diff -urN httpd-2.2.15.orig/modules/generators/mod_cgi.c httpd-2.2.15/modules/generators/mod_cgi.c
--- httpd-2.2.15.orig/modules/generators/mod_cgi.c	2007-07-17 19:16:09.000000000 +0200
+++ httpd-2.2.15/modules/generators/mod_cgi.c	2010-05-08 21:57:41.000000000 +0200
@@ -627,17 +627,15 @@
 static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
                                     const char **str, apr_size_t *len)
 {
-    char *buf;
+    char buf[APR_BUCKET_BUFF_SIZE];
     apr_status_t rv;
 
     *str = NULL;
-    *len = APR_BUCKET_BUFF_SIZE;
-    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
+    *len = sizeof(buf);
 
     rv = apr_file_read(out, buf, len);
 
     if (rv != APR_SUCCESS && rv != APR_EOF) {
-        apr_bucket_free(buf);
         return rv;
     }
 
@@ -646,14 +644,12 @@
         apr_bucket_heap *h;
 
         /* Change the current bucket to refer to what we read */
-        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
+        a = apr_bucket_heap_make(a, buf, *len, NULL);
         h = a->data;
-        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
-        *str = buf;
+        *str = h->base;
         APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
     }
     else {
-        apr_bucket_free(buf);
         a = apr_bucket_immortal_make(a, "", 0);
         *str = a->data;
     }