# HG changeset patch
# User Igor Sysoev <http://sysoev.ru>
# Date 1128888000 -14400
# Node ID cf3d6edb3ad62d04ceb3b006765ed6123d446f71
# Parent  495d867e35e8f14985e68b19314788e4384a6a7b
nginx 0.3.1

    *) Bugfix: the segmentation fault occurred when the signal queue
       overflowed if the "rtsig" method was used; bug appeared in 0.2.0.

    *) Change: correct handling of the "\\", "\"", "\'", and "\$" pairs in
       SSI.

diff --git a/CHANGES b/CHANGES
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,12 @@
+
+Changes with nginx 0.3.1                                         10 Oct 2005
+
+    *) Bugfix: the segmentation fault occurred when the signal queue 
+       overflowed if the "rtsig" method was used; bug appeared in 0.2.0.
+
+    *) Change: correct handling of the "\\", "\"", "\'", and "\$" pairs in 
+       SSI.
+
 
 Changes with nginx 0.3.0                                         07 Oct 2005
 
diff --git a/CHANGES.ru b/CHANGES.ru
--- a/CHANGES.ru
+++ b/CHANGES.ru
@@ -1,9 +1,18 @@
+
+Изменения в nginx 0.3.1                                           10.10.2005
+
+    *) Исправление: во время переполнения очереди сигналов при 
+       использовании метода rtsig происходил segmentation fault; ошибка 
+       появилась в 0.2.0.
+
+    *) Изменение: корректная обработка пар "\\", "\"", "\'" и "\$" в SSI.
+
 
 Изменения в nginx 0.3.0                                           07.10.2005
 
     *) Изменение: убрано десятидневное ограничение времени работы рабочего 
-       процесса. Ограничение было введено из-за переполнения таймеров 
-       миллисекунд.
+       процесса. Ограничение было введено из-за переполнения миллисекундных 
+       таймеров.
 
 
 Изменения в nginx 0.2.6                                           05.10.2005
diff --git a/src/core/nginx.h b/src/core/nginx.h
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -8,7 +8,7 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define NGINX_VER          "nginx/0.3.0"
+#define NGINX_VER          "nginx/0.3.1"
 
 #define NGINX_VAR          "NGINX"
 #define NGX_OLDPID_EXT     ".oldbin"
diff --git a/src/core/ngx_core.h b/src/core/ngx_core.h
--- a/src/core/ngx_core.h
+++ b/src/core/ngx_core.h
@@ -35,15 +35,15 @@ typedef void (*ngx_connection_handler_pt
 #define  NGX_ABORT      -6
 
 
+#include <ngx_errno.h>
 #include <ngx_atomic.h>
+#include <ngx_thread.h>
 #include <ngx_rbtree.h>
 #include <ngx_time.h>
 #include <ngx_socket.h>
-#include <ngx_errno.h>
 #include <ngx_types.h>
 #include <ngx_shared.h>
 #include <ngx_process.h>
-#include <ngx_thread.h>
 #include <ngx_user.h>
 #include <ngx_string.h>
 #include <ngx_parse.h>
diff --git a/src/core/ngx_rbtree.c b/src/core/ngx_rbtree.c
--- a/src/core/ngx_rbtree.c
+++ b/src/core/ngx_rbtree.c
@@ -9,8 +9,8 @@
 
 
 /*
- * The code is based on the algorithm described in the "Introduction
- * to Algorithms" by Cormen, Leiserson and Rivest.
+ * The red-black tree code is based on the algorithm described in
+ * the "Introduction to Algorithms" by Cormen, Leiserson and Rivest.
  */
 
 #define ngx_rbt_red(node)           ((node)->color = 1)
@@ -20,20 +20,23 @@
 #define ngx_rbt_copy_color(n1, n2)  (n1->color = n2->color)
 
 
-static ngx_inline void ngx_rbtree_left_rotate(ngx_rbtree_t **root,
-    ngx_rbtree_t *sentinel, ngx_rbtree_t *node);
-static ngx_inline void ngx_rbtree_right_rotate(ngx_rbtree_t **root,
-    ngx_rbtree_t *sentinel, ngx_rbtree_t *node);
+static ngx_inline void ngx_rbtree_left_rotate(ngx_rbtree_node_t **root,
+    ngx_rbtree_node_t *sentinel, ngx_rbtree_node_t *node);
+static ngx_inline void ngx_rbtree_right_rotate(ngx_rbtree_node_t **root,
+    ngx_rbtree_node_t *sentinel, ngx_rbtree_node_t *node);
 
 
 void
-ngx_rbtree_insert(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_insert(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node)
 {
-    ngx_rbtree_t  *temp;
+    ngx_rbtree_node_t  **root, *temp, *sentinel;
 
     /* a binary tree insert */
 
+    root = (ngx_rbtree_node_t **) &tree->root;
+    sentinel = tree->sentinel;
+
     if (*root == sentinel) {
         node->parent = NULL;
         node->left = sentinel;
@@ -44,6 +47,17 @@ ngx_rbtree_insert(ngx_rbtree_t **root, n
         return;
     }
 
+    /*
+     * The rbtree is currently used by event timers only.  Timer values
+     * 1) are spread in small range, usually several minutes,
+     * 2) and overflow each 49 days, if milliseconds are stored in 32 bits.
+     * The below comparison takes into account that overflow.
+     *
+     * If there will be a necessity to use the rbtree for values with
+     * other comparison rules, then a whole "for ( ;; )" loop should
+     * be made as tree->insert() function.
+     */
+
     temp = *root;
 
     for ( ;; ) {
@@ -130,14 +144,17 @@ ngx_rbtree_insert(ngx_rbtree_t **root, n
 
 
 void
-ngx_rbtree_delete(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_delete(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node)
 {
-    ngx_int_t      is_red;
-    ngx_rbtree_t  *subst, *temp, *w;
+    ngx_int_t            is_red;
+    ngx_rbtree_node_t  **root, *sentinel, *subst, *temp, *w;
 
     /* a binary tree delete */
 
+    root = (ngx_rbtree_node_t **) &tree->root;
+    sentinel = tree->sentinel;
+
     if (node->left == sentinel) {
         temp = node->right;
         subst = node;
@@ -295,10 +312,10 @@ ngx_rbtree_delete(ngx_rbtree_t **root, n
 
 
 static ngx_inline void
-ngx_rbtree_left_rotate(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_left_rotate(ngx_rbtree_node_t **root, ngx_rbtree_node_t *sentinel,
+    ngx_rbtree_node_t *node)
 {
-    ngx_rbtree_t  *temp;
+    ngx_rbtree_node_t  *temp;
 
     temp = node->right;
     node->right = temp->left;
@@ -325,10 +342,10 @@ ngx_rbtree_left_rotate(ngx_rbtree_t **ro
 
 
 static ngx_inline void
-ngx_rbtree_right_rotate(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_right_rotate(ngx_rbtree_node_t **root, ngx_rbtree_node_t *sentinel,
+    ngx_rbtree_node_t *node)
 {
-    ngx_rbtree_t  *temp;
+    ngx_rbtree_node_t  *temp;
 
     temp = node->left;
     node->left = temp->right;
diff --git a/src/core/ngx_rbtree.h b/src/core/ngx_rbtree.h
--- a/src/core/ngx_rbtree.h
+++ b/src/core/ngx_rbtree.h
@@ -16,25 +16,37 @@ typedef ngx_uint_t  ngx_rbtree_key_t;
 typedef ngx_int_t   ngx_rbtree_key_int_t;
 
 
-typedef struct ngx_rbtree_s  ngx_rbtree_t;
+typedef struct ngx_rbtree_node_s  ngx_rbtree_node_t;
 
-struct ngx_rbtree_s {
-    ngx_rbtree_key_t   key;
-    ngx_rbtree_t      *left;
-    ngx_rbtree_t      *right;
-    ngx_rbtree_t      *parent;
-    char               color;
+struct ngx_rbtree_node_s {
+    ngx_rbtree_key_t       key;
+    ngx_rbtree_node_t     *left;
+    ngx_rbtree_node_t     *right;
+    ngx_rbtree_node_t     *parent;
+    char                   color;
 };
 
 
-void ngx_rbtree_insert(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node);
-void ngx_rbtree_delete(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node);
+typedef struct ngx_rbtree_s  ngx_rbtree_t;
+
+typedef ngx_rbtree_t *(*ngx_rbtree_insert_pt) (ngx_rbtree_node_t *root,
+    ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel);
+
+struct ngx_rbtree_s {
+    ngx_rbtree_node_t     *root;
+    ngx_rbtree_node_t     *sentinel;
+ /* ngx_rbtree_insert_pt   insert; */
+};
 
 
-static ngx_inline ngx_rbtree_t *
-ngx_rbtree_min(ngx_rbtree_t *node, ngx_rbtree_t *sentinel)
+void ngx_rbtree_insert(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node);
+void ngx_rbtree_delete(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node);
+
+
+static ngx_inline ngx_rbtree_node_t *
+ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
 {
     while (node->left != sentinel) {
         node = node->left;
diff --git a/src/event/modules/ngx_epoll_module.c b/src/event/modules/ngx_epoll_module.c
--- a/src/event/modules/ngx_epoll_module.c
+++ b/src/event/modules/ngx_epoll_module.c
@@ -405,7 +405,6 @@ ngx_epoll_process_events(ngx_cycle_t *cy
 
     if (timer == NGX_TIMER_INFINITE || timer > 500) {
         timer = 500;
-        break;
     }
 
 #endif
diff --git a/src/event/modules/ngx_kqueue_module.c b/src/event/modules/ngx_kqueue_module.c
--- a/src/event/modules/ngx_kqueue_module.c
+++ b/src/event/modules/ngx_kqueue_module.c
@@ -462,7 +462,6 @@ ngx_kqueue_process_events(ngx_cycle_t *c
 
     if (timer == NGX_TIMER_INFINITE || timer > 500) {
         timer = 500;
-        break;
     }
 
 #endif
diff --git a/src/event/modules/ngx_rtsig_module.c b/src/event/modules/ngx_rtsig_module.c
--- a/src/event/modules/ngx_rtsig_module.c
+++ b/src/event/modules/ngx_rtsig_module.c
@@ -307,7 +307,6 @@ ngx_rtsig_process_events(ngx_cycle_t *cy
 
         if (timer == NGX_TIMER_INFINITE || timer > 500) {
             timer = 500;
-            break;
         }
 
 #endif
@@ -578,7 +577,7 @@ ngx_rtsig_process_overflow(ngx_cycle_t *
 
             c = cycle->files[overflow_current++];
 
-            if (c->fd == -1) {
+            if (c == NULL || c->fd == -1) {
                 continue;
             }
 
@@ -634,6 +633,10 @@ ngx_rtsig_process_overflow(ngx_cycle_t *
         for (i = 0; i < n; i++) {
             c = cycle->files[overflow_list[i].fd];
 
+            if (c == NULL) {
+                continue;
+            }
+
             rev = c->read;
 
             if (rev->active
diff --git a/src/event/ngx_event.h b/src/event/ngx_event.h
--- a/src/event/ngx_event.h
+++ b/src/event/ngx_event.h
@@ -130,18 +130,7 @@ struct ngx_event_s {
 
     ngx_log_t       *log;
 
-    /* TODO: threads: padding to cache line */
-
-    /*
-     * STUB: The inline of "ngx_rbtree_t  rbtree;"
-     */
-
-    ngx_rbtree_key_t   rbtree_key;
-    void              *rbtree_left;
-    void              *rbtree_right;
-    void              *rbtree_parent;
-    char               rbtree_color;
-
+    ngx_rbtree_node_t   timer;
 
     unsigned         closed:1;
 
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -144,6 +144,10 @@ ngx_ssl_certificate(ngx_ssl_t *ssl, u_ch
 ngx_int_t
 ngx_ssl_generate_rsa512_key(ngx_ssl_t *ssl)
 {
+    if (SSL_CTX_need_tmp_RSA(ssl->ctx) == 0) {
+        return NGX_OK;
+    }
+
     ssl->rsa512_key = RSA_generate_key(512, RSA_F4, NULL, NULL);
 
     if (ssl->rsa512_key) {
@@ -851,7 +855,10 @@ ngx_ssl_cleanup_ctx(void *data)
 {
    ngx_ssl_t  *ssl = data;
 
-   RSA_free(ssl->rsa512_key);
+   if (ssl->rsa512_key) {
+       RSA_free(ssl->rsa512_key);
+   }
+
    SSL_CTX_free(ssl->ctx);
 }
 
diff --git a/src/event/ngx_event_timer.c b/src/event/ngx_event_timer.c
--- a/src/event/ngx_event_timer.c
+++ b/src/event/ngx_event_timer.c
@@ -14,27 +14,28 @@ ngx_mutex_t  *ngx_event_timer_mutex;
 #endif
 
 
-ngx_thread_volatile ngx_rbtree_t  *ngx_event_timer_rbtree;
-ngx_rbtree_t                       ngx_event_timer_sentinel;
+ngx_thread_volatile ngx_rbtree_t  ngx_event_timer_rbtree;
+static ngx_rbtree_node_t          ngx_event_timer_sentinel;
 
 
 ngx_int_t
 ngx_event_timer_init(ngx_log_t *log)
 {
-    if (ngx_event_timer_rbtree) {
+    ngx_event_timer_rbtree.root = &ngx_event_timer_sentinel;
+    ngx_event_timer_rbtree.sentinel = &ngx_event_timer_sentinel;
+
 #if (NGX_THREADS)
+
+    if (ngx_event_timer_mutex) {
         ngx_event_timer_mutex->log = log;
-#endif
         return NGX_OK;
     }
 
-    ngx_event_timer_rbtree = &ngx_event_timer_sentinel;
-
-#if (NGX_THREADS)
     ngx_event_timer_mutex = ngx_mutex_init(log, 0);
     if (ngx_event_timer_mutex == NULL) {
         return NGX_ERROR;
     }
+
 #endif
 
     return NGX_OK;
@@ -44,10 +45,10 @@ ngx_event_timer_init(ngx_log_t *log)
 ngx_msec_t
 ngx_event_find_timer(void)
 {
-    ngx_msec_t     timer;
-    ngx_rbtree_t  *node;
+    ngx_rbtree_key_int_t   timer;
+    ngx_rbtree_node_t     *node, *root, *sentinel;
 
-    if (ngx_event_timer_rbtree == &ngx_event_timer_sentinel) {
+    if (ngx_event_timer_rbtree.root == &ngx_event_timer_sentinel) {
         return NGX_TIMER_INFINITE;
     }
 
@@ -55,35 +56,41 @@ ngx_event_find_timer(void)
         return NGX_TIMER_ERROR;
     }
 
-    node = ngx_rbtree_min((ngx_rbtree_t *) ngx_event_timer_rbtree,
-                          &ngx_event_timer_sentinel);
+    root = ngx_event_timer_rbtree.root;
+    sentinel = ngx_event_timer_rbtree.sentinel;
+
+    node = ngx_rbtree_min(root, sentinel);
 
     ngx_mutex_unlock(ngx_event_timer_mutex);
 
-    timer = (ngx_msec_t) node->key - ngx_current_time;
+    timer = (ngx_rbtree_key_int_t) node->key
+                                     - (ngx_rbtree_key_int_t) ngx_current_time;
 
-    return timer > 0 ? timer : 0 ;
+    return (ngx_msec_t) (timer > 0 ? timer : 0);
 }
 
 
 void
 ngx_event_expire_timers(void)
 {
-    ngx_event_t   *ev;
-    ngx_rbtree_t  *node;
+    ngx_event_t        *ev;
+    ngx_rbtree_node_t  *node, *root, *sentinel;
+
+    sentinel = ngx_event_timer_rbtree.sentinel;
 
     for ( ;; ) {
 
-        if (ngx_event_timer_rbtree == &ngx_event_timer_sentinel) {
-            return;
-        }
-
         if (ngx_mutex_lock(ngx_event_timer_mutex) == NGX_ERROR) {
             return;
         }
 
-        node = ngx_rbtree_min((ngx_rbtree_t *) ngx_event_timer_rbtree,
-                              &ngx_event_timer_sentinel);
+        root = ngx_event_timer_rbtree.root;
+
+        if (root == sentinel) {
+            return;
+        }
+
+        node = ngx_rbtree_min(root, sentinel);
 
         /* node->key <= ngx_current_time */
 
@@ -91,8 +98,7 @@ ngx_event_expire_timers(void)
                                       - (ngx_rbtree_key_int_t) ngx_current_time
             <= 0)
         {
-            ev = (ngx_event_t *)
-                           ((char *) node - offsetof(ngx_event_t, rbtree_key));
+            ev = (ngx_event_t *) ((char *) node - offsetof(ngx_event_t, timer));
 
 #if (NGX_THREADS)
 
@@ -114,18 +120,16 @@ ngx_event_expire_timers(void)
 
             ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                            "event timer del: %d: %M",
-                           ngx_event_ident(ev->data), ev->rbtree_key);
+                           ngx_event_ident(ev->data), ev->timer.key);
 
-            ngx_rbtree_delete((ngx_rbtree_t **) &ngx_event_timer_rbtree,
-                              &ngx_event_timer_sentinel,
-                              (ngx_rbtree_t *) &ev->rbtree_key);
+            ngx_rbtree_delete(&ngx_event_timer_rbtree, &ev->timer);
 
             ngx_mutex_unlock(ngx_event_timer_mutex);
 
 #if (NGX_DEBUG)
-            ev->rbtree_left = NULL;
-            ev->rbtree_right = NULL;
-            ev->rbtree_parent = NULL;
+            ev->timer.left = NULL;
+            ev->timer.right = NULL;
+            ev->timer.parent = NULL;
 #endif
 
             ev->timer_set = 0;
diff --git a/src/event/ngx_event_timer.h b/src/event/ngx_event_timer.h
--- a/src/event/ngx_event_timer.h
+++ b/src/event/ngx_event_timer.h
@@ -29,8 +29,7 @@ extern ngx_mutex_t  *ngx_event_timer_mut
 #endif
 
 
-extern ngx_thread_volatile ngx_rbtree_t  *ngx_event_timer_rbtree;
-extern ngx_rbtree_t                       ngx_event_timer_sentinel;
+extern ngx_thread_volatile ngx_rbtree_t  ngx_event_timer_rbtree;
 
 
 static ngx_inline void
@@ -38,22 +37,20 @@ ngx_event_del_timer(ngx_event_t *ev)
 {
     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                    "event timer del: %d: %M",
-                    ngx_event_ident(ev->data), ev->rbtree_key);
+                    ngx_event_ident(ev->data), ev->timer.key);
 
     if (ngx_mutex_lock(ngx_event_timer_mutex) == NGX_ERROR) {
         return;
     }
 
-    ngx_rbtree_delete((ngx_rbtree_t **) &ngx_event_timer_rbtree,
-                      &ngx_event_timer_sentinel,
-                      (ngx_rbtree_t *) &ev->rbtree_key);
+    ngx_rbtree_delete(&ngx_event_timer_rbtree, &ev->timer);
 
     ngx_mutex_unlock(ngx_event_timer_mutex);
 
 #if (NGX_DEBUG)
-    ev->rbtree_left = NULL;
-    ev->rbtree_right = NULL;
-    ev->rbtree_parent = NULL;
+    ev->timer.left = NULL;
+    ev->timer.right = NULL;
+    ev->timer.parent = NULL;
 #endif
 
     ev->timer_set = 0;
@@ -76,31 +73,29 @@ ngx_event_add_timer(ngx_event_t *ev, ngx
          * the rbtree operations for the fast connections.
          */
 
-        diff = (ngx_rbtree_key_int_t) (key - ev->rbtree_key);
+        diff = (ngx_rbtree_key_int_t) (key - ev->timer.key);
 
         if (ngx_abs(diff) < NGX_TIMER_LAZY_DELAY) {
             ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                            "event timer: %d, old: %M, new: %M",
-                            ngx_event_ident(ev->data), ev->rbtree_key, key);
+                            ngx_event_ident(ev->data), ev->timer.key, key);
             return;
         }
 
         ngx_del_timer(ev);
     }
 
-    ev->rbtree_key = key;
+    ev->timer.key = key;
 
     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                    "event timer add: %d: %M:%M",
-                    ngx_event_ident(ev->data), timer, ev->rbtree_key);
+                    ngx_event_ident(ev->data), timer, ev->timer.key);
 
     if (ngx_mutex_lock(ngx_event_timer_mutex) == NGX_ERROR) {
         return;
     }
 
-    ngx_rbtree_insert((ngx_rbtree_t **) &ngx_event_timer_rbtree,
-                      &ngx_event_timer_sentinel,
-                      (ngx_rbtree_t *) &ev->rbtree_key);
+    ngx_rbtree_insert(&ngx_event_timer_rbtree, &ev->timer);
 
     ngx_mutex_unlock(ngx_event_timer_mutex);
 
diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -75,16 +75,16 @@ static ngx_int_t ngx_http_charset_postco
 static ngx_command_t  ngx_http_charset_filter_commands[] = {
 
     { ngx_string("charset"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF
-                        |NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF
+                        |NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
       ngx_http_set_charset_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_charset_loc_conf_t, charset),
       NULL },
 
     { ngx_string("source_charset"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF
-                        |NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF
+                        |NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
       ngx_http_set_charset_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_charset_loc_conf_t, source_charset),
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
--- a/src/http/modules/ngx_http_ssi_filter_module.c
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
@@ -1130,14 +1130,15 @@ ngx_http_ssi_parse(ngx_http_request_t *r
 
         case ssi_double_quoted_value_state:
             switch (ch) {
+            case '"':
+                state = ssi_postparam_state;
+                break;
+
             case '\\':
                 ctx->saved_state = ssi_double_quoted_value_state;
                 state = ssi_quoted_symbol_state;
-                break;
-
-            case '"':
-                state = ssi_postparam_state;
-                break;
+
+                /* fall through */
 
             default:
                 ctx->param->value.data[ctx->param->value.len++] = ch;
@@ -1157,14 +1158,15 @@ ngx_http_ssi_parse(ngx_http_request_t *r
 
         case ssi_quoted_value_state:
             switch (ch) {
+            case '\'':
+                state = ssi_postparam_state;
+                break;
+
             case '\\':
                 ctx->saved_state = ssi_quoted_value_state;
                 state = ssi_quoted_symbol_state;
-                break;
-
-            case '\'':
-                state = ssi_postparam_state;
-                break;
+
+                /* fall through */
 
             default:
                 ctx->param->value.data[ctx->param->value.len++] = ch;
@@ -1183,6 +1185,20 @@ ngx_http_ssi_parse(ngx_http_request_t *r
             break;
 
         case ssi_quoted_symbol_state:
+            state = ctx->saved_state;
+
+            if (ch == '\\') {
+                break;
+            }
+
+            if (ch == '"' && state == ssi_double_quoted_value_state) {
+                break;
+            }
+
+            if (ch == '\'' && state == ssi_quoted_value_state) {
+                break;
+            }
+
             ctx->param->value.data[ctx->param->value.len++] = ch;
 
             if (ctx->param->value.len == ctx->value_len) {
@@ -1197,7 +1213,6 @@ ngx_http_ssi_parse(ngx_http_request_t *r
                 }
             }
 
-            state = ctx->saved_state;
             break;
 
         case ssi_postparam_state:
@@ -1486,13 +1501,25 @@ ngx_http_ssi_evaluate_string(ngx_http_re
             }
 
         } else {
-            part.len = 0;
             part.data = &text->data[i];
 
-            while (i < text->len && text->data[i] != '$') {
-                i++;
-                part.len++;
+            for (p = part.data; i < text->len; i++) {
+                ch = text->data[i];
+
+                if (ch == '$') {
+                    if (text->data[i - 1] != '\\') {
+                        break;
+                    }
+
+                    *(p - 1) = ch;
+
+                    continue;
+                }
+
+                *p++ = ch;
             }
+
+            part.len = p - part.data;
         }
 
         len += part.len;
diff --git a/src/imap/ngx_imap_auth_http_module.c b/src/imap/ngx_imap_auth_http_module.c
--- a/src/imap/ngx_imap_auth_http_module.c
+++ b/src/imap/ngx_imap_auth_http_module.c
@@ -1122,7 +1122,7 @@ ngx_imap_auth_http(ngx_conf_t *cf, ngx_c
         ahcf->uri = inet_upstream.uri;
     }
 
-    if (ahcf->uri.len) {
+    if (ahcf->uri.len == 0) {
         ahcf->uri.len = sizeof("/") - 1;
         ahcf->uri.data = (u_char *) "/";
     }
diff --git a/src/os/unix/ngx_freebsd_rfork_thread.h b/src/os/unix/ngx_freebsd_rfork_thread.h
--- a/src/os/unix/ngx_freebsd_rfork_thread.h
+++ b/src/os/unix/ngx_freebsd_rfork_thread.h
@@ -14,7 +14,6 @@
 
 typedef pid_t  ngx_tid_t;
 
-#undef ngx_log_pid
 #define ngx_log_pid    ngx_thread_self()
 #define ngx_log_tid    0
 
diff --git a/src/os/unix/ngx_process.h b/src/os/unix/ngx_process.h
--- a/src/os/unix/ngx_process.h
+++ b/src/os/unix/ngx_process.h
@@ -51,7 +51,11 @@ typedef struct {
 
 
 #define ngx_getpid   getpid
+
+#ifndef ngx_log_pid
 #define ngx_log_pid  ngx_pid
+#endif
+
 
 ngx_pid_t ngx_spawn_process(ngx_cycle_t *cycle,
     ngx_spawn_proc_pt proc, void *data, char *name, ngx_int_t respawn);
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -703,7 +703,7 @@ ngx_worker_process_cycle(ngx_cycle_t *cy
 
     for ( ;; ) {
         if (ngx_exiting
-            && ngx_event_timer_rbtree == &ngx_event_timer_sentinel)
+            && ngx_event_timer_rbtree.root == ngx_event_timer_rbtree.sentinel)
         {
             ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");