From aadc1d67e4c39bc3840c965d12277e1d7f68e948 Mon Sep 17 00:00:00 2001
From: kenjiro <>
Date: Fri, 21 Aug 2026 02:23:33 +0000
Subject: Allocate TLS 1.3 receive buffers lazily

The receive buffer is not used for records created for sending. Avoid
allocating a maximum-sized buffer in tls13_record_new() and instead
allocate a header-sized buffer when tls13_record_recv() is first called.
The buffer will grow as needed once the record length is known.

This avoids an unnecessary allocation for outgoing records and reduces
the initial allocation size for incoming records.

ok tb jsing
---
 src/lib/libssl/tls13_record.c | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libssl/tls13_record.c b/src/lib/libssl/tls13_record.c
index dbc835c546..0723fa3b0a 100644
--- a/src/lib/libssl/tls13_record.c
+++ b/src/lib/libssl/tls13_record.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_record.c,v 1.10 2022/07/22 19:33:53 jsing Exp $ */
+/* $OpenBSD: tls13_record.c,v 1.11 2026/08/21 02:23:33 kenjiro Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -32,19 +32,7 @@ struct tls13_record {
 struct tls13_record *
 tls13_record_new(void)
 {
-	struct tls13_record *rec = NULL;
-
-	if ((rec = calloc(1, sizeof(struct tls13_record))) == NULL)
-		goto err;
-	if ((rec->buf = tls_buffer_new(TLS13_RECORD_MAX_LEN)) == NULL)
-		goto err;
-
-	return rec;
-
- err:
-	tls13_record_free(rec);
-
-	return NULL;
+	return calloc(1, sizeof(struct tls13_record));
 }
 
 void
@@ -129,6 +117,11 @@ tls13_record_recv(struct tls13_record *rec, tls_read_cb wire_read,
 	if (rec->data != NULL)
 		return TLS13_IO_FAILURE;
 
+	if (rec->buf == NULL)
+		rec->buf = tls_buffer_new(TLS13_RECORD_HEADER_LEN);
+	if (rec->buf == NULL)
+		return TLS13_IO_FAILURE;
+
 	if (rec->content_type == 0) {
 		if ((ret = tls_buffer_extend(rec->buf,
 		    TLS13_RECORD_HEADER_LEN, wire_read, wire_arg)) <= 0)
-- 
cgit v1.2.3-55-g6feb