Fixed bug #75514 mt_rand returns value outside [$min,$max]+ on 32-bit

diff --git a/ext/standard/mt_rand.c b/ext/standard/mt_rand.c
index 0e2fe5143a2e8a0b595cadb94e98efda7c851557..0a76ab8282818b3a98eff5d20a85678a8b93450e 100644 (file)
--- a/ext/standard/mt_rand.c
+++ b/ext/standard/mt_rand.c
@@ -260,7 +260,7 @@ PHPAPI zend_long php_mt_rand_range(zend_long min, zend_long max)
  * rand() allows min > max, mt_rand does not */
 PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max)
 {
-       zend_long n;
+       uint32_t n;
 
        if (BG(mt_rand_mode) == MT_RAND_MT19937) {
                return php_mt_rand_range(min, max);
@@ -268,7 +268,7 @@ PHPAPI zend_long php_mt_rand_common(zend_long min, zend_long max)
 
        /* Legacy mode deliberately not inside php_mt_rand_range()
         * to prevent other functions being affected */
-       n = (zend_long)php_mt_rand() >> 1;
+       n = php_mt_rand() >> 1;
        RAND_RANGE_BADSCALING(n, min, max, PHP_MT_RAND_MAX);
 
        return n;

diff --git a/ext/standard/tests/math/bug75514.phpt b/ext/standard/tests/math/bug75514.phpt
new file mode 100644 (file)
index 0000000..af97b6d
--- /dev/null
+++ b/ext/standard/tests/math/bug75514.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #75514 mt_rand returns value outside [$min,$max]
+--FILE--
+<?php
+mt_srand(0, MT_RAND_PHP);
+var_dump(mt_rand(0,999999999), mt_rand(0,999));
+?>
+===Done===
+--EXPECT--
+int(448865905)
+int(592)
+===Done===