undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

defects/distlib/patch/distlib-0001-stack-set.patch

@@ -0,0 +1,38 @@
+diff --git a/distlib/util.py b/distlib/util.py
+index 0d5bd7a..f5f3c83 100644
+--- a/distlib/util.py
++++ b/distlib/util.py
+@@ -1154,6 +1154,8 @@ class Sequencer(object):
+         # http://en.wikipedia.org/wiki/Tarjan%27s_strongly_connected_components_algorithm
+         index_counter = [0]
+         stack = []
++        # CWE-407 fix: set for O(1) stack membership test (list `in` is O(n))
++        stack_set = set()
+         lowlinks = {}
+         index = {}
+         result = []
+@@ -1166,6 +1168,7 @@ class Sequencer(object):
+             lowlinks[node] = index_counter[0]
+             index_counter[0] += 1
+             stack.append(node)
++            stack_set.add(node)
+ 
+             # Consider successors
+             try:
+@@ -1177,7 +1180,7 @@ class Sequencer(object):
+                     # Successor has not yet been visited
+                     strongconnect(successor)
+                     lowlinks[node] = min(lowlinks[node], lowlinks[successor])
+-                elif successor in stack:
++                elif successor in stack_set:
+                     # the successor is in the stack and hence in the current
+                     # strongly connected component (SCC)
+                     lowlinks[node] = min(lowlinks[node], index[successor])
+@@ -1188,6 +1191,7 @@ class Sequencer(object):
+ 
+                 while True:
+                     successor = stack.pop()
++                    stack_set.discard(successor)
+                     connected_component.append(successor)
+                     if successor == node:
+                         break