# HG changeset patch
# User Igor Sysoev <igor@sysoev.ru>
# Date 1258398645 0
# Node ID 1aed55182ea286313085789bdb203c4859c68b23
# Parent  3051e512e3015f529d74ccada9bd0e46300a6379
fix captures in "rewrite", the bug had been introduced in r3326

diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -910,14 +910,14 @@ ngx_http_script_regex_start_code(ngx_htt
         e->buf.len = code->size;
 
         if (code->uri) {
-            if (rc && (r->quoted_uri || r->plus_in_uri)) {
+            if (r->ncaptures && (r->quoted_uri || r->plus_in_uri)) {
                 e->buf.len += 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len,
                                                  NGX_ESCAPE_ARGS);
             }
         }
 
-        for (n = 1; n < (ngx_uint_t) rc; n++) {
-            e->buf.len += r->captures[2 * n + 1] - r->captures[2 * n];
+        for (n = 2; n < r->ncaptures; n += 2) {
+            e->buf.len += r->captures[n + 1] - r->captures[n];
         }
 
     } else {
diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -1810,7 +1810,7 @@ ngx_http_regex_exec(ngx_http_request_t *
 #endif
     }
 
-    r->ncaptures = len;
+    r->ncaptures = rc * 2;
     r->captures_data = s->data;
 
     return NGX_OK;