From: Stefan Eissing <stefan@eissing.org>
Date: Wed, 8 Oct 2025 10:28:14 +0000 (+0200)
Subject: http2: cleanup pushed newhandle on fail
X-Git-Tag: rc-8_17_0-1~46
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=44a79d4f7afe52ca613516cf9dd5d83ac7d5c2c0;p=thirdparty%2Fcurl.git

http2: cleanup pushed newhandle on fail

When nghttp2_session_set_stream_user_data() fails, clean up the
new handle.

Reported-by: Joshua Rogers
Closes #18931
---

diff --git a/lib/http2.c b/lib/http2.c
index ff53fc4b94..43f4e9106c 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1030,6 +1030,7 @@ static int push_promise(struct Curl_cfilter *cf,
       infof(data, "failed to set user_data for stream %u",
             newstream->id);
       DEBUGASSERT(0);
+      discard_newhandle(cf, newhandle);
       rv = CURL_PUSH_DENY;
       goto fail;
     }