diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index ba218f5..bd3a573 100644
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -960,19 +960,14 @@
     eivlen = s->aead_write_ctx->variable_nonce_len;
   }
 
-  /* lets setup the record stuff. */
-  wr->data = p + eivlen; /* make room for IV in case of CBC */
-  wr->length = (int)len;
-  wr->input = (unsigned char *)buf;
-
-  /* we now 'read' from wr->input, wr->length bytes into wr->data */
-  memcpy(wr->data, wr->input, wr->length);
-  wr->input = wr->data;
-
-  /* this is true regardless of mac size */
+  /* Assemble the input for |s->enc_method->enc|. The input is the plaintext
+   * with |eivlen| bytes of space prepended for the explicit nonce. */
   wr->input = p;
+  wr->length = eivlen + len;
+  memcpy(p + eivlen, buf, len);
+
+  /* Encrypt in-place, so the output also goes into |p|. */
   wr->data = p;
-  wr->length += eivlen;
 
   if (!s->enc_method->enc(s, 1)) {
     goto err;
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 1bf7141..ba5ec9c 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -596,22 +596,14 @@
     eivlen = s->aead_write_ctx->variable_nonce_len;
   }
 
-  /* lets setup the record stuff. */
-  wr->data = p + eivlen;
-  wr->length = (int)(len - (fragment != 0));
-  wr->input = (uint8_t *)buf + (fragment != 0);
-
-  /* we now 'read' from wr->input, wr->length bytes into wr->data */
-
-  memcpy(wr->data, wr->input, wr->length);
-  wr->input = wr->data;
-
-  /* we should still have the output to wr->data and the input from wr->input.
-   * Length should be wr->length. wr->data still points in the wb->buf */
-
+  /* Assemble the input for |s->enc_method->enc|. The input is the plaintext
+   * with |eivlen| bytes of space prepended for the explicit nonce. */
   wr->input = p;
+  wr->length = eivlen + len - (fragment != 0);
+  memcpy(p + eivlen, buf + (fragment != 0), len - (fragment != 0));
+
+  /* Encrypt in-place, so the output also goes into |p|. */
   wr->data = p;
-  wr->length += eivlen;
 
   if (!s->enc_method->enc(s, 1)) {
     goto err;