$OpenBSD$

release the object later, when it is really not in use anymore, fix for bug 5

--- sope-appserver/NGObjWeb/DynamicElements/WORepetition.m.orig	Mon Aug  1 16:27:43 2011
+++ sope-appserver/NGObjWeb/DynamicElements/WORepetition.m	Mon Aug  1 16:28:05 2011
@@ -840,7 +840,7 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
     WOResponse_AddCString(_response, "<!-- repetition with no contents -->");
   }
 #endif
-  
+  [array release];
   [pool release];
   
 #if DEBUG
$OpenBSD$

Fix use after free in OGo Webinterface, see bug: 5

--- sope-appserver/NGObjWeb/Associations/WOKeyPathAssociation.m.orig	Tue Nov  2 15:12:12 2010
+++ sope-appserver/NGObjWeb/Associations/WOKeyPathAssociation.m	Mon Aug  1 16:20:07 2011
@@ -727,7 +727,7 @@ _getValueN(WOKeyPathAssociation *self, unsigned _count
 
   //NSLog(@"object %@ for keyPath %@", object, [self keyPath]);
 
-  return object;
+  return [object retain];
 }
 
 static inline id _getValue(WOKeyPathAssociation *self, id root) {
@@ -742,8 +742,8 @@ static id _getOneValue(WOKeyPathAssociation *self, id 
   retValue = _getComponentValue(self, root, info);
 
   return (info->type == WOKeyType_method)
-    ? _objectify(info->retType, &retValue)
-    : retValue.object;
+    ? [_objectify(info->retType, &retValue) retain]
+    : [retValue.object retain];
 }
 
 static inline void _getSetSelName(register unsigned char *buf,