Ilia Alshanetsky 1a428e528f Fix GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state (#21732) ...

The constructor rejects a seed that would leave the internal state
all zero, because xoshiro256** with zero state produces 0 on every
call forever. The unserialize callback didn't check the same
invariant. A caller feeding a crafted serialized payload through
__unserialize() ended up with a live engine that returned 0 from
every operation.

Match the constructor: reject the all-zero state from the unserialize
callback too. The Mt19937-aliased __unserialize() wrapper turns the
false return into the standard "Invalid serialization data" exception.

Closes GH-21731

2026-04-12 19:51:30 +02:00

..

tests

Fix GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state (#21732)

2026-04-12 19:51:30 +02:00

config.m4

Merge branch 'PHP-8.3'

2024-08-13 20:57:21 +01:00

config.w32

random: Remove engine_combinedlcg.c (#15216)

2024-08-04 18:26:15 +02:00

CREDITS

…

csprng.c

Merge branch 'PHP-8.3'

2024-08-13 20:57:21 +01:00

engine_mt19937.c

Fix GH-21730: Mt19937::__debugInfo() leaks state HashTable when the serialize callback fails (#21733)

2026-04-12 18:43:19 +02:00

engine_pcgoneseq128xslrr64.c

random: Add PHPAPI to all php_random_algo definitions (#14088)

2024-04-30 21:01:13 +02:00

engine_secure.c

random: Add PHPAPI to all php_random_algo definitions (#14088)

2024-04-30 21:01:13 +02:00

engine_user.c

Merge branch 'PHP-8.3' into PHP-8.4

2025-05-31 15:38:06 +02:00

engine_xoshiro256starstar.c

Fix GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state (#21732)

2026-04-12 19:51:30 +02:00

gammasection.c

random: Pass algorithm and state together as php_random_algo_with_state (#13350)

2024-02-25 20:48:58 +01:00

php_random_csprng.h

random: Make php_random_bytes() useable early during engine startup (#14291)

2024-05-30 17:24:34 +02:00

php_random_uint128.h

random: Split the uint128 implementation into its own header (#13132)

2024-01-17 16:07:45 +01:00

php_random_zend_utils.h

Add zend_random_bytes(), zend_random_bytes_insecure() functions (#14054)

2024-06-12 17:27:01 +02:00

php_random.h

random: Optimize Randomizer::getBytes() (#15228)

2024-08-05 19:12:29 +02:00

random_arginfo.h

Rename ZEND_STR_DEPRECATED to ZEND_STR_DEPRECATED_CAPITALIZED (#15831)

2024-09-10 22:45:23 +01:00

random.c

random: Remove engine_combinedlcg.c (#15216)

2024-08-04 18:26:15 +02:00

random.stub.php

random: Deprecate lcg_value() (#15211)

2024-08-04 18:24:21 +02:00

randomizer.c

Merge branch 'PHP-8.3' into PHP-8.4

2025-10-08 17:39:14 +02:00

zend_utils.c

Add zend_random_bytes(), zend_random_bytes_insecure() functions (#14054)

2024-06-12 17:27:01 +02:00