commit 219f7cb9e3eb061103c3c013a6ecf13d38281247
Author: Kevin Zhu <ip0tcp@gmail.com>
Date:   Tue Jan 7 09:42:55 2020 +0100

    BUG/MEDIUM: http-ana: Truncate the response when a redirect rule is applied
    
    When a redirect rule is executed on the response path, we must truncate the
    received response. Otherwise, the redirect is appended after the response, which
    is sent to the client. So it is obviously a bug because the redirect is not
    performed. With bodyless responses, it is the "only" bug. But if the response
    has a body, the result may be invalid. If the payload is not fully received yet
    when the redirect is performed, an internal error is reported.
    
    It must be backported as far as 1.9.
    
    (cherry picked from commit 96b363963f4a4a63823718966798f177a72936b6)
    Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>

diff --git a/src/http_ana.c b/src/http_ana.c
index ee00d2c76..268796d2e 100644
--- a/src/http_ana.c
+++ b/src/http_ana.c
@@ -2526,6 +2526,8 @@ int http_apply_redirect_rule(struct redirect_rule *rule, struct stream *s, struc
 		close = 1;
 
 	htx = htx_from_buf(&res->buf);
+	/* Trim any possible response */
+	channel_htx_truncate(&s->res, htx);
 	flags = (HTX_SL_F_IS_RESP|HTX_SL_F_VER_11|HTX_SL_F_XFER_LEN|HTX_SL_F_BODYLESS);
 	sl = htx_add_stline(htx, HTX_BLK_RES_SL, flags, ist("HTTP/1.1"), status, reason);
 	if (!sl)
@@ -2553,6 +2555,8 @@ int http_apply_redirect_rule(struct redirect_rule *rule, struct stream *s, struc
 	if (!htx_add_endof(htx, HTX_BLK_EOH) || !htx_add_endof(htx, HTX_BLK_EOM))
 		goto fail;
 
+	htx_to_buf(htx, &res->buf);
+
 	/* let's log the request time */
 	s->logs.tv_request = now;