java-topology/whitepaper/outreach/bind9-0001.md

BIND 9 — CWE-407 Disclosure Brief (bind9-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N²) defect in BIND 9's zone loading. zone_registerinclude uses a linked list scan (ISC_LIST_FOREACH) for duplicate detection on every $INCLUDE directive, making zone load cost quadratic in the number of include files.

The Defect

bind9-0001 (PATCHED — HIGH): lib/dns/zone.c:2703

// In zone_registerinclude() — fires per $INCLUDE directive:
ISC_LIST_FOREACH (zone->newincludes, inc, link) {
    if (strcmp(filename, inc->name) == 0) {
        return;
    }
}

zone->newincludes is an ISC_LIST (linked list) of include files encountered during zone loading. Every $INCLUDE directive in a zone file calls zone_registerinclude, which scans the entire list for duplicates. With N include directives, total cost grows as O(1)+O(2)+...+O(N) = O(N²).

Complexity Proof

At N=1000 $INCLUDE directives:

• Defective: 1000 × 500 average = 500,000 string comparisons
• Fixed: 1000 × O(1) hash lookups = 1,000 operations
• ~500× op reduction.

Impact

BIND 9 is the most widely deployed DNS server software, powering a significant fraction of the internet's DNS infrastructure. Large zone files with many $INCLUDE directives (common in enterprise DNS configurations, split-horizon setups, and automatically generated zones) trigger the quadratic path during zone loading. This affects DNS server startup time and zone reload latency, directly impacting DNS availability during configuration changes.

The Fix

Add an isc_ht_t hash table (newincludes_ht) as a shadow index for O(1) duplicate detection:

// Before
ISC_LIST_FOREACH (zone->newincludes, inc, link) {
    if (strcmp(filename, inc->name) == 0) { return; }
}

// After
// CWE-407 fix: hash table for O(1) dup detection during zone load.
if (zone->newincludes_ht == NULL) {
    isc_ht_init(&zone->newincludes_ht, zone->mctx, 4, ISC_HT_CASE_SENSITIVE);
}
if (isc_ht_find(zone->newincludes_ht, (const unsigned char *)filename,
                flen, &found) == ISC_R_SUCCESS) {
    return; /* duplicate */
}

The linked list is preserved for iteration; the hash table serves only as a dedup index during loading and is destroyed in zone_loaddone.

Patch

Fix available: defects/bind9-0001/patch/bind9-0001-zone-registerinclude-newincludes-O-N2.patch

Single-file patch on lib/dns/zone.c. Adds newincludes_ht field to dns_zone, initializes on first use, destroys on load completion.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign an issue reference (isc-projects/bind9 on GitLab).
2. Assess severity — fires during zone loading, scaling quadratically with include count.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit ISC and the BIND 9 team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.