nginx-0.3.55-RELEASE import

    *) Feature: the "stub" parameter in the "include" SSI command.

    *) Feature: the "block" SSI command.

    *) Feature: the unicode2nginx script was added to contrib.

    *) Bugfix: if a "root" was specified by variable only, then the root
       was relative to a server prefix.

    *) Bugfix: if the request contained "//" or "/./" and escaped symbols
       after them, then the proxied request was sent unescaped.

    *) Bugfix: the $r->headers_in("Cookie") of the ngx_http_perl_module now
       returns all "Cookie" header lines.

    *) Bugfix: a segmentation fault occurred if
       "client_body_in_file_only on" was used and nginx switched to a next
       upstream.

    *) Bugfix: on some condition while reconfiguration character codes
       inside the "charset_map" may be treated invalid; the bug had
       appeared in 0.3.50.

src/http/ngx_http_core_module.c

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index ee0d3ca..eb4934e 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -426,7 +426,7 @@
 };
 
 
-ngx_http_module_t  ngx_http_core_module_ctx = {
+static ngx_http_module_t  ngx_http_core_module_ctx = {
     ngx_http_core_preconfiguration,        /* preconfiguration */
     NULL,                                  /* postconfiguration */
 
@@ -1071,13 +1071,19 @@
         last = ngx_copy(path->data, clcf->root.data, clcf->root.len);
 
     } else {
-        last = ngx_http_script_run(r, path, clcf->root_lengths->elts, reserved,
-                                   clcf->root_values->elts);
-        if (last == NULL) {
+        if (ngx_http_script_run(r, path, clcf->root_lengths->elts, reserved,
+                               clcf->root_values->elts)
+            == NULL)
+        {
+            return NULL;
+        }
+
+        if (ngx_conf_full_name((ngx_cycle_t *) ngx_cycle, path) == NGX_ERROR) {
             return NULL;
         }
 
         r->root_length = path->len - reserved;
+        last = path->data + r->root_length;
     }
 
     last = ngx_cpystrn(last, r->uri.data + alias, r->uri.len - alias + 1);
@@ -1158,7 +1164,7 @@
 
 ngx_int_t
 ngx_http_subrequest(ngx_http_request_t *r,
-    ngx_str_t *uri, ngx_str_t *args, ngx_uint_t flags)
+    ngx_str_t *uri, ngx_str_t *args, ngx_chain_t *out, ngx_uint_t flags)
 {
     ngx_connection_t              *c;
     ngx_http_request_t            *sr;
@@ -1239,6 +1245,7 @@
         return NGX_ERROR;
     }
 
+    sr->out = out;
     sr->main = r->main;
     sr->parent = r;
     sr->read_event_handler = ngx_http_request_empty_handler;
@@ -2527,8 +2534,10 @@
         lcf->root.len--;
     }
 
-    if (ngx_conf_full_name(cf->cycle, &lcf->root) == NGX_ERROR) {
-        return NGX_CONF_ERROR;
+    if (lcf->root.data[0] != '$') {
+        if (ngx_conf_full_name(cf->cycle, &lcf->root) == NGX_ERROR) {
+            return NGX_CONF_ERROR;
+        }
     }
 
     n = ngx_http_script_variables_count(&lcf->root);