[master] da49f394b varnishtest: Fix argument processing with vtc_gzip_cmd()

[Nils Goroll]

commit da49f394b43f132525438468d8ff7b4307cbee86
Author: Nils Goroll <nils.goroll at uplex.de>
Date:   Wed May 21 10:17:34 2025 +0200

    varnishtest: Fix argument processing with vtc_gzip_cmd()
    
    vtc_gzip_cmd() returns 0 for "not a gzip argument", 1 for "gzip argument with
    value" and 2 for "same and also add content-encoding". For 2, the argument
    vector was increased by 2 also, wrongly skipping an additional argument of av
    (and causing an out-of-bounds access, which usually was covered but did surface
    while working on an unrelated).

diff --git a/bin/varnishtest/tests/a00011.vtc b/bin/varnishtest/tests/a00011.vtc
index fab31a883..9819e4934 100644
--- a/bin/varnishtest/tests/a00011.vtc
+++ b/bin/varnishtest/tests/a00011.vtc
@@ -7,7 +7,7 @@ server s1 {
 	gunzip
 	expect req.bodylen == "3"
 	expect req.http.content-encoding == "gzip"
-	txresp -gzipbody FOO
+	txresp -gzipbody FOO -gziplevel 9
 } -start
 
 client c1 -connect ${s1_sock} {
diff --git a/bin/varnishtest/vtc_http.c b/bin/varnishtest/vtc_http.c
index 4ed2be366..a5f701862 100644
--- a/bin/varnishtest/vtc_http.c
+++ b/bin/varnishtest/vtc_http.c
@@ -862,7 +862,7 @@ http_tx_parse_args(char * const *av, struct vtclog *vl, struct http *hp,
 			l = vtc_gzip_cmd(hp, av, &body, &bodylen);
 			if (l == 0)
 				break;
-			av += l;
+			av++;
 			if (l > 1)
 				VSB_printf(hp->vsb, "Content-Encoding: gzip%s", nl);
 		} else
diff --git a/bin/varnishtest/vtc_http2.c b/bin/varnishtest/vtc_http2.c
index 7feeb42b0..827e493fc 100644
--- a/bin/varnishtest/vtc_http2.c
+++ b/bin/varnishtest/vtc_http2.c
@@ -1600,7 +1600,7 @@ cmd_tx11obj(CMD_ARGS)
 				i = vtc_gzip_cmd(s->hp, av, &body, &bodylen);
 				if (i == 0)
 					break;
-				av += i;
+				av++;
 				if (i > 1) {
 					ENC(hdr, ":content-encoding", "gzip");
 					f.flags &= ~END_STREAM;