* Fixing crash in ocrandom.c
-In function OCFillRandomMem() in ocrandom.c, location array was filled by incrementing the pointer. As a result,
the base pointer was pointing out the last byte of memory chunk instead of pointing the beginning of the array.
Signed-off-by: Samanway Dey <samanway.dey@samsung.com>
* Update ocrandom.c
Iterating till i > 1 for random swaps.
https://github.sec.samsung.net/RS7-IOTIVITY/IoTivity/pull/516
(cherry picked from
643d922896dfeaf5f3d829009bd1d5b09654d93b)
Change-Id: I8031d4cf5cc22c682ff5c0df607c78e276923bcf
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
void OCFillRandomMem(uint8_t * location, uint16_t len)
{
void OCFillRandomMem(uint8_t * location, uint16_t len)
{
- int i, j, rand_idx;
- i = len;
if (!location)
{
return;
}
if (!location)
{
return;
}
+ uint16_t i, rand_idx;
+ uint8_t *loc;
+ i = len;
+ loc = location;
- *location++ = OCGetRandomByte();
- }
- uint8_t *temp = (char *) OICCalloc(len, sizeof(char));
- int *mask = (int *) OICCalloc(len, sizeof(int));
- for (i = 0; i < len; i++)
- {
- mask[i] = 0;
+ *loc++ = OCGetRandomByte();
- j = 0;
- for (i = 0; i < len; i++)
- {
- rand_idx = lrand48() % len;
- while((rand_idx < len) && (mask[rand_idx] != 0))
- {
- rand_idx++;
- }
- if(rand_idx == len)
- {
- rand_idx = 0;
- while(mask[rand_idx] != 0)
- {
- rand_idx++;
- }
- }
- temp[rand_idx] = location[j];
- mask[rand_idx] = 1;
- j++;
- }
- for (i = 0; i < len; i++)
+ uint8_t temp;
+ i = len;
+ while(i > 1)
+ rand_idx = lrand48() % i;
+ temp = location[i - 1];
+ location[i - 1] = location[rand_idx];
+ location[rand_idx] = temp;
+ i--;
- OICFree(temp);
- OICFree(mask);