Also check EVP_PKEY_CTX_new_id() return in example code. Letting this

be caught by the error check of EVP_PKEY_derive_init() is a dubious
pattern.

diff --git a/lib/libcrypto/man/EVP_PKEY_CTX_set_hkdf_md.3 b/lib/libcrypto/man/EVP_PKEY_CTX_set_hkdf_md.3
index 36e34f3..559c68b 100644 (file)
--- a/lib/libcrypto/man/EVP_PKEY_CTX_set_hkdf_md.3
+++ b/lib/libcrypto/man/EVP_PKEY_CTX_set_hkdf_md.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_PKEY_CTX_set_hkdf_md.3,v 1.1 2022/05/06 07:36:54 tb Exp $
+.\" $OpenBSD: EVP_PKEY_CTX_set_hkdf_md.3,v 1.2 2022/05/06 10:10:10 tb Exp $
 .\" full merge up to: OpenSSL 1cb7eff4 Sep 10 13:56:40 2019 +0100
 .\"
 .\" This file was written by Alessandro Ghedini <alessandro@ghedini.me>,
@@ -217,7 +217,9 @@ This example derives 10 bytes using SHA-256 with the secret key
 EVP_PKEY_CTX *pctx;
 unsigned char out[10];
 size_t outlen = sizeof(out);
-pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
+
+if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL)) == NULL)
+       /* Error */
 
 if (EVP_PKEY_derive_init(pctx) <= 0)
        /* Error */