http/Client: OnDechunkEnd() returns CLOSE, not DESTROYED

Using CLOSED is easier and allows the caller to decide when to destroy
the DechunkIstream object.  Additionally, DESTROYED is illegal when
called from DechunkIstream::_ConsumeBucketList() because that method
must not destroy the DechunkIstream.

Author: MaxKellermann

debian/changelog

@@ -2,6 +2,7 @@ cm4all-beng-proxy (21.18) unstable; urgency=low
 
   * bp: discard MOUNT_LISTEN_STREAM processes under memory pressure
   * bp: reduce MOUNT_LISTEN_STREAM idle timeout to 2 minutes
+  * http_client: fix use-after-free bug
   * istream/dechunk: fix integer overflow
 
  --   

src/http/Client.cxx

@@ -192,8 +192,7 @@ class HttpClient final : BufferedSocketHandler, IstreamSink, Cancellable, Destru
 		DechunkInputAction OnDechunkEnd() noexcept final {
 			GetClient().SocketDone();
 			GetClient().stopwatch.RecordEvent("end");
-			GetClient().Destroy();
-			return DechunkInputAction::DESTROYED;
+			return DechunkInputAction::CLOSE;
 		}
 	};