expat hash collision fix too predictable?

[Marcus Meissner <meissner () suse de>]

Hi,

while reviewing a expat regression (likely caused by the hash collision denial of service fix, but unclear)
i stumbled about the randomness it uses.

        static unsigned long
        generate_hash_secret_salt(void)
        {
          unsigned int seed = time(NULL) % UINT_MAX;
          srand(seed);
          return rand();
        }

and it is seeded once at parser object creation.

This is better than not seeding, but I am not sure if it is sufficient.

Ciao, Marcus