Negative values in PcgOneseq128XslRr64::jump($advance)

php.internals

Anton Smirnov

4 years ago
Hi! I'm writing a polyfill for ext-random and I noticed a small weirdness. PcgOneseq128XslRr64::jump() accepts negative $advance where it automagically becomes unsigned positive. Does it make sense or maybe it's better to throw a ValueError there?
-- Anton

Tim Düsterhus

4 years ago
Hi On 7/31/22 17:50, Anton Smirnov wrote:
> I'm writing a polyfill for ext-random and I noticed a small weirdness. > PcgOneseq128XslRr64::jump() accepts negative $advance where it > automagically becomes unsigned positive.
Yes, this is what happens when casting a negative signed integer to an unsigned integer. It will wrap around to the maximum positive number minus whatever the negative value was.
> Does it make sense or maybe it's better to throw a ValueError there?
No it doesn't, especially since: $a = $pcg->generate(); $pcg->jump(-1); // jumps back 2^64 - 1 steps in a 64-bit system var_dump($pcg->generate() === $a); // bool(false) The PCG state is 128 Bits, so a negative jump does not work as expected and thus should throw. Would you mind filing an issue in the tracker, so that it can be properly referenced (and thus you properly credited for this find)? https://github.com/php/php-src/issues Best regards Tim Düsterhus

Anton Smirnov

4 years ago
On Sun, 2022-07-31 at 19:52 +0200, Tim Düsterhus wrote:
> Hi > > On 7/31/22 17:50, Anton Smirnov wrote: > > I'm writing a polyfill for ext-random and I noticed a small > > weirdness. > > PcgOneseq128XslRr64::jump() accepts negative $advance where it > > automagically becomes unsigned positive. > > Yes, this is what happens when casting a negative signed integer to > an > unsigned integer. It will wrap around to the maximum positive number > minus whatever the negative value was. > > > Does it make sense or maybe it's better to throw a ValueError > > there? > > No it doesn't, especially since: > > $a = $pcg->generate(); > $pcg->jump(-1); // jumps back 2^64 - 1 steps in a 64-bit system > var_dump($pcg->generate() === $a); // bool(false) > > The PCG state is 128 Bits, so a negative jump does not work as > expected > and thus should throw. > > Would you mind filing an issue in the tracker, so that it can be > properly referenced (and thus you properly credited for this find)? > > https://github.com/php/php-src/issues > > Best regards > Tim Düsterhus
Done, The issue: https://github.com/php/php-src/issues/9212 Proposed patch: https://github.com/php/php-src/pull/9213