Index: trunk/include/iprt/crypto/shacrypt.h
===================================================================
--- trunk/include/iprt/crypto/shacrypt.h	(revision 102490)
+++ trunk/include/iprt/crypto/shacrypt.h	(revision 102491)
@@ -115,7 +115,8 @@
  *                      RT_SHACRYPT_MAX_SALT_LEN, both inclusive.
  *
- * @param   cRounds     Number of rounds to use (@see
- *                      RT_SHACRYPT_ROUNDS_DEFAULT).  This is ignored if the
- *                      salt includes a 'rounds=xxx$' part.
+ * @param   cRounds     Number of rounds to use, must be in the range
+ *                      RT_SHACRYPT_ROUNDS_MIN thru RT_SHACRYPT_ROUNDS_MAX.
+ *                      If unsure, use RT_SHACRYPT_ROUNDS_DEFAULT.  This is
+ *                      ignored if the salt includes a 'rounds=xxx$' part.
  * @param   pszString   Where to store the string on success.
  * @param   cbString    The size of the buffer pointed to by @a pszString.
@@ -145,4 +146,8 @@
  *                      RT_SHACRYPT_MAX_SALT_LEN, both inclusive.
  *
+ * @param   cRounds     Number of rounds to use, must be in the range
+ *                      RT_SHACRYPT_ROUNDS_MIN thru RT_SHACRYPT_ROUNDS_MAX.
+ *                      If unsure, use RT_SHACRYPT_ROUNDS_DEFAULT.  This is
+ *                      ignored if the salt includes a 'rounds=xxx$' part.
  * @param   pszString   Where to store the string on success.
  * @param   cbString    The size of the buffer pointed to by @a pszString.
@@ -175,6 +180,8 @@
  *                      RT_SHACRYPT_MAX_SALT_LEN, both inclusive.
  *
- * @param   cRounds     Number of rounds to use (@see
- *                      RT_SHACRYPT_ROUNDS_DEFAULT).
+ * @param   cRounds     Number of rounds to use, must be in the range
+ *                      RT_SHACRYPT_ROUNDS_MIN thru RT_SHACRYPT_ROUNDS_MAX.
+ *                      If unsure, use RT_SHACRYPT_ROUNDS_DEFAULT.  This is
+ *                      ignored if the salt includes a 'rounds=xxx$' part.
  * @param   pabHash     Where to return the hash on success.
  * @see     RTCrShaCrypt256, RTCrShaCrypt256ToString
@@ -201,6 +208,8 @@
  *                      RT_SHACRYPT_MAX_SALT_LEN, both inclusive.
  *
- * @param   cRounds     Number of rounds to use (@see
- *                      RT_SHACRYPT_ROUNDS_DEFAULT).
+ * @param   cRounds     Number of rounds to use, must be in the range
+ *                      RT_SHACRYPT_ROUNDS_MIN thru RT_SHACRYPT_ROUNDS_MAX.
+ *                      If unsure, use RT_SHACRYPT_ROUNDS_DEFAULT.  This is
+ *                      ignored if the salt includes a 'rounds=xxx$' part.
  * @param   pabHash     Where to return the hash on success.
  * @see     RTCrShaCrypt512, RTCrShaCrypt512ToString
Index: trunk/src/VBox/Runtime/common/crypto/shacrypt-256.cpp.h
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/shacrypt-256.cpp.h	(revision 102490)
+++ trunk/src/VBox/Runtime/common/crypto/shacrypt-256.cpp.h	(revision 102491)
@@ -82,8 +82,11 @@
     RTSha256Final(&CtxB, abDigest);                                             /* Step 8. */
 
-    size_t i = cchPhrase;
-    for (; i > RTSHA256_HASH_SIZE; i -= RTSHA256_HASH_SIZE)                     /* Step 9. */
+    size_t cbLeft = cchPhrase;
+    while (cbLeft > RTSHA256_HASH_SIZE)                                         /* Step 9. */
+    {
         RTSha256Update(&CtxA, abDigest, sizeof(abDigest));
-    RTSha256Update(&CtxA, abDigest, i);                                         /* Step 10. */
+        cbLeft -= RTSHA256_HASH_SIZE;
+    }
+    RTSha256Update(&CtxA, abDigest, cbLeft);                                    /* Step 10. */
 
     size_t iPhraseBit = cchPhrase;
@@ -100,5 +103,5 @@
 
     RTSha256Init(&CtxB);                                                        /* Step 13. */
-    for (i = 0; i < cchPhrase; i++)                                             /* Step 14. */
+    for (size_t i = 0; i < cchPhrase; i++)                                      /* Step 14. */
         RTSha256Update(&CtxB, pszPhrase, cchPhrase);
 
@@ -109,19 +112,21 @@
      * Byte sequence P (= password).
      */
+    /* Step 16. */
     size_t const cbSeqP  = cchPhrase;
     uint8_t     *pabSeqP = (uint8_t *)RTMemTmpAllocZ(cbSeqP + 1);               /* +1 because the password may be empty */
     uint8_t     *pb       = pabSeqP;
     AssertPtrReturn(pabSeqP, VERR_NO_MEMORY);
-
-    for (i = cbSeqP; i > RTSHA256_HASH_SIZE; i -= RTSHA256_HASH_SIZE)           /* Step 16. */
+    cbLeft = cbSeqP;
+    while (cbLeft > RTSHA256_HASH_SIZE)
     {
         memcpy(pb, abDigestTemp, sizeof(abDigestTemp));                         /* a) */
-        pb += RTSHA256_HASH_SIZE;
-    }
-    memcpy(pb, abDigestTemp, i);                                                /* b) */
+        pb     += RTSHA256_HASH_SIZE;
+        cbLeft -= RTSHA256_HASH_SIZE;
+    }
+    memcpy(pb, abDigestTemp, cbLeft);                                           /* b) */
 
     RTSha256Init(&CtxB);                                                        /* Step 17. */
 
-    for (i = 0; i < 16 + (unsigned)abDigest[0]; i++)                            /* Step 18. */
+    for (size_t i = 0; i < 16 + (unsigned)abDigest[0]; i++)                     /* Step 18. */
         RTSha256Update(&CtxB, pszSalt, cchSalt);
 
@@ -141,11 +146,13 @@
     AssertPtrReturn(pabSeqS, VERR_NO_MEMORY);
 
-    pb = pabSeqS;
-    for (i = cbSeqS; i > RTSHA256_HASH_SIZE; i -= RTSHA256_HASH_SIZE)
+    pb     = pabSeqS;
+    cbLeft = cbSeqS;
+    while (cbLeft > RTSHA256_HASH_SIZE)
     {
         memcpy(pb, (void *)abDigestTemp, sizeof(abDigestTemp));                 /* a) */
-        pb += RTSHA256_HASH_SIZE;
-    }
-    memcpy(pb, abDigestTemp, i);                                                /* b) */
+        pb     += RTSHA256_HASH_SIZE;
+        cbLeft -= RTSHA256_HASH_SIZE
+    }
+    memcpy(pb, abDigestTemp, cbLeft);                                           /* b) */
 #else
     AssertCompile(RT_SHACRYPT_SALT_MAX_LEN < RTSHA256_HASH_SIZE);
Index: trunk/src/VBox/Runtime/common/crypto/shacrypt-512.cpp.h
===================================================================
--- trunk/src/VBox/Runtime/common/crypto/shacrypt-512.cpp.h	(revision 102490)
+++ trunk/src/VBox/Runtime/common/crypto/shacrypt-512.cpp.h	(revision 102491)
@@ -83,8 +83,11 @@
     RTSha512Final(&CtxB, abDigest);                                             /* Step 8. */
 
-    size_t i = cchPhrase;
-    for (; i > RTSHA512_HASH_SIZE; i -= RTSHA512_HASH_SIZE)                     /* Step 9. */
+    size_t cbLeft = cchPhrase;
+    while (cbLeft > RTSHA512_HASH_SIZE)                                         /* Step 9. */
+    {
         RTSha512Update(&CtxA, abDigest, sizeof(abDigest));
-    RTSha512Update(&CtxA, abDigest, i);                                         /* Step 10. */
+        cbLeft -= RTSHA512_HASH_SIZE;
+    }
+    RTSha512Update(&CtxA, abDigest, cbLeft);                                    /* Step 10. */
 
     size_t iPhraseBit = cchPhrase;
@@ -101,5 +104,5 @@
 
     RTSha512Init(&CtxB);                                                        /* Step 13. */
-    for (i = 0; i < cchPhrase; i++)                                             /* Step 14. */
+    for (size_t i = 0; i < cchPhrase; i++)                                      /* Step 14. */
         RTSha512Update(&CtxB, pszPhrase, cchPhrase);
 
@@ -110,19 +113,21 @@
      * Byte sequence P (= password).
      */
+    /* Step 16. */
     size_t const cbSeqP  = cchPhrase;
     uint8_t     *pabSeqP = (uint8_t *)RTMemTmpAllocZ(cbSeqP + 1);               /* +1 because the password may be empty */
     uint8_t     *pb       = pabSeqP;
     AssertPtrReturn(pabSeqP, VERR_NO_MEMORY);
-
-    for (i = cbSeqP; i > RTSHA512_HASH_SIZE; i -= RTSHA512_HASH_SIZE)           /* Step 16. */
+    cbLeft = cbSeqP;
+    while (cbLeft > RTSHA512_HASH_SIZE)
     {
         memcpy(pb, abDigestTemp, sizeof(abDigestTemp));                         /* a) */
-        pb += RTSHA512_HASH_SIZE;
-    }
-    memcpy(pb, abDigestTemp, i);                                                /* b) */
+        pb     += RTSHA512_HASH_SIZE;
+        cbLeft -= RTSHA512_HASH_SIZE;
+    }
+    memcpy(pb, abDigestTemp, cbLeft);                                           /* b) */
 
     RTSha512Init(&CtxB);                                                        /* Step 17. */
 
-    for (i = 0; i < 16 + (unsigned)abDigest[0]; i++)                            /* Step 18. */
+    for (size_t i = 0; i < 16 + (unsigned)abDigest[0]; i++)                     /* Step 18. */
         RTSha512Update(&CtxB, pszSalt, cchSalt);
 
@@ -142,11 +147,13 @@
     AssertPtrReturn(pabSeqS, VERR_NO_MEMORY);
 
-    pb = pabSeqS;
-    for (i = cbSeqS; i > RTSHA512_HASH_SIZE; i -= RTSHA512_HASH_SIZE)
+    pb     = pabSeqS;
+    cbLeft = cbSeqS;
+    while (cbLeft > RTSHA512_HASH_SIZE)
     {
         memcpy(pb, (void *)abDigestTemp, sizeof(abDigestTemp));                 /* a) */
-        pb += RTSHA512_HASH_SIZE;
-    }
-    memcpy(pb, abDigestTemp, i);                                                /* b) */
+        pb     += RTSHA512_HASH_SIZE;
+        cbLeft -= RTSHA512_HASH_SIZE
+    }
+    memcpy(pb, abDigestTemp, cbLeft);                                           /* b) */
 #else
     AssertCompile(RT_SHACRYPT_SALT_MAX_LEN < RTSHA512_HASH_SIZE);
