if "<!--" was on edge of buf, then ssi_sharp_state was saved in ctx->saved

and if it was not reset, then any '#' was treated as SSI command start

src/http/modules/ngx_http_ssi_filter_module.c

@@ -1020,6 +1020,7 @@ ngx_http_ssi_parse(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx)
                 ch = *p;
             }
 
+            ctx->state = state;
             ctx->pos = p;
             ctx->looked = looked;
             ctx->copy_end = p;