--- a/lib/cryptohi/secvfy.c
+++ b/lib/cryptohi/secvfy.c
@@ -595,18 +595,18 @@ VFY_EndWithSignature(VFYContext *cx, SEC
 	}
 	break;
       case rsaKey:
       {
         SECItem digest;
         digest.data = final;
         digest.len = part;
 	if (sig) {
+	    SECOidTag hashid;
 	    PORT_Assert(cx->hashAlg != SEC_OID_UNKNOWN);
-	    SECOidTag hashid;
 	    rv = recoverPKCS1DigestInfo(cx->hashAlg, &hashid,
 					&cx->pkcs1RSADigestInfo,
 					&cx->pkcs1RSADigestInfoLen,
 					cx->key,
 					sig, cx->wincx);
 	    PORT_Assert(cx->hashAlg == hashid);
 	    if (rv != SECSuccess) {
 		return SECFailure;