Commit 1a2e75520b for openssl.org

commit 1a2e75520be28c1e32668b9167aadcc639ed29bf
Author: Dr. David von Oheimb <dev@ddvo.net>
Date:   Thu Jun 4 06:48:24 2026 +0200

    make sure BIO_set_ssl() transfers ownership of ssl only on success; document this

    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    MergeDate: Wed Jun 10 06:27:04 2026
    (Merged from https://github.com/openssl/openssl/pull/27357)

diff --git a/doc/man3/BIO_f_ssl.pod b/doc/man3/BIO_f_ssl.pod
index a6eff2bb49..000f34e9e9 100644
--- a/doc/man3/BIO_f_ssl.pod
+++ b/doc/man3/BIO_f_ssl.pod
@@ -56,6 +56,7 @@ SSL structure is also freed using SSL_free().

 BIO_set_ssl() sets the internal SSL pointer of SSL BIO B<b> to B<ssl> using
 the close flag B<c>.
+On success, ownership of B<ssl> is transferred to BIO B<b>.

 BIO_get_ssl() retrieves the SSL pointer of SSL BIO B<b>, it can then be
 manipulated using the standard SSL library functions.
diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c
index f1f471682b..ebd9c58365 100644
--- a/ssl/bio_ssl.c
+++ b/ssl/bio_ssl.c
@@ -299,7 +299,6 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
         }
         BIO_set_shutdown(b, num);
         ssl = (SSL *)ptr;
-        bs->ssl = ssl;
         bio = SSL_get_rbio(ssl);
         if (bio != NULL) {
             if (!BIO_up_ref(bio)) {
@@ -311,6 +310,7 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
             BIO_set_next(b, bio);
         }
         BIO_set_init(b, 1);
+        bs->ssl = ssl;
         break;
     case BIO_C_GET_SSL:
         if (ptr != NULL) {