http2: cleanup pushed newhandle on fail

When nghttp2_session_set_stream_user_data() fails, clean up the
new handle.

Reported-by: Joshua Rogers
Closes #18931

diff --git a/lib/http2.c b/lib/http2.c
index ff53fc4b947dc97b0085532f9f33c8f395ba8801..43f4e9106cafeb1ca1165f425ac2e24667825ca3 100644 (file)
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1030,6 +1030,7 @@ static int push_promise(struct Curl_cfilter *cf,
       infof(data, "failed to set user_data for stream %u",
             newstream->id);
       DEBUGASSERT(0);
+      discard_newhandle(cf, newhandle);
       rv = CURL_PUSH_DENY;
       goto fail;
     }