fix captures in "rewrite", the bug had been introduced in r3326

src/http/ngx_http_script.c

diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
index b809e2b..aa03df0 100644
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -910,14 +910,14 @@
         e->buf.len = code->size;
 
         if (code->uri) {
-            if (rc && (r->quoted_uri || r->plus_in_uri)) {
+            if (r->ncaptures && (r->quoted_uri || r->plus_in_uri)) {
                 e->buf.len += 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len,
                                                  NGX_ESCAPE_ARGS);
             }
         }
 
-        for (n = 1; n < (ngx_uint_t) rc; n++) {
-            e->buf.len += r->captures[2 * n + 1] - r->captures[2 * n];
+        for (n = 2; n < r->ncaptures; n += 2) {
+            e->buf.len += r->captures[n + 1] - r->captures[n];
         }
 
     } else {

src/http/ngx_http_variables.c

diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index 633b310..0289a64 100644
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -1810,7 +1810,7 @@
 #endif
     }
 
-    r->ncaptures = len;
+    r->ncaptures = rc * 2;
     r->captures_data = s->data;
 
     return NGX_OK;