fix segfaults introduced in r2549 and r2550

src/http/ngx_http_core_module.c

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index ad00946..a2d4e86 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -1380,9 +1380,9 @@
 
             if ((*clcfp)->captures && r->captures == NULL) {
 
-                len = (NGX_HTTP_MAX_CAPTURES + 1) * 3 * sizeof(int);
+                len = (NGX_HTTP_MAX_CAPTURES + 1) * 3;
 
-                r->captures = ngx_palloc(r->pool, len);
+                r->captures = ngx_palloc(r->pool, len * sizeof(int));
                 if (r->captures == NULL) {
                     return NGX_ERROR;
                 }

src/http/ngx_http_request.c

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 95a392a..c018d68 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1662,9 +1662,9 @@
 
             if (sn[i].captures && r->captures == NULL) {
 
-                ncaptures = (NGX_HTTP_MAX_CAPTURES + 1) * 3 * sizeof(int);
+                ncaptures = (NGX_HTTP_MAX_CAPTURES + 1) * 3;
 
-                r->captures = ngx_palloc(r->pool, ncaptures);
+                r->captures = ngx_palloc(r->pool, ncaptures * sizeof(int));
                 if (r->captures == NULL) {
                     return NGX_ERROR;
                 }