40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
# netbsd-0003 — CWE-407: in_multicast_sysctl — O(I×A×G) double-pass traversal
|
||
|
||
**Severity:** LOW
|
||
**File:** `sys/netinet/in.c`
|
||
**Function:** `in_multicast_sysctl`
|
||
**CWE:** CWE-407 Algorithmic Complexity
|
||
|
||
## Defect
|
||
|
||
Triple nested loop (interfaces × addresses × multicast groups) traversed twice — once for buffer size estimation, once to copy data. Double-pass multiplies O(I×A×G) work by 2.
|
||
|
||
```c
|
||
/* pass 1: size estimation */
|
||
IFNET_FOREACH(ifp) {
|
||
IFADDR_FOREACH(ifa, ifp) {
|
||
LIST_FOREACH(inm, &..., inm_link) {
|
||
needed += sizeof(*xim); // count only
|
||
}
|
||
}
|
||
}
|
||
|
||
/* pass 2: copy */
|
||
IFNET_FOREACH(ifp) {
|
||
IFADDR_FOREACH(ifa, ifp) {
|
||
LIST_FOREACH(inm, &..., inm_link) {
|
||
copyout(inm, p, ...); // same traversal again
|
||
}
|
||
}
|
||
}
|
||
```
|
||
|
||
**Complexity:** 2 × O(I×A×G). For I=50 interfaces, A=10 addresses, G=20 groups: 10,000 iterations (effectively 20,000 with double-pass).
|
||
|
||
## Scale
|
||
|
||
Primarily impacts `sysctl(CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MULTICAST_...)` callers (e.g., `netstat -gn`). On a multicast router the triple-loop cost is material.
|
||
|
||
## Fix
|
||
|
||
Single-pass with dynamic buffer growth (double-on-overflow strategy); eliminate re-traversal. Pay the realloc cost at most O(log(I×A×G)) times instead of doubling the traversal.
|