- mpi_init() and mpi_free() only accept a single argument and do not accept variable arguments anymore. This prevents unexpected memory corruption in a number of use cases.

diff --git a/library/bignum.c b/library/bignum.c
index 2b6e234..2e3595c 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -38,7 +38,6 @@
 #include "polarssl/bn_mul.h"
 
 #include <stdlib.h>
-#include <stdarg.h>
 
 #define ciL    (sizeof(t_uint))         /* chars in limb  */
 #define biL    (ciL << 3)               /* bits  in limb  */
@@ -51,51 +50,35 @@
 #define CHARS_TO_LIMBS(i) (((i) + ciL - 1) / ciL)
 
 /*
- * Initialize one or more mpi
+ * Initialize one MPI
  */
-void mpi_init( mpi *X, ... )
+void mpi_init( mpi *X )
 {
-    va_list args;
+    if( X == NULL )
+        return;
 
-    va_start( args, X );
-
-    while( X != NULL )
-    {
-        X->s = 1;
-        X->n = 0;
-        X->p = NULL;
-
-        X = va_arg( args, mpi* );
-    }
-
-    va_end( args );
+    X->s = 1;
+    X->n = 0;
+    X->p = NULL;
 }
 
 /*
- * Unallocate one or more mpi
+ * Unallocate one MPI
  */
-void mpi_free( mpi *X, ... )
+void mpi_free( mpi *X )
 {
-    va_list args;
+    if( X == NULL )
+        return;
 
-    va_start( args, X );
-
-    while( X != NULL )
+    if( X->p != NULL )
     {
-        if( X->p != NULL )
-        {
-            memset( X->p, 0, X->n * ciL );
-            free( X->p );
-        }
-
-        X->s = 1;
-        X->n = 0;
-        X->p = NULL;
-
-        X = va_arg( args, mpi* );
+        memset( X->p, 0, X->n * ciL );
+        free( X->p );
     }
 
-    va_end( args );
+    X->s = 1;
+    X->n = 0;
+    X->p = NULL;
 }
 
 /*
@@ -258,7 +241,7 @@
     if( radix < 2 || radix > 16 )
         return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
 
-    mpi_init( &T, NULL );
+    mpi_init( &T );
 
     slen = strlen( s );
 
@@ -309,7 +292,7 @@
 
 cleanup:
 
-    mpi_free( &T, NULL );
+    mpi_free( &T );
 
     return( ret );
 }
@@ -366,7 +349,7 @@
     }
 
     p = s;
-    mpi_init( &T, NULL );
+    mpi_init( &T );
 
     if( X->s == -1 )
         *p++ = '-';
@@ -405,7 +388,7 @@
 
 cleanup:
 
-    mpi_free( &T, NULL );
+    mpi_free( &T );
 
     return( ret );
 }
@@ -771,7 +754,7 @@
     if( mpi_cmp_abs( A, B ) < 0 )
         return( POLARSSL_ERR_MPI_NEGATIVE_VALUE );
 
-    mpi_init( &TB, NULL );
+    mpi_init( &TB );
 
     if( X == B )
     {
@@ -797,7 +780,7 @@
 
 cleanup:
 
-    mpi_free( &TB, NULL );
+    mpi_free( &TB );
 
     return( ret );
 }
@@ -969,7 +952,7 @@
     size_t i, j;
     mpi TA, TB;
 
-    mpi_init( &TA, &TB, NULL );
+    mpi_init( &TA ); mpi_init( &TB );
 
     if( X == A ) { MPI_CHK( mpi_copy( &TA, A ) ); A = &TA; }
     if( X == B ) { MPI_CHK( mpi_copy( &TB, B ) ); B = &TB; }
@@ -992,7 +975,7 @@
 
 cleanup:
 
-    mpi_free( &TB, &TA, NULL );
+    mpi_free( &TB ); mpi_free( &TA );
 
     return( ret );
 }
@@ -1025,7 +1008,8 @@
     if( mpi_cmp_int( B, 0 ) == 0 )
         return( POLARSSL_ERR_MPI_DIVISION_BY_ZERO );
 
-    mpi_init( &X, &Y, &Z, &T1, &T2, NULL );
+    mpi_init( &X ); mpi_init( &Y ); mpi_init( &Z );
+    mpi_init( &T1 ); mpi_init( &T2 );
 
     if( mpi_cmp_abs( A, B ) < 0 )
     {
@@ -1170,7 +1154,8 @@
 
 cleanup:
 
-    mpi_free( &X, &Y, &Z, &T1, &T2, NULL );
+    mpi_free( &X ); mpi_free( &Y ); mpi_free( &Z );
+    mpi_free( &T1 ); mpi_free( &T2 );
 
     return( ret );
 }
@@ -1363,7 +1348,7 @@
      * Init temps and window size
      */
     mpi_montg_init( &mm, N );
-    mpi_init( &RR, &T, NULL );
+    mpi_init( &RR ); mpi_init( &T );
     memset( W, 0, sizeof( W ) );
 
     i = mpi_msb( E );
@@ -1514,11 +1499,12 @@
 cleanup:
 
     for( i = (one << (wsize - 1)); i < (one << wsize); i++ )
-        mpi_free( &W[i], NULL );
+        mpi_free( &W[i] );
 
-    if( _RR != NULL )
-         mpi_free( &W[1], &T, NULL );
-    else mpi_free( &W[1], &T, &RR, NULL );
+    mpi_free( &W[1] ); mpi_free( &T );
+
+    if( _RR == NULL )
+        mpi_free( &RR );
 
     return( ret );
 }
@@ -1532,7 +1518,7 @@
     size_t lz, lzt;
     mpi TG, TA, TB;
 
-    mpi_init( &TG, &TA, &TB, NULL );
+    mpi_init( &TG ); mpi_init( &TA ); mpi_init( &TB );
 
     MPI_CHK( mpi_copy( &TA, A ) );
     MPI_CHK( mpi_copy( &TB, B ) );
@@ -1570,7 +1556,7 @@
 
 cleanup:
 
-    mpi_free( &TB, &TA, &TG, NULL );
+    mpi_free( &TG ); mpi_free( &TA ); mpi_free( &TB );
 
     return( ret );
 }
@@ -1605,8 +1591,9 @@
     if( mpi_cmp_int( N, 0 ) <= 0 )
         return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
 
-    mpi_init( &TA, &TU, &U1, &U2, &G,
-              &TB, &TV, &V1, &V2, NULL );
+    mpi_init( &TA ); mpi_init( &TU ); mpi_init( &U1 ); mpi_init( &U2 );
+    mpi_init( &G ); mpi_init( &TB ); mpi_init( &TV );
+    mpi_init( &V1 ); mpi_init( &V2 );
 
     MPI_CHK( mpi_gcd( &G, A, N ) );
 
@@ -1681,8 +1668,9 @@
 
 cleanup:
 
-    mpi_free( &V2, &V1, &TV, &TB, &G,
-              &U2, &U1, &TU, &TA, NULL );
+    mpi_free( &TA ); mpi_free( &TU ); mpi_free( &U1 ); mpi_free( &U2 );
+    mpi_free( &G ); mpi_free( &TB ); mpi_free( &TV );
+    mpi_free( &V1 ); mpi_free( &V2 );
 
     return( ret );
 }
@@ -1728,7 +1716,8 @@
     if( mpi_cmp_int( X, 2 ) == 0 )
         return( 0 );
 
-    mpi_init( &W, &R, &T, &A, &RR, NULL );
+    mpi_init( &W ); mpi_init( &R ); mpi_init( &T ); mpi_init( &A );
+    mpi_init( &RR );
 
     xs = X->s; X->s = 1;
 
@@ -1821,7 +1810,8 @@
 
     X->s = xs;
 
-    mpi_free( &RR, &A, &T, &R, &W, NULL );
+    mpi_free( &W ); mpi_free( &R ); mpi_free( &T ); mpi_free( &A );
+    mpi_free( &RR );
 
     return( ret );
 }
@@ -1839,7 +1829,7 @@
     if( nbits < 3 || nbits > 4096 )
         return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
 
-    mpi_init( &Y, NULL );
+    mpi_init( &Y );
 
     n = BITS_TO_LIMBS( nbits );
 
@@ -1888,7 +1878,7 @@
 
 cleanup:
 
-    mpi_free( &Y, NULL );
+    mpi_free( &Y );
 
     return( ret );
 }
@@ -1914,7 +1904,8 @@
     int ret, i;
     mpi A, E, N, X, Y, U, V;
 
-    mpi_init( &A, &E, &N, &X, &Y, &U, &V, NULL );
+    mpi_init( &A ); mpi_init( &E ); mpi_init( &N ); mpi_init( &X );
+    mpi_init( &Y ); mpi_init( &U ); mpi_init( &V );
 
     MPI_CHK( mpi_read_string( &A, 16,
         "EFE021C2645FD1DC586E69184AF4A31E" \
@@ -2052,7 +2043,8 @@
     if( ret != 0 && verbose != 0 )
         printf( "Unexpected error, return code = %08X\n", ret );
 
-    mpi_free( &V, &U, &Y, &X, &N, &E, &A, NULL );
+    mpi_free( &A ); mpi_free( &E ); mpi_free( &N ); mpi_free( &X );
+    mpi_free( &Y ); mpi_free( &U ); mpi_free( &V );
 
     if( verbose != 0 )
         printf( "\n" );
diff --git a/library/dhm.c b/library/dhm.c
index 59e78f8..9c8daef 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -74,7 +74,7 @@
     mpi L, U;
     int ret = POLARSSL_ERR_DHM_BAD_INPUT_DATA;
 
-    mpi_init( &L, &U, NULL );
+    mpi_init( &L ); mpi_init( &U );
     mpi_lset( &L, 2 );
     mpi_sub_int( &U, P, 2 );
 
@@ -84,7 +84,7 @@
         ret = 0;
     }
 
-    mpi_free( &L, &U, NULL );
+    mpi_free( &L ); mpi_free( &U );
 
     return( ret );
 }
@@ -270,9 +270,9 @@
  */
 void dhm_free( dhm_context *ctx )
 {
-    mpi_free( &ctx->RP, &ctx->K, &ctx->GY,
-              &ctx->GX, &ctx->X, &ctx->G,
-              &ctx->P, NULL );    
+    mpi_free( &ctx->RP ); mpi_free( &ctx->K ); mpi_free( &ctx->GY );
+    mpi_free( &ctx->GX ); mpi_free( &ctx->X ); mpi_free( &ctx->G );
+    mpi_free( &ctx->P );
 }
 
 #if defined(POLARSSL_SELF_TEST)
diff --git a/library/rsa.c b/library/rsa.c
index 4d3fc4c..3018eb4 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -68,7 +68,7 @@
     if( f_rng == NULL || nbits < 128 || exponent < 3 )
         return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
 
-    mpi_init( &P1, &Q1, &H, &G, NULL );
+    mpi_init( &P1 ); mpi_init( &Q1 ); mpi_init( &H ); mpi_init( &G );
 
     /*
      * find primes P and Q with Q < P so that:
@@ -116,7 +116,7 @@
 
 cleanup:
 
-    mpi_free( &G, &H, &Q1, &P1, NULL );
+    mpi_free( &P1 ); mpi_free( &Q1 ); mpi_free( &H ); mpi_free( &G );
 
     if( ret != 0 )
     {
@@ -166,7 +166,9 @@
     if( !ctx->P.p || !ctx->Q.p || !ctx->D.p )
         return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED );
 
-    mpi_init( &PQ, &DE, &P1, &Q1, &H, &I, &G, &G2, &L1, &L2, NULL );
+    mpi_init( &PQ ); mpi_init( &DE ); mpi_init( &P1 ); mpi_init( &Q1 );
+    mpi_init( &H  ); mpi_init( &I  ); mpi_init( &G  ); mpi_init( &G2 );
+    mpi_init( &L1 ); mpi_init( &L2 );
 
     MPI_CHK( mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) );
     MPI_CHK( mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) );
@@ -182,20 +184,25 @@
     /*
      * Check for a valid PKCS1v2 private key
      */
-    if( mpi_cmp_mpi( &PQ, &ctx->N ) == 0 &&
-        mpi_cmp_int( &L2, 0 ) == 0 &&
-        mpi_cmp_int( &I, 1 ) == 0 &&
-        mpi_cmp_int( &G, 1 ) == 0 )
+    if( mpi_cmp_mpi( &PQ, &ctx->N ) != 0 ||
+        mpi_cmp_int( &L2, 0 ) != 0 ||
+        mpi_cmp_int( &I, 1 ) != 0 ||
+        mpi_cmp_int( &G, 1 ) != 0 )
     {
-        mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, &G2, &L1, &L2, NULL );
-        return( 0 );
+        ret = POLARSSL_ERR_RSA_KEY_CHECK_FAILED;
     }
 
     
 cleanup:
 
-    mpi_free( &G, &I, &H, &Q1, &P1, &DE, &PQ, &G2, &L1, &L2, NULL );
-    return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED | ret );
+    mpi_free( &PQ ); mpi_free( &DE ); mpi_free( &P1 ); mpi_free( &Q1 );
+    mpi_free( &H  ); mpi_free( &I  ); mpi_free( &G  ); mpi_free( &G2 );
+    mpi_free( &L1 ); mpi_free( &L2 );
+
+    if( ret != 0 )
+        return( POLARSSL_ERR_RSA_KEY_CHECK_FAILED | ret );
+
+    return( 0 );
 }
 
 /*
@@ -209,13 +216,13 @@
     size_t olen;
     mpi T;
 
-    mpi_init( &T, NULL );
+    mpi_init( &T );
 
     MPI_CHK( mpi_read_binary( &T, input, ctx->len ) );
 
     if( mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
     {
-        mpi_free( &T, NULL );
+        mpi_free( &T );
         return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
     }
 
@@ -225,7 +232,7 @@
 
 cleanup:
 
-    mpi_free( &T, NULL );
+    mpi_free( &T );
 
     if( ret != 0 )
         return( POLARSSL_ERR_RSA_PUBLIC_FAILED | ret );
@@ -244,13 +251,13 @@
     size_t olen;
     mpi T, T1, T2;
 
-    mpi_init( &T, &T1, &T2, NULL );
+    mpi_init( &T ); mpi_init( &T1 ); mpi_init( &T2 );
 
     MPI_CHK( mpi_read_binary( &T, input, ctx->len ) );
 
     if( mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
     {
-        mpi_free( &T, NULL );
+        mpi_free( &T );
         return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
     }
 
@@ -285,7 +292,7 @@
 
 cleanup:
 
-    mpi_free( &T, &T1, &T2, NULL );
+    mpi_free( &T ); mpi_free( &T1 ); mpi_free( &T2 );
 
     if( ret != 0 )
         return( POLARSSL_ERR_RSA_PRIVATE_FAILED | ret );
@@ -1006,10 +1013,10 @@
  */
 void rsa_free( rsa_context *ctx )
 {
-    mpi_free( &ctx->RQ, &ctx->RP, &ctx->RN,
-              &ctx->QP, &ctx->DQ, &ctx->DP,
-              &ctx->Q,  &ctx->P,  &ctx->D,
-              &ctx->E,  &ctx->N,  NULL );
+    mpi_free( &ctx->RQ ); mpi_free( &ctx->RP ); mpi_free( &ctx->RN );
+    mpi_free( &ctx->QP ); mpi_free( &ctx->DQ ); mpi_free( &ctx->DP );
+    mpi_free( &ctx->Q  ); mpi_free( &ctx->P  ); mpi_free( &ctx->D );
+    mpi_free( &ctx->E  ); mpi_free( &ctx->N  );
 }
 
 #if defined(POLARSSL_SELF_TEST)