/* Provenance: openssl/openssl do_fp_oneshot_sign (fixed).
 * repo: openssl/openssl
 * commit: a7936fa4bd23c906e1955a16a0a0ab39a4953a61
 * parent: 1f08e54bad32843044fe8a675948d65e3b4ece65
 * commit_url: https://github.com/openssl/openssl/commit/a7936fa4bd23c906e1955a16a0a0ab39a4953a61
 * cve: CVE-2025-15469
 * license: Apache-2.0
 * function: do_fp_oneshot_sign
 * relpath: apps/dgst.c
 */

static int do_fp_oneshot_sign(BIO *out, EVP_MD_CTX *ctx, BIO *in, int sep, int binout,
    EVP_PKEY *key, unsigned char *sigin, int siglen,
    const char *sig_name, const char *file)
{
    int res, ret = EXIT_FAILURE;
    size_t len = 0;
    size_t buflen = 0;
    size_t maxlen = 16 * 1024 * 1024;
    uint8_t *buf = NULL, *sig = NULL;

    if (!bio_to_mem(&buf, &buflen, maxlen, in)) {
        BIO_printf(bio_err, "Read error in %s\n", file);
        return ret;
    }
    if (sigin != NULL) {
        res = EVP_DigestVerify(ctx, sigin, siglen, buf, buflen);
        print_verify_result(out, res);
        if (res > 0)
            ret = EXIT_SUCCESS;
        goto end;
    }
    if (key != NULL) {
        if (EVP_DigestSign(ctx, NULL, &len, buf, buflen) != 1) {
            BIO_printf(bio_err, "Error getting maximum length of signed data\n");
            goto end;
        }
        sig = app_malloc(len, "Signature buffer");
        if (EVP_DigestSign(ctx, sig, &len, buf, buflen) != 1) {
            BIO_printf(bio_err, "Error signing data\n");
            goto end;
        }
        print_out(out, sig, len, sep, binout, sig_name, NULL, file);
        ret = EXIT_SUCCESS;
    } else {
        BIO_printf(bio_err, "key must be set for one-shot algorithms\n");
        goto end;
    }

end:
    OPENSSL_free(sig);
    OPENSSL_clear_free(buf, buflen);

    return ret;
}