From 6d56dad280c2eee494aaa341e3e8dc4f80addcdb Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Mon, 29 Jun 2026 16:21:10 +0200
Subject: [PATCH 01/13] use modern interface for md5/md4

---
 lib/md4.c | 42 ++++++++++++++++++++++++++++++++++--------
 lib/md5.c | 30 ++++++++++++++++++++++--------
 2 files changed, 56 insertions(+), 16 deletions(-)

diff --git a/lib/md4.c b/lib/md4.c
index e030ffac30..3e32bfc738 100644
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -42,16 +42,42 @@
 #include <wolfssl/options.h>
 #endif
 
-/* When OpenSSL or wolfSSL is available, we use their MD4 functions. */
-
 #if defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
-#include <openssl/md4.h>
+#include <openssl/evp.h>
 
-/* Map directly to OpenSSL implementation */
-#define my_md4_ctx    MD4_CTX
-#define my_md4_init   MD4_Init
-#define my_md4_update MD4_Update
-#define my_md4_final  MD4_Final
+typedef EVP_MD_CTX **my_md4_ctx;
+
+static CURLcode my_md4_init(void *ctx)
+{
+  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
+
+  *pctx = EVP_MD_CTX_new();
+  if(!*pctx)
+    return 0;
+
+  if(EVP_DigestInit_ex(*pctx, EVP_md4(), NULL))
+    return 1;
+
+  EVP_MD_CTX_free(*pctx);
+  *pctx = NULL;
+
+  return 0;
+}
+
+static void my_md4_update(void *ctx,
+                          const unsigned char *input, unsigned int len)
+{
+  (void)EVP_DigestUpdate(ctx, input, len);
+}
+
+static void my_md4_final(unsigned char *digest, void *ctx)
+{
+  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
+
+  (void)EVP_DigestFinal(*pctx, digest, NULL);
+  EVP_MD_CTX_free(*pctx);
+  *pctx = NULL;
+}
 
 #elif defined(USE_WOLFSSL) && !defined(NO_MD4)
 #include <wolfssl/wolfcrypt/md4.h>
diff --git a/lib/md5.c b/lib/md5.c
index 358f0744ea..32cbc90bb3 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -72,29 +72,43 @@ static void my_md5_final(unsigned char *digest, void *ctx)
 #endif
 }
 
-#elif defined(USE_OPENSSL) && \
-  !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-#include <openssl/md5.h>
+#elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD5)
+#include <openssl/evp.h>
 
-typedef MD5_CTX my_md5_ctx;
+typedef EVP_MD_CTX **my_md5_ctx;
 
 static CURLcode my_md5_init(void *ctx)
 {
-  if(!MD5_Init(ctx))
+  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
+
+  *pctx = EVP_MD_CTX_new();
+  if(!*pctx)
     return CURLE_OUT_OF_MEMORY;
 
-  return CURLE_OK;
+  if(EVP_DigestInit_ex(*pctx, EVP_md5(), NULL))
+    return CURLE_OK;
+
+  EVP_MD_CTX_free(*pctx);
+  *pctx = NULL;
+
+  return CURLE_FAILED_INIT;
 }
 
 static void my_md5_update(void *ctx,
                           const unsigned char *input, unsigned int len)
 {
-  (void)MD5_Update(ctx, input, len);
+  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
+
+  (void)EVP_DigestUpdate(*pctx, input, len);
 }
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-  (void)MD5_Final(digest, ctx);
+  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
+
+  (void)EVP_DigestFinal(*pctx, digest, NULL);
+  EVP_MD_CTX_free(*pctx);
+  *pctx = NULL;
 }
 
 #elif defined(USE_WOLFSSL) && !defined(NO_MD5)

From 8805037200d5f2fac7e6620f1ce76a2b64e388be Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Mon, 29 Jun 2026 22:17:07 +0200
Subject: [PATCH 02/13] md4 simplify

---
 lib/md4.c | 30 +++++++++++++-----------------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/lib/md4.c b/lib/md4.c
index 3e32bfc738..2c1d9f99ba 100644
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -45,38 +45,34 @@
 #if defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
 #include <openssl/evp.h>
 
-typedef EVP_MD_CTX **my_md4_ctx;
+typedef EVP_MD_CTX *my_md4_ctx;
 
-static CURLcode my_md4_init(void *ctx)
+static CURLcode my_md4_init(my_md4_ctx *ctx)
 {
-  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
-
-  *pctx = EVP_MD_CTX_new();
-  if(!*pctx)
+  *ctx = EVP_MD_CTX_new();
+  if(!*ctx)
     return 0;
 
-  if(EVP_DigestInit_ex(*pctx, EVP_md4(), NULL))
+  if(EVP_DigestInit_ex(*ctx, EVP_md4(), NULL))
     return 1;
 
-  EVP_MD_CTX_free(*pctx);
-  *pctx = NULL;
+  EVP_MD_CTX_free(*ctx);
+  *ctx = NULL;
 
   return 0;
 }
 
-static void my_md4_update(void *ctx,
+static void my_md4_update(my_md4_ctx *ctx,
                           const unsigned char *input, unsigned int len)
 {
-  (void)EVP_DigestUpdate(ctx, input, len);
+  (void)EVP_DigestUpdate(*ctx, input, len);
 }
 
-static void my_md4_final(unsigned char *digest, void *ctx)
+static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
 {
-  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
-
-  (void)EVP_DigestFinal(*pctx, digest, NULL);
-  EVP_MD_CTX_free(*pctx);
-  *pctx = NULL;
+  (void)EVP_DigestFinal(*ctx, digest, NULL);
+  EVP_MD_CTX_free(*ctx);
+  *ctx = NULL;
 }
 
 #elif defined(USE_WOLFSSL) && !defined(NO_MD4)

From 4d12eb1a88942011667ebb2834345ea5a582c8be Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 30 Jun 2026 00:01:09 +0200
Subject: [PATCH 03/13] md4 fix retval

---
 lib/md4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/md4.c b/lib/md4.c
index 2c1d9f99ba..9a207a02b3 100644
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -47,7 +47,7 @@
 
 typedef EVP_MD_CTX *my_md4_ctx;
 
-static CURLcode my_md4_init(my_md4_ctx *ctx)
+static int my_md4_init(my_md4_ctx *ctx)
 {
   *ctx = EVP_MD_CTX_new();
   if(!*ctx)

From cbaa9d65e1f9b1ea2b85df486bf9030ffe3d859d Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 30 Jun 2026 00:01:38 +0200
Subject: [PATCH 04/13] EVP_DigestFinal_ex

---
 lib/md4.c | 2 +-
 lib/md5.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/md4.c b/lib/md4.c
index 9a207a02b3..d3c4021846 100644
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -70,7 +70,7 @@ static void my_md4_update(my_md4_ctx *ctx,
 
 static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
 {
-  (void)EVP_DigestFinal(*ctx, digest, NULL);
+  (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
   EVP_MD_CTX_free(*ctx);
   *ctx = NULL;
 }
diff --git a/lib/md5.c b/lib/md5.c
index 32cbc90bb3..2246278621 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -106,7 +106,7 @@ static void my_md5_final(unsigned char *digest, void *ctx)
 {
   EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
 
-  (void)EVP_DigestFinal(*pctx, digest, NULL);
+  (void)EVP_DigestFinal_ex(*pctx, digest, NULL);
   EVP_MD_CTX_free(*pctx);
   *pctx = NULL;
 }

From f579308fadc726ca30ac9defa6ea066be3d7743e Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 30 Jun 2026 00:42:41 +0200
Subject: [PATCH 05/13] md5-cleanup

---
 lib/md5.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/md5.c b/lib/md5.c
index 2246278621..5fa989dbe7 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -75,7 +75,7 @@ static void my_md5_final(unsigned char *digest, void *ctx)
 #elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD5)
 #include <openssl/evp.h>
 
-typedef EVP_MD_CTX **my_md5_ctx;
+typedef EVP_MD_CTX *my_md5_ctx;
 
 static CURLcode my_md5_init(void *ctx)
 {

From 2d1c3cf1afb66f3017c1110848155d049bcb9b69 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 30 Jun 2026 01:34:41 +0200
Subject: [PATCH 06/13] sync them of up together with sha256

---
 lib/md4.c    | 13 +++++--------
 lib/md5.c    | 40 ++++++++++++++++++----------------------
 lib/sha256.c | 27 +++++++++++++--------------
 3 files changed, 36 insertions(+), 44 deletions(-)

diff --git a/lib/md4.c b/lib/md4.c
index d3c4021846..ff783eec21 100644
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -53,13 +53,11 @@ static int my_md4_init(my_md4_ctx *ctx)
   if(!*ctx)
     return 0;
 
-  if(EVP_DigestInit_ex(*ctx, EVP_md4(), NULL))
-    return 1;
-
-  EVP_MD_CTX_free(*ctx);
-  *ctx = NULL;
-
-  return 0;
+  if(!EVP_DigestInit_ex(*ctx, EVP_md4(), NULL))
+    EVP_MD_CTX_free(*ctx);
+    return 0;
+  }
+  return 1;
 }
 
 static void my_md4_update(my_md4_ctx *ctx,
@@ -72,7 +70,6 @@ static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
 {
   (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
   EVP_MD_CTX_free(*ctx);
-  *ctx = NULL;
 }
 
 #elif defined(USE_WOLFSSL) && !defined(NO_MD4)
diff --git a/lib/md5.c b/lib/md5.c
index 5fa989dbe7..1d9ca6f7bd 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -77,38 +77,34 @@ static void my_md5_final(unsigned char *digest, void *ctx)
 
 typedef EVP_MD_CTX *my_md5_ctx;
 
-static CURLcode my_md5_init(void *ctx)
+static CURLcode my_md5_init(void *in)
 {
-  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
-
-  *pctx = EVP_MD_CTX_new();
-  if(!*pctx)
+  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  *ctx = EVP_MD_CTX_new();
+  if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
 
-  if(EVP_DigestInit_ex(*pctx, EVP_md5(), NULL))
-    return CURLE_OK;
-
-  EVP_MD_CTX_free(*pctx);
-  *pctx = NULL;
-
-  return CURLE_FAILED_INIT;
+  if(!EVP_DigestInit_ex(*ctx, EVP_md5(), NULL)) {
+    EVP_MD_CTX_free(*ctx);
+    *ctx = NULL;
+    return CURLE_FAILED_INIT;
+  }
+  return CURLE_OK;
 }
 
-static void my_md5_update(void *ctx,
+static void my_md5_update(void *in,
                           const unsigned char *input, unsigned int len)
 {
-  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
-
-  (void)EVP_DigestUpdate(*pctx, input, len);
+  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  (void)EVP_DigestUpdate(*ctx, input, len);
 }
 
-static void my_md5_final(unsigned char *digest, void *ctx)
+static void my_md5_final(unsigned char *digest, void *in)
 {
-  EVP_MD_CTX **pctx = (EVP_MD_CTX **)ctx;
-
-  (void)EVP_DigestFinal_ex(*pctx, digest, NULL);
-  EVP_MD_CTX_free(*pctx);
-  *pctx = NULL;
+  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
+  EVP_MD_CTX_free(*ctx);
+  *ctx = NULL;
 }
 
 #elif defined(USE_WOLFSSL) && !defined(NO_MD5)
diff --git a/lib/sha256.c b/lib/sha256.c
index e2278d3664..bfe57f1d09 100644
--- a/lib/sha256.c
+++ b/lib/sha256.c
@@ -53,20 +53,18 @@
 #ifdef USE_OPENSSL
 #include <openssl/evp.h>
 
-struct ossl_sha256_ctx {
-  EVP_MD_CTX *openssl_ctx;
-};
-typedef struct ossl_sha256_ctx my_sha256_ctx;
+typedef EVP_MD_CTX *my_sha256_ctx;
 
 static CURLcode my_sha256_init(void *in)
 {
-  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  ctx->openssl_ctx = EVP_MD_CTX_new();
-  if(!ctx->openssl_ctx)
+  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  *ctx = EVP_MD_CTX_new();
+  if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
 
-  if(!EVP_DigestInit_ex(ctx->openssl_ctx, EVP_sha256(), NULL)) {
-    EVP_MD_CTX_free(ctx->openssl_ctx);
+  if(!EVP_DigestInit_ex(*ctx, EVP_sha256(), NULL)) {
+    EVP_MD_CTX_free(*ctx);
+    *ctx = NULL;
     return CURLE_FAILED_INIT;
   }
   return CURLE_OK;
@@ -76,15 +74,16 @@ static void my_sha256_update(void *in,
                              const unsigned char *data,
                              unsigned int length)
 {
-  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  EVP_DigestUpdate(ctx->openssl_ctx, data, length);
+  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  (void)EVP_DigestUpdate(*ctx, data, length);
 }
 
 static void my_sha256_final(unsigned char *digest, void *in)
 {
-  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  EVP_DigestFinal_ex(ctx->openssl_ctx, digest, NULL);
-  EVP_MD_CTX_free(ctx->openssl_ctx);
+  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
+  EVP_MD_CTX_free(*ctx);
+  *ctx = NULL;
 }
 
 #elif defined(USE_WOLFSSL)

From 836d17e85e96c21b4343a548d5108b735292dec2 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 30 Jun 2026 01:44:40 +0200
Subject: [PATCH 07/13] free contexts in hmac no failure

---
 lib/hmac.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/hmac.c b/lib/hmac.c
index a4d6ebdd8a..bba98aeec5 100644
--- a/lib/hmac.c
+++ b/lib/hmac.c
@@ -58,6 +58,8 @@ struct HMAC_context *Curl_HMAC_init(const struct HMAC_params *hashparams,
   if(!ctxt)
     return ctxt;
 
+  memset(ctxt, 0, i);
+
   ctxt->hash = hashparams;
   ctxt->hashctxt1 = (void *)(ctxt + 1);
   ctxt->hashctxt2 = (void *)((char *)ctxt->hashctxt1 + hashparams->ctxtsize);
@@ -94,6 +96,8 @@ struct HMAC_context *Curl_HMAC_init(const struct HMAC_params *hashparams,
   return ctxt;
 
 fail:
+  hashparams->hfinal(NULL, ctxt->hashctxt1);
+  hashparams->hfinal(NULL, ctxt->hashctxt2);
   curlx_free(ctxt);
   return NULL;
 }

From 3c6d596905535bfbfb891b65352ea83d71f8bb41 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 30 Jun 2026 01:55:53 +0200
Subject: [PATCH 08/13] md5, sha256: just deinit with a NULL digest

---
 lib/md4.c    |  2 +-
 lib/md5.c    | 36 +++++++++++++++++++++++++-----------
 lib/sha256.c | 35 +++++++++++++++++++++++------------
 3 files changed, 49 insertions(+), 24 deletions(-)

diff --git a/lib/md4.c b/lib/md4.c
index ff783eec21..06cfbb0b3e 100644
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -53,7 +53,7 @@ static int my_md4_init(my_md4_ctx *ctx)
   if(!*ctx)
     return 0;
 
-  if(!EVP_DigestInit_ex(*ctx, EVP_md4(), NULL))
+  if(!EVP_DigestInit_ex(*ctx, EVP_md4(), NULL)) {
     EVP_MD_CTX_free(*ctx);
     return 0;
   }
diff --git a/lib/md5.c b/lib/md5.c
index 1d9ca6f7bd..a80f637fae 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -65,10 +65,11 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
+  if(digest)
 #if NETTLE_VERSION_MAJOR >= 4
-  md5_digest(ctx, digest);
+    md5_digest(ctx, digest);
 #else
-  md5_digest(ctx, MD5_DIGEST_LEN, digest);
+    md5_digest(ctx, MD5_DIGEST_LEN, digest);
 #endif
 }
 
@@ -102,7 +103,8 @@ static void my_md5_update(void *in,
 static void my_md5_final(unsigned char *digest, void *in)
 {
   EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
-  (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
+  if(digest)
+    (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
   EVP_MD_CTX_free(*ctx);
   *ctx = NULL;
 }
@@ -127,7 +129,8 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-  (void)wc_Md5Final(ctx, digest);
+  if(digest)
+    (void)wc_Md5Final(ctx, digest);
 }
 
 #elif defined(USE_MBEDTLS) && \
@@ -153,8 +156,10 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-  size_t actual_length;
-  (void)psa_hash_finish(ctx, digest, MD5_DIGEST_LEN, &actual_length);
+  if(digest) {
+    size_t actual_length;
+    (void)psa_hash_finish(ctx, digest, MD5_DIGEST_LEN, &actual_length);
+  }
 }
 
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
@@ -191,7 +196,8 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-  CC_MD5_Final(digest, ctx);
+  if(digest)
+    CC_MD5_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
@@ -229,12 +235,17 @@ static void my_md5_update(void *in,
 static void my_md5_final(unsigned char *digest, void *in)
 {
   my_md5_ctx *ctx = (my_md5_ctx *)in;
-  unsigned long length = 0;
-  CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
-  if(length == MD5_DIGEST_LEN)
-    CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+
+  if(digest) {
+    unsigned long length = 0;
+    CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
+    if(length == MD5_DIGEST_LEN)
+      CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+  }
+
   if(ctx->hHash)
     CryptDestroyHash(ctx->hHash);
+
   if(ctx->hCryptProv)
     CryptReleaseContext(ctx->hCryptProv, 0);
 }
@@ -485,6 +496,9 @@ static void my_md5_final(unsigned char *digest, void *in)
   unsigned int used, available;
   my_md5_ctx *ctx = (my_md5_ctx *)in;
 
+  if(!digest)
+    return;
+
   used = ctx->lo & 0x3f;
 
   ctx->buffer[used++] = 0x80;
diff --git a/lib/sha256.c b/lib/sha256.c
index bfe57f1d09..0ac53a0f51 100644
--- a/lib/sha256.c
+++ b/lib/sha256.c
@@ -81,7 +81,8 @@ static void my_sha256_update(void *in,
 static void my_sha256_final(unsigned char *digest, void *in)
 {
   EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
-  (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
+  if(digest)
+    (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
   EVP_MD_CTX_free(*ctx);
   *ctx = NULL;
 }
@@ -108,7 +109,8 @@ static void my_sha256_update(void *in,
 
 static void my_sha256_final(unsigned char *digest, void *in)
 {
-  (void)wc_Sha256Final(in, digest);
+  if(digest)
+    (void)wc_Sha256Final(in, digest);
 }
 
 #elif defined(USE_GNUTLS)
@@ -132,10 +134,11 @@ static void my_sha256_update(void *ctx,
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
+  if(digest)
 #if NETTLE_VERSION_MAJOR >= 4
-  sha256_digest(ctx, digest);
+    sha256_digest(ctx, digest);
 #else
-  sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
+    sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
 #endif
 }
 
@@ -163,9 +166,11 @@ static void my_sha256_update(void *ctx,
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-  size_t actual_length;
-  (void)psa_hash_finish(ctx, digest, CURL_SHA256_DIGEST_LENGTH,
-                        &actual_length);
+  if(digest) {
+    size_t actual_length;
+    (void)psa_hash_finish(ctx, digest, CURL_SHA256_DIGEST_LENGTH,
+                          &actual_length);
+  }
 }
 
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
@@ -191,7 +196,8 @@ static void my_sha256_update(void *ctx,
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-  (void)CC_SHA256_Final(digest, ctx);
+  if(digest)
+    (void)CC_SHA256_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
@@ -230,11 +236,13 @@ static void my_sha256_update(void *in,
 static void my_sha256_final(unsigned char *digest, void *in)
 {
   my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  unsigned long length = 0;
 
-  CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
-  if(length == CURL_SHA256_DIGEST_LENGTH)
-    CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+  if(digest) {
+    unsigned long length = 0;
+    CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
+    if(length == CURL_SHA256_DIGEST_LENGTH)
+      CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+  }
 
   if(ctx->hHash)
     CryptDestroyHash(ctx->hHash);
@@ -430,6 +438,9 @@ static void my_sha256_final(unsigned char *out, void *ctx)
   struct sha256_state *md = ctx;
   int i;
 
+  if(!out)
+    return;
+
   if(md->curlen >= sizeof(md->buf))
     return;
 

From 37ec5ba194aed06e5777e6f0f05106b83ded4144 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Tue, 30 Jun 2026 05:12:00 +0200
Subject: [PATCH 09/13] psa_hash_abort()

---
 lib/md5.c    | 2 ++
 lib/sha256.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/lib/md5.c b/lib/md5.c
index a80f637fae..fa361d9de3 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -160,6 +160,8 @@ static void my_md5_final(unsigned char *digest, void *ctx)
     size_t actual_length;
     (void)psa_hash_finish(ctx, digest, MD5_DIGEST_LEN, &actual_length);
   }
+  else
+    (void)psa_hash_abort(ctx);
 }
 
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
diff --git a/lib/sha256.c b/lib/sha256.c
index 0ac53a0f51..f4f35a3826 100644
--- a/lib/sha256.c
+++ b/lib/sha256.c
@@ -171,6 +171,8 @@ static void my_sha256_final(unsigned char *digest, void *ctx)
     (void)psa_hash_finish(ctx, digest, CURL_SHA256_DIGEST_LENGTH,
                           &actual_length);
   }
+  else
+    (void)psa_hash_abort(ctx);
 }
 
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \

From e933b2b9b101fbb496c838cfc129e1a526cde037 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Wed, 1 Jul 2026 00:15:13 +0200
Subject: [PATCH 10/13] curl_sha512_256.c handle NULL digest

---
 lib/curl_sha512_256.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/lib/curl_sha512_256.c b/lib/curl_sha512_256.c
index d0c81e7a55..fe0905c2c0 100644
--- a/lib/curl_sha512_256.c
+++ b/lib/curl_sha512_256.c
@@ -164,19 +164,21 @@ static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
   CURLcode result;
   Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
 
+  if(digest) {
 #ifdef NEED_NETBSD_SHA512_256_WORKAROUND
-  /* Use a larger buffer to work around a bug in NetBSD:
-     https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=58039 */
-  unsigned char tmp_digest[CURL_SHA512_256_DIGEST_SIZE * 2];
-  result = EVP_DigestFinal_ex(*ctx, tmp_digest, NULL) ?
-    CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
-  if(result == CURLE_OK)
-    memcpy(digest, tmp_digest, CURL_SHA512_256_DIGEST_SIZE);
-  curlx_memzero(tmp_digest, sizeof(tmp_digest));
+    /* Use a larger buffer to work around a bug in NetBSD:
+       https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=58039 */
+    unsigned char tmp_digest[CURL_SHA512_256_DIGEST_SIZE * 2];
+    result = EVP_DigestFinal_ex(*ctx, tmp_digest, NULL) ?
+      CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
+    if(result == CURLE_OK)
+      memcpy(digest, tmp_digest, CURL_SHA512_256_DIGEST_SIZE);
+    curlx_memzero(tmp_digest, sizeof(tmp_digest));
 #else /* !NEED_NETBSD_SHA512_256_WORKAROUND */
-  result = EVP_DigestFinal_ex(*ctx, digest, NULL) ?
-    CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
+    result = EVP_DigestFinal_ex(*ctx, digest, NULL) ?
+      CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
 #endif /* NEED_NETBSD_SHA512_256_WORKAROUND */
+  }
 
   EVP_MD_CTX_free(*ctx);
   *ctx = NULL;

From 857449e3f68d4e9633a0e8b45c9ab97e0373ad6b Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Wed, 1 Jul 2026 10:30:06 +0200
Subject: [PATCH 11/13] sync1

---
 lib/curl_sha512_256.c | 38 +++++++++++++++-----------------------
 lib/md5.c             |  6 +++---
 lib/sha256.c          |  6 +++---
 3 files changed, 21 insertions(+), 29 deletions(-)

diff --git a/lib/curl_sha512_256.c b/lib/curl_sha512_256.c
index fe0905c2c0..78006f0d91 100644
--- a/lib/curl_sha512_256.c
+++ b/lib/curl_sha512_256.c
@@ -108,26 +108,23 @@ typedef EVP_MD_CTX *Curl_sha512_256_ctx;
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode Curl_sha512_256_init(void *context)
+static CURLcode Curl_sha512_256_init(void *in)
 {
-  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
-
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   *ctx = EVP_MD_CTX_new();
   if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
 
-  if(EVP_DigestInit_ex(*ctx, EVP_sha512_256(), NULL)) {
-    /* Check whether the header and this file use the same numbers */
-    DEBUGASSERT(EVP_MD_CTX_size(*ctx) == CURL_SHA512_256_DIGEST_SIZE);
-    /* Check whether the block size is correct */
-    DEBUGASSERT(EVP_MD_CTX_block_size(*ctx) == CURL_SHA512_256_BLOCK_SIZE);
-
-    return CURLE_OK; /* Success */
+  if(!EVP_DigestInit_ex(*ctx, EVP_sha512_256(), NULL)) {
+    EVP_MD_CTX_free(*ctx);
+    *ctx = NULL;
+    return CURLE_FAILED_INIT;
   }
-
-  /* Cleanup */
-  EVP_MD_CTX_free(*ctx);
-  return CURLE_FAILED_INIT;
+  /* Check whether the header and this file use the same numbers */
+  DEBUGASSERT(EVP_MD_CTX_size(*ctx) == CURL_SHA512_256_DIGEST_SIZE);
+  /* Check whether the block size is correct */
+  DEBUGASSERT(EVP_MD_CTX_block_size(*ctx) == CURL_SHA512_256_BLOCK_SIZE);
+  return CURLE_OK;
 }
 
 /**
@@ -138,15 +135,13 @@ static CURLcode Curl_sha512_256_init(void *context)
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode Curl_sha512_256_update(void *context,
+static CURLcode Curl_sha512_256_update(void *in,
                                        const unsigned char *data,
                                        size_t length)
 {
-  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
-
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   if(!EVP_DigestUpdate(*ctx, data, length))
     return CURLE_BAD_FUNCTION_ARGUMENT;
-
   return CURLE_OK;
 }
 
@@ -159,11 +154,10 @@ static CURLcode Curl_sha512_256_update(void *context,
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *in)
 {
   CURLcode result;
-  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
-
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   if(digest) {
 #ifdef NEED_NETBSD_SHA512_256_WORKAROUND
     /* Use a larger buffer to work around a bug in NetBSD:
@@ -179,10 +173,8 @@ static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
       CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
 #endif /* NEED_NETBSD_SHA512_256_WORKAROUND */
   }
-
   EVP_MD_CTX_free(*ctx);
   *ctx = NULL;
-
   return result;
 }
 
diff --git a/lib/md5.c b/lib/md5.c
index fa361d9de3..9d8b01988b 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -80,7 +80,7 @@ typedef EVP_MD_CTX *my_md5_ctx;
 
 static CURLcode my_md5_init(void *in)
 {
-  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   *ctx = EVP_MD_CTX_new();
   if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
@@ -96,13 +96,13 @@ static CURLcode my_md5_init(void *in)
 static void my_md5_update(void *in,
                           const unsigned char *input, unsigned int len)
 {
-  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   (void)EVP_DigestUpdate(*ctx, input, len);
 }
 
 static void my_md5_final(unsigned char *digest, void *in)
 {
-  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   if(digest)
     (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
   EVP_MD_CTX_free(*ctx);
diff --git a/lib/sha256.c b/lib/sha256.c
index f4f35a3826..6b1e90dcc1 100644
--- a/lib/sha256.c
+++ b/lib/sha256.c
@@ -57,7 +57,7 @@ typedef EVP_MD_CTX *my_sha256_ctx;
 
 static CURLcode my_sha256_init(void *in)
 {
-  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   *ctx = EVP_MD_CTX_new();
   if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
@@ -74,13 +74,13 @@ static void my_sha256_update(void *in,
                              const unsigned char *data,
                              unsigned int length)
 {
-  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   (void)EVP_DigestUpdate(*ctx, data, length);
 }
 
 static void my_sha256_final(unsigned char *digest, void *in)
 {
-  EVP_MD_CTX **ctx = (EVP_MD_CTX **)in;
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   if(digest)
     (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
   EVP_MD_CTX_free(*ctx);

From 029d4cc94ec4c391df65af56da346e8587eb48dd Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Sun, 5 Jul 2026 02:22:21 +0200
Subject: [PATCH 12/13] curl_setup.h drop `MD5_*` from comment

---
 lib/curl_setup.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/curl_setup.h b/lib/curl_setup.h
index a91b912f3e..8f54d11265 100644
--- a/lib/curl_setup.h
+++ b/lib/curl_setup.h
@@ -1578,8 +1578,8 @@ typedef struct sockaddr_un {
 /* OpenSSL 3 marks these functions deprecated but we have no replacements (yet)
    so tell the compiler to not warn for them:
    - DES_* (for NTLM)
-   - EVP_PKEY_get1_RSA, MD5_*, RSA_flags, RSA_free (auto-skipped for OpenSSL
-     built with no-deprecated) */
+   - EVP_PKEY_get1_RSA, RSA_flags, RSA_free (auto-skipped for OpenSSL built
+     with no-deprecated) */
 #  define OPENSSL_SUPPRESS_DEPRECATED
 #  ifdef _WIN32
 /* Silence LibreSSL warnings about wincrypt.h collision. Works in 3.8.2+ */

From dec4035390ac31447400f735d4be2d90b808d112 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Mon, 27 Jul 2026 13:40:30 +0200
Subject: [PATCH 13/13] curl_sha512_256.c fixup

---
 lib/curl_sha512_256.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/curl_sha512_256.c b/lib/curl_sha512_256.c
index 78006f0d91..f125f4f6c8 100644
--- a/lib/curl_sha512_256.c
+++ b/lib/curl_sha512_256.c
@@ -173,6 +173,8 @@ static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *in)
       CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
 #endif /* NEED_NETBSD_SHA512_256_WORKAROUND */
   }
+  else
+    result = CURLE_OK;
   EVP_MD_CTX_free(*ctx);
   *ctx = NULL;
   return result;