scheduler: Fix possible use_after_free in cupsdReadClient()

If cupsdSendHeader() fails, we free the connection and return -1, but in
that case we try to free the connection again in cupsdReadClient().

Author: zdohnal

CHANGES.md

@@ -7,6 +7,7 @@ Changes in CUPS v2.4.17 (YYYY-MM-DD)
 
 - The scheduler followed symbolic links when cleaning out its temporary
   directory (Issue #1448)
+- Fixed possible use-after-free in `cupsdReadClient()` (Issue #1454)
 
 
 Changes in CUPS v2.4.16 (2025-12-04)

scheduler/client.c

@@ -2752,10 +2752,7 @@ check_start_tls(cupsd_client_t *con)	/* I - Client connection */
     httpSetField(con->http, HTTP_FIELD_CONTENT_LENGTH, "0");
 
     if (!cupsdSendHeader(con, HTTP_STATUS_OK, NULL, CUPSD_AUTH_NONE))
-    {
-      cupsdCloseClient(con);
       return (-1);
-    }
   }
 
   return (1);