diff --git a/src/proto_http.c b/src/proto_http.c
index 206ddcb6e..bfc64b01c 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -3273,7 +3273,7 @@ static int http_replace_value(struct my_regex *re, char *dst, uint dst_size, cha
 
 		/* look for delim. */
 		p_delim = p;
-		while (p_delim < p + len && *p_delim != delim)
+		while (p_delim < val + len && *p_delim != delim)
 			p_delim++;
 
 		if (regex_exec_match2(re, p, p_delim-p, MAX_MATCH, pmatch, 0)) {
@@ -3297,7 +3297,7 @@ static int http_replace_value(struct my_regex *re, char *dst, uint dst_size, cha
 			return -1;
 
 		/* end of the replacements. */
-		if (p_delim >= p + len)
+		if (p_delim >= val + len)
 			break;
 
 		/* Next part. */