Index: modules/ssl/ssl_engine_vars.c
===================================================================
--- modules/ssl/ssl_engine_vars.c	(revision 574917)
+++ modules/ssl/ssl_engine_vars.c	(working copy)
@@ -46,7 +46,7 @@
 static char *ssl_var_lookup_ssl_cert_verify(apr_pool_t *p, conn_rec *c);
 static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, conn_rec *c, char *var);
 static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
-static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
+static char *ssl_var_lookup_ssl_version(apr_pool_t *pp, apr_pool_t *p, char *var);
 
 static int ssl_is_https(conn_rec *c)
 {
@@ -166,7 +166,7 @@
      */
     if (result == NULL) {
         if (strlen(var) > 12 && strcEQn(var, "SSL_VERSION_", 12))
-            result = ssl_var_lookup_ssl_version(p, var+12);
+            result = ssl_var_lookup_ssl_version(s->process->pool, p, var+12);
         else if (strcEQ(var, "SERVER_SOFTWARE"))
             result = (char *)ap_get_server_version();
         else if (strcEQ(var, "API_VERSION")) {
@@ -247,7 +247,8 @@
 
     ssl = sslconn->ssl;
     if (strlen(var) > 8 && strcEQn(var, "VERSION_", 8)) {
-        result = ssl_var_lookup_ssl_version(p, var+8);
+        result = ssl_var_lookup_ssl_version(c->base_server->process->pool,
+                                            p, var+8);
     }
     else if (ssl != NULL && strcEQ(var, "PROTOCOL")) {
         result = (char *)SSL_get_version(ssl);
@@ -567,7 +568,7 @@
     return;
 }
 
-static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var)
+static char *ssl_var_lookup_ssl_version(apr_pool_t *pp, apr_pool_t *p, char *var)
 {
     static char interface[] = "mod_ssl/" MOD_SSL_VERSION;
     static char library_interface[] = SSL_LIBRARY_TEXT;
@@ -576,7 +577,7 @@
   
     if (!library) {
         char *cp, *cp2;
-        library = apr_pstrdup(p, SSL_LIBRARY_DYNTEXT);
+        library = apr_pstrdup(pp, SSL_LIBRARY_DYNTEXT);
         if ((cp = strchr(library, ' ')) != NULL) {
             *cp = '/';
             if ((cp2 = strchr(cp, ' ')) != NULL)