diff --git a/src/proto_http.c b/src/proto_http.c
index 6a1722f..2605c77 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -2421,20 +2421,18 @@
 
 	while (http_find_hdr_func(name, name_len, buf, idx, &ctx)) {
 		struct hdr_idx_elem *hdr = idx->v + ctx.idx;
-		int delta;
+		int delta, len;
 		char *val = ctx.line + ctx.val;
 		char* val_end = val + ctx.vlen;
 
 		if (!regex_exec_match2(re, val, val_end-val, MAX_MATCH, pmatch, 0))
 			continue;
 
-		output->data = exp_replace(output->area, output->size, val,
-					  str, pmatch);
-		if (output->data == -1)
+		len = exp_replace(output->area, output->size, val, str, pmatch);
+		if (len == -1)
 			return -1;
 
-		delta = b_rep_blk(&msg->chn->buf, val, val_end, output->area,
-				  output->data);
+		delta = b_rep_blk(&msg->chn->buf, val, val_end, output->area, len);
 
 		hdr->len += delta;
 		http_msg_move_end(msg, delta);
@@ -6524,7 +6522,7 @@
 	int cur_idx, old_idx, last_hdr;
 	struct http_txn *txn = s->txn;
 	struct hdr_idx_elem *cur_hdr;
-	int delta;
+	int delta, len;
 
 	last_hdr = 0;
 
@@ -6571,14 +6569,14 @@
 				break;
 
 			case ACT_REPLACE:
-				trash.data = exp_replace(trash.area,
-							trash.size, cur_ptr,
-							exp->replace, pmatch);
-				if (trash.data < 0)
+				len = exp_replace(trash.area,
+				                  trash.size, cur_ptr,
+				                  exp->replace, pmatch);
+				if (len < 0)
 					return -1;
 
-				delta = b_rep_blk(&req->buf, cur_ptr, cur_end,
-						  trash.area, trash.data);
+				delta = b_rep_blk(&req->buf, cur_ptr, cur_end, trash.area, len);
+
 				/* FIXME: if the user adds a newline in the replacement, the
 				 * index will not be recalculated for now, and the new line
 				 * will not be counted as a new header.
@@ -6625,7 +6623,7 @@
 	char *cur_ptr, *cur_end;
 	int done;
 	struct http_txn *txn = s->txn;
-	int delta;
+	int delta, len;
 
 	if (unlikely(txn->flags & (TX_CLDENY | TX_CLTARPIT)))
 		return 1;
@@ -6662,13 +6660,13 @@
 			break;
 
 		case ACT_REPLACE:
-			trash.data = exp_replace(trash.area, trash.size,
-						cur_ptr, exp->replace, pmatch);
-			if (trash.data < 0)
+			len = exp_replace(trash.area, trash.size,
+			                  cur_ptr, exp->replace, pmatch);
+			if (len < 0)
 				return -1;
 
-			delta = b_rep_blk(&req->buf, cur_ptr, cur_end,
-					  trash.area, trash.data);
+			delta = b_rep_blk(&req->buf, cur_ptr, cur_end, trash.area, len);
+
 			/* FIXME: if the user adds a newline in the replacement, the
 			 * index will not be recalculated for now, and the new line
 			 * will not be counted as a new header.
@@ -7271,7 +7269,7 @@
 	int cur_idx, old_idx, last_hdr;
 	struct http_txn *txn = s->txn;
 	struct hdr_idx_elem *cur_hdr;
-	int delta;
+	int delta, len;
 
 	last_hdr = 0;
 
@@ -7312,14 +7310,14 @@
 				break;
 
 			case ACT_REPLACE:
-				trash.data = exp_replace(trash.area,
-							trash.size, cur_ptr,
-							exp->replace, pmatch);
-				if (trash.data < 0)
+				len = exp_replace(trash.area,
+				                  trash.size, cur_ptr,
+				                  exp->replace, pmatch);
+				if (len < 0)
 					return -1;
 
-				delta = b_rep_blk(&rtr->buf, cur_ptr, cur_end,
-						  trash.area, trash.data);
+				delta = b_rep_blk(&rtr->buf, cur_ptr, cur_end, trash.area, len);
+
 				/* FIXME: if the user adds a newline in the replacement, the
 				 * index will not be recalculated for now, and the new line
 				 * will not be counted as a new header.
@@ -7364,8 +7362,7 @@
 	char *cur_ptr, *cur_end;
 	int done;
 	struct http_txn *txn = s->txn;
-	int delta;
-
+	int delta, len;
 
 	if (unlikely(txn->flags & TX_SVDENY))
 		return 1;
@@ -7396,13 +7393,13 @@
 			break;
 
 		case ACT_REPLACE:
-			trash.data = exp_replace(trash.area, trash.size,
-						cur_ptr, exp->replace, pmatch);
-			if (trash.data < 0)
+			len = exp_replace(trash.area, trash.size,
+			                  cur_ptr, exp->replace, pmatch);
+			if (len < 0)
 				return -1;
 
-			delta = b_rep_blk(&rtr->buf, cur_ptr, cur_end,
-					  trash.area, trash.data);
+			delta = b_rep_blk(&rtr->buf, cur_ptr, cur_end, trash.area, len);
+
 			/* FIXME: if the user adds a newline in the replacement, the
 			 * index will not be recalculated for now, and the new line
 			 * will not be counted as a new header.