1 files changed, 9 insertions, 13 deletions

diff --git a/src/usr.bin/openssl/certhash.c b/src/usr.bin/openssl/certhash.c
index 5ee29b8d01..1ee1165516 100644
--- a/src/usr.bin/openssl/certhash.c
+++ b/src/usr.bin/openssl/certhash.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: certhash.c,v 1.21 2023/03/06 14:32:05 tb Exp $ */
+/*      $OpenBSD: certhash.c,v 1.22 2025/07/27 14:46:20 joshua Exp $ */
 /*
  * Copyright (c) 2014, 2015 Joel Sing <jsing@openbsd.org>
  *
@@ -297,11 +297,10 @@ hashinfo_from_linkname(const char *linkname, const char *target)
 }
 
 static struct hashinfo *
-certhash_cert(BIO *bio, const char *filename)
+certhash_cert(BIO *bio, const char *filename, const EVP_MD *digest)
 {
         unsigned char fingerprint[EVP_MAX_MD_SIZE];
         struct hashinfo *hi = NULL;
-        const EVP_MD *digest;
         X509 *cert = NULL;
         unsigned long hash;
         unsigned int len;
@@ -311,7 +310,6 @@ certhash_cert(BIO *bio, const char *filename)
 
         hash = X509_subject_name_hash(cert);
 
-        digest = EVP_sha256();
         if (X509_digest(cert, digest, fingerprint, &len) != 1) {
                 fprintf(stderr, "out of memory\n");
                 goto err;
@@ -326,11 +324,10 @@ certhash_cert(BIO *bio, const char *filename)
 }
 
 static struct hashinfo *
-certhash_crl(BIO *bio, const char *filename)
+certhash_crl(BIO *bio, const char *filename, const EVP_MD *digest)
 {
         unsigned char fingerprint[EVP_MAX_MD_SIZE];
         struct hashinfo *hi = NULL;
-        const EVP_MD *digest;
         X509_CRL *crl = NULL;
         unsigned long hash;
         unsigned int len;
@@ -340,7 +337,6 @@ certhash_crl(BIO *bio, const char *filename)
 
         hash = X509_NAME_hash(X509_CRL_get_issuer(crl));
 
-        digest = EVP_sha256();
         if (X509_CRL_digest(crl, digest, fingerprint, &len) != 1) {
                 fprintf(stderr, "out of memory\n");
                 goto err;
@@ -509,7 +505,7 @@ certhash_link(struct dirent *dep, struct hashinfo **links)
 
 static int
 certhash_file(struct dirent *dep, struct hashinfo **certs,
-    struct hashinfo **crls)
+    struct hashinfo **crls, const EVP_MD *digest)
 {
         struct hashinfo *hi = NULL;
         int has_cert, has_crl;
@@ -529,7 +525,7 @@ certhash_file(struct dirent *dep, struct hashinfo **certs,
                 goto err;
         }
 
-        if ((hi = certhash_cert(bio, dep->d_name)) != NULL) {
+        if ((hi = certhash_cert(bio, dep->d_name, digest)) != NULL) {
                 has_cert = 1;
                 *certs = hashinfo_chain(*certs, hi);
         }
@@ -539,7 +535,7 @@ certhash_file(struct dirent *dep, struct hashinfo **certs,
                 goto err;
         }
 
-        if ((hi = certhash_crl(bio, dep->d_name)) != NULL) {
+        if ((hi = certhash_crl(bio, dep->d_name, digest)) != NULL) {
                 has_crl = hi->is_crl = 1;
                 *crls = hashinfo_chain(*crls, hi);
         }
@@ -557,7 +553,7 @@ certhash_file(struct dirent *dep, struct hashinfo **certs,
 }
 
 static int
-certhash_directory(const char *path)
+certhash_directory(const char *path, const EVP_MD *digest)
 {
         struct hashinfo *links = NULL, *certs = NULL, *crls = NULL, *link;
         int ret = 0;
@@ -579,7 +575,7 @@ certhash_directory(const char *path)
                                 goto err;
                 }
                 if (filename_is_pem(dep->d_name)) {
-                        if (certhash_file(dep, &certs, &crls) == -1)
+                        if (certhash_file(dep, &certs, &crls, digest) == -1)
                                 goto err;
                 }
         }
@@ -678,7 +674,7 @@ certhash_main(int argc, char **argv)
                         ret = 1;
                         continue;
                 }
-                ret |= certhash_directory(argv[i]);
+                ret |= certhash_directory(argv[i], EVP_sha256());
                 if (fchdir(cwdfd) == -1) {
                         perror("failed to restore current directory");
                         ret = 1;