to be async-signal
  * safe but the handler calls unsafe functions.
  */
 
diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c
index 00d5f6c..6a36521 100644
--- a/Modules/selectmodule.c
+++ b/Modules/selectmodule.c
@@ -1270,7 +1270,7 @@
     PyObject *pfd;
     static char *kwlist[] = {"ident", "filter", "flags", "fflags",
                              "data", "udata", NULL};
-    static char *fmt = "O|hhi" DATA_FMT_UNIT UINTPTRT_FMT_UNIT ":kevent";
+    static char *fmt = "O|hHI" DATA_FMT_UNIT UINTPTRT_FMT_UNIT ":kevent";
 
     EV_SET(&(self->e), 0, EVFILT_READ, EV_ADD, 0, 0, 0); /* defaults */