Repository: LadybirdBrowser/ladybird
File: AK/Random.cpp (C++)

Code before:
        // > flags and insufficient entropy was present in the random source or
        // > the system call was interrupted by a signal.
        //
        // > The user of getrandom() *must* always check the return value, to
        // > determine whether either an error occurred or fewer bytes than
        // > requested were returned.
        if (ret > 0) [[likely]] {
            size -= ret;
            buf += ret;
        }
    }
#elif defined(AK_OS_WINDOWS)
    if (size > NumericLimits<u32>::max()) [[unlikely]]
        return Error::from_string_literal("The input is too large");

    unsigned char* ptr = reinterpret_cast<unsigned char*>(const_cast<void*>(buf));
    NTSTATUS status = ::BCryptGenRandom(BCRYPT_RNG_ALG_HANDLE, ptr, size, 0);
    if (!NT_SUCCESS(status)) [[unlikely]] {
        ULONG error = RtlNtStatusToDosError(status);
        return Error::from_windows_error(error);
    }
#else
    // There shouldn't be a build target where this can happen.
    //
    // As for MacOS and iOS, they appear to both support arc4random_buf, and AK/Platform.h defines AK_OS_BSD_GENERIC when building for them,
    // so they will be covered by the compile target that uses arc4random_buf.
    //
    // Note that although [SecRandomCopyBytes](https://developer.apple.com/documentation/security/secrandomcopybytes(_:_:_:)) appears to be more commonly used on these platforms,
    // it doesn't seem to be required.
    static_assert(false, "This build target doesn't have a valid CSPRNG interface specified in AK/Random.cpp. This needs to be fixed before you can build for this target.");
#endif
    return {};
}

namespace AK {

void crypto_randombytes_buf(Bytes bytes)
{
    if (csprng(bytes.data(), bytes.size()).is_error())
        VERIFY_NOT_REACHED();
}

u32 crypto_random_uniform(u32 max_bounds)
{
    // If we try to divide all 2**32 numbers into groups of "max_bounds" numbers, we may end up
    // with a group around 2**32-1 that is a bit too small. For this reason, the implementation
    // `arc4random() % max_bounds` would be insufficient. Here we compute the last number of the
    // last "full group". Note that if max_bounds is a divisor of UINT32_MAX,
    // then we end up with UINT32_MAX:
    u32 const max_usable = UINT32_MAX - (static_cast<u64>(UINT32_MAX) + 1) % max_bounds;
    auto random_value = crypto_random<u32>();

Review comment (suggestion):
This note feels a bit out of place here. If you're worried that people might misunderstand the first `#if defined(..)`, add a comment there to explain it includes macOS and iOS.

Code after:
namespace AK {

void fill_with_random(Bytes bytes)
{
    MUST(csprng(bytes.data(), bytes.size()));
}

u32 get_random_uniform(u32 max_bounds)
{
    // If we try to divide all 2**32 numbers into groups of "max_bounds" numbers, we may end up
    // with a group around 2**32-1 that is a bit too small. For this reason, the implementation
    // `arc4random() % max_bounds` would be insufficient. Here we compute the last number of the
    // last "full group". Note that if max_bounds is a divisor of UINT32_MAX,
    // then we end up with UINT32_MAX:
    u32 const max_usable = UINT32_MAX - (static_cast<u64>(UINT32_MAX) + 1) % max_bounds;
    auto random_value = get_random<u32>();
    for (int i = 0; i < 20 && random_value > max_usable; ++i) {
        // By chance we picked a value from the incomplete group. Note that this group has size at
        // most 2**31-1, so picking this group has a chance of less than 50%.
        // In practice, this means that for the worst possible input, there is still only a
        // once-in-a-million chance to get to iteration 20. In theory we should be able to loop
        // forever. Here we prefer marginally imperfect random numbers over weird runtime behavior.
        random_value = get_random<u32>();
    }
    return random_value % max_bounds;
}

u64 get_random_uniform_64(u64 max_bounds)
{
    // Uses the same algorithm as `get_random_uniform`,
    // by replacing u64 with u128 and u32 with u64.
    u64 const max_usable = UINT64_MAX - static_cast<u64>((static_cast<u128>(UINT64_MAX) + 1) % max_bounds);
    auto random_value = get_random<u64>();
    for (int i = 0; i < 20 && random_value > max_usable; ++i) {
        random_value = get_random<u64>();
    }
    return random_value % max_bounds;
}

XorShift128PlusRNG::XorShift128PlusRNG()
{
    // Splitmix64 is used as xorshift is sensitive to being seeded with all 0s
    u64 seed = get_random<u64>();
    m_low = splitmix64(seed);
    seed = get_random<u64>();
    m_high = splitmix64(seed);
}

double XorShift128PlusRNG::get()
{
    u64 value = advance() & ((1ULL << 53) - 1);