# UNDF: UNDF-2026-000000040
# curl CLEAN — altsvc, connect, cookie (CWE-407 scan)

## Files Analyzed
- `lib/url.c`
- `lib/cookie.c`
- `lib/altsvc.c`
- `lib/connect.c`

## Findings

### lib/cookie.c — CLEAN
Cookie storage uses a hash table (`cookielist[COOKIE_HASH_SIZE]` with
`cookiehash(domain)`). Lookups and insertions are O(N/HASH_SIZE) = O(1)
amortized. `replace_existing()` operates on a single hash bucket, not the
full cookie jar. No O(N²) pattern.

### lib/altsvc.c — CLEAN
`altsvc_flush()` is O(L) where L = list length, but it is guarded by
`if (!entries++)` — called at most once per `Curl_altsvc_parse()` invocation,
not inside the parse loop. `Curl_altsvc_lookup()` is a single O(L) scan called
once per connection setup. No multiplication that creates O(N²).

### lib/url.c — CLEAN
`Curl_cpool_find()` for connection reuse uses a destination hash (`needle->destination`)
to narrow the candidate set before per-connection matching. The `url_match_*`
predicates are called O(C/HASH_SIZE) times per new connection. No O(N²) pattern
in the main hot paths.

`priority_remove_child()` is O(N) per call but is invoked once per
`Curl_data_priority_add_child()`, not in a multiply-nested loop.

### lib/connect.c — CLEAN
No list traversal of concern. Per-socket operations only.

## Conclusion
No new CWE-407 defects found in these curl files beyond `curl-0001`
(already patched).
