commit a96cbaa1e30e23bf91b7a4fb46857b4b2823deea
Author: Christopher Faulet <cfaulet@haproxy.com>
Date:   Tue Jan 7 10:01:57 2020 +0100

    BUG/MINOR: channel: inject output data at the end of output
    
    In co_inject(), data must be inserted at the end of output, not the end of
    input. For the record, this function does not take care of input data which are
    supposed to not exist. But the caller may reset input data after or before the
    call. It is its own choice.
    
    This bug, among other effects, is visible when a redirect is performed on
    the response path, on legacy HTTP mode (so for HAProxy < 2.1). The redirect
    response is appended after the server response when it should overwrite it.
    
    Thanks to Kevin Zhu <ip0tcp@gmail.com> to report the bug. It must be backported
    as far as 1.9.
    
    (cherry picked from commit 584348be636fcc9f41b80ef0fde03c7899d75cd7)
    Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>

diff --git a/src/channel.c b/src/channel.c
index d4a46ffed..8b0854ef5 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -96,7 +96,7 @@ int co_inject(struct channel *chn, const char *msg, int len)
 	if (len > max)
 		return max;
 
-	memcpy(ci_tail(chn), msg, len);
+	memcpy(co_tail(chn), msg, len);
 	b_add(&chn->buf, len);
 	c_adv(chn, len);
 	chn->total += len;