1 files changed, 7 insertions, 0 deletions

diff --git a/src/ot_tcp.c b/src/ot_tcp.c
index f93795b..5d7b78f 100644
--- a/src/ot_tcp.c
+++ b/src/ot_tcp.c
@@ -45,6 +45,7 @@ static ssize_t header_complete(char *request, ssize_t byte_count) {
 void tcp_read(const int64_t sock, struct ot_workstruct *ws) {
   struct http_data *cookie     = fdstate_cookie(sock);
   ssize_t           byte_count = read((int)sock, ws->inbuf, G_INBUF_SIZE);
+  uint32_t          generation;
 
   if (byte_count == 0 || (byte_count == -1 && errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)) {
     http_close(sock);
@@ -75,6 +76,7 @@ void tcp_read(const int64_t sock, struct ot_workstruct *ws) {
     return;
   }
 
+  generation = fdstate_generation((int)sock);
   while ((ws->header_size = header_complete(cookie->request.data, (ssize_t)cookie->request.size))) {
     ws->request      = cookie->request.data;
     ws->request_size = (ssize_t)cookie->request.size;
@@ -84,6 +86,11 @@ void tcp_read(const int64_t sock, struct ot_workstruct *ws) {
        off it, so there is nothing here left to look at */
     if (ws->handed_off)
       return;
+
+    /* The handler may have closed the connection inline, for instance on a
+       write error, which frees the cookie this loop reads from */
+    if (fdstate_generation((int)sock) != generation)
+      return;
 #ifdef WANT_KEEPALIVE
     if (!ws->keep_alive)
 #endif