Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.2\))
Subject: Re: oauth integer overflow
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: 
 <CAOYmi+mGZ5H+k_Y-ascgK7X9snAGdBUOuc=FZRxu6gnB_mjFFQ@mail.gmail.com>
Date: Tue, 28 Apr 2026 13:17:54 +0200
Cc: Andres Freund <andres@anarazel.de>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <52EEC73C-5887-43F0-848B-DF515DCDFBBF@yesql.se>
References: <qtclihmrkq67ach3xjxyi4qcksstin5qxwsnkqefkmotxwh4g6@ae2bj6jvcmry>
 <B2FCB6A7-10C4-416D-BA22-240E9FCDCE18@yesql.se>
 <CAOYmi+n4U_g+k1Bfs2eavJdps0qQj3HFDa5i3V1c0m3CLYUWhA@mail.gmail.com>
 <BA41032F-217B-4BDE-9F16-4D237B63DA33@yesql.se>
 <CAOYmi+k6K6VKTZLPtQLHnoSSMRZfH_=x6bHRUC3zf1F9kjyb1Q@mail.gmail.com>
 <fcaddr2zt4q7ee5mm7vctb723pcgfjpyo2hnhjhgae2nysobjf@epjk3wl4i2ck>
 <CAOYmi+mGZ5H+k_Y-ascgK7X9snAGdBUOuc=FZRxu6gnB_mjFFQ@mail.gmail.com>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Archived-At: 
 <https://www.postgresql.org/message-id/52EEC73C-5887-43F0-848B-DF515DCDFBBF%40yesql.se>
Precedence: bulk

> On 23 Apr 2026, at 21:05, Jacob Champion =
<jacob.champion@enterprisedb.com> wrote:
>=20
> On Thu, Apr 23, 2026 at 11:37=E2=80=AFAM Andres Freund =
<andres@anarazel.de> wrote:
>> How about instead making sure that actx->authz.interval never gets =
big enough
>> to have any chance of overflowing during either the +=3D 5 or the * =
1000?  It's
>> clearly ok to error out well before that...
>=20
> It probably is, but I guess the approach depends on whether you prefer
> checking at the time of operation, or attempting to reason about it
> ahead of time in far-away code. With the latter, if additional math is
> added in the future, then either the new overflow hazard gets missed,
> or the ceiling gets lowered again, or the new math gets an overflow
> check when the others don't. I prefer the time-of-use pattern,
> personally.

I am fine with your approach in the attached patch.  If you don't like =
the
static assert you could move it to be out of the way, and expand the =
comment
for it to what it means if it hits.  Just one small nitpick on the =
patch:

+	 * LONG_MAX milliseconds is 24 days on 32-bit platforms,
+	 * which for most people is going to be equivalent to a
+	 * disabled timer... but avoid overflow in case the

When teading "disabled timer" I interpret that as a timer which is 0 and =
has no
interval (which might be due to not being a native speaker), but what it
actually describes is an interval which (in practice) never ends.  =
Perhaps it
could be phrased more like "for most people is going to be equivalent to =
a
never ending interval".

--
Daniel Gustafsson