From: samanway.dey@samsung.com <samanway.dey@samsung.com>
Date: Tue, 11 Jun 2019 18:32:40 +0000 (+0530)
Subject: Fixing crash in ocrandom.c (#516)
X-Git-Tag: accepted/tizen/unified/20190626.040955~2
X-Git-Url: http://review.tizen.org/git/?p=platform%2Fupstream%2Fiotivity.git;a=commitdiff_plain;h=ce2235473629f160c040a0c651a060711eab30f0

Fixing crash in ocrandom.c (#516)

* Fixing crash in ocrandom.c

-In function OCFillRandomMem() in ocrandom.c, location array was filled by incrementing the pointer. As a result,
the base pointer was pointing out the last byte of memory chunk instead of pointing the beginning of the array.

Signed-off-by: Samanway Dey <samanway.dey@samsung.com>

* Update ocrandom.c

Iterating till i > 1 for random swaps.

https://github.sec.samsung.net/RS7-IOTIVITY/IoTivity/pull/516
(cherry picked from 643d922896dfeaf5f3d829009bd1d5b09654d93b)

Change-Id: I8031d4cf5cc22c682ff5c0df607c78e276923bcf
Signed-off-by: DoHyun Pyun <dh79.pyun@samsung.com>
---

diff --git a/resource/c_common/ocrandom/src/ocrandom.c b/resource/c_common/ocrandom/src/ocrandom.c
index babf32b..c7c7e09 100644
--- a/resource/c_common/ocrandom/src/ocrandom.c
+++ b/resource/c_common/ocrandom/src/ocrandom.c
@@ -187,48 +187,28 @@ int8_t OCSeedRandom()
 
 void OCFillRandomMem(uint8_t * location, uint16_t len)
 {
-    int i, j, rand_idx;
-    i = len;
     if (!location)
     {
         return;
     }
+    uint16_t i, rand_idx;
+    uint8_t *loc;
+    i = len;
+    loc = location;
     for (; i--;)
     {
-        *location++ = OCGetRandomByte();
-    }
-    uint8_t *temp = (char *) OICCalloc(len, sizeof(char));
-    int *mask = (int *) OICCalloc(len, sizeof(int));
-    for (i = 0; i < len; i++)
-    {
-        mask[i] = 0;
+        *loc++ = OCGetRandomByte();
     }
-    j = 0;
-    for (i = 0; i < len; i++)
-    {
-        rand_idx = lrand48() % len;
-        while((rand_idx < len) && (mask[rand_idx] != 0))
-        {
-            rand_idx++;
-        }
-        if(rand_idx == len)
-        {
-            rand_idx = 0;
-            while(mask[rand_idx] != 0)
-            {
-                rand_idx++;
-            }
-        }
-        temp[rand_idx] = location[j];
-        mask[rand_idx] = 1;
-        j++;
-    }
-    for (i = 0; i < len; i++)
+    uint8_t temp;
+    i = len;
+    while(i > 1)
     {
-        location[i] = temp[i];
+        rand_idx = lrand48() % i;
+        temp = location[i - 1];
+        location[i - 1] = location[rand_idx];
+        location[rand_idx] = temp;
+        i--;
     }
-    OICFree(temp);
-    OICFree(mask);
 }
 
 uint32_t OCGetRandom()