lib-http: server: Fix premature connection destroy in http_server_connection_output().

Added a reference to the connection object while it is sending the remainder of a response's payload.
This is necessary, since http_server_response_send_more() can destroy the connection, for example when the request has a "Connection: close" header.
This will only occur for responses with a very large payload, because otherwise the payload is fully sent in in the initial pass.

diff --git a/src/lib-http/http-server-connection.c b/src/lib-http/http-server-connection.c
index 6c3496ffe80d0f3dc9f9dff2a0106f0ef42ac69b..9d80331d2371b1444913c62ed6f95bdc93792f74 100644 (file)
--- a/src/lib-http/http-server-connection.c
+++ b/src/lib-http/http-server-connection.c
@@ -954,6 +954,7 @@ int http_server_connection_output(struct http_server_connection *conn)
 {
        bool pipeline_was_full =
                http_server_connection_pipeline_is_full(conn);
+       int ret;
 
        if (http_server_connection_flush(conn) < 0)
                return -1;
@@ -966,8 +967,15 @@ int http_server_connection_output(struct http_server_connection *conn)
                struct http_server_response *resp = req->response;
                const char *error = NULL;
 
+               http_server_connection_ref(conn);
+
                i_assert(resp != NULL);
-               if (http_server_response_send_more(resp, &error) < 0) {
+               ret = http_server_response_send_more(resp, &error);
+
+               if (http_server_connection_unref_is_closed(conn))
+                       return -1;
+
+               if (ret < 0) {
                        http_server_connection_write_failed(conn, error);
                        return -1;
                }