Fix assertion failure, expand doc comment

crypto/digest_extra/digest_extra.c

@@ -282,15 +282,15 @@ static void null_update(EVP_MD_CTX *ctx, const void *data, size_t count) {}
 static void null_final(EVP_MD_CTX *ctx, unsigned char *md) {}
 
 static const EVP_MD evp_md_null = {
-    NID_undef,
-    0,
-    0,
-    null_init,
-    null_update,
-    null_final,
-    0,
-    0,
-    NULL,
+  NID_undef,
+  0,
+  0,
+  null_init,
+  null_update,
+  null_final,
+  0,
+  sizeof(EVP_MD_CTX),
+  NULL,
 };
 
 const EVP_MD *EVP_md_null(void) { return &evp_md_null; }

include/openssl/ssl.h

@@ -1721,7 +1721,12 @@ OPENSSL_EXPORT int SSL_set_strict_cipher_list(SSL *ssl, const char *str);
 // zero on failure.
 OPENSSL_EXPORT int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str);
 
-// SSL_set_ciphersuites simply wraps |SSL_CTX_set_ciphersuites|.
+// SSL_set_ciphersuites simply wraps |SSL_CTX_set_ciphersuites|. In OpenSSL,
+// the only difference between |SSL_CTX_set_ciphersuites| and
+// |SSL_set_ciphersuites| is that the latter duplicates the |SSL| struct's
+// |cipher_list| onto the associated |SSL_CONNECTION| struct. In AWS-LC, we
+// track |tls13_cipher_list| and |cipher_list| on |SSL_CTX| so that behavior is
+// not applicable to this |SSL_set_ciphersuites|.
 OPENSSL_EXPORT int SSL_set_ciphersuites(SSL *ssl, const char *str);
 
 // SSL_set_cipher_list configures the cipher list for |ssl|, evaluating |str| as