<div>in the function switch_stun_random_string, there are two bugs.</div>
<div>1. the 2nd parameter len is uint16_t type, while the local varible x is uint8_t type. If sometimes len is larger than 0xFF, the for loop will be infinite loop.</div>
<div>2. anyway, after this function, there would be no "a" in the buf.</div>
<div>Please see the changes as followed.</div>
<div> </div>
<div>Index: freeswitch/src/switch_stun.c<br>===================================================================<br>--- freeswitch/src/switch_stun.c (revision 0)<br>+++ freeswitch/src/switch_stun.c (working copy)<br>@@ -91,18 +91,18 @@
<br> {<br> char chars[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";<br> int max;<br>- uint8_t x;<br>+ uint16_t x;<br> <br> if (!set) {<br> set = chars;<br> }<br> <br>- max = (int)strlen(set) - 1;
<br>+ max = (int)strlen(set);<br> <br> srand((unsigned int)apr_time_now());<br> <br> for(x = 0; x < len; x++) {<br>- int j = 1+(int)(max*1.0*rand()/(RAND_MAX+1.0));<br>+ int j = (int)(max*1.0*rand()/(RAND_MAX+1.0));
<br> buf[x] = set[j];<br> }<br> }<br> </div>