Take another stab at #1001/#994

bin/varnishd/cache.h

@@ -898,6 +898,7 @@ void RES_StreamPoll(const struct sess *sp);
 /* cache_vary.c */
 struct vsb *VRY_Create(const struct sess *sp, const struct http *hp);
 int VRY_Match(struct sess *sp, const uint8_t *vary);
+void VRY_Validate(const uint8_t *vary);
 
 /* cache_vcl.c */
 void VCL_Init(void);

bin/varnishd/cache_center.c

@@ -802,6 +802,7 @@ cnt_fetchbody(struct sess *sp)
 		    (void *)WS_Alloc(sp->obj->http->ws, varyl);
 		AN(sp->obj->vary);
 		memcpy(sp->obj->vary, VSB_data(vary), varyl);
+		VRY_Validate(sp->obj->vary);
 		VSB_delete(vary);
 	}
 
@@ -1107,10 +1108,14 @@ cnt_lookup(struct sess *sp)
 	if (oc->flags & OC_F_BUSY) {
 		sp->wrk->stats.cache_miss++;
 
-		if (sp->vary_l != NULL)
+		if (sp->vary_l != NULL) {
+			assert(oc->busyobj->vary == sp->vary_b);
+			VRY_Validate(oc->busyobj->vary);
 			WS_ReleaseP(sp->ws, (void*)sp->vary_l);
-		else
-			WS_Release(sp->ws, 0);
+		} else {
+			AZ(oc->busyobj->vary);
+			WS_Release(sp->ws, 0); 
+		}
 		sp->vary_b = NULL;
 		sp->vary_l = NULL;
 		sp->vary_e = NULL;

bin/varnishd/cache_hash.c

@@ -461,7 +461,12 @@ HSH_Lookup(struct sess *sp, struct objhead **poh)
 	AN(oc->flags & OC_F_BUSY);
 	oc->refcnt = 1;
 
-	w->nbusyobj->vary = sp->vary_b;
+	/* XXX: clear w->nbusyobj before use */
+	VRY_Validate(sp->vary_b);
+	if (sp->vary_l != NULL)
+		w->nbusyobj->vary = sp->vary_b;
+	else
+		w->nbusyobj->vary = NULL;
 	oc->busyobj = w->nbusyobj;
 	w->nbusyobj = NULL;
 

bin/varnishd/cache_vary.c

@@ -247,3 +247,13 @@ VRY_Match(struct sess *sp, const uint8_t *vary)
 		sp->vary_l = vsp + 3;
 	return (retval);
 }
+
+void
+VRY_Validate(const uint8_t *vary)
+{
+
+	while (vary[2] != 0) {
+		assert(strlen((const char*)vary+3) == vary[2]);
+		vary += vry_len(vary);
+	}
+}