agora inbox for pgsql-bugs@postgresql.org  

help / color / mirror / Atom feed

From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: 1950233439@qq.com
Subject: BUG #19673: inetmi_int8 Signed Integer Overflow Returns Wrong IPv6 Address
Date: Mon, 07 Sep 2026 14:12:15 +0000
Message-ID: <19673-3af11c9dfc3e0824@postgresql.org> (raw)

The following bug has been logged on the website:

Bug reference:      19673
Logged by:          Tianyu Shi
Email address:      1950233439@qq.com
PostgreSQL version: 19beta3
Operating system:   Ubuntu22.04
Description:        

### Summary

In `inetmi_int8()` (`src/backend/utils/adt/network.c`, line 1946), the
expression `-addend` triggers signed integer overflow (C11 undefined
behavior) when `addend == INT64_MIN`. On x86-64, the CPU wraps the negation
back to `INT64_MIN`, causing the function to compute `ip - 2^63` instead of
the correct `ip + 2^63`. For IPv6 addresses, the overflow-detection path in
`internal_inetpl()` does not catch this case, so the function silently
returns a completely wrong address rather than raising an error.
Applications that use `inet - int8` to compute IPv6 subnet boundaries may
therefore derive incorrect range endpoints, potentially causing
access-control decisions to accept or reject the wrong addresses.

### PoC

Any unprivileged user can trigger the bug with a single SQL statement using
the `inet - int8` operator and `INT64_MIN` as the subtrahend.

```sql
-- Connect as any normal (non-superuser) role.
-- INT64_MIN must be passed as a string cast to avoid parse-time overflow.

-- Trigger: should compute 8000::1 + 2^63 = 8000::8000:0:0:1, but silently
returns a lower address.
SELECT '8000::1'::inet - '-9223372036854775808'::int8 AS trigger_result;

-- Roundtrip invariant: (X - INT64_MIN) + INT64_MIN must equal X.
SELECT
  '8000::1'::inet
AS original,
  '8000::1'::inet - '-9223372036854775808'::int8
AS minus_int64min,
  ('8000::1'::inet - '-9223372036854775808'::int8) +
'-9223372036854775808'::int8        AS roundtrip,
  (('8000::1'::inet - '-9223372036854775808'::int8) +
'-9223372036854775808'::int8)
      = '8000::1'::inet
AS roundtrip_correct;

-- Direction invariant: subtracting a negative must increase the address.
SELECT
  '8000::1'::inet                                                  AS
original,
  '8000::1'::inet - '-9223372036854775808'::int8                   AS
result,
  ('8000::1'::inet - '-9223372036854775808'::int8) > '8000::1'::inet AS
direction_increased;
```

### Result

Expected: `'8000::1'::inet - INT64_MIN` = `ip + 2^63` = `8000::8000:0:0:1`
(address increases).
Actual: the function returns `7fff:ffff:ffff:ffff:8000::1`, which is *less*
than the original address — the arithmetic went in the wrong direction with
no error raised.

All three semantic invariants are violated:

```
 original |       minus_int64min        |       roundtrip        |
roundtrip_correct
----------+-----------------------------+------------------------+-------------------
 8000::1  | 7fff:ffff:ffff:ffff:8000::1 | 7fff:ffff:ffff:ffff::1 | f

 original |           result            | direction_increased
----------+-----------------------------+---------------------
 8000::1  | 7fff:ffff:ffff:ffff:8000::1 | f
```

`roundtrip_correct = f` and `direction_increased = f` confirm that
`inetmi_int8()` computed `ip - 2^63` instead of `ip + 2^63` due to the
signed integer overflow of `-INT64_MIN` on x86-64.

Message-ID: <19673-3af11c9dfc3e0824@postgresql.org>
Permalink:  ../19673-3af11c9dfc3e0824@postgresql.org/
Also on:    postgresql.org/message-id/19673-3af11c9dfc3e0824@postgresql.org

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, 1950233439@qq.com
  Subject: Re: BUG #19673: inetmi_int8 Signed Integer Overflow Returns Wrong IPv6 Address
  In-Reply-To: <19673-3af11c9dfc3e0824@postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox