diff --exclude='*~' --exclude='*.orig' --exclude='*.rej' -ur httpd-2.2.21.orig/modules/dav/fs/repos.c httpd-2.2.21/modules/dav/fs/repos.c
--- httpd-2.2.21.orig/modules/dav/fs/repos.c	2012-01-30 14:42:43.000000000 +0100
+++ httpd-2.2.21/modules/dav/fs/repos.c	2012-01-30 14:50:17.000000000 +0100
@@ -1418,6 +1418,7 @@
     int isdir = fsctx->res1.collection;
     apr_finfo_t dirent;
     apr_dir_t *dirp;
+    apr_pool_t *subpool;
 
     /* ensure the context is prepared properly, then call the func */
     err = (*params->func)(&fsctx->wres,
@@ -1459,10 +1460,13 @@
         /* ### need a better error */
         return dav_new_error(pool, HTTP_NOT_FOUND, 0, NULL);
     }
+    apr_pool_create(&subpool, pool);
     while ((apr_dir_read(&dirent, APR_FINFO_DIRENT, dirp)) == APR_SUCCESS) {
         apr_size_t len;
         apr_status_t status;
 
+        apr_pool_clear(subpool);
+
         len = strlen(dirent.name);
 
         /* avoid recursing into our current, parent, or state directories */
@@ -1490,7 +1494,7 @@
         dav_buffer_place_mem(pool, &fsctx->path1, dirent.name, len + 1, 0);
 
         status = apr_stat(&fsctx->info1.finfo, fsctx->path1.buf,
-                          DAV_FINFO_MASK, pool);
+                          DAV_FINFO_MASK, subpool);
         if (status != APR_SUCCESS && status != APR_INCOMPLETE) {
             /* woah! where'd it go? */
             /* ### should have a better error here */
@@ -1562,6 +1566,8 @@
 
     /* ### check the return value of this? */
     apr_dir_close(dirp);
+    apr_pool_destroy(subpool);
+    subpool = NULL;
 
     if (err != NULL)
         return err;