[master] 4172f98 Fix a bug in the entity-replacement code in the ESI-parser.

[Poul-Henning Kamp]

commit 4172f9888077d42d8c0148a353d6940764d46154
Author: Poul-Henning Kamp <phk at FreeBSD.org>
Date:   Mon Jul 18 14:25:00 2011 +0000

    Fix a bug in the entity-replacement code in the ESI-parser.
    
    Patch by:	scoof
    Fixes		#961

diff --git a/bin/varnishd/cache_esi_parse.c b/bin/varnishd/cache_esi_parse.c
index 411db43..afef1fb 100644
--- a/bin/varnishd/cache_esi_parse.c
+++ b/bin/varnishd/cache_esi_parse.c
@@ -518,7 +518,7 @@ vep_do_include(struct vep_state *vep, enum dowhat what)
 #define R(w,f,r)							\
 			if (q + w <= p + l && !memcmp(q, f, w)) { \
 				VSB_printf(vep->vsb, "%c", r);	\
-				q += l;				\
+				q += w;				\
 				continue;			\
 			}
 			R(6, "'", '\'');
diff --git a/bin/varnishtest/tests/r00961.vtc b/bin/varnishtest/tests/r00961.vtc
new file mode 100644
index 0000000..b162379
--- /dev/null
+++ b/bin/varnishtest/tests/r00961.vtc
@@ -0,0 +1,49 @@
+varnishtest "Test XML 1.0 entity references"
+
+server s1 {
+	rxreq
+	expect req.url == "/"
+	txresp -body {
+		<esi:include src="t&t"/>
+		<esi:include src="t<t"/>
+		<esi:include src="t>t"/>
+		<esi:include src="t't"/>
+		<esi:include src="t"t"/>
+	}
+
+	rxreq
+	expect req.url == "/t&t"
+	txresp -body "1"
+
+	rxreq
+	expect req.url == "/t<t"
+	txresp -body "22"
+
+	rxreq
+	expect req.url == "/t>t"
+	txresp -body "333"
+
+	rxreq
+	expect req.url == {/t't}
+	txresp -body "4444"
+
+	rxreq
+	expect req.url == {/t"t}
+	txresp -body "55555"
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		return (pass);
+	}
+	sub vcl_fetch {
+		set beresp.do_esi = true;
+	}
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.bodylen == 32
+} -run