summaryrefslogtreecommitdiffstats
path: root/php-bug75514.patch
blob: c9639330f9aeb18554abce0066d38d9a1be691f7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
From 00500c425ba895f1b3591ace3ccd5ee125307559 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Mon, 13 Nov 2017 09:55:10 +0100
Subject: [PATCH] Fixed bug #75514 mt_rand returns value outside [$min,$max]+
 on 32-bit

---
 ext/standard/mt_rand.c                |  4 ++--
 ext/standard/tests/math/bug75514.phpt | 12 ++++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 ext/standard/tests/math/bug75514.phpt

diff --git a/ext/standard/mt_rand.c b/ext/standard/mt_rand.c
index 2335a92..6669cbc 100644
--- a/ext/standard/mt_rand.c
+++ b/ext/standard/mt_rand.c
@@ -294,7 +294,7 @@ PHPAPI zend_long php_mt_rand_range(zend_long min, zend_long max)
  * rand() allows min > max, mt_rand does not */
 PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max)
 {
-	zend_long n;
+	uint32_t n;
 
 	if (BG(mt_rand_mode) == MT_RAND_MT19937) {
 		return php_mt_rand_range(min, max);
@@ -302,7 +302,7 @@ PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max)
 
 	/* Legacy mode deliberately not inside php_mt_rand_range()
 	 * to prevent other functions being affected */
-	n = (zend_long)php_mt_rand() >> 1;
+	n = php_mt_rand() >> 1;
 	RAND_RANGE_BADSCALING(n, min, max, PHP_MT_RAND_MAX);
 
 	return n;
diff --git a/ext/standard/tests/math/bug75514.phpt b/ext/standard/tests/math/bug75514.phpt
new file mode 100644
index 0000000..af97b6d
--- /dev/null
+++ b/ext/standard/tests/math/bug75514.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #75514 mt_rand returns value outside [$min,$max]
+--FILE--
+<?php
+mt_srand(0, MT_RAND_PHP);
+var_dump(mt_rand(0,999999999), mt_rand(0,999));
+?>
+===Done===
+--EXPECT--
+int(448865905)
+int(592)
+===Done===
-- 
2.9.5

From 2b071028973782ed87e7038e56d47e9897be804a Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Tue, 28 Nov 2017 17:42:43 +0100
Subject: [PATCH] better fix for #75514

---
 ext/standard/mt_rand.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ext/standard/mt_rand.c b/ext/standard/mt_rand.c
index 0a76ab8..46f52db 100644
--- a/ext/standard/mt_rand.c
+++ b/ext/standard/mt_rand.c
@@ -260,7 +260,7 @@ PHPAPI zend_long php_mt_rand_range(zend_long min, zend_long max)
  * rand() allows min > max, mt_rand does not */
 PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max)
 {
-	uint32_t n;
+	int64_t n;
 
 	if (BG(mt_rand_mode) == MT_RAND_MT19937) {
 		return php_mt_rand_range(min, max);
@@ -268,7 +268,7 @@ PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max)
 
 	/* Legacy mode deliberately not inside php_mt_rand_range()
 	 * to prevent other functions being affected */
-	n = php_mt_rand() >> 1;
+	n = (int64_t)php_mt_rand() >> 1;
 	RAND_RANGE_BADSCALING(n, min, max, PHP_MT_RAND_MAX);
 
 	return n;
-- 
2.1.4