{"record":{"id":"97ab705b4e466cb5","repo":"paragonie/random_compat","slug":"length-must-be-greater-than-0-random-bytes-mcrypt","errorCode":null,"errorMessage":"Length must be greater than 0","messagePattern":"Length must be greater than 0","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"lib/random_bytes_mcrypt.php","lineNumber":54,"sourceCode":"     * @param int $bytes\n     *\n     * @throws Exception\n     *\n     * @return string\n     */\n    function random_bytes($bytes)\n    {\n        try {\n            /** @var int $bytes */\n            $bytes = RandomCompat_intval($bytes);\n        } catch (TypeError $ex) {\n            throw new TypeError(\n                'random_bytes(): $bytes must be an integer'\n            );\n        }\n\n        if ($bytes < 1) {\n            throw new Error(\n                'Length must be greater than 0'\n            );\n        }\n\n        /** @var string|bool $buf */\n        $buf = @mcrypt_create_iv((int) $bytes, (int) MCRYPT_DEV_URANDOM);\n        if (\n            is_string($buf)\n                &&\n            RandomCompat_strlen($buf) === $bytes\n        ) {\n            /**\n             * Return our random entropy buffer here:\n             */\n            return $buf;\n        }\n\n        /**","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/paragonie/random_compat/blob/b5d188cc9d5e02f94d2c41da23093f1ef557c5b1/lib/random_bytes_mcrypt.php#L36-L72","documentation":"The mcrypt-backed random_bytes() rejects integer arguments less than 1 with this Error, because generating zero or negative random bytes is meaningless. It mirrors PHP 7's built-in random_bytes() behavior for the polyfill.","triggerScenarios":"Calling random_bytes(0), random_bytes(-8), or a value that casts to <= 0 (e.g. null cast, 0.4 cast via the earlier intval step) on the mcrypt backend — the '$bytes < 1' check at lib/random_bytes_mcrypt.php:54 fires.","commonSituations":"Zero-length salt/IV requests from misconfigured lengths, off-by-one computations like strlen($x) - strlen($x), or defaults of 0 in config arrays.","solutions":["Validate before calling: reject lengths < 1 with a clear domain error.","Clamp with max(1, $length) when one byte minimum is acceptable.","Correct the upstream calculation that yields a non-positive length.","Enforce positive integer lengths at configuration load time."],"exampleFix":"// before\n$nonce = random_bytes($opts['nonce_len'] ?? 0);\n// after\n$len = (int) ($opts['nonce_len'] ?? 24);\nif ($len < 1) {\n    $len = 24;\n}\n$nonce = random_bytes($len);","handlingStrategy":"validation","validationCode":"$size = (int) $rawSize;\nif ($size < 1) {\n    throw new InvalidArgumentException('size must be >= 1');\n}","typeGuard":"null","tryCatchPattern":"try {\n    $buf = random_bytes($size);\n} catch (Error $e) {\n    throw new InvalidArgumentException('random_bytes() requires a length >= 1', 0, $e);\n}","preventionTips":["Clamp defaults to sane values (e.g. 16/24/32) instead of 0.","Validate config-driven lengths once at startup.","Add unit tests for zero and negative lengths.","Never derive lengths from arithmetic that can go non-positive without a check."],"tags":["php","argument-out-of-range","randomness","validation"],"backgroundTag":"argument-out-of-range","analyzedSha":"b5d188cc9d5e02f94d2c41da23093f1ef557c5b1","analyzedAt":"2026-09-13T16:12:09.755Z","contentChangedAt":"2026-09-13T16:12:09.755Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}