Index: squid-3.3.13/src/HttpRequest.cc
===================================================================
--- squid-3.3.13.orig/src/HttpRequest.cc
+++ squid-3.3.13/src/HttpRequest.cc
@@ -112,7 +112,7 @@ HttpRequest::init()
     errDetail = ERR_DETAIL_NONE;
     peer_login = NULL;		// not allocated/deallocated by this class
     peer_domain = NULL;		// not allocated/deallocated by this class
-    vary_headers = NULL;
+    vary_headers = SBuf();
     myportname = null_string;
     tag = null_string;
 #if USE_AUTH
@@ -145,8 +145,7 @@ HttpRequest::clean()
 #endif
     safe_free(canonical);
 
-    safe_free(vary_headers);
-
+    vary_headers.clear();
     urlpath.clean();
 
     header.clean();
@@ -220,7 +219,7 @@ HttpRequest::clone() const
 
     copy->lastmod = lastmod;
     copy->etag = etag;
-    copy->vary_headers = vary_headers ? xstrdup(vary_headers) : NULL;
+    copy->vary_headers = vary_headers;
     // XXX: what to do with copy->peer_domain?
 
     copy->tag = tag;
Index: squid-3.3.13/src/HttpRequest.h
===================================================================
--- squid-3.3.13.orig/src/HttpRequest.h
+++ squid-3.3.13/src/HttpRequest.h
@@ -38,6 +38,7 @@
 #include "HttpMsg.h"
 #include "HttpRequestMethod.h"
 #include "RequestFlags.h"
+#include "SBuf.h"
 
 #if USE_AUTH
 #include "auth/UserRequest.h"
@@ -191,7 +192,8 @@ public:
 
     time_t lastmod;		/* Used on refreshes */
 
-    const char *vary_headers;	/* Used when varying entities are detected. Changes how the store key is calculated */
+    /// The variant second-stage cache key. Generated from Vary header pattern for this request.
+    SBuf vary_headers;
 
     char *peer_domain;		/* Configured peer forceddomain */
 
Index: squid-3.3.13/src/MemObject.cc
===================================================================
--- squid-3.3.13.orig/src/MemObject.cc
+++ squid-3.3.13/src/MemObject.cc
@@ -138,8 +138,6 @@ MemObject::~MemObject()
     safe_free(url);
 
     safe_free(log_url);    /* XXX account log_url */
-
-    safe_free(vary_headers);
 }
 
 void
@@ -226,8 +224,8 @@ MemObject::stat(MemBuf * mb) const
 {
     mb->Printf("\t%s %s\n",
                RequestMethodStr(method), log_url);
-    if (vary_headers)
-        mb->Printf("\tvary_headers: %s\n", vary_headers);
+    if (!vary_headers.isEmpty())
+        mb->Printf("\tvary_headers: " SQUIDSBUFPH "\n", SQUIDSBUFPRINT(vary_headers));
     mb->Printf("\tinmem_lo: %" PRId64 "\n", inmem_lo);
     mb->Printf("\tinmem_hi: %" PRId64 "\n", data_hdr.endOffset());
     mb->Printf("\tswapout: %" PRId64 " bytes queued\n",
Index: squid-3.3.13/src/MemObject.h
===================================================================
--- squid-3.3.13.orig/src/MemObject.h
+++ squid-3.3.13/src/MemObject.h
@@ -35,6 +35,7 @@
 #include "dlink.h"
 #include "HttpRequestMethod.h"
 #include "RemovalPolicy.h"
+#include "SBuf.h"
 #include "stmem.h"
 #include "StoreIOBuffer.h"
 #include "StoreIOState.h"
@@ -147,7 +148,7 @@ public:
     unsigned int chksum;
 #endif
 
-    const char *vary_headers;
+    SBuf vary_headers;
 
     void delayRead(DeferredRead const &);
     void kickReads();
Index: squid-3.3.13/src/MemStore.cc
===================================================================
--- squid-3.3.13.orig/src/MemStore.cc
+++ squid-3.3.13/src/MemStore.cc
@@ -310,7 +310,7 @@ MemStore::considerKeeping(StoreEntry &e)
         return;
     }
 
-    if (e.mem_obj->vary_headers) {
+    if (!e.mem_obj->vary_headers.isEmpty()) {
         // XXX: We must store/load SerialisedMetaData to cache Vary in RAM
         debugs(20, 5, "Vary not yet supported: " << e.mem_obj->vary_headers);
         return;
Index: squid-3.3.13/src/StoreMetaVary.cc
===================================================================
--- squid-3.3.13.orig/src/StoreMetaVary.cc
+++ squid-3.3.13/src/StoreMetaVary.cc
@@ -41,14 +41,14 @@ StoreMetaVary::checkConsistency(StoreEnt
 {
     assert (getType() == STORE_META_VARY_HEADERS);
 
-    if (!e->mem_obj->vary_headers) {
+    if (e->mem_obj->vary_headers.isEmpty()) {
         /* XXX separate this mutator from the query */
         /* Assume the object is OK.. remember the vary request headers */
-        e->mem_obj->vary_headers = xstrdup((char *)value);
+        e->mem_obj->vary_headers.assign(static_cast<const char*>(value), length);
         return true;
     }
 
-    if (strcmp(e->mem_obj->vary_headers, (char *)value) != 0)
+    if (e->mem_obj->vary_headers.cmp(static_cast<const char*>(value), length) != 0)
         return false;
 
     return true;
Index: squid-3.3.13/src/client_side.cc
===================================================================
--- squid-3.3.13.orig/src/client_side.cc
+++ squid-3.3.13/src/client_side.cc
@@ -4178,20 +4178,19 @@ clientHttpConnectionsClose(void)
 int
 varyEvaluateMatch(StoreEntry * entry, HttpRequest * request)
 {
-    const char *vary = request->vary_headers;
+    SBuf vary(request->vary_headers);
     int has_vary = entry->getReply()->header.has(HDR_VARY);
 #if X_ACCELERATOR_VARY
-
     has_vary |=
         entry->getReply()->header.has(HDR_X_ACCELERATOR_VARY);
 #endif
 
-    if (!has_vary || !entry->mem_obj->vary_headers) {
-        if (vary) {
+    if (!has_vary || entry->mem_obj->vary_headers.isEmpty()) {
+        if (!vary.isEmpty()) {
             /* Oops... something odd is going on here.. */
             debugs(33, DBG_IMPORTANT, "varyEvaluateMatch: Oops. Not a Vary object on second attempt, '" <<
                    entry->mem_obj->url << "' '" << vary << "'");
-            safe_free(request->vary_headers);
+            request->vary_headers.clear();
             return VARY_CANCEL;
         }
 
@@ -4205,8 +4204,8 @@ varyEvaluateMatch(StoreEntry * entry, Ht
          */
         vary = httpMakeVaryMark(request, entry->getReply());
 
-        if (vary) {
-            request->vary_headers = xstrdup(vary);
+        if (!vary.isEmpty()) {
+            request->vary_headers = vary;
             return VARY_OTHER;
         } else {
             /* Ouch.. we cannot handle this kind of variance */
@@ -4214,18 +4213,18 @@ varyEvaluateMatch(StoreEntry * entry, Ht
             return VARY_CANCEL;
         }
     } else {
-        if (!vary) {
+        if (vary.isEmpty()) {
             vary = httpMakeVaryMark(request, entry->getReply());
 
-            if (vary)
-                request->vary_headers = xstrdup(vary);
+            if (!vary.isEmpty())
+                request->vary_headers = vary;
         }
 
-        if (!vary) {
+        if (vary.isEmpty()) {
             /* Ouch.. we cannot handle this kind of variance */
             /* XXX This cannot really happen, but just to be complete */
             return VARY_CANCEL;
-        } else if (strcmp(vary, entry->mem_obj->vary_headers) == 0) {
+        } else if (vary.cmp(entry->mem_obj->vary_headers) == 0) {
             return VARY_MATCH;
         } else {
             /* Oops.. we have already been here and still haven't
Index: squid-3.3.13/src/client_side_reply.cc
===================================================================
--- squid-3.3.13.orig/src/client_side_reply.cc
+++ squid-3.3.13/src/client_side_reply.cc
@@ -982,8 +982,8 @@ clientReplyContext::purgeDoPurgeHead(Sto
 
     /* And for Vary, release the base URI if none of the headers was included in the request */
 
-    if (http->request->vary_headers
-            && !strstr(http->request->vary_headers, "=")) {
+    if (!http->request->vary_headers.isEmpty()
+            && http->request->vary_headers.find('=') != SBuf::npos) {
         StoreEntry *entry = storeGetPublic(urlCanonical(http->request), METHOD_GET);
 
         if (entry) {
Index: squid-3.3.13/src/http.cc
===================================================================
--- squid-3.3.13.orig/src/http.cc
+++ squid-3.3.13/src/http.cc
@@ -598,9 +598,9 @@ HttpStateData::cacheableReply()
 /*
  * For Vary, store the relevant request headers as
  * virtual headers in the reply
- * Returns false if the variance cannot be stored
+ * Returns an empty SBuf if the variance cannot be stored
  */
-const char *
+SBuf
 httpMakeVaryMark(HttpRequest * request, HttpReply const * reply)
 {
     String vary, hdr;
@@ -608,9 +608,9 @@ httpMakeVaryMark(HttpRequest * request,
     const char *item;
     const char *value;
     int ilen;
-    static String vstr;
+    SBuf vstr;
+    static const SBuf asterisk("*");
 
-    vstr.clean();
     vary = reply->header.getList(HDR_VARY);
 
     while (strListGetItem(&vary, ',', &item, &ilen, &pos)) {
@@ -621,11 +621,13 @@ httpMakeVaryMark(HttpRequest * request,
         if (strcmp(name, "*") == 0) {
             /* Can not handle "Vary: *" withtout ETag support */
             safe_free(name);
-            vstr.clean();
+            vstr.clear();
             break;
         }
 
-        strListAdd(&vstr, name, ',');
+        if (!vstr.isEmpty())
+            vstr.append(", ", 2);
+        vstr.append(name);
         hdr = request->header.getByName(name);
         safe_free(name);
         value = hdr.termedBuf();
@@ -650,7 +652,17 @@ httpMakeVaryMark(HttpRequest * request,
         char *name = (char *)xmalloc(ilen + 1);
         xstrncpy(name, item, ilen + 1);
         Tolower(name);
-        strListAdd(&vstr, name, ',');
+
+        if (strcmp(name, "*") == 0) {
+            /* Can not handle "Vary: *" withtout ETag support */
+            safe_free(name);
+            vstr.clear();
+            break;
+        }
+
+        if (!vstr.isEmpty())
+            vstr.append(", ", 2);
+        vstr.append(name);
         hdr = request->header.getByName(name);
         safe_free(name);
         value = hdr.termedBuf();
@@ -668,8 +680,8 @@ httpMakeVaryMark(HttpRequest * request,
     vary.clean();
 #endif
 
-    debugs(11, 3, "httpMakeVaryMark: " << vstr);
-    return vstr.termedBuf();
+    debugs(11, 3, vstr);
+    return vstr;
 }
 
 void
@@ -938,16 +950,16 @@ HttpStateData::haveParsedReplyHeaders()
             || rep->header.has(HDR_X_ACCELERATOR_VARY)
 #endif
        ) {
-        const char *vary = httpMakeVaryMark(request, rep);
+        const SBuf vary(httpMakeVaryMark(request, rep));
 
-        if (!vary) {
+        if (vary.isEmpty()) {
             entry->makePrivate();
             if (!fwd->reforwardableStatus(rep->sline.status))
                 EBIT_CLR(entry->flags, ENTRY_FWD_HDR_WAIT);
             goto no_cache;
         }
 
-        entry->mem_obj->vary_headers = xstrdup(vary);
+        entry->mem_obj->vary_headers = vary;
     }
 
     /*
Index: squid-3.3.13/src/http.h
===================================================================
--- squid-3.3.13.orig/src/http.h
+++ squid-3.3.13/src/http.h
@@ -34,6 +34,7 @@
 
 #include "comm.h"
 #include "HttpStateFlags.h"
+#include "SBuf.h"
 #include "Server.h"
 
 class ChunkedCodingParser;
@@ -138,6 +139,6 @@ private:
 
 int httpCachable(const HttpRequestMethod&);
 void httpStart(FwdState *);
-const char *httpMakeVaryMark(HttpRequest * request, HttpReply const * reply);
+SBuf httpMakeVaryMark(HttpRequest * request, HttpReply const * reply);
 
 #endif /* SQUID_HTTP_H */
Index: squid-3.3.13/src/store.cc
===================================================================
--- squid-3.3.13.orig/src/store.cc
+++ squid-3.3.13/src/store.cc
@@ -729,15 +729,15 @@ StoreEntry::setPublicKey()
     if (mem_obj->request) {
         HttpRequest *request = mem_obj->request;
 
-        if (!mem_obj->vary_headers) {
+        if (mem_obj->vary_headers.isEmpty()) {
             /* First handle the case where the object no longer varies */
-            safe_free(request->vary_headers);
+            request->vary_headers.clear();
         } else {
-            if (request->vary_headers && strcmp(request->vary_headers, mem_obj->vary_headers) != 0) {
+            if (!request->vary_headers.isEmpty() && request->vary_headers.cmp(mem_obj->vary_headers) != 0) {
                 /* Oops.. the variance has changed. Kill the base object
                  * to record the new variance key
                  */
-                safe_free(request->vary_headers);       /* free old "bad" variance key */
+                request->vary_headers.clear();       /* free old "bad" variance key */
                 StoreEntry *pe = storeGetPublic(mem_obj->url, mem_obj->method);
 
                 if (pe)
@@ -745,17 +745,14 @@ StoreEntry::setPublicKey()
             }
 
             /* Make sure the request knows the variance status */
-            if (!request->vary_headers) {
-                const char *vary = httpMakeVaryMark(request, mem_obj->getReply());
-
-                if (vary)
-                    request->vary_headers = xstrdup(vary);
+            if (request->vary_headers.isEmpty()) {
+                request->vary_headers = httpMakeVaryMark(request, mem_obj->getReply());
             }
         }
 
         // TODO: storeGetPublic() calls below may create unlocked entries.
         // We should add/use storeHas() API or lock/unlock those entries.
-        if (mem_obj->vary_headers && !storeGetPublic(mem_obj->url, mem_obj->method)) {
+        if (!mem_obj->vary_headers.isEmpty() && !storeGetPublic(mem_obj->url, mem_obj->method)) {
             /* Create "vary" base object */
             String vary;
             StoreEntry *pe = storeCreateEntry(mem_obj->url, mem_obj->log_url, request->flags, request->method);
Index: squid-3.3.13/src/store_key_md5.cc
===================================================================
--- squid-3.3.13.orig/src/store_key_md5.cc
+++ squid-3.3.13/src/store_key_md5.cc
@@ -145,8 +145,8 @@ storeKeyPublicByRequestMethod(HttpReques
     SquidMD5Update(&M, &m, sizeof(m));
     SquidMD5Update(&M, (unsigned char *) url, strlen(url));
 
-    if (request->vary_headers)
-        SquidMD5Update(&M, (unsigned char *) request->vary_headers, strlen(request->vary_headers));
+    if (!request->vary_headers.isEmpty())
+        SquidMD5Update(&M, request->vary_headers.rawContent(), request->vary_headers.length());
 
     SquidMD5Final(digest, &M);
 
Index: squid-3.3.13/src/store_swapmeta.cc
===================================================================
--- squid-3.3.13.orig/src/store_swapmeta.cc
+++ squid-3.3.13/src/store_swapmeta.cc
@@ -63,7 +63,6 @@ storeSwapMetaBuild(StoreEntry * e)
     tlv *TLV = NULL;		/* we'll return this */
     tlv **T = &TLV;
     const char *url;
-    const char *vary;
     assert(e->mem_obj != NULL);
     const int64_t objsize = e->mem_obj->expectedReplySize();
     assert(e->swap_status == SWAPOUT_WRITING);
@@ -103,10 +102,12 @@ storeSwapMetaBuild(StoreEntry * e)
     }
 
     T = StoreMeta::Add(T, t);
-    vary = e->mem_obj->vary_headers;
+    SBuf vary(e->mem_obj->vary_headers);
 
-    if (vary) {
-        t =StoreMeta::Factory(STORE_META_VARY_HEADERS, strlen(vary) + 1, vary);
+    if (!vary.isEmpty()) {
+        // TODO: do we still need +1 here? StoreMetaVary::checkConsistency
+        //       no longer relies on nul-termination, but other things might.
+        t = StoreMeta::Factory(STORE_META_VARY_HEADERS, vary.length() + 1, vary.c_str());
 
         if (!t) {
             storeSwapTLVFree(TLV);
Index: squid-3.3.13/src/tests/stub_MemObject.cc
===================================================================
--- squid-3.3.13.orig/src/tests/stub_MemObject.cc
+++ squid-3.3.13/src/tests/stub_MemObject.cc
@@ -32,7 +32,6 @@ MemObject::MemObject(char const *, char
         id(0),
         object_sz(-1),
         swap_hdr_sz(0),
-        vary_headers(NULL),
         _reply(NULL)
 {
     memset(&clients, 0, sizeof(clients));
Index: squid-3.3.13/src/tests/stub_http.cc
===================================================================
--- squid-3.3.13.orig/src/tests/stub_http.cc
+++ squid-3.3.13/src/tests/stub_http.cc
@@ -6,4 +6,4 @@
 #define STUB_API "http.cc"
 #include "tests/STUB.h"
 
-const char * httpMakeVaryMark(HttpRequest * request, HttpReply const * reply) STUB_RETVAL(NULL)
+SBuf httpMakeVaryMark(HttpRequest * request, HttpReply const * reply) STUB_RETVAL(SBuf())
