From baa9a5c738f68f3c75ae79a408cabd4e9ea2d12c Mon Sep 17 00:00:00 2001
From: tb <>
Date: Mon, 8 Jun 2026 11:38:04 +0000
Subject: Add a decode_error argument to ssl_kex_peer_public_ecdhe_ecp()

ok jsing kenjiro
---
 src/lib/libssl/ssl_kex.c       | 5 +++--
 src/lib/libssl/ssl_local.h     | 5 +++--
 src/lib/libssl/tls_key_share.c | 9 +++++----
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/src/lib/libssl/ssl_kex.c b/src/lib/libssl/ssl_kex.c
index 9f7e471fe7..ad69b2f485 100644
--- a/src/lib/libssl/ssl_kex.c
+++ b/src/lib/libssl/ssl_kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_kex.c,v 1.13 2026/06/07 02:36:04 tb Exp $ */
+/* $OpenBSD: ssl_kex.c,v 1.14 2026/06/08 11:38:04 tb Exp $ */
 /*
  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -356,7 +356,8 @@ ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb)
 }
 
 int
-ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs)
+ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs,
+    int *decode_error)
 {
 	EC_GROUP *group = NULL;
 	EC_POINT *point = NULL;
diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h
index 95913f81a6..9999d55963 100644
--- a/src/lib/libssl/ssl_local.h
+++ b/src/lib/libssl/ssl_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_local.h,v 1.41 2026/06/06 15:08:15 jsing Exp $ */
+/* $OpenBSD: ssl_local.h,v 1.42 2026/06/08 11:38:04 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1336,7 +1336,8 @@ int ssl_kex_derive_dhe(DH *dh, DH *dh_peer,
 int ssl_kex_dummy_ecdhe_x25519(EVP_PKEY *pkey);
 int ssl_kex_generate_ecdhe_ecp(EC_KEY *ecdh, int nid);
 int ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb);
-int ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs);
+int ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs,
+    int *decode_error);
 int ssl_kex_derive_ecdhe_ecp(EC_KEY *ecdh, EC_KEY *ecdh_peer,
     uint8_t **shared_key, size_t *shared_key_len);
 
diff --git a/src/lib/libssl/tls_key_share.c b/src/lib/libssl/tls_key_share.c
index 48b353d318..adaf147584 100644
--- a/src/lib/libssl/tls_key_share.c
+++ b/src/lib/libssl/tls_key_share.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_key_share.c,v 1.11 2026/05/06 15:02:51 jsing Exp $ */
+/* $OpenBSD: tls_key_share.c,v 1.12 2026/06/08 11:38:04 tb Exp $ */
 /*
  * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
  *
@@ -491,7 +491,8 @@ tls_key_share_peer_public_dhe(struct tls_key_share *ks, CBS *cbs,
 }
 
 static int
-tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs)
+tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs,
+    int *decode_error)
 {
 	EC_KEY *ecdhe = NULL;
 	int ret = 0;
@@ -501,7 +502,7 @@ tls_key_share_peer_public_ecdhe_ecp(struct tls_key_share *ks, CBS *cbs)
 
 	if ((ecdhe = EC_KEY_new()) == NULL)
 		goto err;
-	if (!ssl_kex_peer_public_ecdhe_ecp(ecdhe, ks->nid, cbs))
+	if (!ssl_kex_peer_public_ecdhe_ecp(ecdhe, ks->nid, cbs, decode_error))
 		goto err;
 
 	ks->ecdhe_peer = ecdhe;
@@ -625,7 +626,7 @@ tls_key_share_peer_public(struct tls_key_share *ks, CBS *cbs, int *decode_error,
 	if (ks->nid == NID_X25519)
 		return tls_key_share_peer_public_x25519(ks, cbs, decode_error);
 
-	return tls_key_share_peer_public_ecdhe_ecp(ks, cbs);
+	return tls_key_share_peer_public_ecdhe_ecp(ks, cbs, decode_error);
 }
 
 /* Called from client to process a server peer */
-- 
cgit v1.2.3-55-g6feb