daemon/http: fix double-free on some pkt send failures

When http_write() returns non-zero, worker_submit() performs the task
cleanup and calling on_write() callback only causes double free.

diff --git a/daemon/http.c b/daemon/http.c
index 173fd20ffe732b9fa79997bd2394137b56f84c98..372a83d2f1a4b2304de79cf1b735ec9a3486639f 100644 (file)
--- a/daemon/http.c
+++ b/daemon/http.c
@@ -441,14 +441,12 @@ static int http_send_response(nghttp2_session *h2, char *size, size_t size_len,
        ret = nghttp2_submit_response(h2, stream_id, hdrs, sizeof(hdrs)/sizeof(*hdrs), prov);
        if (ret != 0) {
                kr_log_verbose("[http] nghttp2_submit_response failed: %s\n", nghttp2_strerror(ret));
-               on_pkt_write(data, kr_error(EIO));
                return kr_error(EIO);
        }
 
        ret = nghttp2_session_set_stream_user_data(h2, stream_id, (void*)data);
        if (ret != 0) {
                kr_log_verbose("[http] failed to set stream user data: %s\n", nghttp2_strerror(ret));
-               on_pkt_write(data, kr_error(EIO));
                return kr_error(EIO);
        }