@@ -879,15 +879,15 @@ PHPAPI zend_long php_mt_rand_range(zend_long min, zend_long max)
879879 * rand() allows min > max, mt_rand does not */
880880PHPAPI zend_long php_mt_rand_common (zend_long min , zend_long max )
881881{
882- int64_t n ;
882+ uint64_t n ;
883883
884884 if (RANDOM_G (mt ).mode == MT_RAND_MT19937 ) {
885885 return php_mt_rand_range (min , max );
886886 }
887887
888888 /* Legacy mode deliberately not inside php_mt_rand_range()
889889 * to prevent other functions being affected */
890- n = (int64_t ) php_mt_rand () >> 1 ;
890+ n = (uint64_t ) php_mt_rand () >> 1 ;
891891 RAND_RANGE_BADSCALING (n , min , max , PHP_MT_RAND_MAX );
892892
893893 return n ;
@@ -1077,7 +1077,7 @@ PHPAPI void *php_random_engine_get_default_state(void)
10771077/* }}} */
10781078
10791079/* {{{ php_random_engine_range */
1080- PHPAPI int64_t php_random_engine_range (const php_random_engine_algo * algo , void * state , zend_long min , zend_long max , bool * engine_unsafe )
1080+ PHPAPI uint64_t php_random_engine_range (const php_random_engine_algo * algo , void * state , zend_long min , zend_long max , bool * engine_unsafe )
10811081{
10821082 zend_ulong umax = max - min ;
10831083
@@ -1086,7 +1086,7 @@ PHPAPI int64_t php_random_engine_range(const php_random_engine_algo *algo, void
10861086 return rand_range64 (algo , state , umax , engine_unsafe ) + min ;
10871087 }
10881088
1089- return ((int64_t ) rand_range32 (algo , state , umax , engine_unsafe )) + min ;
1089+ return ((uint64_t ) rand_range32 (algo , state , umax , engine_unsafe )) + min ;
10901090}
10911091/* }}} */
10921092
@@ -1136,7 +1136,7 @@ PHP_FUNCTION(mt_rand)
11361136 int argc = ZEND_NUM_ARGS ();
11371137
11381138 if (argc == 0 ) {
1139- // genrand_int31 in mt19937ar.c performs a right shift
1139+ /* genrand_int31 in mt19937ar.c performs a right shift */
11401140 RETURN_LONG (php_mt_rand () >> 1 );
11411141 }
11421142
@@ -1174,7 +1174,7 @@ PHP_FUNCTION(rand)
11741174 int argc = ZEND_NUM_ARGS ();
11751175
11761176 if (argc == 0 ) {
1177- // genrand_int31 in mt19937ar.c performs a right shift
1177+ /* genrand_int31 in mt19937ar.c performs a right shift */
11781178 RETURN_LONG (php_mt_rand () >> 1 );
11791179 }
11801180
@@ -1556,18 +1556,23 @@ PHP_METHOD(Random_Randomizer, __construct)
15561556PHP_METHOD (Random_Randomizer , getInt )
15571557{
15581558 php_random_randomizer * randomizer = Z_RANDOM_RANDOMIZER_P (ZEND_THIS );
1559- zend_long min , max , result ;
1559+ uint64_t result ;
1560+ zend_long min , max ;
1561+ size_t generate_size = 0 ;
15601562 int argc = ZEND_NUM_ARGS ();
15611563 bool engine_unsafe = false;
15621564
15631565 if (argc == 0 ) {
1564- // right shift for compatibility
1565- result = (zend_long ) (randomizer -> algo -> generate (randomizer -> state , & engine_unsafe ) >> 1 );
1566+ RANDOM_ENGINE_GENERATE (randomizer -> algo , randomizer -> state , result , generate_size , & engine_unsafe );
1567+ if (generate_size > sizeof (zend_long )) {
1568+ zend_throw_exception (spl_ce_RuntimeException , "Generated value exceeds size of int" , 0 );
1569+ RETURN_THROWS ();
1570+ }
15661571 if (engine_unsafe ) {
15671572 zend_throw_exception (spl_ce_RuntimeException , "Random number generate failed" , 0 );
15681573 RETURN_THROWS ();
15691574 }
1570- RETURN_LONG (result );
1575+ RETURN_LONG (( zend_long ) result >> 1 );
15711576 }
15721577
15731578 ZEND_PARSE_PARAMETERS_START (2 , 2 )
@@ -1586,7 +1591,7 @@ PHP_METHOD(Random_Randomizer, getInt)
15861591 RETURN_THROWS ();
15871592 }
15881593
1589- RETURN_LONG (result );
1594+ RETURN_LONG (( zend_long ) result );
15901595}
15911596/* }}} */
15921597
0 commit comments