(evhtp_send_reply): Grab reference to bufferevent during write.

If the data written is not very large, _evhtp_connection_writecb() may
be called directly from the bufferevent_write_buffer() call, and thus
free the evhtp connection and the underlying bufferevent.

This works fine us and for libevhtp, but unfortunately the SSL code in
libevent doesn't hold a reference to the bufferevent when calling the
write callback, and still it uses the bufferevent after the write
callback. By grabbing an extra reference to the bufferevent we become
independent of what libevent does.

evhtp.c

@@ -3045,6 +3045,7 @@ void
 evhtp_send_reply(evhtp_request_t * request, evhtp_res code) {
     evhtp_connection_t * c;
     evbuf_t            * reply_buf;
+    struct bufferevent * bev;
 
     c = evhtp_request_get_connection(request);
     request->finished = 1;
@@ -3055,7 +3056,10 @@ evhtp_send_reply(evhtp_request_t * request, evhtp_res code) {
         return;
     }
 
-    bufferevent_write_buffer(evhtp_connection_get_bev(c), reply_buf);
+    bev = evhtp_connection_get_bev(c);
+    bufferevent_lock(bev);
+    bufferevent_write_buffer(bev, reply_buf);
+    bufferevent_unlock(bev);
     evbuffer_drain(reply_buf, -1);
     /* evbuffer_free(reply_buf); */
 }
@@ -4378,4 +4382,4 @@ evhtp_make_request(evhtp_connection_t * c, evhtp_request_t * r,
 unsigned int
 evhtp_request_status(evhtp_request_t * r) {
     return htparser_get_status(r->conn->parser);
-}
+}