vuln code

static void get_new_session_id(Sessionhandler *self, char *session_id)
{
    time_t  now;
    int     cnt = 0;
    char    now_buf[20];     <-Vulnerability Code

    assert(self);
    assert(session_id);
    /* Start the try loop of generating unique id*/
    do
    {
        /* Count the tries*/
        cnt++;
        /* Get the current time of the generation*/
        time(&now);
        /* Create a timeout limit for the new id by adding the timeout constant*/
        now += self->_timeout;
        self->_differ++;
        /* Generate a id*/
        generate_id(session_id, self->_differ);
        /* Look in the session Map to se if the id is unique*/
    }while(map_find(self->_sessions, session_id) != NULL && cnt < SESSION_MAX_TRY);
    /* When we get here we probably have a unique id or
     * else we accept the id anyway.
     */
    /* Put the id in the session Map*/
    _ltoa((long)now, now_buf, 10);
    map_add(self->_sessions, session_id, now_buf);
}