Fix a bug in the entity-replacement code in the ESI-parser.

Patch by:	scoof
Fixes		#961

bin/varnishd/cache_esi_parse.c

@@ -518,7 +518,7 @@ vep_do_include(struct vep_state *vep, enum dowhat what)
 #define R(w,f,r)							\
 			if (q + w <= p + l && !memcmp(q, f, w)) { \
 				VSB_printf(vep->vsb, "%c", r);	\
-				q += l;				\
+				q += w;				\
 				continue;			\
 			}
 			R(6, "&apos;", '\'');

bin/varnishtest/tests/r00961.vtc

+varnishtest "Test XML 1.0 entity references"
+
+server s1 {
+	rxreq
+	expect req.url == "/"
+	txresp -body {
+		<esi:include src="t&amp;t"/>
+		<esi:include src="t&lt;t"/>
+		<esi:include src="t&gt;t"/>
+		<esi:include src="t&apos;t"/>
+		<esi:include src="t&quot;t"/>
+	}
+
+	rxreq
+	expect req.url == "/t&t"
+	txresp -body "1"
+
+	rxreq
+	expect req.url == "/t<t"
+	txresp -body "22"
+
+	rxreq
+	expect req.url == "/t>t"
+	txresp -body "333"
+
+	rxreq
+	expect req.url == {/t't}
+	txresp -body "4444"
+
+	rxreq
+	expect req.url == {/t"t}
+	txresp -body "55555"
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		return (pass);
+	}
+	sub vcl_fetch {
+		set beresp.do_esi = true;
+	}
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.bodylen == 32
+} -run