H2: fix crash issueaccepted/tizen/6.5/base/20231026.094327tizen_6.5_baseaccepted/tizen_6.5_base

Backport partially to solve the crash
https://github.com/curl/curl/pull/11563/commits/d58827b0ed9d5b66c99fbe29d9b82c7fccd36e76

Change-Id: If4b3a69b08075bb25468f9194637b53be1bf606a

1 files changed, 11 insertions, 0 deletions

diff --git a/lib/http2.c b/lib/http2.c
index 925d9828b..06cc1bda4 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1585,6 +1585,17 @@ static ssize_t http2_recv(struct connectdata *conn, int sockindex,
     return -1;
   }
 
+  if(!stream) {
+    /* Abnormal call sequence: either this transfer has never opened a stream
+     * (unlikely) or the transfer has been done, cleaned up its resources, but
+     * a read() is called anyway. It is not clear what the calling sequence
+     * is for such a case. */
+    failf(data, "http2_recv: http/2 recv on a transfer never opened "
+          "or already cleared\n");
+    *err = CURLE_HTTP2;
+    return -1;
+  }
+
   /* Nullify here because we call nghttp2_session_send() and they
      might refer to the old buffer. */
   stream->upload_mem = NULL;