Fix my typo that meant that we trampled on unowned memory.

Almost pinpointed by Martin using Valgrind.

bin/varnishd/cache/cache_session.c

@@ -98,9 +98,10 @@ ses_new(struct sesspool *pp)
 {
 	struct sess *sp;
 	char *s;
+	unsigned sz;
 
 	CHECK_OBJ_NOTNULL(pp, SESSPOOL_MAGIC);
-	sp = MPL_Get(pp->mpl_sess, NULL);
+	sp = MPL_Get(pp->mpl_sess, &sz);
 	sp->magic = SESS_MAGIC;
 	sp->sesspool = pp;
 
@@ -109,6 +110,8 @@ ses_new(struct sesspool *pp)
 	s += vsa_suckaddr_len;
 	memset(s, 0, vsa_suckaddr_len);
 	sp->their_addr = (void*)s;
+	s += vsa_suckaddr_len;
+	assert((char *)sp + sz == s);
 
 	sp->t_open = NAN;
 	sp->t_idle = NAN;

bin/varnishd/cache/cache_vrt.c

@@ -302,7 +302,7 @@ VRT_IP_string(const struct vrt_ctx *ctx, VCL_IP ip)
 
 	CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
 	len = WS_Reserve(ctx->ws, 0);
-	p = ctx->ws->r;
+	p = ctx->ws->f;
 	VTCP_name(ip, p, len, NULL, 0);
 	WS_Release(ctx->ws, strlen(p) + 1);
 	return (p);