diff --git a/library/x509_create.c b/library/x509_create.c
index 93ca2de..271d4f1 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -218,6 +218,8 @@
                                                  size_t *data_len,
                                                  int *tag)
 {
+    unsigned char *p;
+
     /* Step 1: preliminary length checks. */
     /* Each byte is encoded by exactly two hexadecimal digits. */
     if (len % 2 != 0) {
@@ -243,8 +245,6 @@
         return MBEDTLS_ERR_X509_ALLOC_FAILED;
     }
     /* Beyond this point, der needs to be freed on exit. */
-    unsigned char *p = der + 1;
-
     for (size_t i = 0; i < der_length; i++) {
         int c = hexpair_to_int(s + 2 * i);
         if (c < 0) {
@@ -256,6 +256,7 @@
     /* Step 3: decode the DER. */
     /* We've checked that der_length >= 1 above. */
     *tag = der[0];
+    p = der + 1;
     if (mbedtls_asn1_get_len(&p, der + der_length, data_len) != 0) {
         goto error;
     }