tlsext: add XXX to consider refusing anything but uncompressed point format

ok jsing kenjiro

1 files changed, 3 insertions, 1 deletions

diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index ccdb5d1dfa..22c5e7d1b1 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.161 2026/06/06 08:45:41 tb Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.162 2026/06/08 12:05:25 tb Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -386,6 +386,8 @@ tlsext_ecpf_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         if (CBS_len(&ecpf) == 0)
                 return 0;
 
+        /* XXX - tighten this to reject anything but uncompressed format? */
+
         /* Must contain uncompressed (0) - RFC 8422, section 5.1.2. */
         if (!CBS_contains_zero_byte(&ecpf)) {
                 SSLerror(s, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);