diff -ruN httpd-2.2.17.orig/srclib/apr/misc/win32/start.c httpd-2.2.17/srclib/apr/misc/win32/start.c
--- httpd-2.2.17.orig/srclib/apr/misc/win32/start.c	2007-08-26 17:19:56.000000000 +0100
+++ httpd-2.2.17/srclib/apr/misc/win32/start.c	2011-02-09 12:33:36.876444100 +0000
@@ -45,7 +45,9 @@
     apr_size_t totlen;
     apr_size_t newlen;
     apr_size_t wsize;
-    char **newarr;
+    char **env;
+    char *pstrs;
+    char *strs;
     int arg;
 
     if (args < 0) {
@@ -55,37 +57,40 @@
     }
     wsize = 1 + wch - arrsz;
 
-    newarr = apr_malloc_dbg((args + 1) * sizeof(char *),
-                            __FILE__, __LINE__);
-
-    /* This is a safe max allocation, we will realloc after
-     * processing and return the excess to the free store.
+    /* This is a safe max allocation, we will alloc each
+     * string exactly after processing and return this
+     * temporary buffer to the free store.
      * 3 ucs bytes hold any single wchar_t value (16 bits)
      * 4 ucs bytes will hold a wchar_t pair value (20 bits)
      */
     newlen = totlen = wsize * 3 + 1;
-    newarr[0] = apr_malloc_dbg(newlen * sizeof(char),
-                               __FILE__, __LINE__);
+    pstrs = strs = apr_malloc_dbg(newlen * sizeof(char),
+                                  __FILE__, __LINE__);
 
-    (void)apr_conv_ucs2_to_utf8(arrsz, &wsize,
-                                newarr[0], &newlen);
+    (void)apr_conv_ucs2_to_utf8(arrsz, &wsize, strs, &newlen);
 
     assert(newlen && !wsize);
-    /* Return to the free store if the heap realloc is the least bit optimized
-     */
-    newarr[0] = apr_realloc_dbg(newarr[0], totlen - newlen,
-                                __FILE__, __LINE__);
 
-    for (arg = 1; arg < args; ++arg) {
-        newarr[arg] = newarr[arg - 1] + 2;
-        while (*(newarr[arg]++)) {
-            /* continue */;
-        }
+    *retarr = env = apr_malloc_dbg((args + 1) * sizeof(char*),
+                                   __FILE__, __LINE__);
+    for (arg = 0; arg < args; ++arg) {
+        char* p = pstrs;
+        int len = 0;
+        while (*p++)
+            ++len;
+        len += 1;
+
+        *env = apr_malloc_dbg(len * sizeof(char),
+                              __FILE__, __LINE__);
+        memcpy(*env, pstrs, len * sizeof(char));
+
+        pstrs += len;
+        ++env;
     }
 
-    newarr[arg] = NULL;
+    *env = NULL;
+    free(strs);
 
-    *retarr = newarr;
     return args;
 }
 #endif