When the allocation in https://github.com/openssl/openssl/blob/270540fd5413b00a746a581e8939c30862c689b1/apps/dgst.c#L115 fails, there is a NULL deref in both https://github.com/openssl/openssl/blob/270540fd5413b00a746a581e8939c30862c689b1/apps/dgst.c#L405 and https://github.com/openssl/openssl/blob/270540fd5413b00a746a581e8939c30862c689b1/apps/dgst.c#L426 depending on number of command line arguments.
The source is both missing a NULL check here, but also could be improved by doing this allocation much closer to where it actually is used (only those two places near the end).
app_malloc is a wrapper around malloc that exits on failure.
Most helpful comment
app_malloc is a wrapper around malloc that exits on failure.