From 1acf55eb752db482509d2f9c48443466f9a1bf68 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Thu, 11 Jun 2015 22:10:08 +0200
Subject: [PATCH] Fixed bug #69803

---
 NEWS                                |  4 ++++
 ext/gmp/gmp.c                       | 26 +++++++++++++++-----------
 ext/gmp/tests/bug69803.phpt         | 22 ++++++++++++++++++++++
 ext/gmp/tests/gmp_random_range.phpt |  4 ++--
 4 files changed, 43 insertions(+), 13 deletions(-)
 create mode 100644 ext/gmp/tests/bug69803.phpt

diff --git a/NEWS b/NEWS
index d66d82eebb..c5cf714196 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ PHP                                                                        NEWS
   . Fixed bug #69740 (finally in generator (yield) swallows exception in
     iteration). (Nikita)
 
+- GMP:
+  . Fixed bug #69803 (gmp_random_range() modifies second parameter if GMP
+    number). (Nikita)
+
 - PDO_pgsql:
   . Fixed bug #69752 (PDOStatement::execute() leaks memory with DML
     Statements when closeCuror() is u). (Philip Hofstetter)
diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp.c
index 6bc1d3ff16..575dab8a5b 100644
--- a/ext/gmp/gmp.c
+++ b/ext/gmp/gmp.c
@@ -1841,6 +1841,7 @@ ZEND_FUNCTION(gmp_random_range)
 {
 	zval *min_arg, *max_arg;
 	mpz_ptr gmpnum_min, gmpnum_max, gmpnum_result;
+	mpz_t gmpnum_range;
 	gmp_temp_t temp_a, temp_b;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zz", &min_arg, &max_arg) == FAILURE) {
@@ -1859,22 +1860,23 @@ ZEND_FUNCTION(gmp_random_range)
 		}
 
 		INIT_GMP_RETVAL(gmpnum_result);
+		mpz_init(gmpnum_range);
 
-		if (Z_LVAL_P(min_arg)) {
-			mpz_sub_ui(gmpnum_max, gmpnum_max, Z_LVAL_P(min_arg));
+		if (Z_LVAL_P(min_arg) != 0) {
+			mpz_sub_ui(gmpnum_range, gmpnum_max, Z_LVAL_P(min_arg) - 1);
+		} else {
+			mpz_add_ui(gmpnum_range, gmpnum_max, 1);
 		}
 
-		mpz_add_ui(gmpnum_max, gmpnum_max, 1);
-		mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_max);
+		mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_range);
 
-		if (Z_LVAL_P(min_arg)) {
+		if (Z_LVAL_P(min_arg) != 0) {
 			mpz_add_ui(gmpnum_result, gmpnum_result, Z_LVAL_P(min_arg));
 		}
 
+		mpz_clear(gmpnum_range);
 		FREE_GMP_TEMP(temp_a);
-
-	}
-	else {
+	} else {
 		FETCH_GMP_ZVAL_DEP(gmpnum_min, min_arg, temp_b, temp_a);
 
 		if (mpz_cmp(gmpnum_max, gmpnum_min) <= 0) {
@@ -1885,12 +1887,14 @@ ZEND_FUNCTION(gmp_random_range)
 		}
 
 		INIT_GMP_RETVAL(gmpnum_result);
+		mpz_init(gmpnum_range);
 
-		mpz_sub(gmpnum_max, gmpnum_max, gmpnum_min);
-		mpz_add_ui(gmpnum_max, gmpnum_max, 1);
-		mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_max);
+		mpz_sub(gmpnum_range, gmpnum_max, gmpnum_min);
+		mpz_add_ui(gmpnum_range, gmpnum_range, 1);
+		mpz_urandomm(gmpnum_result, GMPG(rand_state), gmpnum_range);
 		mpz_add(gmpnum_result, gmpnum_result, gmpnum_min);
 
+		mpz_clear(gmpnum_range);
 		FREE_GMP_TEMP(temp_b);
 		FREE_GMP_TEMP(temp_a);
 	}
diff --git a/ext/gmp/tests/bug69803.phpt b/ext/gmp/tests/bug69803.phpt
new file mode 100644
index 0000000000..e158cc5c0c
--- /dev/null
+++ b/ext/gmp/tests/bug69803.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69803: gmp_random_range() modifies second parameter if GMP number
+--FILE--
+<?php
+
+$a = gmp_init(100);
+$b = gmp_init(200);
+echo $a . ", ", $b . "\n";
+gmp_random_range($a, $b);
+echo $a . ", ", $b . "\n";
+
+$b = gmp_init(200);
+echo $a . ", ", $b . "\n";
+gmp_random_range(100, $b);
+echo $a . ", ", $b . "\n";
+
+?>
+--EXPECT--
+100, 200
+100, 200
+100, 200
+100, 200
diff --git a/ext/gmp/tests/gmp_random_range.phpt b/ext/gmp/tests/gmp_random_range.phpt
index db2ece61c5..654ffbefb3 100644
--- a/ext/gmp/tests/gmp_random_range.phpt
+++ b/ext/gmp/tests/gmp_random_range.phpt
@@ -5,8 +5,8 @@ gmp_random_range() basic tests
 --FILE--
 <?php
 
-$minusTen = gmp_init(-1);
-$plusTen = gmp_init(1);
+$minusTen = gmp_init(-10);
+$plusTen = gmp_init(10);
 $zero = gmp_init(0);
 
 var_dump(gmp_random_range());
-- 
2.40.0