in src/rsa_support.c [117:134]
static void MGF1(int sha,const octet *z,int olen,octet *mask)
{
char h[64];
octet H= {0,sizeof(h),h};
int hlen=sha;
int cthreshold;
OCT_empty(mask);
cthreshold=ROUNDUP(olen,hlen);
for (int counter=0; counter<cthreshold; counter++)
{
hashit(sha,z,counter,&H);
if (mask->len+hlen>olen) OCT_jbytes(mask,H.val,olen%hlen);
else OCT_joctet(mask,&H);
}
OCT_clear(&H);
}