Fixed bug #69803

diff --git a/NEWS b/NEWS
index d66d82eebbe50670c566880f3fae98d60ef302ac..c5cf7141964c0f2eae190835fd5265d2e4e6c283 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ PHP                                                                        NEWS
   . Fixed bug #69740 (finally in generator (yield) swallows exception in
     iteration). (Nikita)
 
+- GMP:
+  . Fixed bug #69803 (gmp_random_range() modifies second parameter if GMP
+    number). (Nikita)
+
 - PDO_pgsql:
   . Fixed bug #69752 (PDOStatement::execute() leaks memory with DML
     Statements when closeCuror() is u). (Philip Hofstetter)

diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp.c
index 6bc1d3ff16895e7a6604dbdf37976eeb41541901..575dab8a5bb1ee6520ad46a3779efd17a9eccbfd 100644 (file)
--- a/ext/gmp/gmp.c
+++ b/ext/gmp/gmp.c
@@ -1841,6 +1841,7 @@ ZEND_FUNCTION(gmp_random_range)
 {
        zval *min_arg, *max_arg;
        mpz_ptr gmpnum_min, gmpnum_max, gmpnum_result;
+       mpz_t gmpnum_range;
        gmp_temp_t temp_a, temp_b;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz", &min_arg, &max_arg) == FAILURE) {
@@ -1859,22 +1860,23 @@ ZEND_FUNCTION(gmp_random_range)
                }
 
                INIT_GMP_RETVAL(gmpnum_result);
+               mpz_init(gmpnum_range);
 
-               if (Z_LVAL_P(min_arg)) {
-                       mpz_sub_ui(gmpnum_max, gmpnum_max, Z_LVAL_P(min_arg));
+               if (Z_LVAL_P(min_arg) != 0) {
+                       mpz_sub_ui(gmpnum_range, gmpnum_max, Z_LVAL_P(min_arg) - 1);
+               } else {
+                       mpz_add_ui(gmpnum_range, gmpnum_max, 1);
                }
 
-               mpz_add_ui(gmpnum_max, gmpnum_max, 1);
-               mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_max);
+               mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_range);
 
-               if (Z_LVAL_P(min_arg)) {
+               if (Z_LVAL_P(min_arg) != 0) {
                        mpz_add_ui(gmpnum_result, gmpnum_result, Z_LVAL_P(min_arg));
                }
 
+               mpz_clear(gmpnum_range);
                FREE_GMP_TEMP(temp_a);
-
-       }
-       else {
+       } else {
                FETCH_GMP_ZVAL_DEP(gmpnum_min, min_arg, temp_b, temp_a);
 
                if (mpz_cmp(gmpnum_max, gmpnum_min) <= 0) {
@@ -1885,12 +1887,14 @@ ZEND_FUNCTION(gmp_random_range)
                }
 
                INIT_GMP_RETVAL(gmpnum_result);
+               mpz_init(gmpnum_range);
 
-               mpz_sub(gmpnum_max, gmpnum_max, gmpnum_min);
-               mpz_add_ui(gmpnum_max, gmpnum_max, 1);
-               mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_max);
+               mpz_sub(gmpnum_range, gmpnum_max, gmpnum_min);
+               mpz_add_ui(gmpnum_range, gmpnum_range, 1);
+               mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_range);
                mpz_add(gmpnum_result, gmpnum_result, gmpnum_min);
 
+               mpz_clear(gmpnum_range);
                FREE_GMP_TEMP(temp_b);
                FREE_GMP_TEMP(temp_a);
        }

diff --git a/ext/gmp/tests/bug69803.phpt b/ext/gmp/tests/bug69803.phpt
new file mode 100644 (file)
index 0000000..e158cc5
--- /dev/null
+++ b/ext/gmp/tests/bug69803.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69803: gmp_random_range() modifies second parameter if GMP number
+--FILE--
+<?php
+
+$a = gmp_init(100);
+$b = gmp_init(200);
+echo $a . ", ", $b . "\n";
+gmp_random_range($a, $b);
+echo $a . ", ", $b . "\n";
+
+$b = gmp_init(200);
+echo $a . ", ", $b . "\n";
+gmp_random_range(100, $b);
+echo $a . ", ", $b . "\n";
+
+?>
+--EXPECT--
+100, 200
+100, 200
+100, 200
+100, 200

diff --git a/ext/gmp/tests/gmp_random_range.phpt b/ext/gmp/tests/gmp_random_range.phpt
index db2ece61c5386c4d322b573588d4390898ce1eb5..654ffbefb369a4d86cc1452e7e6a4c1678f7c9e4 100644 (file)
--- a/ext/gmp/tests/gmp_random_range.phpt
+++ b/ext/gmp/tests/gmp_random_range.phpt
@@ -5,8 +5,8 @@ gmp_random_range() basic tests
 --FILE--
 <?php
 
-$minusTen = gmp_init(-1);
-$plusTen = gmp_init(1);
+$minusTen = gmp_init(-10);
+$plusTen = gmp_init(10);
 $zero = gmp_init(0);
 
 var_dump(gmp_random_range());