Update Random_Compat from 1.1.6 to 1.2.1.

Changes: https://github.com/paragonie/random_compat/compare/1.1.6...v1.2.1

See #35665.

git-svn-id: https://develop.svn.wordpress.org/trunk@36886 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/random_compat/byte_safe_strings.php

@@ -50,8 +50,10 @@ if (!function_exists('RandomCompat_strlen')) {
                     'RandomCompat_strlen() expects a string'
                 );
             }
+
             return mb_strlen($binary_string, '8bit');
         }
+
     } else {
         /**
          * strlen() implementation that isn't brittle to mbstring.func_overload
@@ -77,8 +79,10 @@ if (!function_exists('RandomCompat_strlen')) {
 }
 
 if (!function_exists('RandomCompat_substr')) {
+
     if (
-        defined('MB_OVERLOAD_STRING') &&
+        defined('MB_OVERLOAD_STRING')
+        &&
         ini_get('mbstring.func_overload') & MB_OVERLOAD_STRING
     ) {
         /**
@@ -102,11 +106,13 @@ if (!function_exists('RandomCompat_substr')) {
                     'RandomCompat_substr(): First argument should be a string'
                 );
             }
+
             if (!is_int($start)) {
                 throw new TypeError(
                     'RandomCompat_substr(): Second argument should be an integer'
                 );
             }
+
             if ($length === null) {
                 /**
                  * mb_substr($str, 0, NULL, '8bit') returns an empty string on
@@ -118,9 +124,12 @@ if (!function_exists('RandomCompat_substr')) {
                     'RandomCompat_substr(): Third argument should be an integer, or omitted'
                 );
             }
+
             return mb_substr($binary_string, $start, $length, '8bit');
         }
+
     } else {
+
         /**
          * substr() implementation that isn't brittle to mbstring.func_overload
          *
@@ -141,19 +150,23 @@ if (!function_exists('RandomCompat_substr')) {
                     'RandomCompat_substr(): First argument should be a string'
                 );
             }
+
             if (!is_int($start)) {
                 throw new TypeError(
                     'RandomCompat_substr(): Second argument should be an integer'
                 );
             }
+
             if ($length !== null) {
                 if (!is_int($length)) {
                     throw new TypeError(
                         'RandomCompat_substr(): Third argument should be an integer, or omitted'
                     );
                 }
+
                 return substr($binary_string, $start, $length);
             }
+
             return substr($binary_string, $start);
         }
     }

src/wp-includes/random_compat/cast_to_int.php

@@ -37,26 +37,33 @@ if (!function_exists('RandomCompat_intval')) {
      * lose precision, so the <= and => operators might accidentally let a float
      * through.
      * 
-     * @param numeric $number The number we want to convert to an int
+     * @param int|float $number    The number we want to convert to an int
-     * @param boolean $fail_open Set to true to not throw an exception
+     * @param boolean   $fail_open Set to true to not throw an exception
      * 
      * @return int (or float if $fail_open)
+     *
+     * @throws TypeError
      */
     function RandomCompat_intval($number, $fail_open = false)
     {
         if (is_numeric($number)) {
             $number += 0;
         }
+
         if (
-            is_float($number) &&
+            is_float($number)
-            $number > ~PHP_INT_MAX &&
+            &&
+            $number > ~PHP_INT_MAX
+            &&
             $number < PHP_INT_MAX
         ) {
             $number = (int) $number;
         }
+
         if (is_int($number) || $fail_open) {
             return $number;
         }
+
         throw new TypeError(
             'Expected an integer.'
         );

src/wp-includes/random_compat/random.php

@@ -1,22 +1,25 @@
 <?php
 /**
- * Random_* Compatibility Library 
+ * Random_* Compatibility Library
  * for using the new PHP 7 random_* API in PHP 5 projects
- * 
+ *
+ * @version 1.2.1
+ * @released 2016-02-29
+ *
  * The MIT License (MIT)
- * 
+ *
  * Copyright (c) 2015 Paragon Initiative Enterprises
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  * copies of the Software, and to permit persons to whom the Software is
  * furnished to do so, subject to the following conditions:
- * 
+ *
  * The above copyright notice and this permission notice shall be included in
  * all copies or substantial portions of the Software.
- * 
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
@@ -29,31 +32,41 @@
 if (!defined('PHP_VERSION_ID')) {
     // This constant was introduced in PHP 5.2.7
     $RandomCompatversion = explode('.', PHP_VERSION);
-    define('PHP_VERSION_ID', ($RandomCompatversion[0] * 10000 + $RandomCompatversion[1] * 100 + $RandomCompatversion[2]));
+    define(
+        'PHP_VERSION_ID',
+        $RandomCompatversion[0] * 10000
+        + $RandomCompatversion[1] * 100
+        + $RandomCompatversion[2]
+    );
     $RandomCompatversion = null;
 }
+
 if (PHP_VERSION_ID < 70000) {
+
     if (!defined('RANDOM_COMPAT_READ_BUFFER')) {
         define('RANDOM_COMPAT_READ_BUFFER', 8);
     }
+
     $RandomCompatDIR = dirname(__FILE__);
+
     require_once $RandomCompatDIR.'/byte_safe_strings.php';
     require_once $RandomCompatDIR.'/cast_to_int.php';
     require_once $RandomCompatDIR.'/error_polyfill.php';
+
     if (!function_exists('random_bytes')) {
         /**
          * PHP 5.2.0 - 5.6.x way to implement random_bytes()
-         * 
+         *
          * We use conditional statements here to define the function in accordance
          * to the operating environment. It's a micro-optimization.
-         * 
+         *
          * In order of preference:
          *   1. Use libsodium if available.
          *   2. fread() /dev/urandom if available (never on Windows)
          *   3. mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM)
          *   4. COM('CAPICOM.Utilities.1')->GetRandom()
          *   5. openssl_random_pseudo_bytes() (absolute last resort)
-         * 
+         *
          * See ERRATA.md for our reasoning behind this particular order
          */
         if (extension_loaded('libsodium')) {
@@ -64,6 +77,7 @@ if (PHP_VERSION_ID < 70000) {
                 require_once $RandomCompatDIR.'/random_bytes_libsodium_legacy.php';
             }
         }
+
         /**
          * Reading directly from /dev/urandom:
          */
@@ -72,6 +86,7 @@ if (PHP_VERSION_ID < 70000) {
             // way to exclude Windows.
             $RandomCompatUrandom = true;
             $RandomCompat_basedir = ini_get('open_basedir');
+
             if (!empty($RandomCompat_basedir)) {
                 $RandomCompat_open_basedir = explode(
                     PATH_SEPARATOR,
@@ -83,46 +98,61 @@ if (PHP_VERSION_ID < 70000) {
                 );
                 $RandomCompat_open_basedir = null;
             }
+
             if (
-                !function_exists('random_bytes') && 
+                !function_exists('random_bytes')
-                $RandomCompatUrandom &&
+                &&
+                $RandomCompatUrandom
+                &&
                 @is_readable('/dev/urandom')
             ) {
                 // Error suppression on is_readable() in case of an open_basedir
                 // or safe_mode failure. All we care about is whether or not we
-                // can read it at this point. If the PHP environment is going to 
+                // can read it at this point. If the PHP environment is going to
-                // panic over trying to see if the file can be read in the first 
+                // panic over trying to see if the file can be read in the first
                 // place, that is not helpful to us here.
 
                 // See random_bytes_dev_urandom.php
                 require_once $RandomCompatDIR.'/random_bytes_dev_urandom.php';
             }
             // Unset variables after use
-            $RandomCompatUrandom = null;
             $RandomCompat_basedir = null;
+            $RandomCompatUrandom = null;
         }
-        
+
         /**
          * mcrypt_create_iv()
          */
         if (
-            !function_exists('random_bytes') &&
+            !function_exists('random_bytes')
-            PHP_VERSION_ID >= 50307 &&
+            &&
+            PHP_VERSION_ID >= 50307
+            &&
             extension_loaded('mcrypt')
         ) {
-            // See random_bytes_mcrypt.php
+            // Prevent this code from hanging indefinitely on non-Windows;
-            require_once $RandomCompatDIR.'/random_bytes_mcrypt.php';
+            // see https://bugs.php.net/bug.php?id=69833
+            if (
+                DIRECTORY_SEPARATOR !== '/' ||
+                (PHP_VERSION_ID <= 50609 || PHP_VERSION_ID >= 50613)
+            ) {
+                // See random_bytes_mcrypt.php
+                require_once $RandomCompatDIR.'/random_bytes_mcrypt.php';
+            }
         }
+
         if (
-            !function_exists('random_bytes') && 
+            !function_exists('random_bytes')
-            extension_loaded('com_dotnet') &&
+            &&
+            extension_loaded('com_dotnet')
+            &&
             class_exists('COM')
         ) {
             $RandomCompat_disabled_classes = preg_split(
-                '#\s*,\s*#', 
+                '#\s*,\s*#',
                 strtolower(ini_get('disable_classes'))
             );
-            
+
             if (!in_array('com', $RandomCompat_disabled_classes)) {
                 try {
                     $RandomCompatCOMtest = new COM('CAPICOM.Utilities.1');
@@ -137,27 +167,31 @@ if (PHP_VERSION_ID < 70000) {
             $RandomCompat_disabled_classes = null;
             $RandomCompatCOMtest = null;
         }
-        
+
         /**
          * openssl_random_pseudo_bytes()
          */
         if (
-            !function_exists('random_bytes') && 
-            extension_loaded('openssl') &&
             (
                 // Unix-like with PHP >= 5.3.0 or
                 (
-                    DIRECTORY_SEPARATOR === '/' &&
+                    DIRECTORY_SEPARATOR === '/'
+                    &&
                     PHP_VERSION_ID >= 50300
-                ) ||
+                )
+                ||
                 // Windows with PHP >= 5.4.1
                 PHP_VERSION_ID >= 50401
             )
+            &&
+            !function_exists('random_bytes')
+            &&
+            extension_loaded('openssl')
         ) {
             // See random_bytes_openssl.php
             require_once $RandomCompatDIR.'/random_bytes_openssl.php';
         }
-        
+
         /**
          * throw new Exception
          */
@@ -174,8 +208,10 @@ if (PHP_VERSION_ID < 70000) {
             }
         }
     }
+
     if (!function_exists('random_int')) {
         require_once $RandomCompatDIR.'/random_int.php';
     }
+
     $RandomCompatDIR = null;
 }

src/wp-includes/random_compat/random_bytes_com_dotnet.php

@@ -46,14 +46,17 @@ function random_bytes($bytes)
             'random_bytes(): $bytes must be an integer'
         );
     }
+
     if ($bytes < 1) {
         throw new Error(
             'Length must be greater than 0'
         );
     }
+
     $buf = '';
     $util = new COM('CAPICOM.Utilities.1');
     $execCount = 0;
+
     /**
      * Let's not let it loop forever. If we run N times and fail to
      * get N bytes of random data, then CAPICOM has failed us.
@@ -68,6 +71,7 @@ function random_bytes($bytes)
         }
         ++$execCount; 
     } while ($execCount < $bytes);
+
     /**
      * If we reach here, PHP has failed us.
      */

src/wp-includes/random_compat/random_bytes_dev_urandom.php

@@ -62,6 +62,7 @@ function random_bytes($bytes)
                 $fp = false;
             }
         }
+
         if (!empty($fp)) {
             /**
              * stream_set_read_buffer() does not exist in HHVM
@@ -79,6 +80,7 @@ function random_bytes($bytes)
             }
         }
     }
+
     try {
         $bytes = RandomCompat_intval($bytes);
     } catch (TypeError $ex) {
@@ -86,11 +88,13 @@ function random_bytes($bytes)
             'random_bytes(): $bytes must be an integer'
         );
     }
+
     if ($bytes < 1) {
         throw new Error(
             'Length must be greater than 0'
         );
     }
+
     /**
      * This if() block only runs if we managed to open a file handle
      * 
@@ -101,6 +105,7 @@ function random_bytes($bytes)
     if (!empty($fp)) {
         $remaining = $bytes;
         $buf = '';
+
         /**
          * We use fread() in a loop to protect against partial reads
          */
@@ -133,6 +138,7 @@ function random_bytes($bytes)
             }
         }
     }
+
     /**
      * If we reach here, PHP has failed us.
      */

src/wp-includes/random_compat/random_bytes_libsodium.php

@@ -48,11 +48,13 @@ function random_bytes($bytes)
             'random_bytes(): $bytes must be an integer'
         );
     }
+
     if ($bytes < 1) {
         throw new Error(
             'Length must be greater than 0'
         );
     }
+
     /**
      * \Sodium\randombytes_buf() doesn't allow more than 2147483647 bytes to be
      * generated in one invocation.

src/wp-includes/random_compat/random_bytes_libsodium_legacy.php

@@ -48,11 +48,13 @@ function random_bytes($bytes)
             'random_bytes(): $bytes must be an integer'
         );
     }
+
     if ($bytes < 1) {
         throw new Error(
             'Length must be greater than 0'
         );
     }
+
     /**
      * \Sodium\randombytes_buf() doesn't allow more than 2147483647 bytes to be
      * generated in one invocation.

src/wp-includes/random_compat/random_bytes_mcrypt.php

@@ -48,6 +48,7 @@ function random_bytes($bytes)
             'random_bytes(): $bytes must be an integer'
         );
     }
+
     if ($bytes < 1) {
         throw new Error(
             'Length must be greater than 0'
@@ -55,14 +56,17 @@ function random_bytes($bytes)
     }
 
     $buf = @mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM);
-    if ($buf !== false) {
+    if (
-        if (RandomCompat_strlen($buf) === $bytes) {
+        $buf !== false
-            /**
+        &&
-             * Return our random entropy buffer here:
+        RandomCompat_strlen($buf) === $bytes
-             */
+    ) {
-            return $buf;
+        /**
-        }
+         * Return our random entropy buffer here:
+         */
+        return $buf;
     }
+
     /**
      * If we reach here, PHP has failed us.
      */

src/wp-includes/random_compat/random_bytes_openssl.php

@@ -48,12 +48,13 @@ function random_bytes($bytes)
             'random_bytes(): $bytes must be an integer'
         );
     }
+
     if ($bytes < 1) {
         throw new Error(
             'Length must be greater than 0'
         );
     }
-    $secure = true;
+
     /**
      * $secure is passed by reference. If it's set to false, fail. Note
      * that this will only return false if this function fails to return
@@ -61,12 +62,18 @@ function random_bytes($bytes)
      * 
      * @ref https://github.com/paragonie/random_compat/issues/6#issuecomment-119564973
      */
+    $secure = true;
     $buf = openssl_random_pseudo_bytes($bytes, $secure);
-    if ($buf !== false && $secure) {
+    if (
-        if (RandomCompat_strlen($buf) === $bytes) {
+        $buf !== false
-            return $buf;
+        &&
-        }
+        $secure
+        &&
+        RandomCompat_strlen($buf) === $bytes
+    ) {
+        return $buf;
     }
+
     /**
      * If we reach here, PHP has failed us.
      */

src/wp-includes/random_compat/random_int.php

@@ -55,6 +55,7 @@ function random_int($min, $max)
             'random_int(): $min must be an integer'
         );
     }
+
     try {
         $max = RandomCompat_intval($max);
     } catch (TypeError $ex) {
@@ -73,6 +74,7 @@ function random_int($min, $max)
             'Minimum value must be less than or equal to the maximum value'
         );
     }
+
     if ($max === $min) {
         return $min;
     }
@@ -98,6 +100,7 @@ function random_int($min, $max)
      * Test for integer overflow:
      */
     if (!is_int($range)) {
+
         /**
          * Still safely calculate wider ranges.
          * Provided by @CodesInChaos, @oittaa
@@ -111,7 +114,9 @@ function random_int($min, $max)
          */
         $bytes = PHP_INT_SIZE;
         $mask = ~0;
+
     } else {
+
         /**
          * $bits is effectively ceil(log($range, 2)) without dealing with 
          * type juggling
@@ -181,5 +186,6 @@ function random_int($min, $max)
          * then try again.
          */
     } while (!is_int($val) || $val > $max || $val < $min);
+
     return (int) $val;
 }