1
0
mirror of https://github.com/php/php-src.git synced 2026-04-15 03:51:07 +02:00
Files
archived-php-src/ext
Tim Düsterhus 60ace13f9c Fix undefined behavior of MT_RAND_PHP if range exceeds ZEND_LONG_MAX (#9197)
RAND_RANGE_BADSCALING() invokes undefined behavior when (max - min) >
ZEND_LONG_MAX, because the intermediate `double` might not fit into
`zend_long`.

Fix this by inlining a fixed version of the macro into Mt19937's range()
function. Fixing the macro itself cannot be done in the general case, because
the types of the inputs are not known. Instead of replacing one possibly broken
version with another possibly broken version, the macro is simply left as is
and should be removed in a future version.

The fix itself is simple: Instead of storing the "offset" in a `zend_long`, we
use a `zend_ulong` which is capable of storing the resulting double by
construction. With this fix the implementation of this broken scaling is
effectively identical to the implementation of php_random_range from a data
type perspective, making it easy to verify the correctness.

It was further empirically verified that the broken macro and the fix return
the same results for all possible values of `r` for several distinct pairs of
(min, max).

Fixes GH-9190
Fixes GH-9191
2022-08-03 18:46:36 +02:00
..
2022-06-25 07:40:19 +01:00
2022-07-28 19:36:04 +01:00
2022-06-10 12:45:30 -04:00
2022-07-28 21:09:18 +02:00
2022-07-28 21:09:18 +02:00
2022-06-09 13:42:45 +02:00
2022-06-13 14:44:49 +02:00
2022-07-27 13:11:58 +02:00
2022-07-28 19:36:04 +01:00
2022-07-29 12:15:38 +02:00
2022-07-25 19:28:25 +01:00
2022-05-16 14:47:02 +02:00