Jabberd2/jabberd2 — pull request #5 by eagafonov (2012-06-15 18:41:56+00:00)
Title: Utilize XML_SetHashSalt

It is a prelimnary fix for multiple calls of srand() with expat-2.1.0

Captured from mail thread:

>> Anyway, I suspect you blame the following expat's function:
>>
>> static unsigned long
>> generate_hash_secret_salt(void)
>> {
>> unsigned int seed = time(NULL) % UINT_MAX;
>> srand(seed);
>> return rand();
>> }
>>
>> It is called once (per parser instance) with quite random value
>> based on current time.
>> That's the mostly recommended way to initialize pseudo-random
>> generator as far as I remember
>> so it looks safe for me.

>No, the problem is that jabberd2 creates a new parser for each
>connection and needs a random id for each connection. Now if there are
>2 connections within a second, the random number generator gets
>reseeded with the same initial value and you get the same random id
>for both connections.

The fix is the call of XML_SetHashSalt (as suggested by expat) for each XML_Parser instance so srand() is not even called.

The only doubt with this patch is using clock(). It has about 1 ms granularity
so two call within 1 ms may have the same hash salt.

It is much better than 1 sec granularity of time() but anyway..

Lets test this patch.