Add NULL check in updateSSLPendingFlag

[zuiderkwast]

Fixes #3607

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.69%. Comparing base (96763ad) to head (92fba6e).
⚠️ Report is 1 commits behind head on unstable.

Additional details and impacted files

@@             Coverage Diff              @@
##           unstable    #3641      +/-   ##
============================================
+ Coverage     76.67%   76.69%   +0.01%     
============================================
  Files           162      162              
  Lines         80623    80623              
============================================
+ Hits          61816    61830      +14     
+ Misses        18807    18793      -14     

Files with missing lines	Coverage Δ
src/tls.c	17.64% <ø> (ø)

... and 21 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[murphyjacob4]

This guard LGTM and it's good to be defensive here.

But conn->ssl == NULL implies that shutdown or close was previously called. Do we have a bug in the state machine? Ideally after shutdown or close we would move the connection state to reflect that, and fail fast in connTLSRead with the check:

if (conn->c.state != CONN_STATE_CONNECTED) return -1;

I guess we don't move the state machine on shutdown or close in the existing code?

[zuiderkwast]

Do we have a bug in the state machine?

I don't know how it happened, but I know from #3607 that it happened and that this fix prevents the crash.

If we can't reproduce it, we can only try to follow all call sites to see how this can happen.

Let's backport this small fix and then we can improve the state machine in future versions?