h2: use after free on premature connection close
h2: use after free on premature connection close

lib/http2/connection.c:on_read() calls parse_input(), which might free
`conn`. It does so in particular if the connection preface isn't
the expected one in expect_preface(). `conn` is then used after the free
in `if (h2o_timeout_is_linked(&conn->_write.timeout_entry)`.
We fix this by adding a return value to close_connection that returns a
negative value if `conn` has been free'd and can't be used anymore.

Credits for finding the bug to Tim Newsham.

tamediadigital/h2o,zlm2012/h2o,h2o/h2o,cwyang/h2o,cubicdaiya/h2o,lkwg82/h2o,tamediadigital/h2o,deweerdt/h2o,rayrapetyan/h2o,nkmideb/h2o-server,rayrapetyan/h2o,nkmideb/h2o-server,cubicdaiya/h2o,lkwg82/h2o,zlm2012/h2o,h2o/h2o,yannick/h2o,deweerdt/h2o,zlm2012/h2o,cwyang/h2o,rayrapetyan/h2o,deweerdt/h2o,lkwg82/h2o,devnexen/h2o,cubicdaiya/h2o,tamediadigital/h2o,i110/h2o,devnexen/h2o,i110/h2o,nkmideb/h2o-server,yannick/h2o,yannick/h2o,tamediadigital/h2o,cwyang/h2o,yannick/h2o,deweerdt/h2o,yannick/h2o,tamediadigital/h2o,nkmideb/h2o-server,i110/h2o,deweerdt/h2o,cubicdaiya/h2o,i110/h2o,devnexen/h2o,i110/h2o,rayrapetyan/h2o,lkwg82/h2o,i110/h2o,lkwg82/h2o,lkwg82/h2o,devnexen/h2o,i110/h2o,cwyang/h2o,rayrapetyan/h2o,lkwg82/h2o,lkwg82/h2o,cubicdaiya/h2o,i110/h2o,h2o/h2o,cubicdaiya/h2o,tamediadigital/h2o,zlm2012/h2o,cubicdaiya/h2o,devnexen/h2o,nkmideb/h2o-server,h2o/h2o,lkwg82/h2o,rayrapetyan/h2o,zlm2012/h2o,i110/h2o,devnexen/h2o,rayrapetyan/h2o,cwyang/h2o,zlm2012/h2o,cubicdaiya/h2o,zlm2012/h2o,nkmideb/h2o-server,tamediadigital/h2o,cwyang/h2o,rayrapetyan/h2o,yannick/h2o,yannick/h2o,deweerdt/h2o,deweerdt/h2o,cwyang/h2o,cwyang/h2o,nkmideb/h2o-server,rayrapetyan/h2o,zlm2012/h2o,tamediadigital/h2o,devnexen/h2o,deweerdt/h2o,i110/h2o,yannick/h2o,yannick/h2o,tamediadigital/h2o,h2o/h2o,rayrapetyan/h2o,h2o/h2o,devnexen/h2o,zlm2012/h2o,deweerdt/h2o,h2o/h2o,devnexen/h2o,nkmideb/h2o-server,h2o/h2o,h2o/h2o