Re: BUG #19671: IPv4 CIDR Prefix Integer Overflow Bypasses Validation in inet/cidr Casts

чт, 10 сент. 2026 г., 21:58 Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>:

> Andrey Rachitskiy <pl0h0yp1(at)gmail(dot)com> writes:
> > чт, 10 сент. 2026 г. в 17:11, PG Bug reporting form <
> noreply(at)postgresql(dot)org
> >> :
> >> In `src/backend/utils/adt/inet_net_pton.c`, both `inet_cidr_pton_ipv4()`
> >> (lines 177–188) and `inet_net_pton_ipv4()` (lines 296–308) accumulate
> the
> >> CIDR prefix length digit-by-digit with no per-digit overflow guard,
> >> allowing
> >> a 32-bit signed `int bits` to wrap silently on inputs such as
> `4294967297`
> >> (2³²+1 → 1).
>
> > I've already encountered this problem, I just never got around to making
> a
> > report.
> > Fix in attachment.
>
> In a post-scarcity world, I might be interested in fixing edge-case
> problems like this (and the adjacent bug reports), but as things are
> it's a waste of extremely limited developer time. The argument that
> not rejecting garbage input somehow has security consequences is
> laughable --- if an attacker has control over data you intend to use
> for security-critical purposes, they hardly need to resort to putting
> in syntactically-invalid values to cause trouble. I don't foresee
> real-world users putting in this sort of data in the first place,
> which explains why nobody ever noticed until they could put AI to work
> on finding this kind of case.

Dear Tom,

I completely agree with everything said above. Should add that I didn't
post report it for the same reasons, but since someone already "bug" wrote
it, I already had the patch.

---
Regards,
Rachitskiy Andrey