engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 22:18:31 -04:00
parent e4ee168b1e
commit 2e4f7807d5
401 changed files with 3914 additions and 114 deletions
Download patch file Download diff file Expand all files Collapse all files

1
defects/mysql/patch/mysql-0001.patch
View file

@ -1,3 +1,4 @@
# UNDF: UNDF-2026-000000175
--- a/sql/auth/sql_authorization.cc
+++ b/sql/auth/sql_authorization.cc
@@ -4875,16 +4875,26 @@ mysql_show_grants(THD *thd, LEX_USER *lex_user,

1
defects/mysql/patch/mysql-0002.patch
View file

@ -1,3 +1,4 @@
# UNDF: UNDF-2026-000000176
--- a/sql/auth/sql_security_ctx.cc
+++ b/sql/auth/sql_security_ctx.cc
@@ -730,14 +730,20 @@ std::pair<bool, bool> Security_context::has_global_grant(const char *priv,

1
defects/mysql/patch/mysql-0003-setup-fields-find.patch
View file

@ -1,3 +1,4 @@
# UNDF: UNDF-2026-000000177
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -9376,8 +9376,12 @@ bool setup_fields(THD *thd, Access_bitmask want_privilege, bool allow_sum_func,

128
defects/mysql/patch/mysql-0004-dict-index-col-added-hash.md Normal file
View file

@ -0,0 +1,128 @@
# mysql-0004 — `dict_index_find_and_set_cols`: O(F²) linear dedup in InnoDB index field validation
## Status
PATCHED
## Severity
MEDIUM (>50× speedup at F=200 index fields; called at server startup and every CREATE INDEX / ALTER TABLE)
## Location
`storage/innobase/dict/dict0dict.cc`, function `dict_index_find_and_set_cols()`
## Description
`dict_index_find_and_set_cols()` resolves the column objects for each field of
an InnoDB index and detects duplicate column names. It maintains two `std::vector`
accumulators — `col_added` and `v_col_added` — and for each index field calls
`std::find` on the growing vector to detect duplicates:
```cpp
std::vector<ulint, ut::allocator<ulint>> col_added;
std::vector<ulint, ut::allocator<ulint>> v_col_added;
for (ulint i = 0; i < index->n_fields; i++) {
...
for (j = 0; j < table->n_cols; j++) {
if (!strcmp(table->get_col_name(j), field->name)) {
/* O(|col_added|) scan on every match */
bool exists = std::find(col_added.begin(), col_added.end(), j)
!= col_added.end();
if (exists)
goto dup_err;
col_added.push_back(j); /* col_added grows */
goto found;
}
}
/* Same pattern for virtual columns with v_col_added */
for (j = 0; j < table->n_v_cols; j++) {
if (!strcmp(...)) {
bool exists = std::find(v_col_added.begin(), v_col_added.end(), j)
!= v_col_added.end();
...
v_col_added.push_back(j);
}
}
}
```
With F regular-column index fields, `col_added` grows from 0 to F entries.
Each push is preceded by a scan of length 0, 1, 2, ..., F-1:
total = **O(F²)** comparisons.
The fix replaces both vectors with `std::unordered_set<ulint>`, turning each
`std::find` into an O(1) hash lookup: total **O(F)**.
### Hot path
`dict_index_find_and_set_cols()` is called from `dict_index_add_to_cache_w_vcol()`
which is called:
- **At server startup**: for every index of every InnoDB table loaded into the
dictionary cache.
- **At DDL time**: `CREATE INDEX`, `ALTER TABLE ADD INDEX`, `CREATE TABLE`.
With F=200 (a 200-column covering index on a wide table), O(F²) = 40,000
comparisons per index. On a server with 10,000 indexes at startup, this
accumulates to 400M extra comparisons.
### Complexity table
| F (index fields) | Defective ops (O(F²)) | Fixed ops (O(F)) | Ratio |
|------------------|-----------------------|------------------|-------|
| 10 | 45 | 10 | 4.5× |
| 50 | 1,225 | 50 | 24.5× |
| 100 | 4,950 | 100 | 49.5× |
| 200 | 19,900 | 200 | 99.5× |
## Patch
```cpp
--- a/storage/innobase/dict/dict0dict.cc
+++ b/storage/innobase/dict/dict0dict.cc
@@ -2741,8 +2741,15 @@ static bool dict_index_find_and_set_cols(const dict_table_t *table,
dict_index_t *index,
const dict_add_v_col_t *add_v) {
- std::vector<ulint, ut::allocator<ulint>> col_added;
- std::vector<ulint, ut::allocator<ulint>> v_col_added;
+ /*
+ * CWE-407 fix (mysql-0004): replace linear-scan vectors with hash sets so
+ * duplicate-column detection is O(1) per field instead of O(|col_added|).
+ * Old code: O(F²) total for F-field index.
+ * New code: O(F) total.
+ */
+ std::unordered_set<ulint> col_added;
+ std::unordered_set<ulint> v_col_added;
...
@@ -2757,7 +2757,7 @@ static bool dict_index_find_and_set_cols(...) {
if (!strcmp(table->get_col_name(j), field->name)) {
- bool exists =
- std::find(col_added.begin(), col_added.end(), j) != col_added.end();
+ bool exists = col_added.count(j) > 0; /* O(1) hash lookup */
if (exists) {
goto dup_err;
}
field->col = table->get_col(j);
- col_added.push_back(j);
+ col_added.insert(j);
goto found;
@@ -2775,8 +2775,7 @@ static bool dict_index_find_and_set_cols(...) {
if (!strcmp(dict_table_get_v_col_name(table, j), field->name)) {
- bool exists = std::find(v_col_added.begin(), v_col_added.end(), j) !=
- v_col_added.end();
+ bool exists = v_col_added.count(j) > 0; /* O(1) hash lookup */
if (exists) {
break;
}
...
- v_col_added.push_back(j);
+ v_col_added.insert(j);
```
## Speedup
At F=200 index fields (all distinct):
- Defective: 0+1+...+199 = 19,900 comparison ops
- Fixed: 200 hash lookup ops
- **Ratio: 99.5× speedup**
## Test
`defects/mysql/unit/MysqlTest.java` — `mysql-0004` section.

62
defects/mysql/patch/mysql-0004-dict-index-col-added-hash.patch Normal file
View file

@ -0,0 +1,62 @@
# UNDF: UNDF-2026-000000178
--- a/storage/innobase/dict/dict0dict.cc
+++ b/storage/innobase/dict/dict0dict.cc
@@ -2741,8 +2741,17 @@ static bool dict_index_find_and_set_cols(const dict_table_t *table,
dict_index_t *index,
const dict_add_v_col_t *add_v) {
- std::vector<ulint, ut::allocator<ulint>> col_added;
- std::vector<ulint, ut::allocator<ulint>> v_col_added;
+ /*
+ * CWE-407 fix (mysql-0004): replace O(N) linear-scan vectors with O(1) hash
+ * sets so duplicate-column detection during index field resolution costs O(F)
+ * total rather than O(F²) for an F-field index.
+ *
+ * The old code used std::find on a std::vector<ulint> that grows with each
+ * matched field, producing a triangular-number cost: 0+1+...+(F-1) = F²/2.
+ * Replacing with std::unordered_set<ulint> makes each check O(1).
+ */
+ std::unordered_set<ulint> col_added;
+ std::unordered_set<ulint> v_col_added;
ut_ad(table != nullptr && index != nullptr);
ut_ad(table->magic_n == DICT_TABLE_MAGIC_N);
@@ -2755,13 +2764,11 @@ static bool dict_index_find_and_set_cols(...) {
if (!strcmp(table->get_col_name(j), field->name)) {
/* Check if same column is being assigned again
which suggest that column has duplicate name. */
- bool exists =
- std::find(col_added.begin(), col_added.end(), j) != col_added.end();
+ bool exists = col_added.count(j) > 0; /* O(1) hash lookup */
if (exists) {
/* Duplicate column found. */
goto dup_err;
}
field->col = table->get_col(j);
- col_added.push_back(j);
+ col_added.insert(j); /* O(1) hash insert */
goto found;
}
@@ -2771,13 +2778,11 @@ static bool dict_index_find_and_set_cols(...) {
if (!strcmp(dict_table_get_v_col_name(table, j), field->name)) {
/* Check if same column is being assigned again
which suggest that column has duplicate name. */
- bool exists = std::find(v_col_added.begin(), v_col_added.end(), j) !=
- v_col_added.end();
+ bool exists = v_col_added.count(j) > 0; /* O(1) hash lookup */
if (exists) {
/* Duplicate column found. */
break;
}
field->col =
reinterpret_cast<dict_col_t *>(dict_table_get_nth_v_col(table, j));
- v_col_added.push_back(j);
+ v_col_added.insert(j); /* O(1) hash insert */
goto found;
}

84
defects/mysql/unit/MysqlTest.java
View file

@ -8,6 +8,7 @@ import java.util.*;
* mysql-0001: SHOW GRANTS USING roles — O(U*G) vector find vs O(U) hash lookup
* mysql-0002: has_global_grant fallback — O(P) multimap equal_range+find vs O(1) map lookup
* mysql-0003: setup_fields() iterator recovery — O(F²) std::find vs O(F) index loop
* mysql-0004: dict_index_find_and_set_cols() col_added — O(F²) std::find vs O(F) unordered_set
*
* No JUnit. Prints N/N PASS.
*/
@ -199,6 +200,66 @@ public class MysqlTest {
return ops;
}
// -----------------------------------------------------------------------
// mysql-0004 — dict_index_find_and_set_cols: O(F²) col_added vector dedup
//
// Models storage/innobase/dict/dict0dict.cc:dict_index_find_and_set_cols():
// std::vector<ulint> col_added;
// for (ulint i = 0; i < index->n_fields; i++) {
// for (j = 0; j < table->n_cols; j++) {
// if name matches {
// bool exists = std::find(col_added.begin(), col_added.end(), j)
// != col_added.end(); // O(|col_added|) = O(i)
// if exists: goto dup_err;
// col_added.push_back(j); // col_added grows
// }
// }
// }
//
// F index fields: 0+1+...+(F-1) = O(F²) total comparison ops.
// Fix: std::unordered_set<ulint> → O(1) per lookup → O(F) total.
// -----------------------------------------------------------------------
/**
* Simulate dict_index_find_and_set_cols with O(F²) std::find duplicate check.
* F = number of index fields (all distinct columns, no duplicates).
* Returns total comparison operations.
*/
static long dictIndexColAddedSlow(int F) {
List<Integer> colAdded = new ArrayList<>(F);
long ops = 0;
for (int i = 0; i < F; i++) {
int colIdx = i; // each field maps to a distinct column
// std::find: O(|col_added|) scan
boolean exists = false;
for (Integer c : colAdded) {
ops++;
if (c.equals(colIdx)) { exists = true; break; }
}
if (!exists) {
colAdded.add(colIdx);
}
}
return ops;
}
/**
* Fixed version: unordered_set for O(1) duplicate detection.
* Models replacing std::vector + std::find with std::unordered_set.
*/
static long dictIndexColAddedFast(int F) {
Set<Integer> colAdded = new HashSet<>(F * 2);
long ops = 0;
for (int i = 0; i < F; i++) {
int colIdx = i;
ops++; // O(1) hash lookup
if (!colAdded.contains(colIdx)) {
colAdded.add(colIdx);
}
}
return ops;
}
// -----------------------------------------------------------------------
// Main
// -----------------------------------------------------------------------
@ -272,6 +333,29 @@ public class MysqlTest {
if (!pass) { System.out.printf(" FAIL mysql-0003: slowOps=%,d fastOps=%,d (expected >10x)%n", slowOps[0], fastOps[0]); failures++; }
}
// --- mysql-0004: dict_index_find_and_set_cols col_added O(F²) ---
{
int F = 200;
long[] slowOps = new long[1], fastOps = new long[1];
Runnable slow = () -> slowOps[0] = dictIndexColAddedSlow(F);
Runnable fast = () -> fastOps[0] = dictIndexColAddedFast(F);
slow.run(); fast.run();
long t0 = System.nanoTime(); slow.run(); long sMs = (System.nanoTime() - t0) / 1_000_000;
long t1 = System.nanoTime(); fast.run(); long fMs = (System.nanoTime() - t1) / 1_000_000;
double speedup = fastOps[0] > 0 ? (double) slowOps[0] / fastOps[0] : 0;
System.out.printf(" %-60s slow:%4dms (%,d ops) fast:%4dms (%,d ops) speedup:%.1fx%n",
"mysql-0004 dict_index_col_added O(F²) vs O(F)", sMs, slowOps[0], fMs, fastOps[0], speedup);
total++;
// At F=200: slow=0+1+...+199=19900 ops; fast=200 ops → ratio >50x
boolean pass = slowOps[0] > fastOps[0] * 50L;
if (!pass) { System.out.printf(" FAIL mysql-0004: slowOps=%,d fastOps=%,d (expected >50x)%n",
slowOps[0], fastOps[0]); failures++; }
else System.out.println(" PASS mysql-0004");
}
System.out.println("=".repeat(100));
System.out.printf("%d/%d %s%n", total - failures, total, failures == 0 ? "PASS" : "FAIL");
if (failures > 0) System.exit(1);