agora inbox for pgsql-bugs@postgresql.org
help / color / mirror / Atom feedBUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
6+ messages / 4 participants
[nested] [flat]
* BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
@ 2026-09-07 14:09 PG Bug reporting form <noreply@postgresql.org>
2026-09-10 12:42 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: PG Bug reporting form @ 2026-09-07 14:09 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: 1950233439@qq.com
The following bug has been logged on the website:
Bug reference: 19671
Logged by: Tianyu Shi
Email address: 1950233439@qq.com
PostgreSQL version: 19beta3
Operating system: Ubuntu22.04
Description:
### Summary
In `src/backend/utils/adt/inet_net_pton.c`, both `inet_cidr_pton_ipv4()`
(lines 177–188) and `inet_net_pton_ipv4()` (lines 296–308) accumulate the
CIDR prefix length digit-by-digit with no per-digit overflow guard, allowing
a 32-bit signed `int bits` to wrap silently on inputs such as `4294967297`
(2³²+1 → 1). The post-loop check `if (bits > 32) goto emsgsize` then sees
the wrapped value and passes it, causing any non-privileged SQL user to
store `inet`/`cidr` values with silently corrupted prefix lengths. An
attacker who can INSERT into a table with an `inet`/`cidr` column, or supply
a cast literal, can produce entries whose stored masklen differs arbitrarily
from what was written, potentially bypassing application-layer ACL logic
built on PostgreSQL subnet-containment operators.
### PoC
No superuser required; any user able to execute a `SELECT` or `INSERT` with
an `inet`/`cidr` cast is sufficient.
```sql
\set ON_ERROR_STOP off
-- Test 1: inet cast — 4294967297 = 2^32+1 wraps to 1; should ERROR but does
not
SELECT masklen('1.2.3.4/4294967297'::inet) AS actual_masklen;
-- Observed: 1 Expected: ERROR
-- Test 2: cidr cast — 4294967296 = 2^32 wraps to 0; should ERROR but does
not
SELECT masklen('0.0.0.0/4294967296'::cidr) AS actual_masklen;
-- Observed: 0 Expected: ERROR
-- Control: legitimate out-of-range /33 is correctly rejected
SELECT masklen('1.2.3.4/33'::inet) AS should_error;
-- Observed: ERROR: invalid input syntax for type inet: "1.2.3.4/33"
-- Stored value demonstration
SELECT host('1.2.3.4/4294967297'::inet) AS inet_host,
masklen('1.2.3.4/4294967297'::inet) AS inet_masklen_actual,
1 AS inet_masklen_expected;
-- Returns: 1.2.3.4 | 1 | 1 (value accepted and stored with wrong prefix)
```
### Result
- `'1.2.3.4/4294967297'::inet` — expected `ERROR: invalid mask length`;
actual `masklen() = 1` (2³²+1 wraps to 1, bypass confirmed).
- `'0.0.0.0/4294967296'::cidr` — expected `ERROR: invalid mask length`;
actual `masklen() = 0` (2³² wraps to 0, bypass confirmed).
- `'1.2.3.4/33'::inet` — correctly raises `ERROR: invalid input syntax for
type inet: "1.2.3.4/33"` (normal in-range bound check works).
The asymmetry demonstrates that only the integer-overflow path escapes
validation: overflowing prefix literals are silently accepted and stored
with a wrong (wrapped) prefix length, while a straightforward out-of-range
value is rejected. Any application relying on `<<` / `<<=` subnet
comparisons against stored `inet`/`cidr` values is exposed to logic bypass
via entries whose effective mask is broader than intended.
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
2026-09-07 14:09 BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts PG Bug reporting form <noreply@postgresql.org>
@ 2026-09-10 12:42 ` Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-09-10 16:58 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 6+ messages in thread
From: Andrey Rachitskiy @ 2026-09-10 12:42 UTC (permalink / raw)
To: 1950233439@qq.com; pgsql-bugs@lists.postgresql.org
чт, 10 сент. 2026 г. в 17:11, PG Bug reporting form <noreply@postgresql.org
>:
> The following bug has been logged on the website:
>
> Bug reference: 19671
> Logged by: Tianyu Shi
> Email address: 1950233439@qq.com
> PostgreSQL version: 19beta3
> Operating system: Ubuntu22.04
> Description:
>
> ### Summary
>
> In `src/backend/utils/adt/inet_net_pton.c`, both `inet_cidr_pton_ipv4()`
> (lines 177–188) and `inet_net_pton_ipv4()` (lines 296–308) accumulate the
> CIDR prefix length digit-by-digit with no per-digit overflow guard,
> allowing
> a 32-bit signed `int bits` to wrap silently on inputs such as `4294967297`
> (2³²+1 → 1). The post-loop check `if (bits > 32) goto emsgsize` then sees
> the wrapped value and passes it, causing any non-privileged SQL user to
> store `inet`/`cidr` values with silently corrupted prefix lengths. An
> attacker who can INSERT into a table with an `inet`/`cidr` column, or
> supply
> a cast literal, can produce entries whose stored masklen differs
> arbitrarily
> from what was written, potentially bypassing application-layer ACL logic
> built on PostgreSQL subnet-containment operators.
>
> ### PoC
>
> No superuser required; any user able to execute a `SELECT` or `INSERT` with
> an `inet`/`cidr` cast is sufficient.
>
> ```sql
> \set ON_ERROR_STOP off
>
> -- Test 1: inet cast — 4294967297 = 2^32+1 wraps to 1; should ERROR but
> does
> not
> SELECT masklen('1.2.3.4/4294967297'::inet) AS actual_masklen;
> -- Observed: 1 Expected: ERROR
>
> -- Test 2: cidr cast — 4294967296 = 2^32 wraps to 0; should ERROR but does
> not
> SELECT masklen('0.0.0.0/4294967296'::cidr) AS actual_masklen;
> -- Observed: 0 Expected: ERROR
>
> -- Control: legitimate out-of-range /33 is correctly rejected
> SELECT masklen('1.2.3.4/33'::inet) AS should_error;
> -- Observed: ERROR: invalid input syntax for type inet: "1.2.3.4/33"
>
> -- Stored value demonstration
> SELECT host('1.2.3.4/4294967297'::inet) AS inet_host,
> masklen('1.2.3.4/4294967297'::inet) AS inet_masklen_actual,
> 1 AS inet_masklen_expected;
> -- Returns: 1.2.3.4 | 1 | 1 (value accepted and stored with wrong prefix)
> ```
>
> ### Result
>
> - `'1.2.3.4/4294967297'::inet` <http://1.2.3.4/4294967297'::inet; —
> expected `ERROR: invalid mask length`;
> actual `masklen() = 1` (2³²+1 wraps to 1, bypass confirmed).
> - `'0.0.0.0/4294967296'::cidr` <http://0.0.0.0/4294967296'::cidr; —
> expected `ERROR: invalid mask length`;
> actual `masklen() = 0` (2³² wraps to 0, bypass confirmed).
> - `'1.2.3.4/33'::inet` <http://1.2.3.4/33'::inet; — correctly raises
> `ERROR: invalid input syntax for
> type inet: "1.2.3.4/33"` (normal in-range bound check works).
>
> The asymmetry demonstrates that only the integer-overflow path escapes
> validation: overflowing prefix literals are silently accepted and stored
> with a wrong (wrapped) prefix length, while a straightforward out-of-range
> value is rejected. Any application relying on `<<` / `<<=` subnet
> comparisons against stored `inet`/`cidr` values is exposed to logic bypass
> via entries whose effective mask is broader than intended.
>
>
>
>
>
Hi!
Thnx for the report.
I've already encountered this problem, I just never got around to making a
report.
Fix in attachment.
Attachments:
[text/x-patch] 0001-Fix-IPv4-CIDR-prefix-length-overflow-in-inet_net_pto.patch (10.2K, ../../CAB8bMitHLMbrhLkyFHFogAV-W433Db2wrGz80Gmk50Fbcm8JnQ@mail.gmail.com/3-0001-Fix-IPv4-CIDR-prefix-length-overflow-in-inet_net_pto.patch)
download | inline diff:
From c42c29f590de6b13703d4566cd02fdde290d426d Mon Sep 17 00:00:00 2001
From: Andrey Rachitskiy <pl0h0yp1@gmail.com>
Date: Tue, 1 Sep 2026 23:40:15 +0500
Subject: [PATCH] Fix IPv4 CIDR prefix-length overflow in inet_net_pton.
Parsing /NNN for IPv4 inet and cidr accumulated digits in an int
without a per-step range check. A long digit string could overflow
to -1, pass the bits > 32 test, and fall through to classful
inference as if no prefix had been given.
Use getbits() with an explicit max prefix length (32 for IPv4, 128
for IPv6) in both inet_cidr_pton_ipv4() and inet_net_pton_ipv4().
RFC 4632 requires the suffix to be a decimal value between 0 and 32.
Bug: #19671
Reported-by: Tianyu Shi <1950233439@qq.com>
Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
---
src/backend/utils/adt/inet_net_pton.c | 115 ++++++++++++++++------------------
src/test/regress/expected/inet.out | 9 +++
src/test/regress/sql/inet.sql | 5 ++
3 files changed, 68 insertions(+), 61 deletions(-)
diff --git a/src/backend/utils/adt/inet_net_pton.c b/src/backend/utils/adt/inet_net_pton.c
index 3b0db2a3799..f679722f849 100644
--- a/src/backend/utils/adt/inet_net_pton.c
+++ b/src/backend/utils/adt/inet_net_pton.c
@@ -32,11 +32,31 @@ static const char rcsid[] = "Id: inet_net_pton.c,v 1.4.2.3 2004/03/17 00:40:11 m
#include "utils/builtins.h" /* needed on some platforms */
#include "utils/inet.h"
+#define INET4_MAXBITS 32 /* RFC 4632 */
+#define INET6_MAXBITS 128 /* RFC 4291 */
+#define INET4_OCTET_MAX 255
+#define INET4_OCTET_BITS 8
+#define NS_INADDRSZ 4
+#define NS_IN6ADDRSZ 16
+#define NS_INT16SZ 2
+
+#define INET4_CLASSB_MIN 128
+#define INET4_CLASSC_MIN 192
+#define INET4_CLASSD_MIN 224
+#define INET4_CLASSE_MIN 240
+
+#define INET4_CLASSA_BITS 8
+#define INET4_CLASSB_BITS 16
+#define INET4_CLASSC_BITS 24
+#define INET4_CLASSD_BITS 8
+#define INET4_CLASSD_MC_BITS 4
+
static int inet_net_pton_ipv4(const char *src, u_char *dst);
static int inet_cidr_pton_ipv4(const char *src, u_char *dst, size_t size);
static int inet_net_pton_ipv6(const char *src, u_char *dst);
static int inet_cidr_pton_ipv6(const char *src, u_char *dst, size_t size);
+static int getbits(const char *src, int *bitsp, int maxbits);
/*
@@ -149,7 +169,7 @@ inet_cidr_pton_ipv4(const char *src, u_char *dst, size_t size)
assert(n >= 0 && n <= 9);
tmp *= 10;
tmp += n;
- if (tmp > 255)
+ if (tmp > INET4_OCTET_MAX)
goto enoent;
} while ((ch = *src++) != '\0' &&
isdigit((unsigned char) ch));
@@ -171,20 +191,9 @@ inet_cidr_pton_ipv4(const char *src, u_char *dst, size_t size)
bits = -1;
if (ch == '/' && isdigit((unsigned char) src[0]) && dst > odst)
{
- /* CIDR width specifier. Nothing can follow it. */
- ch = *src++; /* Skip over the /. */
- bits = 0;
- do
- {
- n = strchr(digits, ch) - digits;
- assert(n >= 0 && n <= 9);
- bits *= 10;
- bits += n;
- } while ((ch = *src++) != '\0' && isdigit((unsigned char) ch));
- if (ch != '\0')
- goto enoent;
- if (bits > 32)
+ if (getbits(src, &bits, INET4_MAXBITS) <= 0)
goto emsgsize;
+ ch = '\0';
}
/* Fiery death and destruction unless we prefetched EOS. */
@@ -197,30 +206,29 @@ inet_cidr_pton_ipv4(const char *src, u_char *dst, size_t size)
/* If no CIDR spec was given, infer width from net class. */
if (bits == -1)
{
- if (*odst >= 240) /* Class E */
- bits = 32;
- else if (*odst >= 224) /* Class D */
- bits = 8;
- else if (*odst >= 192) /* Class C */
- bits = 24;
- else if (*odst >= 128) /* Class B */
- bits = 16;
+ if (*odst >= INET4_CLASSE_MIN)
+ bits = INET4_MAXBITS;
+ else if (*odst >= INET4_CLASSD_MIN)
+ bits = INET4_CLASSD_BITS;
+ else if (*odst >= INET4_CLASSC_MIN)
+ bits = INET4_CLASSC_BITS;
+ else if (*odst >= INET4_CLASSB_MIN)
+ bits = INET4_CLASSB_BITS;
else
- /* Class A */
- bits = 8;
+ bits = INET4_CLASSA_BITS;
/* If imputed mask is narrower than specified octets, widen. */
- if (bits < ((dst - odst) * 8))
- bits = (dst - odst) * 8;
+ if (bits < ((dst - odst) * INET4_OCTET_BITS))
+ bits = (dst - odst) * INET4_OCTET_BITS;
/*
* If there are no additional bits specified for a class D address
* adjust bits to 4.
*/
- if (bits == 8 && *odst == 224)
- bits = 4;
+ if (bits == INET4_CLASSD_BITS && *odst == INET4_CLASSD_MIN)
+ bits = INET4_CLASSD_MC_BITS;
}
/* Extend network to cover the actual mask. */
- while (bits > ((dst - odst) * 8))
+ while (bits > ((dst - odst) * INET4_OCTET_BITS))
{
if (size-- <= 0U)
goto emsgsize;
@@ -263,7 +271,7 @@ inet_net_pton_ipv4(const char *src, u_char *dst)
ch,
tmp,
bits;
- size_t size = 4;
+ size_t size = NS_INADDRSZ;
/* Get the mantissa. */
while (ch = *src++, isdigit((unsigned char) ch))
@@ -275,7 +283,7 @@ inet_net_pton_ipv4(const char *src, u_char *dst)
assert(n >= 0 && n <= 9);
tmp *= 10;
tmp += n;
- if (tmp > 255)
+ if (tmp > INET4_OCTET_MAX)
goto enoent;
} while ((ch = *src++) != '\0' && isdigit((unsigned char) ch));
if (size-- == 0)
@@ -291,20 +299,9 @@ inet_net_pton_ipv4(const char *src, u_char *dst)
bits = -1;
if (ch == '/' && isdigit((unsigned char) src[0]) && dst > odst)
{
- /* CIDR width specifier. Nothing can follow it. */
- ch = *src++; /* Skip over the /. */
- bits = 0;
- do
- {
- n = strchr(digits, ch) - digits;
- assert(n >= 0 && n <= 9);
- bits *= 10;
- bits += n;
- } while ((ch = *src++) != '\0' && isdigit((unsigned char) ch));
- if (ch != '\0')
- goto enoent;
- if (bits > 32)
+ if (getbits(src, &bits, INET4_MAXBITS) <= 0)
goto emsgsize;
+ ch = '\0';
}
/* Fiery death and destruction unless we prefetched EOS. */
@@ -314,8 +311,8 @@ inet_net_pton_ipv4(const char *src, u_char *dst)
/* Prefix length can default to /32 only if all four octets spec'd. */
if (bits == -1)
{
- if (dst - odst == 4)
- bits = 32;
+ if (dst - odst == NS_INADDRSZ)
+ bits = INET4_MAXBITS;
else
goto enoent;
}
@@ -325,7 +322,7 @@ inet_net_pton_ipv4(const char *src, u_char *dst)
goto enoent;
/* If prefix length overspecifies mantissa, life is bad. */
- if ((bits / 8) > (dst - odst))
+ if ((bits / INET4_OCTET_BITS) > (dst - odst))
goto enoent;
/* Extend address to four octets. */
@@ -344,7 +341,7 @@ emsgsize:
}
static int
-getbits(const char *src, int *bitsp)
+getbits(const char *src, int *bitsp, int maxbits)
{
static const char digits[] = "0123456789";
int n;
@@ -364,7 +361,7 @@ getbits(const char *src, int *bitsp)
return 0;
val *= 10;
val += (pch - digits);
- if (val > 128) /* range */
+ if (val > maxbits) /* RFC 4632 / RFC 4291 prefix range */
return 0;
continue;
}
@@ -398,17 +395,17 @@ getv4(const char *src, u_char *dst, int *bitsp)
return 0;
val *= 10;
val += (pch - digits);
- if (val > 255) /* range */
+ if (val > INET4_OCTET_MAX) /* range */
return 0;
continue;
}
if (ch == '.' || ch == '/')
{
- if (dst - odst > 3) /* too many octets? */
+ if (dst - odst > NS_INADDRSZ - 1) /* too many octets */
return 0;
*dst++ = val;
if (ch == '/')
- return getbits(src, bitsp);
+ return getbits(src, bitsp, INET6_MAXBITS);
val = 0;
n = 0;
continue;
@@ -417,7 +414,7 @@ getv4(const char *src, u_char *dst, int *bitsp)
}
if (n == 0)
return 0;
- if (dst - odst > 3) /* too many octets? */
+ if (dst - odst > NS_INADDRSZ - 1) /* too many octets */
return 0;
*dst++ = val;
return 1;
@@ -426,13 +423,9 @@ getv4(const char *src, u_char *dst, int *bitsp)
static int
inet_net_pton_ipv6(const char *src, u_char *dst)
{
- return inet_cidr_pton_ipv6(src, dst, 16);
+ return inet_cidr_pton_ipv6(src, dst, NS_IN6ADDRSZ);
}
-#define NS_IN6ADDRSZ 16
-#define NS_INT16SZ 2
-#define NS_INADDRSZ 4
-
static int
inet_cidr_pton_ipv6(const char *src, u_char *dst, size_t size)
{
@@ -508,7 +501,7 @@ inet_cidr_pton_ipv6(const char *src, u_char *dst, size_t size)
saw_xdigit = 0;
break; /* '\0' was seen by inet_pton4(). */
}
- if (ch == '/' && getbits(src, &bits) > 0)
+ if (ch == '/' && getbits(src, &bits, INET6_MAXBITS) > 0)
break;
goto enoent;
}
@@ -520,9 +513,9 @@ inet_cidr_pton_ipv6(const char *src, u_char *dst, size_t size)
*tp++ = (u_char) val & 0xff;
}
if (bits == -1)
- bits = 128;
+ bits = INET6_MAXBITS;
- endp = tmp + 16;
+ endp = tmp + NS_IN6ADDRSZ;
if (colonp != NULL)
{
diff --git a/src/test/regress/expected/inet.out b/src/test/regress/expected/inet.out
index 1705bff4dd3..2ea6562ca7c 100644
--- a/src/test/regress/expected/inet.out
+++ b/src/test/regress/expected/inet.out
@@ -43,6 +43,15 @@ ERROR: invalid cidr value: "ffff:ffff:ffff:ffff::/24"
LINE 1: INSERT INTO INET_TBL (c, i) VALUES (cidr('ffff:ffff:ffff:fff...
^
DETAIL: Value has bits set to right of mask.
+-- reject invalid IPv4 CIDR prefix lengths (RFC 4632: decimal 0-32)
+SELECT ('10.0.0.0/' || repeat('9', 32))::cidr;
+ERROR: invalid input syntax for type cidr: "10.0.0.0/99999999999999999999999999999999"
+SELECT ('10.0.0.0/' || repeat('9', 32))::inet;
+ERROR: invalid input syntax for type inet: "10.0.0.0/99999999999999999999999999999999"
+SELECT '10.0.0.0/033'::cidr;
+ERROR: invalid input syntax for type cidr: "10.0.0.0/033"
+SELECT '10.0.0.0/033'::inet;
+ERROR: invalid input syntax for type inet: "10.0.0.0/033"
SELECT c AS cidr, i AS inet FROM INET_TBL;
cidr | inet
--------------------+------------------
diff --git a/src/test/regress/sql/inet.sql b/src/test/regress/sql/inet.sql
index 8f276856df9..922f4653995 100644
--- a/src/test/regress/sql/inet.sql
+++ b/src/test/regress/sql/inet.sql
@@ -29,6 +29,11 @@ INSERT INTO INET_TBL (c, i) VALUES ('1234::1234::1234', '::1.2.3.4');
-- check that CIDR rejects invalid input when converting from text:
INSERT INTO INET_TBL (c, i) VALUES (cidr('192.168.1.2/30'), '192.168.1.226');
INSERT INTO INET_TBL (c, i) VALUES (cidr('ffff:ffff:ffff:ffff::/24'), '::192.168.1.226');
+-- reject invalid IPv4 CIDR prefix lengths (RFC 4632: decimal 0-32)
+SELECT ('10.0.0.0/' || repeat('9', 32))::cidr;
+SELECT ('10.0.0.0/' || repeat('9', 32))::inet;
+SELECT '10.0.0.0/033'::cidr;
+SELECT '10.0.0.0/033'::inet;
SELECT c AS cidr, i AS inet FROM INET_TBL;
-- now test some support functions
--
2.53.0
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
2026-09-07 14:09 BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts PG Bug reporting form <noreply@postgresql.org>
2026-09-10 12:42 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Andrey Rachitskiy <pl0h0yp1@gmail.com>
@ 2026-09-10 16:58 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-09-10 17:16 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Daniel Gustafsson <daniel@yesql.se>
2026-09-10 17:22 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Andrey Rachitskiy <pl0h0yp1@gmail.com>
0 siblings, 2 replies; 6+ messages in thread
From: Tom Lane @ 2026-09-10 16:58 UTC (permalink / raw)
To: Andrey Rachitskiy <pl0h0yp1@gmail.com>; +Cc: 1950233439@qq.com; pgsql-bugs@lists.postgresql.org
Andrey Rachitskiy <pl0h0yp1@gmail.com> writes:
> чт, 10 сент. 2026 г. в 17:11, PG Bug reporting form <noreply@postgresql.org
>> :
>> In `src/backend/utils/adt/inet_net_pton.c`, both `inet_cidr_pton_ipv4()`
>> (lines 177–188) and `inet_net_pton_ipv4()` (lines 296–308) accumulate the
>> CIDR prefix length digit-by-digit with no per-digit overflow guard,
>> allowing
>> a 32-bit signed `int bits` to wrap silently on inputs such as `4294967297`
>> (2³²+1 → 1).
> I've already encountered this problem, I just never got around to making a
> report.
> Fix in attachment.
In a post-scarcity world, I might be interested in fixing edge-case
problems like this (and the adjacent bug reports), but as things are
it's a waste of extremely limited developer time. The argument that
not rejecting garbage input somehow has security consequences is
laughable --- if an attacker has control over data you intend to use
for security-critical purposes, they hardly need to resort to putting
in syntactically-invalid values to cause trouble. I don't foresee
real-world users putting in this sort of data in the first place,
which explains why nobody ever noticed until they could put AI to work
on finding this kind of case.
regards, tom lane
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
2026-09-07 14:09 BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts PG Bug reporting form <noreply@postgresql.org>
2026-09-10 12:42 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-09-10 16:58 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Tom Lane <tgl@sss.pgh.pa.us>
@ 2026-09-10 17:16 ` Daniel Gustafsson <daniel@yesql.se>
1 sibling, 0 replies; 6+ messages in thread
From: Daniel Gustafsson @ 2026-09-10 17:16 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Andrey Rachitskiy <pl0h0yp1@gmail.com>; 1950233439@qq.com; pgsql-bugs@lists.postgresql.org
> On 10 Sep 2026, at 18:58, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> In a post-scarcity world, I might be interested in fixing edge-case
> problems like this (and the adjacent bug reports), but as things are
> it's a waste of extremely limited developer time.
+1. The main reason to fix these types of issues is to avoid getting umpteen
duplicate reports of this over the coming weeks/months/year, and that really
doesn't seem to fit the bill of improving Postgres for actual users with real
world usecases.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
2026-09-07 14:09 BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts PG Bug reporting form <noreply@postgresql.org>
2026-09-10 12:42 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-09-10 16:58 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Tom Lane <tgl@sss.pgh.pa.us>
@ 2026-09-10 17:22 ` Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-09-10 20:23 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Daniel Gustafsson <daniel@yesql.se>
1 sibling, 1 reply; 6+ messages in thread
From: Andrey Rachitskiy @ 2026-09-10 17:22 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: 1950233439@qq.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
чт, 10 сент. 2026 г., 21:58 Tom Lane <tgl@sss.pgh.pa.us>:
> Andrey Rachitskiy <pl0h0yp1@gmail.com> writes:
> > чт, 10 сент. 2026 г. в 17:11, PG Bug reporting form <
> noreply@postgresql.org
> >> :
> >> In `src/backend/utils/adt/inet_net_pton.c`, both `inet_cidr_pton_ipv4()`
> >> (lines 177–188) and `inet_net_pton_ipv4()` (lines 296–308) accumulate
> the
> >> CIDR prefix length digit-by-digit with no per-digit overflow guard,
> >> allowing
> >> a 32-bit signed `int bits` to wrap silently on inputs such as
> `4294967297`
> >> (2³²+1 → 1).
>
> > I've already encountered this problem, I just never got around to making
> a
> > report.
> > Fix in attachment.
>
> In a post-scarcity world, I might be interested in fixing edge-case
> problems like this (and the adjacent bug reports), but as things are
> it's a waste of extremely limited developer time. The argument that
> not rejecting garbage input somehow has security consequences is
> laughable --- if an attacker has control over data you intend to use
> for security-critical purposes, they hardly need to resort to putting
> in syntactically-invalid values to cause trouble. I don't foresee
> real-world users putting in this sort of data in the first place,
> which explains why nobody ever noticed until they could put AI to work
> on finding this kind of case.
Dear Tom,
I completely agree with everything said above. Should add that I didn't
post report it for the same reasons, but since someone already "bug" wrote
it, I already had the patch.
---
Regards,
Rachitskiy Andrey
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts
2026-09-07 14:09 BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts PG Bug reporting form <noreply@postgresql.org>
2026-09-10 12:42 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-09-10 16:58 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Tom Lane <tgl@sss.pgh.pa.us>
2026-09-10 17:22 ` Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts Andrey Rachitskiy <pl0h0yp1@gmail.com>
@ 2026-09-10 20:23 ` Daniel Gustafsson <daniel@yesql.se>
0 siblings, 0 replies; 6+ messages in thread
From: Daniel Gustafsson @ 2026-09-10 20:23 UTC (permalink / raw)
To: Andrey Rachitskiy <pl0h0yp1@gmail.com>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; 1950233439@qq.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
> I completely agree with everything said above. Should add that I didn't post report it for the same reasons, but since someone already "bug" wrote it, I already had the patch.
I would argue that you did the right thing, now the patch is archived and
avialable for future use and reference, so thank you for that.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-09-10 20:23 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-09-07 14:09 BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts PG Bug reporting form <noreply@postgresql.org>
2026-09-10 12:42 ` Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-09-10 16:58 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-09-10 17:16 ` Daniel Gustafsson <daniel@yesql.se>
2026-09-10 17:22 ` Andrey Rachitskiy <pl0h0yp1@gmail.com>
2026-09-10 20:23 ` Daniel Gustafsson <daniel@yesql.se>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox