Fix potential NULL dereference

We document that either of recv or recv_timeout may be NULL, but for TLS we
always used recv... Thanks Coverity for catching that.
(Not remotely trigerrable: local configuration.)

Also made me notice net_recv_timeout didn't do its job properly.
diff --git a/include/mbedtls/net.h b/include/mbedtls/net.h
index ed2d5d3..92f94c0 100644
--- a/include/mbedtls/net.h
+++ b/include/mbedtls/net.h
@@ -178,6 +178,7 @@
  * \param buf      The buffer to write to
  * \param len      Maximum length of the buffer
  * \param timeout  Maximum number of milliseconds to wait for data
+ *                 0 means no timeout (wait forever)
  *
  * \return         the number of bytes received,
  *                 or a non-zero error code:
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index d75e93a..b7e361a 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -982,7 +982,7 @@
  * \param f_recv   read callback
  * \param f_recv_timeout blocking read callback with timeout.
  *                 The last argument is the timeout in milliseconds,
- *                 0 means no timeout
+ *                 0 means no timeout (block forever until a message comes)
  *
  * \note           One of f_recv or f_recv_timeout can be NULL, in which case
  *                 the other is used. If both are non-NULL, f_recv_timeout is