Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts

Andrey Rachitskiy <pl0h0yp1(at)gmail(dot)com> writes:
> чт, 10 сент. 2026 г. в 17:11, PG Bug reporting form <noreply(at)postgresql(dot)org
>> :
>> In `src/backend/utils/adt/inet_net_pton.c`, both `inet_cidr_pton_ipv4()`
>> (lines 177–188) and `inet_net_pton_ipv4()` (lines 296–308) accumulate the
>> CIDR prefix length digit-by-digit with no per-digit overflow guard,
>> allowing
>> a 32-bit signed `int bits` to wrap silently on inputs such as `4294967297`
>> (2³²+1 → 1).

> I've already encountered this problem, I just never got around to making a
> report.
> Fix in attachment.

In a post-scarcity world, I might be interested in fixing edge-case
problems like this (and the adjacent bug reports), but as things are
it's a waste of extremely limited developer time. The argument that
not rejecting garbage input somehow has security consequences is
laughable --- if an attacker has control over data you intend to use
for security-critical purposes, they hardly need to resort to putting
in syntactically-invalid values to cause trouble. I don't foresee
real-world users putting in this sort of data in the first place,
which explains why nobody ever noticed until they could put AI to work
on finding this kind of case.

regards, tom lane