random: fix bound check ordering (CVE-2007-3105)