Never release more bytes than there is room for.

git-svn-id: http://www.varnish-cache.org/svn/trunk/varnish-cache@2791 d4fa192b-c00b-0410-8231-f00ffab90ce4

bin/varnishd/cache.h

@@ -691,6 +691,8 @@ Tlen(const txt t)
 static inline void
 Tadd(txt *t, const char *p, int l)
 {
+	Tcheck(*t);
+
 	if (l <= 0) {
 	} if (t->b + l < t->e) {
 		memcpy(t->b, p, l);

bin/varnishd/cache_vrt_re.c

@@ -110,7 +110,7 @@ VRT_regsub(const struct sess *sp, int all, const char *str, void *re, const char
 	regex_t *t;
 	int i, l;
 	txt res;
-	char *p;
+	char *b0;
 	const char *s;
 	unsigned u, x;
 
@@ -124,8 +124,9 @@ VRT_regsub(const struct sess *sp, int all, const char *str, void *re, const char
 	if (i == REG_NOMATCH)
 		return(str);
 
+VSL(SLT_Debug, sp->fd, "REGSUB {");
 	u = WS_Reserve(sp->http->ws, 0);
-	res.e = res.b = p = sp->http->ws->f;
+	res.e = res.b = b0 = sp->http->ws->f;
 	res.e += u;
 
 	do {
@@ -163,6 +164,7 @@ VRT_regsub(const struct sess *sp, int all, const char *str, void *re, const char
 		return (str);
 	} 
 	Tcheck(res);
-	WS_Release(sp->http->ws, p - res.b);
-	return (p);
+	WS_Release(sp->http->ws, b0 - res.b);
+VSL(SLT_Debug, sp->fd, "REGSUB }");
+	return (b0);
 }

bin/varnishd/cache_ws.c

@@ -167,6 +167,7 @@ void
 WS_Release(struct ws *ws, unsigned bytes)
 {
 	WS_Assert(ws);
+	assert(bytes <= ws->e - ws->f);
 	DSL(0x02, SLT_Debug, 0, "WS_Release(%p, %u)", ws, bytes);
 	assert(ws->r != NULL);
 	assert(ws->f + bytes <= ws->r);