static int rand_add(const void *buf, int num, double add)
{
    int i, j, k, st_idx;
    long md_c[2];
    unsigned char local_md[SHA_DIGEST_LENGTH];
    EVP_MD_CTX *m;
    int do_not_lock;
    int rv = 0;
    OSSL_RAND_STATE *sp = &global_state;

    if (!num)
        return 1;

    /*
     * (Based on the rand(3) manpage)
     *
     * The input is chopped up into units of 20 bytes (or less for
     * the last block).  Each of these blocks is run through the hash
     * function as follows:  The data passed to the hash function
     * is the current 'md', the same number of bytes from the 'state'
     * (the location determined by in incremented looping index) as
     * the current 'block', the new key data 'block', and 'count'
     * (which is incremented after each use).
     * The result of this is kept in 'md' and also xored into the
     * 'state' at the same locations that were used as input into the
     * hash function.
     */

    m = EVP_MD_CTX_new();
    if (m == NULL)
        goto err;

    if (!RUN_ONCE(&ossl_rand_init, do_ossl_rand_init))
        goto err;

    /* check if we already have the lock */
    if (crypto_lock_rand) {
        CRYPTO_THREAD_ID cur = CRYPTO_THREAD_get_current_id();
        CRYPTO_THREAD_read_lock(rand_tmp_lock);
        do_not_lock = CRYPTO_THREAD_compare_id(locking_threadid, cur);
        CRYPTO_THREAD_unlock(rand_tmp_lock);
    } else
        do_not_lock = 0;

    if (!do_not_lock)
        CRYPTO_THREAD_write_lock(rand_lock);
    st_idx = sp->index;

    /*
     * use our own copies of the counters so that even if a concurrent thread
     * seeds with exactly the same data and uses the same subarray there's
     * _some_ difference
     */
    md_c[0] = sp->md_count[0];
    md_c[1] = sp->md_count[1];

    memcpy(local_md, sp->md, sizeof(sp->md));

    /* sp->index <= sp->num <= STATE_SIZE */
    sp->index += num;
    if (sp->index >= STATE_SIZE) {
        sp->index %= STATE_SIZE;
        sp->num = STATE_SIZE;
    } else if (sp->num < STATE_SIZE) {
        if (sp->index > sp->num)
            sp->num = sp->index;
    }
    /* sp->index <= sp->num <= STATE_SIZE */

    /*
     * state[st_idx], ..., state[(st_idx + num - 1) % STATE_SIZE] are what we
     * will use now, but other threads may use them as well
     */

    sp->md_count[1] += (num / SHA_DIGEST_LENGTH) + (num % SHA_DIGEST_LENGTH > 0);

    if (!do_not_lock)
        CRYPTO_THREAD_unlock(rand_lock);

    for (i = 0; i < num; i += SHA_DIGEST_LENGTH) {
        j = (num - i);
        j = (j > SHA_DIGEST_LENGTH) ? SHA_DIGEST_LENGTH : j;

        if (!EVP_DigestInit_ex(m, EVP_sha1(), NULL))
            goto err;
        if (!EVP_DigestUpdate(m, local_md, SHA_DIGEST_LENGTH))
            goto err;
        k = (st_idx + j) - STATE_SIZE;
        if (k > 0) {
            if (!EVP_DigestUpdate(m, &sp->state[st_idx], j - k))
                goto err;
            if (!EVP_DigestUpdate(m, &sp->state[0], k))
                goto err;
        } else if (!EVP_DigestUpdate(m, &sp->state[st_idx], j))
            goto err;

        /* DO NOT REMOVE THE FOLLOWING CALL TO EVP_DigestUpdate()! */
        if (!EVP_DigestUpdate(m, buf, j))
            goto err;
        /*
         * We know that line may cause programs such as purify and valgrind
         * to complain about use of uninitialized data.  The problem is not,
         * it's with the caller.  Removing that line will make sure you get
         * really bad randomness and thereby other problems such as very
         * insecure keys.
         */

        if (!EVP_DigestUpdate(m, (unsigned char *)md_c, sizeof(md_c)))
            goto err;
        if (!EVP_DigestFinal_ex(m, local_md, NULL))
            goto err;
        md_c[1]++;

        buf = (const char *)buf + j;

        for (k = 0; k < j; k++) {
            /*
             * Parallel threads may interfere with this, but always each byte
             * of the new state is the XOR of some previous value of its and
             * local_md (intermediate values may be lost). Alway using locking
             * could hurt performance more than necessary given that
             * conflicts occur only when the total seeding is longer than the
             * random state.
             */
            sp->state[st_idx++] ^= local_md[k];
            if (st_idx >= STATE_SIZE)
                st_idx = 0;
        }
    }

    if (!do_not_lock)
        CRYPTO_THREAD_write_lock(rand_lock);
    /*
     * Don't just copy back local_md into md -- this could mean that other
     * thread's seeding remains without effect (except for the incremented
     * counter).  By XORing it we keep at least as much randomness as fits into
     * md.
     */
    for (k = 0; k < (int)sizeof(sp->md); k++) {
        sp->md[k] ^= local_md[k];
    }
    if (randomness < RANDOMNESS_NEEDED) /* stop counting when we have enough */
        randomness += add;
    if (!do_not_lock)
        CRYPTO_THREAD_unlock(rand_lock);

    rv = 1;
 err:
    EVP_MD_CTX_free(m);
    return rv;
}