java-topology/whitepaper/outreach/dbus-0001.md

D-Bus — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(R^2) defect in D-Bus's client policy optimization routine. Patched. Patch ready for upstream review.

The Defects

dbus-0001 (PATCHED — HIGH): bus/policy.c:780

// In bus_client_policy_optimize() — fires at connection setup:
for (link = head; link != NULL; link = next) {
    if (remove_preceding)
        remove_rules_by_type_up_to(policy, rule->type, link);  // O(R) inner walk
}

For each blanket rule, remove_rules_by_type_up_to() walks from the list head to the current position, producing O(R) inner work per blanket rule. With R total rules, the optimization pass costs O(R^2).

Complexity Proof

At R=200 policy rules:

• Defective: 200 * 200 / 2 = 20,000 comparisons
• Fixed: 200 comparisons (single reverse pass with boolean flags)
• 100x op reduction.

Impact

D-Bus is the system message bus on virtually all Linux desktops and many embedded systems. bus_client_policy_optimize() runs once per client connection. Systems with complex security policies (container hosts, multi-tenant environments) accumulate hundreds of rules. Every new client connection pays the O(R^2) cost.

The Fix

Replace the forward-scan-and-remove approach with a single reverse pass that tracks which blanket rule types have been seen:

// Before
link = head;
while (link) {
    if (remove_preceding)
        remove_rules_by_type_up_to(policy, type, link);  // O(R) inner
    link = next;
}

// After — single O(R) reverse pass
dbus_bool_t seen_send_blanket = FALSE, seen_receive_blanket = FALSE, seen_own_blanket = FALSE;
link = tail;
while (link) {
    if (already_shadowed)
        _dbus_list_remove_link(&policy->rules, link);  // O(1)
    link = prev;
}

Patch

Fix available: defects/dbus-0001/patch/dbus-0001-policy-optimize-o-n2.patch

Single-file patch on bus/policy.c. 100x speedup at R=200 rules.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a bug tracker reference (gitlab.freedesktop.org/dbus/dbus).
2. Assess severity — fires on every client connection; scales with policy rule count.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the D-Bus team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.