fix panic when receiving already reset push promise (#597)

Found by oss-fuzz

src/proto/streams/recv.rs

@@ -786,6 +786,16 @@ impl Recv {
         }
     }
 
+    pub(super) fn maybe_reset_next_stream_id(&mut self, id: StreamId) {
+        if let Ok(next_id) = self.next_stream_id {
+            // !Peer::is_local_init should have been called beforehand
+            debug_assert_eq!(id.is_server_initiated(), next_id.is_server_initiated());
+            if id >= next_id {
+                self.next_stream_id = id.next_id();
+            }
+        }
+    }
+
     /// Returns true if the remote peer can reserve a stream with the given ID.
     pub fn ensure_can_reserve(&self) -> Result<(), Error> {
         if !self.is_push_enabled {

src/proto/streams/streams.rs

@@ -883,6 +883,10 @@ impl Inner {
                     // We normally would open this stream, so update our
                     // next-send-id record.
                     self.actions.send.maybe_reset_next_stream_id(id);
+                } else {
+                    // We normally would recv this stream, so update our
+                    // next-recv-id record.
+                    self.actions.recv.maybe_reset_next_stream_id(id);
                 }
 
                 let stream = Stream::new(id, 0, 0);