--- x/lighttpd-1.4.23/src/mod_rewrite.c	2009-03-31 00:16:59.000000000 +0200
+++ lighttpd-1.4.23/src/mod_rewrite.c	2009-10-20 01:10:01.000000000 +0200
@@ -384,11 +384,12 @@
 			buffer_reset(con->request.uri);
 
 			start = 0; end = pattern_len;
-			for (k = 0; k < pattern_len; k++) {
-				if (pattern[k] == '$' || pattern[k] == '%') {
-					/* got one */
+			for (k = 0; k < pattern_len - 1; k++) {
 
-					size_t num = pattern[k + 1] - '0';
+				switch(pattern[k]) {
+				case '$':
+				case '%':
+					/* got one */
 
 					end = k;
 
@@ -399,6 +400,7 @@
 						buffer_append_string_len(con->request.uri, pattern+k, pattern[k] == pattern[k+1] ? 1 : 2);
 					} else if (pattern[k] == '$') {
 						/* n is always > 0 */
+						size_t num = pattern[k + 1] - '0';
 						if (num < (size_t)n) {
 							buffer_append_string(con->request.uri, list[num]);
 						}
@@ -407,9 +409,8 @@
 						log_error_write(srv, __FILE__, __LINE__, "sb",
 								"used a redirect containing a %[0-9]+ in the global scope, ignored:",
 								rule->value);
-
 					} else {
-						config_append_cond_match_buffer(con, p->conf.context, con->request.uri, num);
+						config_append_cond_match_buffer(con, p->conf.context, con->request.uri, pattern[k + 1] - '0');
 					}
 
 					k++;