3 files changed, 11 insertions, 8 deletions

diff --git a/src/lib/libssl/ssl_kex.c b/src/lib/libssl/ssl_kex.c
index 9f7e471fe7..ad69b2f485 100644
--- a/src/lib/libssl/ssl_kex.c
+++ b/src/lib/libssl/ssl_kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_kex.c,v 1.13 2026/06/07 02:36:04 tb Exp $ */
+/* $OpenBSD: ssl_kex.c,v 1.14 2026/06/08 11:38:04 tb Exp $ */
 /*
  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -356,7 +356,8 @@ ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb)
 }
 
 int
-ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs)
+ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs,
+    int *decode_error)
 {
         EC_GROUP *group = NULL;
         EC_POINT *point = NULL;
diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h
index 95913f81a6..9999d55963 100644
--- a/src/lib/libssl/ssl_local.h
+++ b/src/lib/libssl/ssl_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_local.h,v 1.41 2026/06/06 15:08:15 jsing Exp $ */
+/* $OpenBSD: ssl_local.h,v 1.42 2026/06/08 11:38:04 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1336,7 +1336,8 @@ int ssl_kex_derive_dhe(DH *dh, DH *dh_peer,
 int ssl_kex_dummy_ecdhe_x25519(EVP_PKEY *pkey);
 int ssl_kex_generate_ecdhe_ecp(EC_KEY *ecdh, int nid);
 int ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb);
-int ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs);
+int ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs,
+    int *decode_error);
 int ssl_kex_derive_ecdhe_ecp(EC_KEY *ecdh, EC_KEY *ecdh_peer,
     uint8_t **shared_key, size_t *shared_key_len);
 
diff --git a/src/lib/libssl/tls_key_share.c b/src/lib/libssl/tls_key_share.c
index 48b353d318..adaf147584 100644
--- a/src/lib/libssl/tls_key_share.c
+++ b/src/lib/libssl/tls_key_share.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_key_share.c,v 1.11 2026/05/06 15:02:51 jsing Exp $ */
+/* $OpenBSD: tls_key_share.c,v 1.12 2026/06/08 11:38:04 tb Exp $ */
 /*
  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -491,7 +491,8 @@ tls_key_share_peer_public_dhe(struct tls_key_share *ks, CBS *cbs,
 }
 
 static int
-tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs)
+tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs,
+    int *decode_error)
 {
         EC_KEY *ecdhe = NULL;
         int ret = 0;
@@ -501,7 +502,7 @@ tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs)
 
         if ((ecdhe = EC_KEY_new()) == NULL)
                 goto err;
-        if (!ssl_kex_peer_public_ecdhe_ecp(ecdhe, ks->nid, cbs))
+        if (!ssl_kex_peer_public_ecdhe_ecp(ecdhe, ks->nid, cbs, decode_error))
                 goto err;
 
         ks->ecdhe_peer = ecdhe;
@@ -625,7 +626,7 @@ tls_key_share_peer_public(struct tls_key_share *ks, CBS *cbs, int *decode_error,
         if (ks->nid == NID_X25519)
                 return tls_key_share_peer_public_x25519(ks, cbs, decode_error);
 
-        return tls_key_share_peer_public_ecdhe_ecp(ks, cbs);
+        return tls_key_share_peer_public_ecdhe_ecp(ks, cbs, decode_error);
 }
 
 /* Called from client to process a server peer */