agora inbox for pgsql-bugs@postgresql.org  

help / color / mirror / Atom feed

From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: 1950233439@qq.com
Subject: BUG #19670: Silent Integer Overflow in time_pl_interval() Returns Wrong Time Value
Date: Mon, 07 Sep 2026 14:06:53 +0000
Message-ID: <19670-c4e56832fa6686f8@postgresql.org> (raw)

The following bug has been logged on the website:

Bug reference:      19670
Logged by:          Tianyu Shi
Email address:      1950233439@qq.com
PostgreSQL version: 19beta3
Operating system:   Ubuntu22.04
Description:        

### Summary

`time_pl_interval()` in `src/backend/utils/adt/date.c` (lines 2174–2195)
silently produces incorrect results when adding a near-maximal interval to a
time value. The infinity guard (`INTERVAL_NOT_FINITE`) requires all three
interval fields to simultaneously hold their extreme values, so an interval
such as `'9223372036854 seconds'` (where `span->time = 9223372036854000000`,
slightly below `INT64_MAX`) bypasses the check entirely. The subsequent
unchecked addition `result = time + span->time` overflows signed 64-bit
integer arithmetic (C undefined behavior), returning a garbage `TimeADT`
with no error raised. Applications relying on correct time arithmetic for
security decisions — session expiry, scheduling windows, access-time
enforcement — may silently receive a corrupted value and act on it.

### PoC

Any authenticated database user can trigger the overflow with a single SQL
statement; no special privileges are required.

```sql
SELECT '23:59:59.999999'::time + interval '9223372036854 seconds';
```

To run against the local build:

```sql
-- Connect: ./build/bin/psql -h ./build/run -p 5432 postgres
SELECT
  '23:59:59.999999'::time + interval '9223372036854 seconds' AS
actual_result,
  make_time(0, 0, 0) + 24053999999::bigint * interval '1 microsecond' AS
expected_result,
  CASE
    WHEN ('23:59:59.999999'::time + interval '9223372036854 seconds') !=
         (make_time(0, 0, 0) + 24053999999::bigint * interval '1
microsecond')
    THEN 'MISMATCH: Integer overflow confirmed - result is WRONG'
    ELSE 'MATCH: No overflow detected'
  END AS verdict;
```

### Result

Expected output (correct modular arithmetic): `06:40:53.999999`.
Actual output observed: `19:59:04.448383` — an overflow-corrupted value
returned without any error or warning.

```
 actual_result  | expected_result |                        verdict
-----------------+-----------------+--------------------------------------------------------
 19:59:04.448383 | 06:40:53.999999 | MISMATCH: Integer overflow confirmed -
result is WRONG
```

The semantic invariant `(time + interval) mod USECS_PER_DAY` is violated. No
exception is raised, so callers cannot distinguish a correct result from a
corrupted one.

Message-ID: <19670-c4e56832fa6686f8@postgresql.org>
Permalink:  ../19670-c4e56832fa6686f8@postgresql.org/
Also on:    postgresql.org/message-id/19670-c4e56832fa6686f8@postgresql.org

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, 1950233439@qq.com
  Subject: Re: BUG #19670: Silent Integer Overflow in time_pl_interval() Returns Wrong Time Value
  In-Reply-To: <19670-c4e56832fa6686f8@postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox