From d07193bbcefc36f53030480770ace8ab82b18912 Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Thu, 16 Jul 2026 14:43:22 +0000
Subject: Make dtls1_do_write_ccs() self contained.

A ChangeCipherSpec message is always the same single byte. Make
dtls1_do_write_ccs() know how to send this message, which avoids the use of
buffers and needing to keep copies for retransmission.

ok kenjiro@ tb@
---
 src/lib/libssl/d1_both.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index 57390112c9..b57c8960c1 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_both.c,v 1.98 2026/07/16 14:37:21 jsing Exp $ */
+/* $OpenBSD: d1_both.c,v 1.99 2026/07/16 14:43:22 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -354,18 +354,19 @@ dtls1_do_write_handshake_message(SSL *s)
 static int
 dtls1_do_write_ccs(SSL *s)
 {
+	const uint8_t ccs[] = { SSL3_MT_CCS };
 	int ret;
 
 	OPENSSL_assert(s->d1->mtu >= dtls1_min_mtu());
 
 	if ((ret = dtls1_write_bytes(s, SSL3_RT_CHANGE_CIPHER_SPEC,
-	    &s->init_buf->data[s->init_off], s->init_num)) < 0)
+	    ccs, sizeof(ccs))) < 0)
 		return -1;
 
-	OPENSSL_assert(s->init_num == ret);
+	OPENSSL_assert(sizeof(ccs) == ret);
 
 	ssl_msg_callback(s, 1, SSL3_RT_CHANGE_CIPHER_SPEC,
-	    s->init_buf->data, s->init_num);
+	    ccs, sizeof(ccs));
 
 	s->init_off = 0;
 	s->init_num = 0;
-- 
cgit v1.2.3-55-g6feb