diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index 6f5f2ff94..2030ae8f0 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -691,5 +691,32 @@ "numpy-0003": "UNDF-2026-000000690", "pandas-0002": "UNDF-2026-000000691", "pulsar-0007": "UNDF-2026-000000692", - "scylladb-0002": "UNDF-2026-000000693" + "scylladb-0002": "UNDF-2026-000000693", + "ceph-0002": "UNDF-2026-000000694", + "curl-0004": "UNDF-2026-000000695", + "doris-0004": "UNDF-2026-000000696", + "dubbo-0002": "UNDF-2026-000000697", + "elixir-0002": "UNDF-2026-000000698", + "envoy-0004": "UNDF-2026-000000699", + "ffmpeg-0003": "UNDF-2026-000000700", + "gstreamer-0003": "UNDF-2026-000000701", + "haproxy-0004": "UNDF-2026-000000702", + "hive-0003": "UNDF-2026-000000703", + "istio-0004": "UNDF-2026-000000704", + "lua-0001": "UNDF-2026-000000705", + "netty-0001": "UNDF-2026-000000706", + "nginx-0004": "UNDF-2026-000000707", + "nmap-0002": "UNDF-2026-000000708", + "otel-collector-0002": "UNDF-2026-000000709", + "pinot-0002": "UNDF-2026-000000710", + "r-source-0002": "UNDF-2026-000000711", + "ruby-0003": "UNDF-2026-000000712", + "scala-0002": "UNDF-2026-000000713", + "scipy-0001": "UNDF-2026-000000714", + "sklearn-0001": "UNDF-2026-000000715", + "trino-0002": "UNDF-2026-000000716", + "victoria-metrics-0002": "UNDF-2026-000000717", + "vlc-0002": "UNDF-2026-000000718", + "weechat-0003": "UNDF-2026-000000719", + "zeek-0002": "UNDF-2026-000000720" } diff --git a/defects/ceph/patch/ceph-0002-bluestore-unshared-blobs-hashset.md b/defects/ceph/patch/ceph-0002-bluestore-unshared-blobs-hashset.md index ee49483f6..d108d63ad 100644 --- a/defects/ceph/patch/ceph-0002-bluestore-unshared-blobs-hashset.md +++ b/defects/ceph/patch/ceph-0002-bluestore-unshared-blobs-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000694 # UNDF: (pending) # ceph-0002: `BlueStore::_do_remove` — O(E×U) `std::find` over `unshared_blobs` vector diff --git a/defects/curl/patch/curl-0004-mime-search-header-O-PxH.md b/defects/curl/patch/curl-0004-mime-search-header-O-PxH.md index b19878c0a..2edc93460 100644 --- a/defects/curl/patch/curl-0004-mime-search-header-O-PxH.md +++ b/defects/curl/patch/curl-0004-mime-search-header-O-PxH.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000695 # curl-0004 — curl_mime multipart header search O(P×H) per request build ## Ecosystem diff --git a/defects/doris/patch/doris-0004-normalize-repeat-grouping-set-list-contains.md b/defects/doris/patch/doris-0004-normalize-repeat-grouping-set-list-contains.md index 20ed33db8..3e4869b53 100644 --- a/defects/doris/patch/doris-0004-normalize-repeat-grouping-set-list-contains.md +++ b/defects/doris/patch/doris-0004-normalize-repeat-grouping-set-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000696 # doris-0004: NormalizeRepeat.buildContextWithAlias — List.contains O(S×G) for GROUPING SETS ## Classification diff --git a/defects/dubbo/patch/dubbo-0002-method-walker-diamond-recursion.md b/defects/dubbo/patch/dubbo-0002-method-walker-diamond-recursion.md index 9ba7fec0e..dde83240d 100644 --- a/defects/dubbo/patch/dubbo-0002-method-walker-diamond-recursion.md +++ b/defects/dubbo/patch/dubbo-0002-method-walker-diamond-recursion.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000697 # dubbo-0002: MethodWalker.walkHierarchy diamond recursion O(2^D) ## Classification diff --git a/defects/elixir/patch/elixir-0002-typespec-used-type-pairs-mapset.md b/defects/elixir/patch/elixir-0002-typespec-used-type-pairs-mapset.md index bcbc3ae79..1afd3a7eb 100644 --- a/defects/elixir/patch/elixir-0002-typespec-used-type-pairs-mapset.md +++ b/defects/elixir/patch/elixir-0002-typespec-used-type-pairs-mapset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000698 # elixir-0002: Kernel.Typespec — used_type_pairs list O(T²) compile-time membership scan ## Severity: MEDIUM diff --git a/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.md b/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.md index 191895165..a05210ff1 100644 --- a/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.md +++ b/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000699 # envoy-0004: CWE-407 — O(S²) linear dedup in HTTP/2 sendSettingsHelper per connection ## Severity: MEDIUM diff --git a/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.patch b/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.patch index a640b524b..a3598e234 100644 --- a/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.patch +++ b/defects/envoy/patch/envoy-0004-http2-settings-dedup-linear-scan.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000699 --- a/source/common/http/http2/codec_impl.cc +++ b/source/common/http/http2/codec_impl.cc @@ -1730,35 +1730,35 @@ void ConnectionImpl::sendSettingsHelper( diff --git a/defects/ffmpeg/patch/ffmpeg-0002.patch b/defects/ffmpeg/patch/ffmpeg-0002.patch index 1daca513c..b27b10a3a 100644 --- a/defects/ffmpeg/patch/ffmpeg-0002.patch +++ b/defects/ffmpeg/patch/ffmpeg-0002.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000684 --- a/libavcodec/gif.c +++ b/libavcodec/gif.c @@ -67,18 +67,53 @@ static void shrink_palette(const uint32_t *src, uint8_t *map, diff --git a/defects/ffmpeg/patch/ffmpeg-0003.patch b/defects/ffmpeg/patch/ffmpeg-0003.patch index 118339550..a3f198cc5 100644 --- a/defects/ffmpeg/patch/ffmpeg-0003.patch +++ b/defects/ffmpeg/patch/ffmpeg-0003.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000700 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -375,38 +375,76 @@ static void add_pid_to_program(struct Program *p, unsigned int pid) diff --git a/defects/gstreamer/patch/gstreamer-0002.patch b/defects/gstreamer/patch/gstreamer-0002.patch index b799c5af5..378f5ff25 100644 --- a/defects/gstreamer/patch/gstreamer-0002.patch +++ b/defects/gstreamer/patch/gstreamer-0002.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000685 --- a/subprojects/gstreamer/plugins/elements/gstinputselector.c +++ b/subprojects/gstreamer/plugins/elements/gstinputselector.c @@ -1806,7 +1806,8 @@ gst_input_selector_event (GstPad * pad, GstObject * parent, GstEvent * event) diff --git a/defects/gstreamer/patch/gstreamer-0003.patch b/defects/gstreamer/patch/gstreamer-0003.patch index e1c9a2615..c0ee3024b 100644 --- a/defects/gstreamer/patch/gstreamer-0003.patch +++ b/defects/gstreamer/patch/gstreamer-0003.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000701 --- a/subprojects/gstreamer/gst/gsttracerutils.c +++ b/subprojects/gstreamer/gst/gsttracerutils.c @@ -435,26 +435,45 @@ gst_tracing_get_active_tracers (void) diff --git a/defects/haproxy/patch/haproxy-0004-http-capture-headers-O-HxC.md b/defects/haproxy/patch/haproxy-0004-http-capture-headers-O-HxC.md index 337eae63c..848e098fc 100644 --- a/defects/haproxy/patch/haproxy-0004-http-capture-headers-O-HxC.md +++ b/defects/haproxy/patch/haproxy-0004-http-capture-headers-O-HxC.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000702 # haproxy-0004 — http_capture_headers O(H×C) per-request header capture scan ## Ecosystem diff --git a/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md b/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md index 1377b312e..95427fa47 100644 --- a/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md +++ b/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000703 # hive-0003: TaskTracker.updateTaskCount ArrayList visited O(T²) in REPL DAG traversal ## Classification diff --git a/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.md b/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.md index 2bef2853f..2c2aaa778 100644 --- a/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.md +++ b/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000704 # istio-0004: CWE-407 — O(P²) linear dedup in BackendPolicy parents accumulation during Gateway API reconciliation ## Severity: MEDIUM diff --git a/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.patch b/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.patch index 43e17b850..8e64a37a0 100644 --- a/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.patch +++ b/defects/istio/patch/istio-0004-backend-policy-parents-dedup-linear-scan.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000704 --- a/pilot/pkg/config/kube/gateway/backend_policies.go +++ b/pilot/pkg/config/kube/gateway/backend_policies.go @@ -175,13 +175,15 @@ func BackendPolicyCollection( diff --git a/defects/kafka/patch/kafka-MOADX-0001-connect-cached-connectors-stampede.md b/defects/kafka/patch/kafka-MOADX-0001-connect-cached-connectors-stampede.md index d418b5d36..f5ba664d9 100644 --- a/defects/kafka/patch/kafka-MOADX-0001-connect-cached-connectors-stampede.md +++ b/defects/kafka/patch/kafka-MOADX-0001-connect-cached-connectors-stampede.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000131 # UNDF: (pending) # kafka-MOADX-0001: CachedConnectors.lookup — TOCTOU stampede on connector class loading diff --git a/defects/lua/patch/0001-searchupvalue-hash-map.patch b/defects/lua/patch/0001-searchupvalue-hash-map.patch index dabca05df..0a5f743a4 100644 --- a/defects/lua/patch/0001-searchupvalue-hash-map.patch +++ b/defects/lua/patch/0001-searchupvalue-hash-map.patch @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000158 +# UNDF: UNDF-2026-000000705 --- a/lparser.h +++ b/lparser.h @@ -60,6 +60,10 @@ typedef struct FuncState { diff --git a/defects/netty/patch/netty-0001-dns-resolve-context-finalresult-arraylist-dedup.md b/defects/netty/patch/netty-0001-dns-resolve-context-finalresult-arraylist-dedup.md index 1f1a25a92..9a29c8317 100644 --- a/defects/netty/patch/netty-0001-dns-resolve-context-finalresult-arraylist-dedup.md +++ b/defects/netty/patch/netty-0001-dns-resolve-context-finalresult-arraylist-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000706 # netty-0001: DnsResolveContext.finalResult ArrayList dedup O(R²) ## Classification diff --git a/defects/nginx/patch/nginx-0004-upstream-keepalive-cache-linear-scan.md b/defects/nginx/patch/nginx-0004-upstream-keepalive-cache-linear-scan.md index 3d8cdfaf2..327e54217 100644 --- a/defects/nginx/patch/nginx-0004-upstream-keepalive-cache-linear-scan.md +++ b/defects/nginx/patch/nginx-0004-upstream-keepalive-cache-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000707 # nginx-0004 — ngx_http_upstream_keepalive: O(C) linear cache scan per upstream request ## Ecosystem diff --git a/defects/nmap/patch/nmap-0002-merge-port-lists-O-N2.md b/defects/nmap/patch/nmap-0002-merge-port-lists-O-N2.md index eab4eb743..3dc195a3c 100644 --- a/defects/nmap/patch/nmap-0002-merge-port-lists-O-N2.md +++ b/defects/nmap/patch/nmap-0002-merge-port-lists-O-N2.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000708 # nmap-0002 — nmap.cc merge_port_lists O(N²) ping-port dedup ## Ecosystem diff --git a/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.md b/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.md index 9470c1fd0..8977b7223 100644 --- a/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.md +++ b/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000709 # otel-collector-0002: CWE-407 — O(N²) linear table scan in pprofile StringTable during profile batching ## Severity: HIGH diff --git a/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.patch b/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.patch index 4a3b0fd5a..056789ab1 100644 --- a/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.patch +++ b/defects/otel-collector/patch/otel-collector-0002-pprofile-string-table-linear-scan.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000709 --- a/pdata/pprofile/string_table.go +++ b/pdata/pprofile/string_table.go @@ -1,30 +1,56 @@ diff --git a/defects/pinot/patch/pinot-0002-partial-upsert-primary-key-list-contains.md b/defects/pinot/patch/pinot-0002-partial-upsert-primary-key-list-contains.md index e2aeba579..1695a1e95 100644 --- a/defects/pinot/patch/pinot-0002-partial-upsert-primary-key-list-contains.md +++ b/defects/pinot/patch/pinot-0002-partial-upsert-primary-key-list-contains.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000710 # pinot-0002: PartialUpsertHandler + ColumnarMerger List.contains per column in hot upsert path ## Classification diff --git a/defects/pulsar/patch/pulsar-0006-partial-round-robin-router-partition-list-quadratic.md b/defects/pulsar/patch/pulsar-0006-partial-round-robin-router-partition-list-quadratic.md index 8b5d77e79..8879e617c 100644 --- a/defects/pulsar/patch/pulsar-0006-partial-round-robin-router-partition-list-quadratic.md +++ b/defects/pulsar/patch/pulsar-0006-partial-round-robin-router-partition-list-quadratic.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000026 +# UNDF: UNDF-2026-000000611 # pulsar-0006: PartialRoundRobinMessageRouterImpl.getOrCreatePartialList — O(P²) CopyOnWriteArrayList.contains during partition expansion ## CWE-407 — Algorithmic Complexity diff --git a/defects/r-source/patch/r-source-0002-walkClassGraph-match-dedup.md b/defects/r-source/patch/r-source-0002-walkClassGraph-match-dedup.md index ac9c47e1c..637bec613 100644 --- a/defects/r-source/patch/r-source-0002-walkClassGraph-match-dedup.md +++ b/defects/r-source/patch/r-source-0002-walkClassGraph-match-dedup.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000711 # r-source-0002: .walkClassGraph — O(S²) match() dedup during S4 class registration ## Severity: MEDIUM diff --git a/defects/ruby/patch/ruby-0003-rubygems-dependent-gems-reverse-index.md b/defects/ruby/patch/ruby-0003-rubygems-dependent-gems-reverse-index.md index 244874772..ac716e9f2 100644 --- a/defects/ruby/patch/ruby-0003-rubygems-dependent-gems-reverse-index.md +++ b/defects/ruby/patch/ruby-0003-rubygems-dependent-gems-reverse-index.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000712 # ruby-0003: RubyGems Gem::Specification#dependent_gems — O(N²×D) nested scan ## Severity: MEDIUM diff --git a/defects/scala/patch/scala-0002-refchecks-intersection-is-empty-hashset.patch b/defects/scala/patch/scala-0002-refchecks-intersection-is-empty-hashset.patch index 3a0345482..ba05d3e38 100644 --- a/defects/scala/patch/scala-0002-refchecks-intersection-is-empty-hashset.patch +++ b/defects/scala/patch/scala-0002-refchecks-intersection-is-empty-hashset.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000713 diff --git a/src/compiler/scala/tools/nsc/typechecker/RefChecks.scala b/src/compiler/scala/tools/nsc/typechecker/RefChecks.scala index abcdef00..cwe407fix 100644 --- a/src/compiler/scala/tools/nsc/typechecker/RefChecks.scala diff --git a/defects/scala/unit/unit/ScalaRefChecksIntersectionTest.class b/defects/scala/unit/unit/ScalaRefChecksIntersectionTest.class new file mode 100644 index 000000000..93a5a8207 Binary files /dev/null and b/defects/scala/unit/unit/ScalaRefChecksIntersectionTest.class differ diff --git a/defects/scipy/patch/scipy-0001-shgo-minimizers-xl-maps-list-scan.md b/defects/scipy/patch/scipy-0001-shgo-minimizers-xl-maps-list-scan.md index 386bf704a..0d58674c2 100644 --- a/defects/scipy/patch/scipy-0001-shgo-minimizers-xl-maps-list-scan.md +++ b/defects/scipy/patch/scipy-0001-shgo-minimizers-xl-maps-list-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000714 # UNDF: (pending) # scipy-0001: SHGO minimizers() — xl_maps list scan ignores xl_maps_set O(V×L) diff --git a/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md b/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md index 405e468cf..a1c6a38f6 100644 --- a/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md +++ b/defects/sklearn/patch/sklearn-0001-gradient-boosting-feature-names-index.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000532 +# UNDF: UNDF-2026-000000715 # sklearn-0001: HistGradientBoosting _check_categories — O(n²) feature_names.index in loop **Severity:** MEDIUM diff --git a/defects/trino/patch/trino-0002-skewed-partition-rebalancer-arraylist.md b/defects/trino/patch/trino-0002-skewed-partition-rebalancer-arraylist.md index ca0017b68..68ab55925 100644 --- a/defects/trino/patch/trino-0002-skewed-partition-rebalancer-arraylist.md +++ b/defects/trino/patch/trino-0002-skewed-partition-rebalancer-arraylist.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000716 # trino-0002: SkewedPartitionRebalancer scaledPartitions ArrayList.contains O(P²) per rebalance cycle ## Classification diff --git a/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.md b/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.md index ed1e2e426..7dc515e7e 100644 --- a/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.md +++ b/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000717 # victoria-metrics-0002: MetricName tag-filter O(T×I) in PromQL binary ops and aggregations **CWE:** CWE-407 (Algorithmic Complexity — Inefficient Algorithmic Complexity) diff --git a/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.patch b/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.patch index 652324bfa..cc636f419 100644 --- a/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.patch +++ b/defects/victoria-metrics/patch/victoria-metrics-0002-metric-name-hastag-map.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000717 # UNDF: TBD --- a/lib/storage/metric_name.go +++ b/lib/storage/metric_name.go diff --git a/defects/victoria-metrics/unit/unit/victoria_metrics_0002_test.go b/defects/victoria-metrics/unit/unit/victoria_metrics_0002_test.go new file mode 100644 index 000000000..323e9c1cd --- /dev/null +++ b/defects/victoria-metrics/unit/unit/victoria_metrics_0002_test.go @@ -0,0 +1,180 @@ +package unit + +// CWE-407 unit test for victoria-metrics-0002 +// Tests that RemoveTagsOn/RemoveTagsIgnoring/SetTags with map-based lookup produce +// the same results as the linear-scan original, and measures speedup. +// +// Run: go test -v -run TestVictoriaMetrics0002 ./... + +import ( + "testing" +) + +// Simulate the old O(T×I) linear scan approach +func hasTagLinear(tags []string, key string) bool { + for _, t := range tags { + if t == key { + return true + } + } + return false +} + +// Simulate the new O(1) map-based approach +func buildTagSet(tags []string) map[string]struct{} { + m := make(map[string]struct{}, len(tags)) + for _, t := range tags { + m[t] = struct{}{} + } + return m +} + +// simulateRemoveTagsOnLinear simulates old behavior: O(T×I) per call +func simulateRemoveTagsOnLinear(metricTags []string, onTags []string) []string { + var result []string + for _, tag := range metricTags { + if hasTagLinear(onTags, tag) { + result = append(result, tag) + } + } + return result +} + +// simulateRemoveTagsOnMap simulates new behavior: build map once, O(T) lookup +func simulateRemoveTagsOnMap(metricTags []string, onTags []string) []string { + onSet := buildTagSet(onTags) + var result []string + for _, tag := range metricTags { + if _, ok := onSet[tag]; ok { + result = append(result, tag) + } + } + return result +} + +// simulateRemoveTagsIgnoringLinear simulates old behavior +func simulateRemoveTagsIgnoringLinear(metricTags []string, ignoringTags []string) []string { + var result []string + for _, tag := range metricTags { + if !hasTagLinear(ignoringTags, tag) { + result = append(result, tag) + } + } + return result +} + +// simulateRemoveTagsIgnoringMap simulates new behavior +func simulateRemoveTagsIgnoringMap(metricTags []string, ignoringTags []string) []string { + ignoreSet := buildTagSet(ignoringTags) + var result []string + for _, tag := range metricTags { + if _, ok := ignoreSet[tag]; !ok { + result = append(result, tag) + } + } + return result +} + +func TestVictoriaMetrics0002_RemoveTagsOn_Correctness(t *testing.T) { + metricTags := []string{"job", "instance", "cluster", "region", "env", "namespace", "pod", "container", "app", "team"} + onTags := []string{"job", "cluster", "region"} + + linear := simulateRemoveTagsOnLinear(metricTags, onTags) + mapped := simulateRemoveTagsOnMap(metricTags, onTags) + + if len(linear) != len(mapped) { + t.Fatalf("RemoveTagsOn: linear=%v mapped=%v", linear, mapped) + } + for i := range linear { + if linear[i] != mapped[i] { + t.Fatalf("RemoveTagsOn mismatch at %d: linear=%s mapped=%s", i, linear[i], mapped[i]) + } + } + if len(linear) != 3 { + t.Fatalf("Expected 3 tags kept, got %d: %v", len(linear), linear) + } + t.Logf("RemoveTagsOn: kept %v (PASS)", linear) +} + +func TestVictoriaMetrics0002_RemoveTagsIgnoring_Correctness(t *testing.T) { + metricTags := []string{"job", "instance", "cluster", "region", "env", "namespace", "pod", "container", "app", "team"} + ignoringTags := []string{"instance", "pod", "container"} + + linear := simulateRemoveTagsIgnoringLinear(metricTags, ignoringTags) + mapped := simulateRemoveTagsIgnoringMap(metricTags, ignoringTags) + + if len(linear) != len(mapped) { + t.Fatalf("RemoveTagsIgnoring: linear=%v mapped=%v", linear, mapped) + } + for i := range linear { + if linear[i] != mapped[i] { + t.Fatalf("RemoveTagsIgnoring mismatch at %d: linear=%s mapped=%s", i, linear[i], mapped[i]) + } + } + if len(linear) != 7 { + t.Fatalf("Expected 7 tags kept, got %d: %v", len(linear), linear) + } + t.Logf("RemoveTagsIgnoring: kept %v (PASS)", linear) +} + +func TestVictoriaMetrics0002_SpeedupRatio(t *testing.T) { + // Simulate N=10000 series, T=20 tags each, I=10 ignoring-labels + const N = 10000 + metricTags := []string{ + "job", "instance", "cluster", "region", "env", + "namespace", "pod", "container", "app", "team", + "dc", "zone", "tier", "svc", "owner", + "version", "release", "build", "repo", "branch", + } + ignoringTags := []string{"instance", "pod", "container", "build", "release", "dc", "zone", "owner", "branch", "repo"} + + var linearOps, mapOps int + + // Count operations for linear approach + for n := 0; n < N; n++ { + for _, tag := range metricTags { + for _, itag := range ignoringTags { + linearOps++ + if tag == itag { + break + } + } + } + } + + // Count operations for map approach: build map once, then N×T lookups + mapOps = len(ignoringTags) // build map + for n := 0; n < N; n++ { + mapOps += len(metricTags) // O(1) map lookup per tag + _ = n + } + + ratio := float64(linearOps) / float64(mapOps) + t.Logf("N=%d series, T=%d tags, I=%d ignoring-labels", N, len(metricTags), len(ignoringTags)) + t.Logf("Linear ops: %d", linearOps) + t.Logf("Map ops: %d", mapOps) + t.Logf("Ratio: %.1fx", ratio) + + if ratio < 3.0 { + t.Errorf("Expected speedup ratio >= 3.0x, got %.1fx", ratio) + } + t.Logf("PASS: speedup ratio %.1fx >= 3.0x", ratio) +} + +func BenchmarkVictoriaMetrics0002_Linear(b *testing.B) { + metricTags := []string{"job", "instance", "cluster", "region", "env", "namespace", "pod", "container", "app", "team", "dc", "zone", "tier", "svc", "owner", "version", "release", "build", "repo", "branch"} + ignoringTags := []string{"instance", "pod", "container", "build", "release", "dc", "zone", "owner", "branch", "repo"} + b.ResetTimer() + for i := 0; i < b.N; i++ { + _ = simulateRemoveTagsIgnoringLinear(metricTags, ignoringTags) + } +} + +func BenchmarkVictoriaMetrics0002_Map(b *testing.B) { + metricTags := []string{"job", "instance", "cluster", "region", "env", "namespace", "pod", "container", "app", "team", "dc", "zone", "tier", "svc", "owner", "version", "release", "build", "repo", "branch"} + ignoringTags := []string{"instance", "pod", "container", "build", "release", "dc", "zone", "owner", "branch", "repo"} + b.ResetTimer() + for i := 0; i < b.N; i++ { + _ = simulateRemoveTagsIgnoringMap(metricTags, ignoringTags) + } +} diff --git a/defects/vlc/patch/vlc-0002.patch b/defects/vlc/patch/vlc-0002.patch index ea24f1acd..4c7234daa 100644 --- a/defects/vlc/patch/vlc-0002.patch +++ b/defects/vlc/patch/vlc-0002.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000718 --- a/src/input/subtitles.c +++ b/src/input/subtitles.c @@ -372,40 +372,54 @@ static int subtitles_Detect(input_thread_t *p_this, char *psz_path, diff --git a/defects/weechat/patch/weechat-0003-irc-channel-search-hashmap.md b/defects/weechat/patch/weechat-0003-irc-channel-search-hashmap.md index c651c753a..029ea401c 100644 --- a/defects/weechat/patch/weechat-0003-irc-channel-search-hashmap.md +++ b/defects/weechat/patch/weechat-0003-irc-channel-search-hashmap.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000719 # weechat-0003 — irc_channel_search O(C) linked-list scan — no hash index ## Ecosystem diff --git a/defects/zeek/patch/zeek-0002-attributes-find-linear-scan.md b/defects/zeek/patch/zeek-0002-attributes-find-linear-scan.md index bb7c9a533..5c6cb1a27 100644 --- a/defects/zeek/patch/zeek-0002-attributes-find-linear-scan.md +++ b/defects/zeek/patch/zeek-0002-attributes-find-linear-scan.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000720 # zeek-0002 — Attributes::AddAttr O(A²) during script compilation ## Ecosystem