1 files changed, 16 insertions, 12 deletions

diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c
index 401178f0c2..4086101282 100644
--- a/ssl/bio_ssl.c
+++ b/ssl/bio_ssl.c
@@ -227,19 +227,23 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
     BIO *dbio, *bio;
     long ret = 1;
     BIO *next;
+    SSL_CONNECTION *sc = NULL;
 
     bs = BIO_get_data(b);
     next = BIO_next(b);
     ssl = bs->ssl;
-    if ((ssl == NULL) && (cmd != BIO_C_SET_SSL))
+    if ((ssl == NULL
+         || (sc = SSL_CONNECTION_FROM_SSL(ssl)) == NULL)
+        && cmd != BIO_C_SET_SSL)
         return 0;
+    /* TODO(QUIC): The rbio/wbio might be from QUIC_CONNECTION instead */
     switch (cmd) {
     case BIO_CTRL_RESET:
         SSL_shutdown(ssl);
 
-        if (ssl->handshake_func == ssl->method->ssl_connect)
+        if (sc->handshake_func == ssl->method->ssl_connect)
             SSL_set_connect_state(ssl);
-        else if (ssl->handshake_func == ssl->method->ssl_accept)
+        else if (sc->handshake_func == ssl->method->ssl_accept)
             SSL_set_accept_state(ssl);
 
         if (!SSL_clear(ssl)) {
@@ -249,8 +253,8 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
 
         if (next != NULL)
             ret = BIO_ctrl(next, cmd, num, ptr);
-        else if (ssl->rbio != NULL)
-            ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
+        else if (sc->rbio != NULL)
+            ret = BIO_ctrl(sc->rbio, cmd, num, ptr);
         else
             ret = 1;
         break;
@@ -311,20 +315,20 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
         BIO_set_shutdown(b, (int)num);
         break;
     case BIO_CTRL_WPENDING:
-        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
+        ret = BIO_ctrl(sc->wbio, cmd, num, ptr);
         break;
     case BIO_CTRL_PENDING:
         ret = SSL_pending(ssl);
         if (ret == 0)
-            ret = BIO_pending(ssl->rbio);
+            ret = BIO_pending(sc->rbio);
         break;
     case BIO_CTRL_FLUSH:
         BIO_clear_retry_flags(b);
-        ret = BIO_ctrl(ssl->wbio, cmd, num, ptr);
+        ret = BIO_ctrl(sc->wbio, cmd, num, ptr);
         BIO_copy_next_retry(b);
         break;
     case BIO_CTRL_PUSH:
-        if ((next != NULL) && (next != ssl->rbio)) {
+        if ((next != NULL) && (next != sc->rbio)) {
             /*
              * We are going to pass ownership of next to the SSL object...but
              * we don't own a reference to pass yet - so up ref
@@ -378,13 +382,13 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
         ret = (dbs->ssl != NULL);
         break;
     case BIO_C_GET_FD:
-        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
+        ret = BIO_ctrl(sc->rbio, cmd, num, ptr);
         break;
     case BIO_CTRL_SET_CALLBACK:
         ret = 0; /* use callback ctrl */
         break;
     default:
-        ret = BIO_ctrl(ssl->rbio, cmd, num, ptr);
+        ret = BIO_ctrl(sc->rbio, cmd, num, ptr);
         break;
     }
     return ret;
@@ -400,7 +404,7 @@ static long ssl_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)
     ssl = bs->ssl;
     switch (cmd) {
     case BIO_CTRL_SET_CALLBACK:
-        ret = BIO_callback_ctrl(ssl->rbio, cmd, fp);
+        ret = BIO_callback_ctrl(SSL_get_rbio(ssl), cmd, fp);
         break;
     default:
         ret = 0;