in the backref() method, check more precisely that the StringPiece

array for captures is wholly contained in the current workspace

src/vmod_re2.c

@@ -215,7 +215,8 @@ vmod_regex_backref(VRT_CTX, struct vmod_re2_regex *re, VCL_INT refnum,
 	if (group == match_failed)
 		return fallback;
 
-	assert((char *)group >= ctx->ws->s && (char *)group < ctx->ws->e);
+	assert((char *)group >= ctx->ws->s
+	       && (char *)(group + ((re->ngroups+1) * match_sz)) <= ctx->ws->e);
 
 	if ((err = vre2_capture(group, (int) refnum, &capture, &len))
 	    != NULL) {