From e0e031d163e221bca80eb1b377b908f5e5be9891 Mon Sep 17 00:00:00 2001
From: brectanus <brectanus@9017d574-64ec-4062-9424-5e00b32a252b>
Date: Mon, 1 Oct 2007 19:05:34 +0000
Subject: [PATCH] Oops, too fast to blame apr :)  This bug was a forgotten NULL
 in the apr_pstrcat function.  Apparently newer APRs can handle this.

---
 apache2/re.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/apache2/re.c b/apache2/re.c
index aa4d7eb9..e043a002 100644
--- a/apache2/re.c
+++ b/apache2/re.c
@@ -1295,9 +1295,7 @@ static int execute_operator(msre_var *var, msre_rule *rule, modsec_rec *msr,
                                     var->name, var->param);
     }
     else if ((var->name != NULL) && var->is_counting && (*var->name != '&')) {
-        // TODO: This fails (sigsegv) on FC4, but apr_psprintf works
-        //full_varname = apr_pstrcat(mptmp, "&", var->name);
-        full_varname = apr_psprintf(mptmp, "&%s", var->name);
+        full_varname = apr_pstrcat(mptmp, "&", var->name, NULL);
     }
     else {
         full_varname = var->name;