Bug #75514 [Asn->Csd]: mt_rand returns value outside [$min,$max]+ on 32-bit

Edit report at https://bugs.php.net/bug.php?id=75514&edit=1 ID: 75514 Updated by: remi@php.net Reported by: remi@php.net Summary: mt_rand returns value outside [$min,$max]+ on 32-bit -Status: Assigned +Status: Closed Type: Bug Package: *General Issues Operating System: 32-bit PHP Version: 7.1.11 Assigned To: remi Block user comment: N Private report: N New Comment: Automatic comment on behalf of remi@remirepo.net Revision: http://git.php.net/?p=php-src.git;a=commit;h=e704e1e8c25ff726e7c890cce20fb932210737b7 Log: Fixed bug #75514 mt_rand returns value outside [$min,$max]+ on 32-bit Previous Comments: ------------------------------------------------------------------------ [2017-11-13 08:45:05] remi@php.net Possible fix diff --git a/ext/standard/mt_rand.c b/ext/standard/mt_rand.c index 2335a92..6669cbc 100644 --- a/ext/standard/mt_rand.c +++ b/ext/standard/mt_rand.c @@ -294,7 +294,7 @@ PHPAPI zend_long php_mt_rand_range(zend_long min, zend_long max) * rand() allows min > max, mt_rand does not */ PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max) { - zend_long n; + uint32_t n; if (BG(mt_rand_mode) == MT_RAND_MT19937) { return php_mt_rand_range(min, max); @@ -302,7 +302,7 @@ PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max) /* Legacy mode deliberately not inside php_mt_rand_range() * to prevent other functions being affected */ - n = (zend_long)php_mt_rand() >> 1; + n = php_mt_rand() >> 1; RAND_RANGE_BADSCALING(n, min, max, PHP_MT_RAND_MAX); return n; ------------------------------------------------------------------------ [2017-11-13 08:19:51] remi@php.net 7.1 is also affected ------------------------------------------------------------------------ [2017-11-13 08:13:09] remi@php.net Description: ------------ Notice this affects on 32-bit build Test script: --------------- php -r 'mt_srand(0, MT_RAND_PHP); var_dump(mt_rand(0,999999999), mt_rand(0,999));' Expected result: ---------------- # On 64-bit build, this is ok int(448865905) int(592) Actual result: -------------- int(448865905) int(-407) # out of range ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75514&edit=1