undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

defects/kotlin/patch/kotlin-0001-collectreachable-hashset.patch

@@ -0,0 +1,28 @@
+diff --git a/compiler/frontend/src/org/jetbrains/kotlin/resolve/NonExpansiveInheritanceRestrictionChecker.kt b/compiler/frontend/src/org/jetbrains/kotlin/resolve/NonExpansiveInheritanceRestrictionChecker.kt
+index 9f32db32..73838c72 100644
+--- a/compiler/frontend/src/org/jetbrains/kotlin/resolve/NonExpansiveInheritanceRestrictionChecker.kt
++++ b/compiler/frontend/src/org/jetbrains/kotlin/resolve/NonExpansiveInheritanceRestrictionChecker.kt
+@@ -149,10 +149,13 @@ object NonExpansiveInheritanceRestrictionChecker {
+ 
+     private fun <T> Graph<T>.isEdgeInCycle(edge: ExpansiveEdge<T>) = edge.from in collectReachable(edge.to)
+ 
+-    private fun <T> Graph<T>.collectReachable(from: T): List<T> {
++    // CWE-407 fix: return HashSet<T> so `in` is O(1) instead of O(V) on a List<T>
++    private fun <T> Graph<T>.collectReachable(from: T): Set<T> {
++        val reachable = hashSetOf<T>()
++
+         val handler = object : DFS.NodeHandlerWithListResult<T, T>() {
+             override fun afterChildren(current: T?) {
+-                result.add(current)
++                if (current != null) reachable.add(current)
+             }
+         }
+ 
+@@ -162,6 +165,6 @@ object NonExpansiveInheritanceRestrictionChecker {
+ 
+         DFS.dfs(listOf(from), neighbors, handler)
+ 
+-        return handler.result()
++        return reachable
+     }
+ }