diff --git a/ChangeLog b/ChangeLog
index e2be1a1..32f0043 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,7 +2,17 @@
 Version 1.6.18
 *******************************************************************************
 
-2012-03-26 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+2012-04-05 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	SF Bug Tracker id 3507819 - Use of thread-unsafe gmtime() in httpreadwrite.c
+
+	Submitted: zephyrus ( zephyrus00jp ) - 2012-03-18 06:31:00 PDT
+
+	Define http_gmtime_r and web_server_asctime_r and use it.
+	Those prefix are added since pthread for Win32 already
+	has macro gmtime_r and asctime_r.
+
+2012-04-05 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
 
 	Fix type of local variable stopSock in RunMiniServer()
 
diff --git a/upnp/src/genlib/net/http/httpreadwrite.c b/upnp/src/genlib/net/http/httpreadwrite.c
index 4f27dbd..b1955a7 100644
--- a/upnp/src/genlib/net/http/httpreadwrite.c
+++ b/upnp/src/genlib/net/http/httpreadwrite.c
@@ -164,6 +164,18 @@ static int private_connect(
 #endif /* UPNP_ENABLE_BLOCKING_TCP_CONNECTIONS */
 }
 
+#ifdef WIN32
+struct tm *http_gmtime_r(const time_t *clock, struct tm *result)
+{
+	if (clock == NULL || *clock < 0 || result == NULL)
+		return NULL;
+
+	/* gmtime in VC runtime is thread safe. */
+	*result = *gmtime(clock);
+	return result;
+}
+#endif
+
 int http_FixUrl(IN uri_type *url, OUT uri_type *fixed_url)
 {
 	const char *temp_path = "/";
@@ -1624,6 +1636,7 @@ int http_MakeMessage(membuffer *buf, int http_major_version,
 	size_t length;
 	time_t *loc_time;
 	time_t curr_time;
+	struct tm date_storage;
 	struct tm *date;
 	const char *start_str;
 	const char *end_str;
@@ -1711,7 +1724,7 @@ int http_MakeMessage(membuffer *buf, int http_major_version,
 				loc_time = (time_t *)va_arg(argp, time_t *);
 			}
 			assert(loc_time);
-			date = gmtime(loc_time);
+			date = http_gmtime_r(loc_time, &date_storage);
 			if (date == NULL)
 				goto error_handler;
 			rc = snprintf(tempbuf, sizeof(tempbuf),
diff --git a/upnp/src/genlib/net/http/webserver.c b/upnp/src/genlib/net/http/webserver.c
index 9975e87..0cd04e1 100644
--- a/upnp/src/genlib/net/http/webserver.c
+++ b/upnp/src/genlib/net/http/webserver.c
@@ -132,6 +132,20 @@ static const char *gMediaTypes[] = {
 #define NUM_MEDIA_TYPES       69
 #define NUM_HTTP_HEADER_NAMES 33
 
+#define ASCTIME_R_BUFFER_SIZE 26
+#ifdef WIN32
+static char *web_server_asctime_r(const struct tm *tm, char *buf)
+{
+	if (tm == NULL || buf == NULL)
+		return NULL;
+
+	asctime_s(buf, ASCTIME_R_BUFFER_SIZE, tm);
+	return buf;
+}
+#else
+#define web_server_asctime_r asctime_r
+#endif
+
 /* sorted by file extension; must have 'NUM_MEDIA_TYPES' extensions */
 static const char *gEncodedMediaTypes =
 	"aif\0" AUDIO_STR "aiff\0"
@@ -512,6 +526,8 @@ static int get_file_info(
 	struct stat s;
 	FILE *fp;
 	int rc = 0;
+	struct tm date;
+	char buffer[ASCTIME_R_BUFFER_SIZE];
 
 	ixmlFreeDOMString(info->content_type);	
 	info->content_type = NULL;
@@ -535,7 +551,8 @@ static int get_file_info(
 	UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
 		"file info: %s, length: %lld, last_mod=%s readable=%d\n",
 		filename, (long long)info->file_length,
-		asctime(gmtime(&info->last_modified)), info->is_readable);
+		web_server_asctime_r(http_gmtime_r(&info->last_modified, &date), buffer),
+		info->is_readable);
 
 	return rc;
 }
diff --git a/upnp/src/inc/httpreadwrite.h b/upnp/src/inc/httpreadwrite.h
index 18ee957..b03cda9 100644
--- a/upnp/src/inc/httpreadwrite.h
+++ b/upnp/src/inc/httpreadwrite.h
@@ -49,6 +49,12 @@
 extern "C" {
 #endif
 
+#ifdef WIN32
+struct tm *http_gmtime_r(const time_t *clock, struct tm *result);
+#else
+#define http_gmtime_r gmtime_r
+#endif
+
 int http_CancelHttpGet(IN void *Handle);
 
 /*!