Fix lookbehind handling in regsuball

Do not advance the subject but use the ovector information as offset,
pcre might need to peek back when handling lookbehinds.

Original patch from MegaMaddin via github.

Fixes: #1557

bin/varnishd/cache/cache_vrt_re.c

@@ -92,6 +92,7 @@ VRT_regsub(const struct vrt_ctx *ctx, int all, const char *str, void *re,
 	const char *s;
 	unsigned u, x;
 	int options = 0;
+	int offset = 0;
 	size_t len;
 
 	CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
@@ -120,7 +121,7 @@ VRT_regsub(const struct vrt_ctx *ctx, int all, const char *str, void *re,
 
 	do {
 		/* Copy prefix to match */
-		Tadd(&res, str, ovector[0]);
+		Tadd(&res, str + offset, ovector[0] - offset);
 		for (s = sub ; *s != '\0'; s++ ) {
 			if (*s != '\\' || s[1] == '\0') {
 				if (res.b < res.e)
@@ -138,13 +139,12 @@ VRT_regsub(const struct vrt_ctx *ctx, int all, const char *str, void *re,
 					*res.b++ = *s;
 			}
 		}
-		str += ovector[1];
-		len -= ovector[1];
+		offset = ovector[1];
 		if (!all)
 			break;
 		memset(&ovector, 0, sizeof(ovector));
 		options |= VRE_NOTEMPTY;
-		i = VRE_exec(t, str, len, 0, options, ovector, 30,
+		i = VRE_exec(t, str, len, offset, options, ovector, 30,
 		    &cache_param->vre_limits);
 		if (i < VRE_ERROR_NOMATCH ) {
 			WS_Release(ctx->ws, 0);
@@ -155,7 +155,7 @@ VRT_regsub(const struct vrt_ctx *ctx, int all, const char *str, void *re,
 	} while (i != VRE_ERROR_NOMATCH);
 
 	/* Copy suffix to match */
-	Tadd(&res, str, len+1);
+	Tadd(&res, str + offset, len - offset + 1);
 	if (res.b >= res.e) {
 		WS_Release(ctx->ws, 0);
 		return (str);

bin/varnishtest/tests/r01557.vtc

+varnishtest "Test case for #1557"
+
+server s1 {
+	rxreq
+	expect req.url == "/?foobar=2"
+	txresp
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		set req.url = regsuball(req.url,
+		    "(?<=[&\?])(foo|bar)=[^&]+(?:&|$)", "");
+	}
+} -start
+
+client c1 {
+	txreq -url "/?foo=0&bar=1&foobar=2"
+	rxresp
+} -run