Deal with any remaining request body in cnt_synth

Call HTTP1_DiscardReqBody() in cnt_synth before delivery to deal with
any lingering request body.

Fixes: #1577

bin/varnishd/cache/cache_req_fsm.c

@@ -209,7 +209,6 @@ cnt_synth(struct worker *wrk, struct req *req)
 
 	wrk->stats.s_synth++;
 
-
 	now = W_TIM_real(wrk);
 	VSLb_ts_req(req, "Process", now);
 
@@ -247,6 +246,9 @@ cnt_synth(struct worker *wrk, struct req *req)
 	if (http_HdrIs(req->resp, H_Connection, "close"))
 		req->doclose = SC_RESP_CLOSE;
 
+	/* Discard any lingering request body before delivery */
+	(void)HTTP1_DiscardReqBody(req);
+
 	V1D_Deliver_Synth(req);
 
 	VSLb_ts_req(req, "Resp", W_TIM_real(wrk));

bin/varnishtest/tests/r01577.vtc

+varnishtest "#1577: reqbody and synth from recv"
+
+server s1 {
+	rxreq
+	txresp
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		if (req.url == "/1") {
+			return (synth(200, "OK"));
+		}
+	}
+	sub vcl_synth {
+		set resp.http.x-url = req.url;
+	}
+	sub vcl_deliver {
+		set resp.http.x-url = req.url;
+	}
+} -start
+
+client c1 {
+	# Send a body that happens to be a valid HTTP request
+	# This one is answered by synth()
+	txreq -url "/1" -body "GET /foo HTTP/1.1\r\n\r\n"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-url == "/1"
+
+	# Make sure that a second request on the same connection goes through
+	# and that the body of the previous one isn't interpreted as the
+	# next request
+	txreq -url "/2"
+	rxresp
+	expect resp.status == 200
+	expect resp.http.x-url == "/2"
+} -run