Worked with Samy Kamkar to improve LCG entropy.

diff --git a/NEWS b/NEWS
index 044040594c06e2e7296d6565b62d4c8716fa3197..3385971c896acf4e459f1d3a5ed25c2c115cd7a5 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP                                                                        NEWS
 - Added missing host validation for HTTP urls inside FILTER_VALIDATE_URL.
   (Ilia)
 - Added stream_resolve_include_path(). (Mikko)
+- Improved LCG entropy (Rasmus, Samy Kamkar)
 
 - Fixed bug #50680 (strtotime() does not support eighth ordinal number).
   (Ilia)

diff --git a/ext/standard/lcg.c b/ext/standard/lcg.c
index ad9c4744f8b0c5dc05d7168002580d5368637168..aa0adff2fb8696b3bbf8a8a94ee7428bcfd0151f 100644 (file)
--- a/ext/standard/lcg.c
+++ b/ext/standard/lcg.c
@@ -78,7 +78,7 @@ static void lcg_seed(TSRMLS_D) /* {{{ */
        struct timeval tv;
 
        if (gettimeofday(&tv, NULL) == 0) {
-               LCG(s1) = tv.tv_sec ^ (~tv.tv_usec);
+               LCG(s1) = tv.tv_sec ^ (tv.tv_usec<<11);
        } else {
                LCG(s1) = 1;
        }
@@ -88,6 +88,11 @@ static void lcg_seed(TSRMLS_D) /* {{{ */
        LCG(s2) = (long) getpid();
 #endif
 
+       /* Add entropy to s2 by calling gettimeofday() again */
+       if (gettimeofday(&tv, NULL) == 0) {
+               LCG(s2) ^= (tv.tv_usec<<11);
+       }
+
        LCG(seeded) = 1;
 }
 /* }}} */