3 files changed, 24 insertions, 16 deletions

diff --git a/src/c/fastcgi.c b/src/c/fastcgi.c
index f3e66e3a..cda3e1f6 100644
--- a/src/c/fastcgi.c
+++ b/src/c/fastcgi.c
@@ -333,7 +333,7 @@ static void *worker(void *data) {
   size_t path_size = 0;
   char *path_buf = malloc(0);
 
-  hs.uppercased = malloc(0);
+  hs.uppercased = malloc(6);
   hs.uppercased_len = 0;
   hs.nvps = malloc(sizeof(nvp));
   hs.n_nvps = 1;
diff --git a/src/c/openssl.c b/src/c/openssl.c
index 6a998e29..1d820a34 100644
--- a/src/c/openssl.c
+++ b/src/c/openssl.c
@@ -9,6 +9,7 @@
 #include <string.h>
 
 #include <openssl/sha.h>
+#include <openssl/rand.h>
 
 #define PASSSIZE 4
 
@@ -19,10 +20,11 @@ static int password[PASSSIZE];
 char *uw_sig_file = NULL;
 
 static void random_password() {
-  int i;
-
-  for (i = 0; i < PASSSIZE; ++i)
-    password[i] = rand();
+  if (!RAND_bytes((unsigned char *)password, sizeof password)) {
+    fprintf(stderr, "Error generating random password\n");
+    perror("RAND_bytes");
+    exit(1);
+  }
 }
 
 void uw_init_crypto() {
diff --git a/src/c/urweb.c b/src/c/urweb.c
index d01cfaa2..53344c5e 100644
--- a/src/c/urweb.c
+++ b/src/c/urweb.c
@@ -167,6 +167,19 @@ void *uw_init_client_data();
 void uw_free_client_data(void *);
 void uw_copy_client_data(void *dst, void *src);
 
+static pthread_mutex_t rand_mutex = PTHREAD_MUTEX_INITIALIZER;
+
+static uw_Basis_int my_rand() {
+  pthread_mutex_lock(&rand_mutex);
+  int ret, r = RAND_bytes((unsigned char *)&ret, sizeof ret);
+  pthread_mutex_unlock(&rand_mutex);
+
+  if (r)
+    return abs(ret);
+  else
+    return -1;
+}
+
 static client *new_client() {
   client *c;
 
@@ -192,7 +205,7 @@ static client *new_client() {
 
   pthread_mutex_lock(&c->lock);
   c->mode = USED;
-  c->pass = rand();
+  c->pass = my_rand();
   c->sock = -1;
   c->last_contact = time(NULL);
   uw_buffer_reset(&c->msgs);
@@ -349,8 +362,6 @@ extern void uw_global_custom();
 extern void uw_init_crypto();
 
 void uw_global_init() {
-  srand(time(NULL) ^ getpid());
-
   clients = malloc(0);
 
   uw_global_custom();
@@ -4234,16 +4245,11 @@ uw_Basis_unit uw_Basis_debug(uw_context ctx, uw_Basis_string s) {
   return uw_unit_v;
 }
 
-static pthread_mutex_t rand_mutex = PTHREAD_MUTEX_INITIALIZER;
-
 uw_Basis_int uw_Basis_rand(uw_context ctx) {
-  uw_Basis_int ret;
-  pthread_mutex_lock(&rand_mutex);
-  int r = RAND_bytes((unsigned char *)&ret, sizeof ret);
-  pthread_mutex_unlock(&rand_mutex);
+  int r = my_rand();
 
-  if (r)
-    return abs(ret);
+  if (r >= 0)
+    return r;
   else
     uw_error(ctx, FATAL, "Random number generation failed");
 }