random.php

<?

if (!defined('RANDOM_COMPAT_READ_BUFFER')) {
    define('RANDOM_COMPAT_READ_BUFFER', 8);
}

function random_bytes($bytes)
{
    static $fp = null;
    /**
      * This block should only be run once
      */
    if (empty($fp)) {
        /**
          * We use /dev/random if it is a char device.
          */
        $fp = fopen('/dev/random', 'rb');
        if (!empty($fp)) {
            $st = fstat($fp);
            if (($st['mode'] & 0170000) !== 020000) {
                fclose($fp);
                $fp = false;
            }
        }

        if (!empty($fp)) {
            /**
              * stream_set_read_buffer() does not exist in HHVM
              *
              * If we don't set the stream's read buffer to 0, PHP will
              * internally buffer 8192 bytes, which can waste entropy
              *
              * stream_set_read_buffer returns 0 on success
              */
            if (is_callable('stream_set_read_buffer')) {
                stream_set_read_buffer($fp, RANDOM_COMPAT_READ_BUFFER);
            }
            if (is_callable('stream_set_chunk_size')) {
                stream_set_chunk_size($fp, RANDOM_COMPAT_READ_BUFFER);
            }
        }
    }

    try {
        $bytes = RandomCompat_intval($bytes);
    } catch (TypeError $ex) {
        throw new TypeError(
            'random_bytes(): $bytes must be an integer'
        );
    }

    if ($bytes < 1) {
        throw new Error(
            'Length must be greater than 0'
        );
    }

    /**
      * This if() block only runs if we managed to open a file handle
      *
      * It does not belong in an else {} block, because the above
      * if (empty($fp)) line is logic that should only be run once per
      * page load.
      */
    if (!empty($fp)) {
        /**
          * @var int
          */
        $remaining = $bytes;

        /**
          * @var string|bool
          */
        $buf = '';

        /**
          * We use fread() in a loop to protect against partial reads
          */
        do {
            /**
              * @var string|bool
              */
            $read = fread($fp, $remaining);
            if (!is_string($read)) {
                if ($read === false) {
                    /**
                      * We cannot safely read from the file. Exit the
                      * do-while loop and trigger the exception condition
                      *
                      * @var string|bool
                      */
                    $buf = false;
                    break;
                }
            }
            /**
              * Decrease the number of bytes returned from remaining
              */
            $remaining -= strlen($read);
            /**
              * @var string|bool
              */
            $buf = $buf . $read;
        } while ($remaining > 0);

        /**
          * Is our result valid?
          */
        if (is_string($buf)) {
            if (strlen($buf) === $bytes) {
                /**
                  * Return our random entropy buffer here:
                  */
                return $buf;
            }
        }
    }

    /**
      * If we reach here, PHP has failed us.
      */
    throw new Exception(
        'Error reading from source device'
      );
}

function RandomCompat_intval($number, $fail_open = false)
{
    if (is_int($number) || is_float($number)) {
        $number += 0;
    } elseif (is_numeric($number)) {
        $number += 0;
    }

    if (
        is_float($number)
        &&
        $number > ~PHP_INT_MAX
        &&
        $number < PHP_INT_MAX
    ) {
        $number = (int) $number;
    }

    if (is_int($number)) {
        return (int) $number;
    } elseif (!$fail_open) {
        throw new TypeError(
            'Expected an integer.'
        );
    }
    return $number;
}

function random_int($min, $max)
{
    /**
      * Type and input logic checks
      *
      * If you pass it a float in the range (~PHP_INT_MAX, PHP_INT_MAX)
      * (non-inclusive), it will sanely cast it to an int. If you it's equal to
      * ~PHP_INT_MAX or PHP_INT_MAX, we let it fail as not an integer. Floats
      * lose precision, so the <= and => operators might accidentally let a float
      * through.
      */

    try {
        $min = RandomCompat_intval($min);
    } catch (TypeError $ex) {
        throw new TypeError(
            'random_int(): $min must be an integer'
        );
    }

    try {
        $max = RandomCompat_intval($max);
    } catch (TypeError $ex) {
        throw new TypeError(
            'random_int(): $max must be an integer'
        );
    }

    /**
      * Now that we've verified our weak typing system has given us an integer,
      * let's validate the logic then we can move forward with generating random
      * integers along a given range.
      */
    if ($min > $max) {
        throw new Error(
            'Minimum value must be less than or equal to the maximum value'
        );
    }

    if ($max === $min) {
        return (int) $min;
    }

    /**
      * Initialize variables to 0
      *
      * We want to store:
      * $bytes => the number of random bytes we need
      * $mask => an integer bitmask (for use with the &) operator
      *          so we can minimize the number of discards
      */
    $attempts = $bits = $bytes = $mask = $valueShift = 0;

    /**
      * At this point, $range is a positive number greater than 0. It might
      * overflow, however, if $max - $min > PHP_INT_MAX. PHP will cast it to
      * a float and we will lose some precision.
      */
    $range = $max - $min;

    /**
      * Test for integer overflow:
      */
    if (!is_int($range)) {

        /**
          * Still safely calculate wider ranges.
          * Provided by @CodesInChaos, @oittaa
          *
          * @ref https://gist.github.com/CodesInChaos/03f9ea0b58e8b2b8d435
          *
          * We use ~0 as a mask in this case because it generates all 1s
          *
          * @ref https://eval.in/400356 (32-bit)
          * @ref http://3v4l.org/XX9r5  (64-bit)
          */
        $bytes = PHP_INT_SIZE;
        $mask = ~0;

    } else {

        /**
          * $bits is effectively ceil(log($range, 2)) without dealing with
          * type juggling
          */
        while ($range > 0) {
            if ($bits % 8 === 0) {
                ++$bytes;
            }
            ++$bits;
            $range >>= 1;
            $mask = $mask << 1 | 1;
        }
        $valueShift = $min;
    }

    $val = 0;
    /**
      * Now that we have our parameters set up, let's begin generating
      * random integers until one falls between $min and $max
      */
    do {
        /**
          * The rejection probability is at most 0.5, so this corresponds
          * to a failure probability of 2^-128 for a working RNG
          */
        if ($attempts > 128) {
            throw new Exception(
                'random_int: RNG is broken - too many rejections'
            );
        }

        /**
          * Let's grab the necessary number of random bytes
          */
        $randomByteString = random_bytes($bytes);

        /**
          * Let's turn $randomByteString into an integer
          *
          * This uses bitwise operators (<< and |) to build an integer
          * out of the values extracted from ord()
          *
          * Example: [9F] | [6D] | [32] | [0C] =>
          *   159 + 27904 + 3276800 + 201326592 =>
          *   204631455
          */
        $val &= 0;
        for ($i = 0; $i < $bytes; ++$i) {
            $val |= ord($randomByteString[$i]) << ($i * 8);
        }

        /**
          * Apply mask
          */
        $val &= $mask;
        $val += $valueShift;

        ++$attempts;
        /**
          * If $val overflows to a floating point number,
          * ... or is larger than $max,
          * ... or smaller than $min,
          * then try again.
          */
    } while (!is_int($val) || $val > $max || $val < $min);

    return (int) $val;
}

printf("Between 0 and 100: %d\n", random_int(0, 100));
printf("Between 45 and 50: %d\n", random_int(45, 50));
printf("Between 1e5 and 1e6: %d\n", random_int(1e5, 1e6));

?>

➜  ~ php random.php
Between 0 and 100: 46
Between 45 and 50: 50
Between 1e5 and 1e6: 823917