lib-http: server: Fix premature connection destroy in http_server_con…

…nection_output().

Added a reference to the connection object while it is sending the remainder of a response's payload.
This is necessary, since http_server_response_send_more() can destroy the connection, for example when the request has a "Connection: close" header.
This will only occur for responses with a very large payload, because otherwise the payload is fully sent in in the initial pass.

src/lib-http/http-server-connection.c

@@ -954,6 +954,7 @@ int http_server_connection_output(struct http_server_connection *conn)
 {
 	bool pipeline_was_full =
 		http_server_connection_pipeline_is_full(conn);
+	int ret;
 
 	if (http_server_connection_flush(conn) < 0)
 		return -1;
@@ -966,8 +967,15 @@ int http_server_connection_output(struct http_server_connection *conn)
 		struct http_server_response *resp = req->response;
 		const char *error = NULL;
 
+		http_server_connection_ref(conn);
+
 		i_assert(resp != NULL);
-		if (http_server_response_send_more(resp, &error) < 0) {
+		ret = http_server_response_send_more(resp, &error);
+
+		if (http_server_connection_unref_is_closed(conn))
+			return -1;
+
+		if (ret < 0) {
 			http_server_connection_write_failed(conn, error);
 			return -1;
 		}