# HG changeset patch
# User Igor Sysoev <igor@sysoev.ru>
# Date 1236776642 0
# Node ID 8ec97ff12a0a8e97e08190f4e36a7e750a5f4d21
# Parent  0408f34ef7eaa9850958f19feeedf2f248f6c32c
fix segfaults introduced in r2549 and r2550

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -1380,9 +1380,9 @@ ngx_http_core_find_location(ngx_http_req
 
             if ((*clcfp)->captures && r->captures == NULL) {
 
-                len = (NGX_HTTP_MAX_CAPTURES + 1) * 3 * sizeof(int);
-
-                r->captures = ngx_palloc(r->pool, len);
+                len = (NGX_HTTP_MAX_CAPTURES + 1) * 3;
+
+                r->captures = ngx_palloc(r->pool, len * sizeof(int));
                 if (r->captures == NULL) {
                     return NGX_ERROR;
                 }
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1662,9 +1662,9 @@ ngx_http_find_virtual_server(ngx_http_re
 
             if (sn[i].captures && r->captures == NULL) {
 
-                ncaptures = (NGX_HTTP_MAX_CAPTURES + 1) * 3 * sizeof(int);
-
-                r->captures = ngx_palloc(r->pool, ncaptures);
+                ncaptures = (NGX_HTTP_MAX_CAPTURES + 1) * 3;
+
+                r->captures = ngx_palloc(r->pool, ncaptures * sizeof(int));
                 if (r->captures == NULL) {
                     return NGX_ERROR;
                 }