Fixed bug #46587 (mt_rand() does not check that max is greater than min).

diff --git a/NEWS b/NEWS
index c2c108e2e605ba0aa97781053b45f4553df7a871..4c9618bcb92f6ccb04de02255b1241679666d830 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,8 @@
     EXTR_OVERWRITE. (jorto at redhat dot com)
   . Fixed bug #47168 (printf of floating point variable prints maximum of 40 
     decimal places). (Ilia)
+  . Fixed bug #46587 (mt_rand() does not check that max is greater than min).
+    (Ilia)  
       
 - Intl extension:
   . Fixed crashes on invalid parameters in intl extension (Stas, Maksymilian

diff --git a/ext/standard/rand.c b/ext/standard/rand.c
index 4f1f18b2781b3f37525d00a22eb17d0b584faa83..eb26cc5c500c2a88fea7f4edc79f5cd9df7532de 100644 (file)
--- a/ext/standard/rand.c
+++ b/ext/standard/rand.c
@@ -322,6 +322,11 @@ PHP_FUNCTION(mt_rand)
                php_mt_srand(GENERATE_SEED() TSRMLS_CC);
        }
 
+       if (max < min) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "max(%d) is smaller than min(%d)", max, min);
+               RETURN_FALSE;
+       }
+
        /*
         * Melo: hmms.. randomMT() returns 32 random bits...
         * Yet, the previous php_rand only returns 31 at most.