On Mon, Jan 16, 2017 at 4:04 PM, Yasuo Ohgaki <yohg...@ohgaki.net>
wrote:
We know this kind of seed is guessable. i.e. Our session id is
compromised
by this kind of code.
Maybe you should fix session id instead of (or in addition to) mt_rand.
On 2017-01-16 09:16, Yasuo Ohgaki wrote:
Comments are appreciated.
Simply set BG(state)[0] to 0x80000000U and fill the rest with random.
That's practically like the MT reference implementation init_by_array.
See the attached patch. Feel free to commit.
--
Lauri Kenttä
From 696053c906c855242e1f95f3311f5db93c8f3723 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lauri=20Kentt=C3=A4?= <lauri.ken...@gmail.com>
Date: Mon, 16 Jan 2017 18:54:33 +0200
Subject: [PATCH] mt_rand: Seed with php_random_bytes
---
ext/standard/mt_rand.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/ext/standard/mt_rand.c b/ext/standard/mt_rand.c
index 0594ab24e1..cbfc3edece 100644
--- a/ext/standard/mt_rand.c
+++ b/ext/standard/mt_rand.c
@@ -27,6 +27,7 @@
#include "php.h"
#include "php_rand.h"
+#include "php_random.h"
#include "php_mt_rand.h"
/* MT RAND FUNCTIONS */
@@ -158,6 +159,17 @@ PHPAPI void php_mt_srand(uint32_t seed)
}
/* }}} */
+/* {{{ php_mt_srand_auto
+ */
+PHPAPI void php_mt_srand_auto(void)
+{
+ php_random_bytes_throw(BG(state)+1, sizeof(BG(state)[0]) * (N-1));
+ BG(state)[0] = 0x80000000U;
+ php_mt_reload();
+ BG(mt_rand_is_seeded) = 1;
+}
+/* }}} */
+
/* {{{ php_mt_rand
*/
PHPAPI uint32_t php_mt_rand(void)
@@ -168,7 +180,7 @@ PHPAPI uint32_t php_mt_rand(void)
register uint32_t s1;
if (UNEXPECTED(!BG(mt_rand_is_seeded))) {
- php_mt_srand(GENERATE_SEED());
+ php_mt_srand_auto();
}
if (BG(left) == 0) {
@@ -197,9 +209,6 @@ PHP_FUNCTION(mt_srand)
Z_PARAM_LONG(mode)
ZEND_PARSE_PARAMETERS_END();
- if (ZEND_NUM_ARGS() == 0)
- seed = GENERATE_SEED();
-
switch (mode) {
case MT_RAND_PHP:
BG(mt_rand_mode) = MT_RAND_PHP;
@@ -208,7 +217,10 @@ PHP_FUNCTION(mt_srand)
BG(mt_rand_mode) = MT_RAND_MT19937;
}
- php_mt_srand(seed);
+ if (ZEND_NUM_ARGS() == 0)
+ php_mt_srand_auto();
+ else
+ php_mt_srand(seed);
}
/* }}} */
--
2.11.0
--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php
