Code: htc_request_check_host_hdr(struct http *hp)
 {
 	int u;
 	int seen_host = 0;
 	for (u = HTTP_HDR_FIRST; u < hp->nhd; u++) {
 		if (hp->hd[u].b == NULL)
 			continue;
 		AN(hp->hd[u].b);
 		AN(hp->hd[u].e);
 		if (http_IsHdr(&hp->hd[u], H_Host)) {
 			if (seen_host) {
 				return (400);
 			}
 			seen_host = 1;
 		}
 	}
 	return (0);
 }

Vulnerability Type: Http R.Spl. 
CWE ID: 
Summary: Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
Commit Message: Check for duplicate Content-Length headers in requests

If a duplicate CL header is in the request, we fail the request with a
400 (Bad Request)

Fix a test case that was sending duplicate CL by misstake and would
not fail because of that.