http2: abort the send_callback if not setup yet

When Curl_http2_done() gets called before the http2 data is setup all
the way, we cannot send anything and this should just return an error.

Detected by OSS-Fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10012

diff --git a/lib/http2.c b/lib/http2.c
index 251fcd8e820edcdb199385a15e6757e00fb8074b..22655e94cd8de0a70ee01591ca4286c82f91f440 100644 (file)
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -370,6 +370,10 @@ static ssize_t send_callback(nghttp2_session *h2,
   (void)h2;
   (void)flags;
 
+  if(!c->send_underlying)
+    /* called before setup properly! */
+    return NGHTTP2_ERR_CALLBACK_FAILURE;
+
   written = ((Curl_send*)c->send_underlying)(conn, FIRSTSOCKET,
                                              data, length, &result);