BUG/MEDIUM: http: cook_cnt() forgets to set its output type

Since comit b805f71 (MEDIUM: sample: let the cast functions set their
output type), the output type of a fetch function is automatically
considered and passed to the next converter. A bug introduced in
1.5-dev9 with commit f853c46 (MEDIUM: pattern/acl: get rid of
temp_pattern in ACLs) was revealed by this last one : the output type
remained string instead of UINT, causing the cast function to try to
cast the contents and to crash on a NULL deref.

Note: this fix was made after a careful review of all fetch functions.
A few non-trivial ones had their comments amended to clearly indicate
the output type.
diff --git a/src/payload.c b/src/payload.c
index cd266cd..bb4c010 100644
--- a/src/payload.c
+++ b/src/payload.c
@@ -398,8 +398,8 @@
 }
 
 /* Fetch the request RDP cookie identified in <cname>:<clen>, or any cookie if
- * <clen> is empty (cname is then ignored). It returns the data into sample <smp>.
- * Note: this decoder only works with non-wrapping data.
+ * <clen> is empty (cname is then ignored). It returns the data into sample <smp>
+ * of type SMP_T_CSTR. Note: this decoder only works with non-wrapping data.
  */
 int
 fetch_rdp_cookie_name(struct session *s, struct sample *smp, const char *cname, int clen)
@@ -490,7 +490,8 @@
 /* Fetch the request RDP cookie identified in the args, or any cookie if no arg
  * is passed. It is usable both for ACL and for samples. Note: this decoder
  * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
- * is a string (cookie name), other types will lead to undefined behaviour.
+ * is a string (cookie name), other types will lead to undefined behaviour. The
+ * returned sample has type SMP_T_CSTR.
  */
 int
 smp_fetch_rdp_cookie(struct proxy *px, struct session *s, void *l7, unsigned int opt,
diff --git a/src/proto_http.c b/src/proto_http.c
index bd663ef..82863ad 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -9304,6 +9304,7 @@
  * that '*' will not be added, resulting in exactly the first Host entry.
  * If no Host header is found, then the path is returned as-is. The returned
  * value is stored in the trash so it does not need to be marked constant.
+ * The returned sample is of type string.
  */
 static int
 smp_fetch_base(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@@ -9615,6 +9616,7 @@
  * The cookie name is in args and the name length in args->data.str.len.
  * Accepts exactly 1 argument of type string. If the input options indicate
  * that no iterating is desired, then only last value is fetched if any.
+ * The returned sample is of type CSTR.
  */
 static int
 smp_fetch_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@@ -9711,8 +9713,8 @@
 
 /* Iterate over all cookies present in a request to count how many occurrences
  * match the name in args and args->data.str.len. If <multi> is non-null, then
- * multiple cookies may be parsed on the same line.
- * Accepts exactly 1 argument of type string.
+ * multiple cookies may be parsed on the same line. The returned sample is of
+ * type UINT. Accepts exactly 1 argument of type string.
  */
 static int
 smp_fetch_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@@ -9771,6 +9773,7 @@
 		}
 	}
 
+	smp->type = SMP_T_UINT;
 	smp->data.uint = cnt;
 	smp->flags |= SMP_F_VOL_HDR;
 	return 1;