Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19673: inetmi_int8 Signed Integer Overflow Returns Wrong IPv6
 Address
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: 1950233439@qq.com
Reply-To: 1950233439@qq.com, pgsql-bugs@lists.postgresql.org
Date: Mon, 07 Sep 2026 14:12:15 +0000
Message-ID: <19673-3af11c9dfc3e0824@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19673-3af11c9dfc3e0824%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19673
Logged by:          Tianyu Shi
Email address:      1950233439@qq.com
PostgreSQL version: 19beta3
Operating system:   Ubuntu22.04
Description:       =20

### Summary

In `inetmi_int8()` (`src/backend/utils/adt/network.c`, line 1946), the
expression `-addend` triggers signed integer overflow (C11 undefined
behavior) when `addend =3D=3D INT64_MIN`. On x86-64, the CPU wraps the nega=
tion
back to `INT64_MIN`, causing the function to compute `ip - 2^63` instead of
the correct `ip + 2^63`. For IPv6 addresses, the overflow-detection path in
`internal_inetpl()` does not catch this case, so the function silently
returns a completely wrong address rather than raising an error.
Applications that use `inet - int8` to compute IPv6 subnet boundaries may
therefore derive incorrect range endpoints, potentially causing
access-control decisions to accept or reject the wrong addresses.

### PoC

Any unprivileged user can trigger the bug with a single SQL statement using
the `inet - int8` operator and `INT64_MIN` as the subtrahend.

```sql
-- Connect as any normal (non-superuser) role.
-- INT64_MIN must be passed as a string cast to avoid parse-time overflow.

-- Trigger: should compute 8000::1 + 2^63 =3D 8000::8000:0:0:1, but silently
returns a lower address.
SELECT '8000::1'::inet - '-9223372036854775808'::int8 AS trigger_result;

-- Roundtrip invariant: (X - INT64_MIN) + INT64_MIN must equal X.
SELECT
  '8000::1'::inet
AS original,
  '8000::1'::inet - '-9223372036854775808'::int8
AS minus_int64min,
  ('8000::1'::inet - '-9223372036854775808'::int8) +
'-9223372036854775808'::int8        AS roundtrip,
  (('8000::1'::inet - '-9223372036854775808'::int8) +
'-9223372036854775808'::int8)
      =3D '8000::1'::inet
AS roundtrip_correct;

-- Direction invariant: subtracting a negative must increase the address.
SELECT
  '8000::1'::inet                                                  AS
original,
  '8000::1'::inet - '-9223372036854775808'::int8                   AS
result,
  ('8000::1'::inet - '-9223372036854775808'::int8) > '8000::1'::inet AS
direction_increased;
```

### Result

Expected: `'8000::1'::inet - INT64_MIN` =3D `ip + 2^63` =3D `8000::8000:0:0=
:1`
(address increases).
Actual: the function returns `7fff:ffff:ffff:ffff:8000::1`, which is *less*
than the original address =E2=80=94 the arithmetic went in the wrong direct=
ion with
no error raised.

All three semantic invariants are violated:

```
 original |       minus_int64min        |       roundtrip        |
roundtrip_correct
----------+-----------------------------+------------------------+---------=
----------
 8000::1  | 7fff:ffff:ffff:ffff:8000::1 | 7fff:ffff:ffff:ffff::1 | f

 original |           result            | direction_increased
----------+-----------------------------+---------------------
 8000::1  | 7fff:ffff:ffff:ffff:8000::1 | f
```

`roundtrip_correct =3D f` and `direction_increased =3D f` confirm that
`inetmi_int8()` computed `ip - 2^63` instead of `ip + 2^63` due to the
signed integer overflow of `-INT64_MIN` on x86-64.