# UNDF: UNDF-2026-000000579
# zsh — CLEAN

## Scan Date

2026-03-27

## Files Scanned

- `Src/params.c` (parameter lookup)
- `Src/jobs.c` (job table)
- `Src/exec.c` (command resolution, findcmd)

## Findings

No CWE-407 defects found.

### Parameter lookup (`paramtab`)

`paramtab` is a hash table (`HashTable`); lookups use `paramtab->getnode()`
which is O(1). No linear scans in parameter access paths.

### Job table (`jobtab`)

`jobtab` is an array indexed by job number; lookup is O(1) by index. The
`findproc()` function scans jobs linearly, but it is called from signal
handlers on PID receipt — not in a per-event inner loop.

### Command resolution (`findcmd`, `cmdnamtab`)

`cmdnamtab->getnode()` is a hash table lookup O(1). `findcmd()` does walk
`path[]` linearly but this is bounded by PATH entries (typically < 20), not
by the number of commands. Not CWE-407.

### Verdict

CLEAN — no algorithmic complexity defects in scanned code paths.
