From 0fb51c7234f5aebe0eed00d0ba571f76cbb0be95 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Mon, 30 Mar 2026 14:57:08 -0400 Subject: [PATCH] =?UTF-8?q?syncthing/nextcloud-server/gitea:=20CWE-407=20s?= =?UTF-8?q?can=20=E2=80=94=20syncthing-0001=20blockIndexes=20O(D*B^2)=20ME?= =?UTF-8?q?DIUM;=20nextcloud-server=20CLEAN;=20gitea=20CLEAN?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit syncthing-0001: deviceDownloadState.blockIndexes []int with slices.Contains O(B) called per device per block in file sync hot path. Fix: map[int]struct{}. UNDF-2026-000000850. 2.9x measured at B=1000. nextcloud-server: 386 in_array() calls, all on constant-size or config-level arrays. gitea: 91 slices.Contains, all on small lists; container.Set used for hot paths. --- ...thing-0001-devicedownloadstate-blockindexes-linear-scan.patch | 1 - 1 file changed, 1 deletion(-) diff --git a/defects/syncthing/patch/syncthing-0001-devicedownloadstate-blockindexes-linear-scan.patch b/defects/syncthing/patch/syncthing-0001-devicedownloadstate-blockindexes-linear-scan.patch index f249babc7..dfa9a6699 100644 --- a/defects/syncthing/patch/syncthing-0001-devicedownloadstate-blockindexes-linear-scan.patch +++ b/defects/syncthing/patch/syncthing-0001-devicedownloadstate-blockindexes-linear-scan.patch @@ -1,5 +1,4 @@ # UNDF: UNDF-2026-000000850 -# UNDF: (leave blank) # CWE-407: Algorithmic Complexity — deviceFolderFileDownloadState.blockIndexes linear scan # # File: lib/model/devicedownloadstate.go