From 71e5df660cfab3ec27a4af83c91b7db5b87348b8 Mon Sep 17 00:00:00 2001 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com> Date: Sat, 25 Mar 2023 23:10:27 +0100 Subject: [PATCH] Fix undefined behaviour in GENERATE_SEED() Signed multiply overflow is undefined behaviour. If you run the CI tests with UBSAN enabled on a 32-bit platform, this is quite easy to hit. On 64-bit it's more difficult to hit though, but not impossible. --- ext/standard/php_rand.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/standard/php_rand.h b/ext/standard/php_rand.h index e8018722772f7..b9ccb06ad4d09 100644 --- a/ext/standard/php_rand.h +++ b/ext/standard/php_rand.h @@ -61,9 +61,9 @@ (__n) = (__min) + (zend_long) ((double) ( (double) (__max) - (__min) + 1.0) * ((__n) / ((__tmax) + 1.0))) #ifdef PHP_WIN32 -#define GENERATE_SEED() (((zend_long) (time(0) * GetCurrentProcessId())) ^ ((zend_long) (1000000.0 * php_combined_lcg()))) +#define GENERATE_SEED() (((zend_long) ((zend_ulong) time(0) * (zend_ulong) GetCurrentProcessId())) ^ ((zend_long) (1000000.0 * php_combined_lcg()))) #else -#define GENERATE_SEED() (((zend_long) (time(0) * getpid())) ^ ((zend_long) (1000000.0 * php_combined_lcg()))) +#define GENERATE_SEED() (((zend_long) ((zend_ulong) time(0) * (zend_ulong) getpid())) ^ ((zend_long) (1000000.0 * php_combined_lcg()))) #endif PHPAPI void php_srand(zend_long seed);