$OpenBSD$

retain the array, to fix a use after free
see http://www.sogo.nu/bugs/view.php?id=1404

--- sope-appserver/NGObjWeb/DynamicElements/WORepetition.m.orig	Tue Dec  6 13:52:00 2011
+++ sope-appserver/NGObjWeb/DynamicElements/WORepetition.m	Tue Dec  6 14:23:17 2011
@@ -479,7 +479,7 @@ _applyIndex(_WOComplexRepetition *self, WOComponent *s
 
   doRender   = ![_ctx isRenderingDisabled];
   sComponent = [_ctx component];
-  array      = [self->list valueInContext:_ctx];
+  array      = [[self->list valueInContext:_ctx] retain];
   aCount     = [array count];
   startIdx   = [self->startIndex unsignedIntValueInComponent:sComponent];
 
@@ -581,7 +581,7 @@ _applyIndex(_WOComplexRepetition *self, WOComponent *s
       WOResponse_AddCString(_response, "<!-- repetition with no contents -->");
   }
 #endif
-  
+  [array release];
   [pool release];
   
 #if DEBUG
@@ -787,9 +787,9 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
   pool       = [[NSAutoreleasePool alloc] init];
   
   sComponent = [_ctx component];
-  array      = [self->list valueInContext:_ctx];
+  array      = [[self->list valueInContext:_ctx] retain];
   aCount     = [array count];
-  
+
   if (aCount > 0) {
     unsigned cnt;
 
@@ -841,6 +841,7 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
   }
 #endif
   
+  [array release];
   [pool release];
   
 #if DEBUG