At least check stream ID is valid when PUSH_PROMISE is received in goaway mode

lib/nghttp2_session.c

@@ -4121,17 +4121,18 @@ int nghttp2_session_on_push_promise_received(nghttp2_session *session,
     return session_inflate_handle_invalid_connection(
         session, frame, NGHTTP2_ERR_PROTO, "PUSH_PROMISE: push disabled");
   }
-  if (session->goaway_flags) {
-    /* We just dicard PUSH_PROMISE after GOAWAY is sent or
-       received. */
-    return NGHTTP2_ERR_IGN_HEADER_BLOCK;
-  }
 
   if (!nghttp2_session_is_my_stream_id(session, frame->hd.stream_id)) {
     return session_inflate_handle_invalid_connection(
         session, frame, NGHTTP2_ERR_PROTO, "PUSH_PROMISE: invalid stream_id");
   }
 
+  if (session->goaway_flags) {
+    /* We just dicard PUSH_PROMISE after GOAWAY is sent or
+       received. */
+    return NGHTTP2_ERR_IGN_HEADER_BLOCK;
+  }
+
   if (!session_is_new_peer_stream_id(session,
                                      frame->push_promise.promised_stream_id)) {
     /* The spec says if an endpoint receives a PUSH_PROMISE with