Fix segfault with broken rewrite/redirect patterns (fixes #2140, found by crypt)

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2707 152afb58-edef-0310-8abb-c4023f1b3aa9

src/mod_redirect.c

@@ -210,7 +210,7 @@ static handler_t mod_redirect_uri_handler(server *srv, connection *con, void *p_
 			buffer_reset(p->location);
 
 			start = 0;
-			for (k = 0; k < pattern_len; k++) {
+			for (k = 0; k + 1 < pattern_len; k++) {
 				if (pattern[k] == '$' || pattern[k] == '%') {
 					/* got one */
 

src/mod_rewrite.c

@@ -394,7 +394,7 @@ static int process_rewrite_rules(server *srv, connection *con, plugin_data *p, r
 			buffer_reset(con->request.uri);
 
 			start = 0;
-			for (k = 0; k < pattern_len; k++) {
+			for (k = 0; k+1 < pattern_len; k++) {
 				if (pattern[k] == '$' || pattern[k] == '%') {
 					/* got one */