tls: fix use-after-free in tls_push_record