# UNDF: UNDF-2026-000000341
# wireshark — CWE-407 scan result: CLEAN (beyond wireshark-0001)

**Scan date:** 2026-03-27
**Files scanned:**
- `epan/proto.c` (protocol registration and field lookup)
- `epan/packet.c` (dissector table lookup, heuristic dissector dispatch)
- `epan/dissectors/packet-tcp.c` (TCP stream reassembly, MPTCP)

## Candidates Investigated

### proto_cleanup_base() — proto.c
`g_list_remove()` inside `while (protocols)` loop. Appears quadratic but is
actually O(N): each iteration takes `protocol = protocols->data` (the list
head) and then calls `g_list_remove(protocols, protocol)`. GLib's
`g_list_remove` scans from head and finds the element immediately (it IS the
head). O(1) per iteration, O(N) total. Not a defect.

### heur_dissector_add() — packet.c
Linear duplicate-check loop over `sub_dissectors->dissectors` before each
heuristic registration. Runs only at startup; 96 TCP heuristics → ~4,656
ops total. Startup-only, not a per-packet hot path. Not a qualifying CWE-407.

### dissector_try_heuristic() — packet.c
Iterates all H heuristic dissectors per unmatched packet. This is O(H) per
packet, not O(H²). The outer "loop" is the packet stream, but each packet
is independent — there is no inner membership-test-inside-a-loop structure.
Has bubble-to-front optimization and breaks on first match. Not CWE-407.

### mptcp_attach_subflow() — packet-tcp.c
`wmem_list_find(mptcpd->subflows, tcpd)` called once per MPTCP subflow
attach event. MPTCP subflow counts are bounded by the protocol specification
(typically 2–8 per connection). Not a scalable O(N²) pattern.

### wmem_list_count() — wsutil/wmem/wmem_list.c
Confirmed O(1): the `wmem_list_t` struct caches a `count` field.

## Verdict: CLEAN beyond wireshark-0001
No new CWE-407 defects found in the scanned files.
