java-topology/docs/tickets/netbsd-0003.md

netbsd-0003 — CWE-407: in_multicast_sysctl — O(I×A×G) double-pass traversal

Severity: LOW File: sys/netinet/in.c Function: in_multicast_sysctl CWE: CWE-407 Algorithmic Complexity

Defect

Triple nested loop (interfaces × addresses × multicast groups) traversed twice — once for buffer size estimation, once to copy data. Double-pass multiplies O(I×A×G) work by 2.

/* pass 1: size estimation */
IFNET_FOREACH(ifp) {
    IFADDR_FOREACH(ifa, ifp) {
        LIST_FOREACH(inm, &..., inm_link) {
            needed += sizeof(*xim);   // count only
        }
    }
}

/* pass 2: copy */
IFNET_FOREACH(ifp) {
    IFADDR_FOREACH(ifa, ifp) {
        LIST_FOREACH(inm, &..., inm_link) {
            copyout(inm, p, ...);     // same traversal again
        }
    }
}

Complexity: 2 × O(I×A×G). For I=50 interfaces, A=10 addresses, G=20 groups: 10,000 iterations (effectively 20,000 with double-pass).

Scale

Primarily impacts sysctl(CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MULTICAST_...) callers (e.g., netstat -gn). On a multicast router the triple-loop cost is material.

Fix

Single-pass with dynamic buffer growth (double-on-overflow strategy); eliminate re-traversal. Pay the realloc cost at most O(log(I×A×G)) times instead of doubling the traversal.