nginx-0.3.1-RELEASE import

    *) Bugfix: the segmentation fault occurred when the signal queue
       overflowed if the "rtsig" method was used; the bug had appeared in
       0.2.0.

    *) Change: correct handling of the "\\", "\"", "\'", and "\$" pairs in
       SSI.
diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml
index 4d67ea3..0726a1f 100644
--- a/docs/xml/nginx/changes.xml
+++ b/docs/xml/nginx/changes.xml
@@ -9,12 +9,39 @@
 <title lang="en">nginx changelog</title>
 
 
+<changes ver="0.3.1" date="10.10.2005">
+
+<change type="bugfix">
+<para lang="ru">
+×Ï ×ÒÅÍÑ ÐÅÒÅÐÏÌÎÅÎÉÑ ÏÞÅÒÅÄÉ ÓÉÇÎÁÌÏ× ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÍÅÔÏÄÁ rtsig
+ÐÒÏÉÓÈÏÄÉÌ segmentation fault;
+ÏÛÉÂËÁ ÐÏÑ×ÉÌÁÓØ × 0.2.0.
+</para>
+<para lang="en">
+the segmentation fault occurred when the signal queue overflowed
+if the "rtsig" method was used;
+bug appeared in 0.2.0.
+</para>
+</change>
+
+<change type="change">
+<para lang="ru">
+ËÏÒÒÅËÔÎÁÑ ÏÂÒÁÂÏÔËÁ ÐÁÒ "\\", "\"", "\'" É "\$" × SSI.
+</para>
+<para lang="en">
+correct handling of the "\\", "\"", "\'", and "\$" pairs in SSI.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="0.3.0" date="07.10.2005">
 
 <change type="change">
 <para lang="ru">
 ÕÂÒÁÎÏ ÄÅÓÑÔÉÄÎÅ×ÎÏÅ ÏÇÒÁÎÉÞÅÎÉÅ ×ÒÅÍÅÎÉ ÒÁÂÏÔÙ ÒÁÂÏÞÅÇÏ ÐÒÏÃÅÓÓÁ.
-ïÇÒÁÎÉÞÅÎÉÅ ÂÙÌÏ ××ÅÄÅÎÏ ÉÚ-ÚÁ ÐÅÒÅÐÏÌÎÅÎÉÑ ÔÁÊÍÅÒÏ× ÍÉÌÌÉÓÅËÕÎÄ.
+ïÇÒÁÎÉÞÅÎÉÅ ÂÙÌÏ ××ÅÄÅÎÏ ÉÚ-ÚÁ ÐÅÒÅÐÏÌÎÅÎÉÑ ÍÉÌÌÉÓÅËÕÎÄÎÙÈ ÔÁÊÍÅÒÏ×.
 </para>
 <para lang="en">
 the 10-days live time limit of worker process was eliminated.
diff --git a/src/core/nginx.h b/src/core/nginx.h
index 734c401..22c632f 100644
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -8,7 +8,7 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define NGINX_VER          "nginx/0.3.0"
+#define NGINX_VER          "nginx/0.3.1"
 
 #define NGINX_VAR          "NGINX"
 #define NGX_OLDPID_EXT     ".oldbin"
diff --git a/src/core/ngx_core.h b/src/core/ngx_core.h
index 27058bf..9efbecd 100644
--- a/src/core/ngx_core.h
+++ b/src/core/ngx_core.h
@@ -35,15 +35,15 @@
 #define  NGX_ABORT      -6
 
 
+#include <ngx_errno.h>
 #include <ngx_atomic.h>
+#include <ngx_thread.h>
 #include <ngx_rbtree.h>
 #include <ngx_time.h>
 #include <ngx_socket.h>
-#include <ngx_errno.h>
 #include <ngx_types.h>
 #include <ngx_shared.h>
 #include <ngx_process.h>
-#include <ngx_thread.h>
 #include <ngx_user.h>
 #include <ngx_string.h>
 #include <ngx_parse.h>
diff --git a/src/core/ngx_rbtree.c b/src/core/ngx_rbtree.c
index 1ebc56a..3c42be4 100644
--- a/src/core/ngx_rbtree.c
+++ b/src/core/ngx_rbtree.c
@@ -9,8 +9,8 @@
 
 
 /*
- * The code is based on the algorithm described in the "Introduction
- * to Algorithms" by Cormen, Leiserson and Rivest.
+ * The red-black tree code is based on the algorithm described in
+ * the "Introduction to Algorithms" by Cormen, Leiserson and Rivest.
  */
 
 #define ngx_rbt_red(node)           ((node)->color = 1)
@@ -20,20 +20,23 @@
 #define ngx_rbt_copy_color(n1, n2)  (n1->color = n2->color)
 
 
-static ngx_inline void ngx_rbtree_left_rotate(ngx_rbtree_t **root,
-    ngx_rbtree_t *sentinel, ngx_rbtree_t *node);
-static ngx_inline void ngx_rbtree_right_rotate(ngx_rbtree_t **root,
-    ngx_rbtree_t *sentinel, ngx_rbtree_t *node);
+static ngx_inline void ngx_rbtree_left_rotate(ngx_rbtree_node_t **root,
+    ngx_rbtree_node_t *sentinel, ngx_rbtree_node_t *node);
+static ngx_inline void ngx_rbtree_right_rotate(ngx_rbtree_node_t **root,
+    ngx_rbtree_node_t *sentinel, ngx_rbtree_node_t *node);
 
 
 void
-ngx_rbtree_insert(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_insert(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node)
 {
-    ngx_rbtree_t  *temp;
+    ngx_rbtree_node_t  **root, *temp, *sentinel;
 
     /* a binary tree insert */
 
+    root = (ngx_rbtree_node_t **) &tree->root;
+    sentinel = tree->sentinel;
+
     if (*root == sentinel) {
         node->parent = NULL;
         node->left = sentinel;
@@ -44,6 +47,17 @@
         return;
     }
 
+    /*
+     * The rbtree is currently used by event timers only.  Timer values
+     * 1) are spread in small range, usually several minutes,
+     * 2) and overflow each 49 days, if milliseconds are stored in 32 bits.
+     * The below comparison takes into account that overflow.
+     *
+     * If there will be a necessity to use the rbtree for values with
+     * other comparison rules, then a whole "for ( ;; )" loop should
+     * be made as tree->insert() function.
+     */
+
     temp = *root;
 
     for ( ;; ) {
@@ -130,14 +144,17 @@
 
 
 void
-ngx_rbtree_delete(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_delete(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node)
 {
-    ngx_int_t      is_red;
-    ngx_rbtree_t  *subst, *temp, *w;
+    ngx_int_t            is_red;
+    ngx_rbtree_node_t  **root, *sentinel, *subst, *temp, *w;
 
     /* a binary tree delete */
 
+    root = (ngx_rbtree_node_t **) &tree->root;
+    sentinel = tree->sentinel;
+
     if (node->left == sentinel) {
         temp = node->right;
         subst = node;
@@ -295,10 +312,10 @@
 
 
 static ngx_inline void
-ngx_rbtree_left_rotate(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_left_rotate(ngx_rbtree_node_t **root, ngx_rbtree_node_t *sentinel,
+    ngx_rbtree_node_t *node)
 {
-    ngx_rbtree_t  *temp;
+    ngx_rbtree_node_t  *temp;
 
     temp = node->right;
     node->right = temp->left;
@@ -325,10 +342,10 @@
 
 
 static ngx_inline void
-ngx_rbtree_right_rotate(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node)
+ngx_rbtree_right_rotate(ngx_rbtree_node_t **root, ngx_rbtree_node_t *sentinel,
+    ngx_rbtree_node_t *node)
 {
-    ngx_rbtree_t  *temp;
+    ngx_rbtree_node_t  *temp;
 
     temp = node->left;
     node->left = temp->right;
diff --git a/src/core/ngx_rbtree.h b/src/core/ngx_rbtree.h
index d6803f9..1b1322d 100644
--- a/src/core/ngx_rbtree.h
+++ b/src/core/ngx_rbtree.h
@@ -16,25 +16,37 @@
 typedef ngx_int_t   ngx_rbtree_key_int_t;
 
 
-typedef struct ngx_rbtree_s  ngx_rbtree_t;
+typedef struct ngx_rbtree_node_s  ngx_rbtree_node_t;
 
-struct ngx_rbtree_s {
-    ngx_rbtree_key_t   key;
-    ngx_rbtree_t      *left;
-    ngx_rbtree_t      *right;
-    ngx_rbtree_t      *parent;
-    char               color;
+struct ngx_rbtree_node_s {
+    ngx_rbtree_key_t       key;
+    ngx_rbtree_node_t     *left;
+    ngx_rbtree_node_t     *right;
+    ngx_rbtree_node_t     *parent;
+    char                   color;
 };
 
 
-void ngx_rbtree_insert(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node);
-void ngx_rbtree_delete(ngx_rbtree_t **root, ngx_rbtree_t *sentinel,
-    ngx_rbtree_t *node);
+typedef struct ngx_rbtree_s  ngx_rbtree_t;
+
+typedef ngx_rbtree_t *(*ngx_rbtree_insert_pt) (ngx_rbtree_node_t *root,
+    ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel);
+
+struct ngx_rbtree_s {
+    ngx_rbtree_node_t     *root;
+    ngx_rbtree_node_t     *sentinel;
+ /* ngx_rbtree_insert_pt   insert; */
+};
 
 
-static ngx_inline ngx_rbtree_t *
-ngx_rbtree_min(ngx_rbtree_t *node, ngx_rbtree_t *sentinel)
+void ngx_rbtree_insert(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node);
+void ngx_rbtree_delete(ngx_thread_volatile ngx_rbtree_t *tree,
+    ngx_rbtree_node_t *node);
+
+
+static ngx_inline ngx_rbtree_node_t *
+ngx_rbtree_min(ngx_rbtree_node_t *node, ngx_rbtree_node_t *sentinel)
 {
     while (node->left != sentinel) {
         node = node->left;
diff --git a/src/event/modules/ngx_epoll_module.c b/src/event/modules/ngx_epoll_module.c
index 177c05d..a53b8eb 100644
--- a/src/event/modules/ngx_epoll_module.c
+++ b/src/event/modules/ngx_epoll_module.c
@@ -405,7 +405,6 @@
 
     if (timer == NGX_TIMER_INFINITE || timer > 500) {
         timer = 500;
-        break;
     }
 
 #endif
diff --git a/src/event/modules/ngx_kqueue_module.c b/src/event/modules/ngx_kqueue_module.c
index ee55915..99342ab 100644
--- a/src/event/modules/ngx_kqueue_module.c
+++ b/src/event/modules/ngx_kqueue_module.c
@@ -462,7 +462,6 @@
 
     if (timer == NGX_TIMER_INFINITE || timer > 500) {
         timer = 500;
-        break;
     }
 
 #endif
diff --git a/src/event/modules/ngx_rtsig_module.c b/src/event/modules/ngx_rtsig_module.c
index fdbbb2f..f88dd5d 100644
--- a/src/event/modules/ngx_rtsig_module.c
+++ b/src/event/modules/ngx_rtsig_module.c
@@ -307,7 +307,6 @@
 
         if (timer == NGX_TIMER_INFINITE || timer > 500) {
             timer = 500;
-            break;
         }
 
 #endif
@@ -578,7 +577,7 @@
 
             c = cycle->files[overflow_current++];
 
-            if (c->fd == -1) {
+            if (c == NULL || c->fd == -1) {
                 continue;
             }
 
@@ -634,6 +633,10 @@
         for (i = 0; i < n; i++) {
             c = cycle->files[overflow_list[i].fd];
 
+            if (c == NULL) {
+                continue;
+            }
+
             rev = c->read;
 
             if (rev->active
diff --git a/src/event/ngx_event.h b/src/event/ngx_event.h
index 308d460..9d917ea 100644
--- a/src/event/ngx_event.h
+++ b/src/event/ngx_event.h
@@ -130,18 +130,7 @@
 
     ngx_log_t       *log;
 
-    /* TODO: threads: padding to cache line */
-
-    /*
-     * STUB: The inline of "ngx_rbtree_t  rbtree;"
-     */
-
-    ngx_rbtree_key_t   rbtree_key;
-    void              *rbtree_left;
-    void              *rbtree_right;
-    void              *rbtree_parent;
-    char               rbtree_color;
-
+    ngx_rbtree_node_t   timer;
 
     unsigned         closed:1;
 
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 49640fa..48a03a1 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -144,6 +144,10 @@
 ngx_int_t
 ngx_ssl_generate_rsa512_key(ngx_ssl_t *ssl)
 {
+    if (SSL_CTX_need_tmp_RSA(ssl->ctx) == 0) {
+        return NGX_OK;
+    }
+
     ssl->rsa512_key = RSA_generate_key(512, RSA_F4, NULL, NULL);
 
     if (ssl->rsa512_key) {
@@ -851,7 +855,10 @@
 {
    ngx_ssl_t  *ssl = data;
 
-   RSA_free(ssl->rsa512_key);
+   if (ssl->rsa512_key) {
+       RSA_free(ssl->rsa512_key);
+   }
+
    SSL_CTX_free(ssl->ctx);
 }
 
diff --git a/src/event/ngx_event_timer.c b/src/event/ngx_event_timer.c
index c3d3c7e..656f62b 100644
--- a/src/event/ngx_event_timer.c
+++ b/src/event/ngx_event_timer.c
@@ -14,27 +14,28 @@
 #endif
 
 
-ngx_thread_volatile ngx_rbtree_t  *ngx_event_timer_rbtree;
-ngx_rbtree_t                       ngx_event_timer_sentinel;
+ngx_thread_volatile ngx_rbtree_t  ngx_event_timer_rbtree;
+static ngx_rbtree_node_t          ngx_event_timer_sentinel;
 
 
 ngx_int_t
 ngx_event_timer_init(ngx_log_t *log)
 {
-    if (ngx_event_timer_rbtree) {
+    ngx_event_timer_rbtree.root = &ngx_event_timer_sentinel;
+    ngx_event_timer_rbtree.sentinel = &ngx_event_timer_sentinel;
+
 #if (NGX_THREADS)
+
+    if (ngx_event_timer_mutex) {
         ngx_event_timer_mutex->log = log;
-#endif
         return NGX_OK;
     }
 
-    ngx_event_timer_rbtree = &ngx_event_timer_sentinel;
-
-#if (NGX_THREADS)
     ngx_event_timer_mutex = ngx_mutex_init(log, 0);
     if (ngx_event_timer_mutex == NULL) {
         return NGX_ERROR;
     }
+
 #endif
 
     return NGX_OK;
@@ -44,10 +45,10 @@
 ngx_msec_t
 ngx_event_find_timer(void)
 {
-    ngx_msec_t     timer;
-    ngx_rbtree_t  *node;
+    ngx_rbtree_key_int_t   timer;
+    ngx_rbtree_node_t     *node, *root, *sentinel;
 
-    if (ngx_event_timer_rbtree == &ngx_event_timer_sentinel) {
+    if (ngx_event_timer_rbtree.root == &ngx_event_timer_sentinel) {
         return NGX_TIMER_INFINITE;
     }
 
@@ -55,35 +56,41 @@
         return NGX_TIMER_ERROR;
     }
 
-    node = ngx_rbtree_min((ngx_rbtree_t *) ngx_event_timer_rbtree,
-                          &ngx_event_timer_sentinel);
+    root = ngx_event_timer_rbtree.root;
+    sentinel = ngx_event_timer_rbtree.sentinel;
+
+    node = ngx_rbtree_min(root, sentinel);
 
     ngx_mutex_unlock(ngx_event_timer_mutex);
 
-    timer = (ngx_msec_t) node->key - ngx_current_time;
+    timer = (ngx_rbtree_key_int_t) node->key
+                                     - (ngx_rbtree_key_int_t) ngx_current_time;
 
-    return timer > 0 ? timer : 0 ;
+    return (ngx_msec_t) (timer > 0 ? timer : 0);
 }
 
 
 void
 ngx_event_expire_timers(void)
 {
-    ngx_event_t   *ev;
-    ngx_rbtree_t  *node;
+    ngx_event_t        *ev;
+    ngx_rbtree_node_t  *node, *root, *sentinel;
+
+    sentinel = ngx_event_timer_rbtree.sentinel;
 
     for ( ;; ) {
 
-        if (ngx_event_timer_rbtree == &ngx_event_timer_sentinel) {
-            return;
-        }
-
         if (ngx_mutex_lock(ngx_event_timer_mutex) == NGX_ERROR) {
             return;
         }
 
-        node = ngx_rbtree_min((ngx_rbtree_t *) ngx_event_timer_rbtree,
-                              &ngx_event_timer_sentinel);
+        root = ngx_event_timer_rbtree.root;
+
+        if (root == sentinel) {
+            return;
+        }
+
+        node = ngx_rbtree_min(root, sentinel);
 
         /* node->key <= ngx_current_time */
 
@@ -91,8 +98,7 @@
                                       - (ngx_rbtree_key_int_t) ngx_current_time
             <= 0)
         {
-            ev = (ngx_event_t *)
-                           ((char *) node - offsetof(ngx_event_t, rbtree_key));
+            ev = (ngx_event_t *) ((char *) node - offsetof(ngx_event_t, timer));
 
 #if (NGX_THREADS)
 
@@ -114,18 +120,16 @@
 
             ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                            "event timer del: %d: %M",
-                           ngx_event_ident(ev->data), ev->rbtree_key);
+                           ngx_event_ident(ev->data), ev->timer.key);
 
-            ngx_rbtree_delete((ngx_rbtree_t **) &ngx_event_timer_rbtree,
-                              &ngx_event_timer_sentinel,
-                              (ngx_rbtree_t *) &ev->rbtree_key);
+            ngx_rbtree_delete(&ngx_event_timer_rbtree, &ev->timer);
 
             ngx_mutex_unlock(ngx_event_timer_mutex);
 
 #if (NGX_DEBUG)
-            ev->rbtree_left = NULL;
-            ev->rbtree_right = NULL;
-            ev->rbtree_parent = NULL;
+            ev->timer.left = NULL;
+            ev->timer.right = NULL;
+            ev->timer.parent = NULL;
 #endif
 
             ev->timer_set = 0;
diff --git a/src/event/ngx_event_timer.h b/src/event/ngx_event_timer.h
index a9d3176..13b5c0a 100644
--- a/src/event/ngx_event_timer.h
+++ b/src/event/ngx_event_timer.h
@@ -29,8 +29,7 @@
 #endif
 
 
-extern ngx_thread_volatile ngx_rbtree_t  *ngx_event_timer_rbtree;
-extern ngx_rbtree_t                       ngx_event_timer_sentinel;
+extern ngx_thread_volatile ngx_rbtree_t  ngx_event_timer_rbtree;
 
 
 static ngx_inline void
@@ -38,22 +37,20 @@
 {
     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                    "event timer del: %d: %M",
-                    ngx_event_ident(ev->data), ev->rbtree_key);
+                    ngx_event_ident(ev->data), ev->timer.key);
 
     if (ngx_mutex_lock(ngx_event_timer_mutex) == NGX_ERROR) {
         return;
     }
 
-    ngx_rbtree_delete((ngx_rbtree_t **) &ngx_event_timer_rbtree,
-                      &ngx_event_timer_sentinel,
-                      (ngx_rbtree_t *) &ev->rbtree_key);
+    ngx_rbtree_delete(&ngx_event_timer_rbtree, &ev->timer);
 
     ngx_mutex_unlock(ngx_event_timer_mutex);
 
 #if (NGX_DEBUG)
-    ev->rbtree_left = NULL;
-    ev->rbtree_right = NULL;
-    ev->rbtree_parent = NULL;
+    ev->timer.left = NULL;
+    ev->timer.right = NULL;
+    ev->timer.parent = NULL;
 #endif
 
     ev->timer_set = 0;
@@ -76,31 +73,29 @@
          * the rbtree operations for the fast connections.
          */
 
-        diff = (ngx_rbtree_key_int_t) (key - ev->rbtree_key);
+        diff = (ngx_rbtree_key_int_t) (key - ev->timer.key);
 
         if (ngx_abs(diff) < NGX_TIMER_LAZY_DELAY) {
             ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                            "event timer: %d, old: %M, new: %M",
-                            ngx_event_ident(ev->data), ev->rbtree_key, key);
+                            ngx_event_ident(ev->data), ev->timer.key, key);
             return;
         }
 
         ngx_del_timer(ev);
     }
 
-    ev->rbtree_key = key;
+    ev->timer.key = key;
 
     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ev->log, 0,
                    "event timer add: %d: %M:%M",
-                    ngx_event_ident(ev->data), timer, ev->rbtree_key);
+                    ngx_event_ident(ev->data), timer, ev->timer.key);
 
     if (ngx_mutex_lock(ngx_event_timer_mutex) == NGX_ERROR) {
         return;
     }
 
-    ngx_rbtree_insert((ngx_rbtree_t **) &ngx_event_timer_rbtree,
-                      &ngx_event_timer_sentinel,
-                      (ngx_rbtree_t *) &ev->rbtree_key);
+    ngx_rbtree_insert(&ngx_event_timer_rbtree, &ev->timer);
 
     ngx_mutex_unlock(ngx_event_timer_mutex);
 
diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
index 51f115b..8eee358 100644
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -75,16 +75,16 @@
 static ngx_command_t  ngx_http_charset_filter_commands[] = {
 
     { ngx_string("charset"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF
-                        |NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF
+                        |NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
       ngx_http_set_charset_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_charset_loc_conf_t, charset),
       NULL },
 
     { ngx_string("source_charset"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF
-                        |NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF
+                        |NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
       ngx_http_set_charset_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_charset_loc_conf_t, source_charset),
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
index acbae29..5f9ee3a 100644
--- a/src/http/modules/ngx_http_ssi_filter_module.c
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
@@ -1130,15 +1130,16 @@
 
         case ssi_double_quoted_value_state:
             switch (ch) {
-            case '\\':
-                ctx->saved_state = ssi_double_quoted_value_state;
-                state = ssi_quoted_symbol_state;
-                break;
-
             case '"':
                 state = ssi_postparam_state;
                 break;
 
+            case '\\':
+                ctx->saved_state = ssi_double_quoted_value_state;
+                state = ssi_quoted_symbol_state;
+
+                /* fall through */
+
             default:
                 ctx->param->value.data[ctx->param->value.len++] = ch;
 
@@ -1157,15 +1158,16 @@
 
         case ssi_quoted_value_state:
             switch (ch) {
-            case '\\':
-                ctx->saved_state = ssi_quoted_value_state;
-                state = ssi_quoted_symbol_state;
-                break;
-
             case '\'':
                 state = ssi_postparam_state;
                 break;
 
+            case '\\':
+                ctx->saved_state = ssi_quoted_value_state;
+                state = ssi_quoted_symbol_state;
+
+                /* fall through */
+
             default:
                 ctx->param->value.data[ctx->param->value.len++] = ch;
 
@@ -1183,6 +1185,20 @@
             break;
 
         case ssi_quoted_symbol_state:
+            state = ctx->saved_state;
+
+            if (ch == '\\') {
+                break;
+            }
+
+            if (ch == '"' && state == ssi_double_quoted_value_state) {
+                break;
+            }
+
+            if (ch == '\'' && state == ssi_quoted_value_state) {
+                break;
+            }
+
             ctx->param->value.data[ctx->param->value.len++] = ch;
 
             if (ctx->param->value.len == ctx->value_len) {
@@ -1197,7 +1213,6 @@
                 }
             }
 
-            state = ctx->saved_state;
             break;
 
         case ssi_postparam_state:
@@ -1486,13 +1501,25 @@
             }
 
         } else {
-            part.len = 0;
             part.data = &text->data[i];
 
-            while (i < text->len && text->data[i] != '$') {
-                i++;
-                part.len++;
+            for (p = part.data; i < text->len; i++) {
+                ch = text->data[i];
+
+                if (ch == '$') {
+                    if (text->data[i - 1] != '\\') {
+                        break;
+                    }
+
+                    *(p - 1) = ch;
+
+                    continue;
+                }
+
+                *p++ = ch;
             }
+
+            part.len = p - part.data;
         }
 
         len += part.len;
diff --git a/src/imap/ngx_imap_auth_http_module.c b/src/imap/ngx_imap_auth_http_module.c
index 3cafa6f..bc98dc8 100644
--- a/src/imap/ngx_imap_auth_http_module.c
+++ b/src/imap/ngx_imap_auth_http_module.c
@@ -1122,7 +1122,7 @@
         ahcf->uri = inet_upstream.uri;
     }
 
-    if (ahcf->uri.len) {
+    if (ahcf->uri.len == 0) {
         ahcf->uri.len = sizeof("/") - 1;
         ahcf->uri.data = (u_char *) "/";
     }
diff --git a/src/os/unix/ngx_freebsd_rfork_thread.h b/src/os/unix/ngx_freebsd_rfork_thread.h
index 215d2dc..79e748a 100644
--- a/src/os/unix/ngx_freebsd_rfork_thread.h
+++ b/src/os/unix/ngx_freebsd_rfork_thread.h
@@ -14,7 +14,6 @@
 
 typedef pid_t  ngx_tid_t;
 
-#undef ngx_log_pid
 #define ngx_log_pid    ngx_thread_self()
 #define ngx_log_tid    0
 
diff --git a/src/os/unix/ngx_process.h b/src/os/unix/ngx_process.h
index 06ff21c..a34ca61 100644
--- a/src/os/unix/ngx_process.h
+++ b/src/os/unix/ngx_process.h
@@ -51,7 +51,11 @@
 
 
 #define ngx_getpid   getpid
+
+#ifndef ngx_log_pid
 #define ngx_log_pid  ngx_pid
+#endif
+
 
 ngx_pid_t ngx_spawn_process(ngx_cycle_t *cycle,
     ngx_spawn_proc_pt proc, void *data, char *name, ngx_int_t respawn);
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index 97475e6..029de43 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -703,7 +703,7 @@
 
     for ( ;; ) {
         if (ngx_exiting
-            && ngx_event_timer_rbtree == &ngx_event_timer_sentinel)
+            && ngx_event_timer_rbtree.root == ngx_event_timer_rbtree.sentinel)
         {
             ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");