6 files changed, 10 insertions, 527 deletions

diff --git a/www/apache22/Makefile b/www/apache22/Makefile
index 3e27dd97543d..6c6ba9cd57b7 100644
--- a/www/apache22/Makefile
+++ b/www/apache22/Makefile
@@ -1,8 +1,8 @@
 # $FreeBSD$
 
 PORTNAME=	apache22
-PORTVERSION=	2.2.27
-PORTREVISION?=	6
+PORTVERSION=	2.2.29
+PORTREVISION?=	0
 CATEGORIES=	www ipv6
 MASTER_SITES=	${MASTER_SITE_APACHE_HTTPD}
 DISTNAME=	httpd-${PORTVERSION}
diff --git a/www/apache22/Makefile.modules b/www/apache22/Makefile.modules
index e1a1fb2267ce..79949c8e76bb 100644
--- a/www/apache22/Makefile.modules
+++ b/www/apache22/Makefile.modules
@@ -101,18 +101,19 @@ CONFIGURE_ARGS+=	--enable-exception-hook
 
 .if ${PORT_OPTIONS:MAUTH_BASIC} || ${PORT_OPTIONS:MAUTH_DIGEST}
 .  if !${APACHE_MODULES:MAUTHN*}
-IGNORE=	AUTH_BASIC and AUTH_DIGEST need at last one AUTHN provider	
-.  endif	
+IGNORE=	AUTH_BASIC and AUTH_DIGEST need at least one AUTHN provider
+.  endif
 .endif
 
 .if ${PORT_OPTIONS:MAUTH_BASIC}
 .  if !${APACHE_MODULES:MAUTHZ*}
-IGNORE=	AUTH_BASIC need at last one AUTHZ provider	
-.  endif	
+IGNORE=	AUTH_BASIC need at least one AUTHZ provider
+.  endif
 .endif
 
 .if defined(APR_HAS_THREADS)
-LDFLAGS+=	-pthread
+CFLAGS+=	${PTHREAD_CFLAGS}
+LDFLAGS+=	${PTHREAD_LIBS}
 .else
 .  if exists(${APR_CONFIG}) && ${PORT_OPTIONS:MMEM_CACHE}
 IGNORE=	MEM_CACHE requires APR threads. Please rebuild APR with THREAD support
diff --git a/www/apache22/distinfo b/www/apache22/distinfo
index 48a2d66a83c6..d216509fe27b 100644
--- a/www/apache22/distinfo
+++ b/www/apache22/distinfo
@@ -1,2 +1,2 @@
-SHA256 (apache22/httpd-2.2.27.tar.bz2) = 205973ded6ca55c056ce9c84d73ab708f7829f330193bd39b651463b8d4f8147
-SIZE (apache22/httpd-2.2.27.tar.bz2) = 5616798
+SHA256 (apache22/httpd-2.2.29.tar.bz2) = 574b4f994b99178dfd5160bcb14025402e2ce381be9889b83e4be0ffbf5839a4
+SIZE (apache22/httpd-2.2.29.tar.bz2) = 5625498
diff --git a/www/apache22/files/patch-CVE-2014-0118__mod_deflate.c b/www/apache22/files/patch-CVE-2014-0118__mod_deflate.c
deleted file mode 100644
index 915c455dd06c..000000000000
--- a/www/apache22/files/patch-CVE-2014-0118__mod_deflate.c
+++ /dev/null
@@ -1,284 +0,0 @@
-SECURITY: CVE-2014-0118 (cve.mitre.org)
-
-mod_deflate: The DEFLATE input filter (inflates request bodies) now
-limits the length and compression ratio of inflated request bodies to
-avoid denial of sevice via highly compressed bodies.  See directives
-DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and
-DeflateInflateRatioBurst.
-
-http://svn.apache.org/viewvc?view=revision&revision=1611426
-
-
---- ./modules/filters/mod_deflate.c.orig	2011-08-29 17:22:22.000000000 +0200
-+++ ./modules/filters/mod_deflate.c	2014-07-24 21:07:40.000000000 +0200
-@@ -37,6 +37,7 @@
- #include "httpd.h"
- #include "http_config.h"
- #include "http_log.h"
-+#include "http_core.h"
- #include "apr_lib.h"
- #include "apr_strings.h"
- #include "apr_general.h"
-@@ -51,6 +52,9 @@
- static const char deflateFilterName[] = "DEFLATE";
- module AP_MODULE_DECLARE_DATA deflate_module;
- 
-+#define AP_INFLATE_RATIO_LIMIT 200
-+#define AP_INFLATE_RATIO_BURST 3
-+
- typedef struct deflate_filter_config_t
- {
-     int windowSize;
-@@ -62,6 +66,12 @@
-     char *note_output_name;
- } deflate_filter_config;
- 
-+typedef struct deflate_dirconf_t {
-+    apr_off_t inflate_limit;
-+    int ratio_limit,
-+        ratio_burst;
-+} deflate_dirconf_t;
-+
- /* RFC 1952 Section 2.3 defines the gzip header:
-  *
-  * +---+---+---+---+---+---+---+---+---+---+
-@@ -193,6 +203,14 @@
-     return c;
- }
- 
-+static void *create_deflate_dirconf(apr_pool_t *p, char *dummy)
-+{
-+    deflate_dirconf_t *dc = apr_pcalloc(p, sizeof(*dc));
-+    dc->ratio_limit = AP_INFLATE_RATIO_LIMIT;
-+    dc->ratio_burst = AP_INFLATE_RATIO_BURST;
-+    return dc;
-+}
-+
- static const char *deflate_set_window_size(cmd_parms *cmd, void *dummy,
-                                            const char *arg)
- {
-@@ -284,6 +302,55 @@
-     return NULL;
- }
- 
-+
-+static const char *deflate_set_inflate_limit(cmd_parms *cmd, void *dirconf,
-+                                      const char *arg)
-+{
-+    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
-+    char *errp;
-+
-+    if (APR_SUCCESS != apr_strtoff(&dc->inflate_limit, arg, &errp, 10)) {
-+        return "DeflateInflateLimitRequestBody is not parsable.";
-+    }
-+    if (*errp || dc->inflate_limit < 0) {
-+        return "DeflateInflateLimitRequestBody requires a non-negative integer.";
-+    }
-+
-+    return NULL;
-+}
-+
-+static const char *deflate_set_inflate_ratio_limit(cmd_parms *cmd,
-+                                                   void *dirconf,
-+                                                   const char *arg)
-+{
-+    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
-+    int i;
-+
-+    i = atoi(arg);
-+    if (i <= 0)
-+        return "DeflateInflateRatioLimit must be positive";
-+
-+    dc->ratio_limit = i;
-+
-+    return NULL;
-+}
-+
-+static const char *deflate_set_inflate_ratio_burst(cmd_parms *cmd,
-+                                                   void *dirconf,
-+                                                   const char *arg)
-+{
-+    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
-+    int i;
-+
-+    i = atoi(arg);
-+    if (i <= 0)
-+        return "DeflateInflateRatioBurst must be positive";
-+
-+    dc->ratio_burst = i;
-+
-+    return NULL;
-+}
-+
- typedef struct deflate_ctx_t
- {
-     z_stream stream;
-@@ -294,8 +361,26 @@
-     unsigned char *validation_buffer;
-     apr_size_t validation_buffer_length;
-     int inflate_init;
-+    int ratio_hits;
-+    apr_off_t inflate_total;
- } deflate_ctx;
- 
-+/* Check whether the (inflate) ratio exceeds the configured limit/burst. */
-+static int check_ratio(request_rec *r, deflate_ctx *ctx,
-+                       const deflate_dirconf_t *dc)
-+{
-+    if (ctx->stream.total_in) {
-+        int ratio = ctx->stream.total_out / ctx->stream.total_in;
-+        if (ratio < dc->ratio_limit) {
-+            ctx->ratio_hits = 0;
-+        }
-+        else if (++ctx->ratio_hits > dc->ratio_burst) {
-+            return 0;
-+        }
-+    }
-+    return 1;
-+}
-+
- /* Number of validation bytes (CRC and length) after the compressed data */
- #define VALIDATION_SIZE 8
- /* Do not update ctx->crc, see comment in flush_libz_buffer */
-@@ -744,6 +829,8 @@
-     int zRC;
-     apr_status_t rv;
-     deflate_filter_config *c;
-+    deflate_dirconf_t *dc;
-+    apr_off_t inflate_limit;
- 
-     /* just get out of the way of things we don't want. */
-     if (mode != AP_MODE_READBYTES) {
-@@ -751,6 +838,7 @@
-     }
- 
-     c = ap_get_module_config(r->server->module_config, &deflate_module);
-+    dc = ap_get_module_config(r->per_dir_config, &deflate_module);
- 
-     if (!ctx) {
-         char deflate_hdr[10];
-@@ -803,11 +891,13 @@
-         if (len != 10 ||
-             deflate_hdr[0] != deflate_magic[0] ||
-             deflate_hdr[1] != deflate_magic[1]) {
-+            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Failed to inflate input: wrong/partial magic bytes");
-             return APR_EGENERAL;
-         }
- 
-         /* We can't handle flags for now. */
-         if (deflate_hdr[3] != 0) {
-+            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Failed to inflate input: cannot handle deflate flags");
-             return APR_EGENERAL;
-         }
- 
-@@ -831,6 +921,12 @@
-         apr_brigade_cleanup(ctx->bb);
-     }
- 
-+    inflate_limit = dc->inflate_limit; 
-+    if (inflate_limit == 0) { 
-+        /* The core is checking the deflated body, we'll check the inflated */
-+        inflate_limit = ap_get_limit_req_body(f->r);
-+    }
-+
-     if (APR_BRIGADE_EMPTY(ctx->proc_bb)) {
-         rv = ap_get_brigade(f->next, ctx->bb, mode, block, readbytes);
- 
-@@ -863,6 +959,17 @@
- 
-                 ctx->stream.next_out = ctx->buffer;
-                 len = c->bufferSize - ctx->stream.avail_out;
-+ 
-+                ctx->inflate_total += len;
-+                if (inflate_limit && ctx->inflate_total > inflate_limit) { 
-+                    inflateEnd(&ctx->stream);
-+                    ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, 
-+                            "Inflated content length of %" APR_OFF_T_FMT
-+                            " is larger than the configured limit"
-+                            " of %" APR_OFF_T_FMT, 
-+                            ctx->inflate_total, inflate_limit);
-+                    return APR_ENOSPC;
-+                }
- 
-                 ctx->crc = crc32(ctx->crc, (const Bytef *)ctx->buffer, len);
-                 tmp_heap = apr_bucket_heap_create((char *)ctx->buffer, len,
-@@ -891,6 +998,26 @@
-                     ctx->stream.next_out = ctx->buffer;
-                     len = c->bufferSize - ctx->stream.avail_out;
- 
-+                      ctx->inflate_total += len;
-+                      if (inflate_limit && ctx->inflate_total > inflate_limit) { 
-+                          inflateEnd(&ctx->stream);
-+                          ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
-+                                  "Inflated content length of %" APR_OFF_T_FMT
-+                                  " is larger than the configured limit"
-+                                  " of %" APR_OFF_T_FMT, 
-+                                  ctx->inflate_total, inflate_limit);
-+                          return APR_ENOSPC;
-+                      }
-+
-+                      if (!check_ratio(r, ctx, dc)) {
-+                          inflateEnd(&ctx->stream);
-+                          ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, 
-+                                  "Inflated content ratio is larger than the "
-+                                  "configured limit %i by %i time(s)",
-+                                  dc->ratio_limit, dc->ratio_burst);
-+                          return APR_EINVAL;
-+                      }
-+
-                     ctx->crc = crc32(ctx->crc, (const Bytef *)ctx->buffer, len);
-                     tmp_heap = apr_bucket_heap_create((char *)ctx->buffer, len,
-                                                       NULL, f->c->bucket_alloc);
-@@ -1003,6 +1130,7 @@
-     int zRC;
-     apr_status_t rv;
-     deflate_filter_config *c;
-+    deflate_dirconf_t *dc;
- 
-     /* Do nothing if asked to filter nothing. */
-     if (APR_BRIGADE_EMPTY(bb)) {
-@@ -1010,6 +1138,7 @@
-     }
- 
-     c = ap_get_module_config(r->server->module_config, &deflate_module);
-+    dc = ap_get_module_config(r->per_dir_config, &deflate_module);
- 
-     if (!ctx) {
- 
-@@ -1272,6 +1401,14 @@
-         while (ctx->stream.avail_in != 0) {
-             if (ctx->stream.avail_out == 0) {
- 
-+                if (!check_ratio(r, ctx, dc)) {
-+                    ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, 
-+                            "Inflated content ratio is larger than the "
-+                            "configured limit %i by %i time(s)",
-+                            dc->ratio_limit, dc->ratio_burst);
-+                    return APR_EINVAL;
-+                }
-+
-                 ctx->stream.next_out = ctx->buffer;
-                 len = c->bufferSize - ctx->stream.avail_out;
- 
-@@ -1346,12 +1483,20 @@
-                   "Set the Deflate Memory Level (1-9)"),
-     AP_INIT_TAKE1("DeflateCompressionLevel", deflate_set_compressionlevel, NULL, RSRC_CONF,
-                   "Set the Deflate Compression Level (1-9)"),
-+    AP_INIT_TAKE1("DeflateInflateLimitRequestBody", deflate_set_inflate_limit, NULL, OR_ALL,
-+                  "Set a limit on size of inflated input"),
-+    AP_INIT_TAKE1("DeflateInflateRatioLimit", deflate_set_inflate_ratio_limit, NULL, OR_ALL,
-+                  "Set the inflate ratio limit above which inflation is "
-+                  "aborted (default: " APR_STRINGIFY(AP_INFLATE_RATIO_LIMIT) ")"),
-+    AP_INIT_TAKE1("DeflateInflateRatioBurst", deflate_set_inflate_ratio_burst, NULL, OR_ALL,
-+                  "Set the maximum number of following inflate ratios above limit "
-+                  "(default: " APR_STRINGIFY(AP_INFLATE_RATIO_BURST) ")"),
-     {NULL}
- };
- 
- module AP_MODULE_DECLARE_DATA deflate_module = {
-     STANDARD20_MODULE_STUFF,
--    NULL,                         /* dir config creater */
-+    create_deflate_dirconf,       /* dir config creater */
-     NULL,                         /* dir merger --- default is to override */
-     create_deflate_server_config, /* server config */
-     NULL,                         /* merge server config */
diff --git a/www/apache22/files/patch-CVE-2014-0226__scoreboard.c b/www/apache22/files/patch-CVE-2014-0226__scoreboard.c
deleted file mode 100644
index 34d159754ffc..000000000000
--- a/www/apache22/files/patch-CVE-2014-0226__scoreboard.c
+++ /dev/null
@@ -1,82 +0,0 @@
-SECURITY: CVE-2014-0226 (cve.mitre.org)
-
-Fix a race condition in scoreboard handling,
-which could lead to a heap buffer overflow.  Thanks to Marek Kroemeke
-working with HP's Zero Day Initiative for reporting this.
-* include/scoreboard.h: Add ap_copy_scoreboard_worker.
-* server/scoreboard.c (ap_copy_scoreboard_worker): New function.
-* modules/generators/mod_status.c (status_handler): Use it.
-
-http://svn.apache.org/viewvc?view=revision&revision=1610515
-
---- ./include/scoreboard.h.orig	2007-12-08 17:59:08.000000000 +0100
-+++ ./include/scoreboard.h	2014-07-24 21:07:40.000000000 +0200
-@@ -189,7 +189,24 @@
-                                                     int status, request_rec *r);
- void ap_time_process_request(ap_sb_handle_t *sbh, int status);
- 
-+/** Return a pointer to the worker_score for a given child, thread pair.
-+ * @param child_num The child number.
-+ * @param thread_num The thread number.
-+ * @return A pointer to the worker_score structure.
-+ * @deprecated This function is deprecated, use ap_copy_scoreboard_worker instead. 
-+ */
- AP_DECLARE(worker_score *) ap_get_scoreboard_worker(int x, int y);
-+
-+/** Copy the contents of a worker's scoreboard entry.  The contents of
-+ * the worker_score structure are copied verbatim into the dest
-+ * structure.
-+ * @param dest Output parameter.
-+ * @param child_num The child number.
-+ * @param thread_num The thread number.
-+ */
-+AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest,
-+                                           int child_num, int thread_num);
-+
- AP_DECLARE(process_score *) ap_get_scoreboard_process(int x);
- AP_DECLARE(global_score *) ap_get_scoreboard_global(void);
- AP_DECLARE(lb_score *) ap_get_scoreboard_lb(int lb_num);
---- ./server/scoreboard.c.orig	2012-07-24 15:46:40.000000000 +0200
-+++ ./server/scoreboard.c	2014-07-24 21:07:40.000000000 +0200
-@@ -510,6 +510,21 @@
-     return &ap_scoreboard_image->servers[x][y];
- }
- 
-+AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest, 
-+                                           int child_num,
-+                                           int thread_num)
-+{
-+    worker_score *ws = ap_get_scoreboard_worker(child_num, thread_num);
-+
-+    memcpy(dest, ws, sizeof *ws);
-+
-+    /* For extra safety, NUL-terminate the strings returned, though it
-+     * should be true those last bytes are always zero anyway. */
-+    dest->client[sizeof(dest->client) - 1] = '\0';
-+    dest->request[sizeof(dest->request) - 1] = '\0';
-+    dest->vhost[sizeof(dest->vhost) - 1] = '\0';
-+}
-+
- AP_DECLARE(process_score *) ap_get_scoreboard_process(int x)
- {
-     if ((x < 0) || (server_limit < x)) {
---- ./modules/generators/mod_status.c.orig	2013-02-18 17:52:21.000000000 +0100
-+++ ./modules/generators/mod_status.c	2014-07-24 21:07:40.000000000 +0200
-@@ -241,7 +241,7 @@
- #endif
-     int short_report;
-     int no_table_report;
--    worker_score *ws_record;
-+    worker_score *ws_record = apr_palloc(r->pool, sizeof *ws_record);
-     process_score *ps_record;
-     char *stat_buffer;
-     pid_t *pid_buffer, worker_pid;
-@@ -333,7 +333,7 @@
-         for (j = 0; j < thread_limit; ++j) {
-             int indx = (i * thread_limit) + j;
- 
--            ws_record = ap_get_scoreboard_worker(i, j);
-+            ap_copy_scoreboard_worker(ws_record, i, j);
-             res = ws_record->status;
-             stat_buffer[indx] = status_flags[res];
- 
diff --git a/www/apache22/files/patch-CVE-2014-0231__mod_cgid.c b/www/apache22/files/patch-CVE-2014-0231__mod_cgid.c
deleted file mode 100644
index e1adbc2a335e..000000000000
--- a/www/apache22/files/patch-CVE-2014-0231__mod_cgid.c
+++ /dev/null
@@ -1,152 +0,0 @@
-SECURITY: CVE-2014-0231 (cve.mitre.org)
-
-mod_cgid: Fix a denial of service against CGI scripts that do not consume
-stdin that could lead to lingering HTTPD child processes filling up the
-scoreboard and eventually hanging the server.
-
-http://svn.apache.org/viewvc?view=revision&revision=1611185
-
-
---- ./modules/generators/mod_cgid.c.orig	2009-08-03 16:38:53.000000000 +0200
-+++ ./modules/generators/mod_cgid.c	2014-07-24 21:07:40.000000000 +0200
-@@ -93,6 +93,10 @@
- static pid_t parent_pid;
- static ap_unix_identity_t empty_ugid = { (uid_t)-1, (gid_t)-1, -1 };
- 
-+typedef struct { 
-+    apr_interval_time_t timeout;
-+} cgid_dirconf;
-+
- /* The APR other-child API doesn't tell us how the daemon exited
-  * (SIGSEGV vs. exit(1)).  The other-child maintenance function
-  * needs to decide whether to restart the daemon after a failure
-@@ -934,7 +938,14 @@
-     return overrides->logname ? overrides : base;
- }
- 
-+static void *create_cgid_dirconf(apr_pool_t *p, char *dummy)
-+{
-+    cgid_dirconf *c = (cgid_dirconf *) apr_pcalloc(p, sizeof(cgid_dirconf));
-+    return c;
-+}
-+
- static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
-+
- {
-     server_rec *s = cmd->server;
-     cgid_server_conf *conf = ap_get_module_config(s->module_config,
-@@ -987,7 +998,16 @@
- 
-     return NULL;
- }
-+static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
-+{
-+    cgid_dirconf *dc = dummy;
- 
-+    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { 
-+        return "CGIDScriptTimeout has wrong format";
-+    }
-+ 
-+    return NULL;
-+}
- static const command_rec cgid_cmds[] =
- {
-     AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
-@@ -999,6 +1019,10 @@
-     AP_INIT_TAKE1("ScriptSock", set_script_socket, NULL, RSRC_CONF,
-                   "the name of the socket to use for communication with "
-                   "the cgi daemon."),
-+    AP_INIT_TAKE1("CGIDScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
-+                  "The amount of time to wait between successful reads from "
-+                  "the CGI script, in seconds."),
-+                  
-     {NULL}
- };
- 
-@@ -1335,11 +1359,15 @@
-     apr_file_t *tempsock;
-     struct cleanup_script_info *info;
-     apr_status_t rv;
-+    cgid_dirconf *dc;
- 
-     if (strcmp(r->handler,CGI_MAGIC_TYPE) && strcmp(r->handler,"cgi-script"))
-         return DECLINED;
- 
-     conf = ap_get_module_config(r->server->module_config, &cgid_module);
-+    dc = ap_get_module_config(r->per_dir_config, &cgid_module);
-+
-+    
-     is_included = !strcmp(r->protocol, "INCLUDED");
- 
-     if ((argv0 = strrchr(r->filename, '/')) != NULL)
-@@ -1412,6 +1440,12 @@
-      */
- 
-     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
-+    if (dc->timeout > 0) { 
-+        apr_file_pipe_timeout_set(tempsock, dc->timeout);
-+    }
-+    else { 
-+        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
-+    }
-     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
- 
-     if ((argv0 = strrchr(r->filename, '/')) != NULL)
-@@ -1487,6 +1521,10 @@
-             if (rv != APR_SUCCESS) {
-                 /* silly script stopped reading, soak up remaining message */
-                 child_stopped_reading = 1;
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, 
-+                              "Error writing request body to script %s", 
-+                              r->filename);
-+
-             }
-         }
-         apr_brigade_cleanup(bb);
-@@ -1577,7 +1615,13 @@
-             return HTTP_MOVED_TEMPORARILY;
-         }
- 
--        ap_pass_brigade(r->output_filters, bb);
-+        rv = ap_pass_brigade(r->output_filters, bb);
-+        if (rv != APR_SUCCESS) { 
-+            /* APLOG_ERR because the core output filter message is at error,
-+             * but doesn't know it's passing CGI output 
-+             */
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, "Failed to flush CGI output to client");
-+        }
-     }
- 
-     if (nph) {
-@@ -1707,6 +1751,8 @@
-     request_rec *r = f->r;
-     cgid_server_conf *conf = ap_get_module_config(r->server->module_config,
-                                                   &cgid_module);
-+    cgid_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgid_module);
-+
-     struct cleanup_script_info *info;
- 
-     add_ssi_vars(r);
-@@ -1736,6 +1782,13 @@
-      * get rid of the cleanup we registered when we created the socket.
-      */
-     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
-+    if (dc->timeout > 0) {
-+        apr_file_pipe_timeout_set(tempsock, dc->timeout);
-+    }
-+    else {
-+        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
-+    }
-+
-     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
- 
-     APR_BRIGADE_INSERT_TAIL(bb, apr_bucket_pipe_create(tempsock,
-@@ -1841,7 +1894,7 @@
- 
- module AP_MODULE_DECLARE_DATA cgid_module = {
-     STANDARD20_MODULE_STUFF,
--    NULL, /* dir config creater */
-+    create_cgid_dirconf, /* dir config creater */
-     NULL, /* dir merger --- default is to override */
-     create_cgid_config, /* server config */
-     merge_cgid_config, /* merge server config */