diff -urN freeradius-snapshot-20060127.orig/src/include/radiusd.h freeradius-snapshot-20060127/src/include/radiusd.h
--- freeradius-snapshot-20060127.orig/src/include/radiusd.h	2005-11-11 01:32:49.000000000 +0100
+++ freeradius-snapshot-20060127/src/include/radiusd.h	2006-01-27 11:17:37.000000000 +0100
@@ -347,6 +347,8 @@
 				 void *opaque, void (*free_opaque)(void *));
 void		*request_data_get(REQUEST *request,
 				  void *unique_ptr, int unique_int);
+void		*request_data_reference(REQUEST *request,
+				  void *unique_ptr, int unique_int);
 int		rad_copy_string(char *dst, const char *src);
 int		rad_copy_variable(char *dst, const char *from);
 
diff -urN freeradius-snapshot-20060127.orig/src/main/util.c freeradius-snapshot-20060127/src/main/util.c
--- freeradius-snapshot-20060127.orig/src/main/util.c	2005-11-11 01:32:55.000000000 +0100
+++ freeradius-snapshot-20060127/src/main/util.c	2006-01-27 11:17:29.000000000 +0100
@@ -171,6 +171,28 @@
 
 
 /*
+ *	Get opaque data from a request without removing it.
+ */
+void *request_data_reference(REQUEST *request,
+		       void *unique_ptr, int unique_int)
+{
+	request_data_t **last;
+
+	for (last = &(request->data); *last != NULL; last = &((*last)->next)) {
+		if (((*last)->unique_ptr == unique_ptr) &&
+		    ((*last)->unique_int == unique_int)) {
+			request_data_t *this = *last;
+			void *ptr = this->opaque;
+
+			return ptr;
+		}
+	}
+
+	return NULL;		/* wasn't found, too bad... */
+}
+
+
+/*
  *	Free a REQUEST struct.
  */
 void request_free(REQUEST **request_ptr)
diff -urN freeradius-snapshot-20060127.orig/src/main/xlat.c freeradius-snapshot-20060127/src/main/xlat.c
--- freeradius-snapshot-20060127.orig/src/main/xlat.c	2005-11-11 01:32:55.000000000 +0100
+++ freeradius-snapshot-20060127/src/main/xlat.c	2006-01-27 11:17:07.000000000 +0100
@@ -368,7 +368,7 @@
 	fmt = fmt;		/* -Wunused */
 	func = func;		/* -Wunused FIXME: do escaping? */
 	
-	regex = request_data_get(request, request,
+	regex = request_data_reference(request, request,
 				 REQUEST_DATA_REGEX | *(int *)instance);
 	if (!regex) return 0;
 
@@ -377,7 +377,6 @@
 	 *	a zero byte.
 	 */
 	strNcpy(out, regex, outlen);
-	free(regex); /* was strdup'd */
 	return strlen(out);
 }
 #endif				/* HAVE_REGEX_H */