File 9101-Fix-rand-shuffle-1-bitstream-mask-bug-for-weak-low-b.patch of Package erlang
From 65e3f1ccf797da36af395c0fe7f8fd0911aca07f Mon Sep 17 00:00:00 2001
From: Raimo Niskanen <raimo@erlang.org>
Date: Tue, 13 Jan 2026 15:12:36 +0100
Subject: [PATCH] Fix rand:shuffle/1 bitstream mask bug for weak low bits
A generator with weak low bits and less than 58 good bits
would get zero bits just under the top bit in
rand:shuffle_new_bits/1, which could cause exploitable
non-randomness in the shuffle algorithm.
---
lib/stdlib/src/rand.erl | 5 +++--
lib/stdlib/test/rand_SUITE.erl | 8 ++++----
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/lib/stdlib/src/rand.erl b/lib/stdlib/src/rand.erl
index 4ffd09d267..e85d778c8f 100644
--- a/lib/stdlib/src/rand.erl
+++ b/lib/stdlib/src/rand.erl
@@ -2086,7 +2086,8 @@ shuffle_init_bitstream(R, #{max:=Mask, next:=Next}) ->
%%
-dialyzer({no_improper_lists, shuffle_init_bitstream/4}).
shuffle_init_bitstream(R, Next, Shift, Mask0) ->
- Mask = ?MASK(58, Mask0), % Limit the mask to avoid bignum
+ Mask1 = Mask0 bsr Shift, % Adjust mask for weak low bits
+ Mask = ?MASK(58, Mask1), % Limit the mask to avoid bignum
P = 1, % Marker for out of random bits
W = {Next,Shift,Mask}, % Generator
S = [R|W], % Generator state
diff --git a/lib/stdlib/test/rand_SUITE.erl b/lib/stdlib/test/rand_SUITE.erl
index 09aec8305a..27fa5fe513 100644
--- a/lib/stdlib/test/rand_SUITE.erl
+++ b/lib/stdlib/test/rand_SUITE.erl
@@ -442,11 +442,11 @@ shuffle_reference(Config) when is_list(Config) ->
{exro928ss,
<<160,170,223,95,44,254,192,107,145,180,236,235,102,110,72,131>>},
{exrop,
- <<175,236,222,199,129,54,205,86,81,38,92,219,66,71,30,69>>},
+ <<35,166,181,166,83,202,211,92,67,175,87,98,47,232,79,14>>},
{exs1024s,
<<148,169,164,28,198,202,108,206,123,68,189,26,116,210,82,116>>},
{exsp,
- <<63,163,228,59,249,88,205,251,225,174,227,65,144,130,169,191>>}],
+ <<100,211,162,22,155,200,132,240,228,124,245,32,229,53,223,183>>}],
[shuffle_reference(M, List, Seed, Alg, MD5) || {Alg, MD5} <- Ref],
ok.
--
2.51.0
