fix segfaults introduced in r2549 and r2550

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index ad009462e125d4b42730cb66152218a06f23000d..a2d4e86882556a8e4b072c4e76ea91123be412fa 100644 (file)
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -1380,9 +1380,9 @@ ngx_http_core_find_location(ngx_http_request_t *r)
 
             if ((*clcfp)->captures && r->captures == NULL) {
 
-                len = (NGX_HTTP_MAX_CAPTURES + 1) * 3 * sizeof(int);
+                len = (NGX_HTTP_MAX_CAPTURES + 1) * 3;
 
-                r->captures = ngx_palloc(r->pool, len);
+                r->captures = ngx_palloc(r->pool, len * sizeof(int));
                 if (r->captures == NULL) {
                     return NGX_ERROR;
                 }

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 95a392a82cdf82a1b0e30a9f0b8a920dd4bb0d92..c018d68686baabad44dd46f8a0f115731d9354ca 100644 (file)
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1662,9 +1662,9 @@ ngx_http_find_virtual_server(ngx_http_request_t *r, u_char *host, size_t len)
 
             if (sn[i].captures && r->captures == NULL) {
 
-                ncaptures = (NGX_HTTP_MAX_CAPTURES + 1) * 3 * sizeof(int);
+                ncaptures = (NGX_HTTP_MAX_CAPTURES + 1) * 3;
 
-                r->captures = ngx_palloc(r->pool, ncaptures);
+                r->captures = ngx_palloc(r->pool, ncaptures * sizeof(int));
                 if (r->captures == NULL) {
                     return NGX_ERROR;
                 }