In mg_get_var() the first call of get_var() inspects the variables of
the query string. If the requested variable is found but the destination
buffer is too small to hold the variable, return -2 right away. If it's
not found, make the second call of get_var() to inspect the POST buffer.

Note that in Android NDK st_mtime is long unsigned int

Fix remove_double_dots_and_double_slashes removing all the dots leading http server to serve wrong URI

If the uri is something like '/js/...jquery.js', remove_double_dots_and_double_slashes will remove the 3 dots and the http server will serves the /js/jquery.js file.
remove_double_dots_and_double_slashes should check if a dot or double dots is followed by a slash (or backslash) and only remove this to avoid disclosure attack.

Upstream patch from MAME project

Fixes the build on NetBSD.

The comment says it's only needed on Linux, and AFAIK Linux
is the only operating system that only adds symbols when it's defined;
others, like NetBSD or Solaris, also hide symbols.

Signed-off-by: Thomas Klausner <wiz@NetBSD.org>

Replaced tabs with spaces.