undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

defects/gyp/patch/gyp-0001-path-set.patch

@@ -0,0 +1,29 @@
+diff --git a/pylib/gyp/input.py b/pylib/gyp/input.py
+index 4c12891..8ad96a6 100644
+--- a/pylib/gyp/input.py
++++ b/pylib/gyp/input.py
+@@ -1600,16 +1600,20 @@ class DependencyGraphNode(object):
+     results = []
+     visited = set()
+ 
+-    def Visit(node, path):
++    def Visit(node, path, path_set):
+       for child in node.dependents:
+-        if child in path:
++        # CWE-407 fix: use path_set for O(1) membership test.
++        # path list is kept only for cycle extraction (path.index).
++        if child in path_set:
+           results.append([child] + path[:path.index(child) + 1])
+         elif not child in visited:
+           visited.add(child)
+-          Visit(child, [child] + path)
++          path_set.add(child)
++          Visit(child, [child] + path, path_set)
++          path_set.discard(child)
+ 
+     visited.add(self)
+-    Visit(self, [self])
++    Visit(self, [self], {self})
+ 
+     return results
+