diff --git a/CHANGES b/CHANGES
index 3507e6ee4..3a6b9466d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,15 @@
 
+Changes with nginx 1.4.6                                         04 Mar 2014
+
+    *) Bugfix: the "client_max_body_size" directive might not work when
+       reading a request body using chunked transfer encoding; the bug had
+       appeared in 1.3.9.
+       Thanks to Lucas Molas.
+
+    *) Bugfix: a segmentation fault might occur in a worker process when
+       proxying WebSocket connections.
+
+
 Changes with nginx 1.4.5                                         11 Feb 2014
 
     *) Bugfix: the $ssl_session_id variable contained full session
diff --git a/CHANGES.ru b/CHANGES.ru
index ccaf26f2a..186bb4670 100644
--- a/CHANGES.ru
+++ b/CHANGES.ru
@@ -1,4 +1,15 @@
 
+Изменения в nginx 1.4.6                                           04.03.2014
+
+    *) Исправление: директива client_max_body_size могла не работать при
+       чтении тела запроса с использованием chunked transfer encoding;
+       ошибка появилась в 1.3.9.
+       Спасибо Lucas Molas.
+
+    *) Исправление: при проксировании WebSocket-соединений в рабочем
+       процессе мог произойти segmentation fault.
+
+
 Изменения в nginx 1.4.5                                           11.02.2014
 
     *) Исправление: переменная $ssl_session_id содержала всю сессию в
diff --git a/src/core/nginx.h b/src/core/nginx.h
index 697e64102..227e5f735 100644
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -9,8 +9,8 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define nginx_version      1004005
-#define NGINX_VERSION      "1.4.5"
+#define nginx_version      1004006
+#define NGINX_VERSION      "1.4.6"
 #define NGINX_VER          "nginx/" NGINX_VERSION
 
 #define NGINX_VAR          "NGINX"
diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
index 1d8bc4a28..e9cf3e930 100644
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -953,13 +953,13 @@ ngx_http_request_body_chunked_filter(ngx_http_request_t *r, ngx_chain_t *in)
 
                 if (clcf->client_max_body_size
                     && clcf->client_max_body_size
-                       < r->headers_in.content_length_n + rb->chunked->size)
+                       - r->headers_in.content_length_n < rb->chunked->size)
                 {
                     ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                                   "client intended to send too large chunked "
-                                  "body: %O bytes",
-                                  r->headers_in.content_length_n
-                                  + rb->chunked->size);
+                                  "body: %O+%O bytes",
+                                  r->headers_in.content_length_n,
+                                  rb->chunked->size);
 
                     r->lingering_close = 1;
 
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index ffdffcf07..d99d85454 100644
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -2456,7 +2456,9 @@ ngx_http_upstream_upgrade(ngx_http_request_t *r, ngx_http_upstream_t *u)
     if (u->peer.connection->read->ready
         || u->buffer.pos != u->buffer.last)
     {
+        ngx_post_event(c->read, &ngx_posted_events);
         ngx_http_upstream_process_upgraded(r, 1, 1);
+        return;
     }
 
     ngx_http_upstream_process_upgraded(r, 0, 1);