BUG/MEDIUM: http_fetch: fix the "base" and "base32" fetch methods in HTX mode

The resulting value produced in functions smp_fetch_base() and
smp_fetch_base32() was wrong when in HTX mode.

This patch also adds the semicolon at the end of the for-loop line, used
in function smp_fetch_path(), since it's actually with no body.

This must be backported to 1.9.
diff --git a/src/http_fetch.c b/src/http_fetch.c
index 292da21..01cbac4 100644
--- a/src/http_fetch.c
+++ b/src/http_fetch.c
@@ -1571,9 +1571,10 @@
 			return 0;
 
 		for (len = 0; len < path.len && *(path.ptr + len) != '?'; len++)
+			;
 
-			/* OK, we got the '/' ! */
-			smp->data.type = SMP_T_STR;
+		/* OK, we got the '/' ! */
+		smp->data.type = SMP_T_STR;
 		smp->data.u.str.area = path.ptr;
 		smp->data.u.str.data = len;
 		smp->flags = SMP_F_VOL_1ST | SMP_F_CONST;
@@ -1638,7 +1639,9 @@
 		if (path.ptr) {
 			size_t len;
 
-			for (len = 0; len < path.len && *(path.ptr) != '?'; len++);
+			for (len = 0; len < path.len && *(path.ptr + len) != '?'; len++)
+				;
+
 			if (len && *(path.ptr) == '/')
 				chunk_memcat(temp, path.ptr, len);
 		}
@@ -1708,7 +1711,7 @@
 			return 0;
 
 		ctx.blk = NULL;
-		if (!http_find_header(htx, ist("Host"), &ctx, 0)) {
+		if (http_find_header(htx, ist("Host"), &ctx, 0)) {
 			/* OK we have the header value in ctx.value */
 			while (ctx.value.len--)
 				hash = *(ctx.value.ptr++) + (hash << 6) + (hash << 16) - hash;
@@ -1720,7 +1723,9 @@
 		if (path.ptr) {
 			size_t len;
 
-			for (len = 0; len < path.len && *(path.ptr) != '?'; len++);
+			for (len = 0; len < path.len && *(path.ptr + len) != '?'; len++)
+				;
+
 			if (len && *(path.ptr) == '/') {
 				while (len--)
 					hash = *(path.ptr++) + (hash << 6) + (hash << 16) - hash;