Commit 4d885b16eb for openssl.org

commit 4d885b16ebc6e6cc76f8a72fb4b7a00db127990f
Author: Tomas Mraz <tomas@openssl.foundation>
Date:   Mon Oct 26 20:22:08 2026 +0100

    scan_ext_flags(): There is no libctx in x509 anymore

    Fixes a0945b66bc0369fab5b5dd79f444799700d48a7f

    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
    Merge-date: Mon Oct 26 19:45:28 2026
    Merged-from: https://github.com/openssl/openssl/pull/33407

diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c
index 9f627bc375..de63ff588a 100644
--- a/crypto/x509/v3_purp.c
+++ b/crypto/x509/v3_purp.c
@@ -514,7 +514,10 @@ static void scan_ext_flags(const X509 *x509, uint32_t *flags)
              * unsupported-critical check for this and every later extension.
              */
             if (h == NULL) {
-                if (RAND_bytes_ex(x509->libctx, (unsigned char *)k, sizeof(k), 0) <= 0
+                OSSL_LIB_CTX *libctx = NULL;
+
+                ossl_x509_get0_libctx(x509, &libctx, NULL);
+                if (RAND_bytes_ex(libctx, (unsigned char *)k, sizeof(k), 0) <= 0
                     || (arr = OPENSSL_malloc_array(count, sizeof(*arr))) == NULL
                     || (h = OPENSSL_LH_new(oid_hash, oid_cmp)) == NULL) {
                     *flags |= EXFLAG_INVALID;