engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave17: openssh-0001/2, strongswan-0001, gradle-0002, groovy-0001/2, make-0001, clojure-CLEAN + whitepaper 549/240

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 19:55:52 -04:00
parent 0f275c44af
commit 4221966e66
22 changed files with 1776 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
whitepaper/MD5SUMS
View file

@ -1 +1 @@
4184c0cb8ecd2b3730ada28628420349 undefect-cwe407-2026-03-27.pdf
d9bc9420eb82aaa4332260e96b417c1d undefect-cwe407-2026-03-27.pdf

17
whitepaper/full-paper.md
View file

@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint.
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 542 validated
elegant solutions inspire elegant variations. The process of generating 549 validated
defect patches across 240 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
query optimizer, and browser runtime.
**542 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
**549 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
3 unpatched (Minecraft, Create mod). No language left behind.
@ -667,6 +667,9 @@ stacks, Spark schemas — this is the dominant build cost.
| mbedtls-0001 | mbedTLS | `library/ssl_tls.c` — `mbedtls_ssl_parse_alpn_ext()` outer for over S server ALPN names × inner while memcmp scan of C client names; O(S×C×L); fix: 64-slot FNV-1a hash set | **PATCHED** |
| mbedtls-0002 | mbedTLS | `library/ssl_tls12_server.c` — TLS 1.2 cipher selection: S server suites × C client suites × D ciphersuite_definitions[] linear scan; O(S×C×D) ≈11.5M ops/handshake; fix: HashSet + direct lookup | **PATCHED** |
| wolfssl-0001 | WolfSSL | `src/tls.c` — `TLSX_ALPN_GetRequest()` outer for over S server names × inner while over C client names; O(S×C) ALPN negotiation; fix: hash set of client names | **PATCHED** |
| openssh-0001 | OpenSSH | `kex.c` — `kex_assemble_server_sig_algs()` O(N²) dedup of sig-alg tokens via `match_list()` linear scan; fix: `HashSet<String>` before loop (249×) | **PATCHED** |
| openssh-0002 | OpenSSH | `kex.c` — `kex_names_cat()` O(M×N+N²) dedup during token concatenation; fix: seen `HashSet` and pre-built server set (249×) | **PATCHED** |
| strongswan-0001 | strongSwan | `libstrongswan/crypto/proposal/proposal.c` — `proposal_select()` O(P_c×P_s×T×A₁×A₂) per-algorithm nested scan during IKE/ESP SA negotiation; pre-auth DoS amplifier; fix: pre-built type-keyed hash map (4-5×) | **PATCHED** |
| ros2-0001 | ROS2 | `rclcpp/src/rclcpp/parameter_events_filter.cpp:34` — `ParameterEventsFilter` constructor `std::find` on names vector (N) inside 3 loops over P event parameters; O(3×N×P) per event; fix: `unordered_set` (4.5×) | **PATCHED** |
| ros2-0002 | ROS2 | `rclcpp/src/rclcpp/node_interfaces/node_parameters.cpp:1128` — `list_parameters()` `std::find` on growing `result.prefixes` vector inside prefix-dedup loop; O(P²); fix: `unordered_set` dedup on insert (5×) | **PATCHED** |
| opencv-0001 | OpenCV | `modules/dnn/src/op_timvx.cpp:30,869` — `tvUpdateConfictMap`+`isConflict` `std::find` on graphConflictMap vector (G) inside recursive DFS (depth C); O(C²×G); fix: `unordered_set<int>` per layer (8.5×) | **PATCHED** |
@ -705,6 +708,9 @@ stacks, Spark schemas — this is the dominant build cost.
| zookeeper-0003 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — third ACL dedup path; all share root cause comment `// TODO: Use set` | **PATCHED** |
| pip-0001 | pip | `pip/_internal/cache.py` — `Wheel.support_index_min()` O(n×T) linear tag scan per wheel candidate; fix: `dict<tag, index>` (65×) | **PATCHED** |
| gradle-0001 | Gradle | `subprojects/cli/` — `OptionReader` `CollectionUtils.toList().contains()` rebuilt per method-option pair; O(M×O²) | **PATCHED** |
| gradle-0002 | Gradle | `dependency-management/.../NodeState.java:77,674` — `incomingEdges ArrayList<EdgeState>.contains()` O(E) in `addIncomingEdge()` called O(E) times per node; O(E²) dependency graph resolution; fix: `LinkedHashSet` (249×) | **PATCHED** |
| groovy-0001 | Groovy | `stc/StaticTypeCheckingVisitor.java:3205` — `collectedNames ArrayList<String>.contains()` O(C) per entry in named-param annotation check; O(E×C) per static type check; fix: `HashSet` (500×) | **PATCHED** |
| groovy-0002 | Groovy | `classgen/Verifier.java` — `Arrays.asList(params).contains(p)` fresh allocation + O(P) scan per variable expression in `addDefaultParameterMethods/Constructors`; fix: `HashSet<Parameter>` before visitor (500×) | **PATCHED** |
| nginx-0001 | nginx | `src/http/ngx_http_upstream.c` — `ngx_http_upstream_cache_get()` O(n) linear name scan per upstream cache zone; fix: `rbtree` index | **PATCHED** |
| haproxy-0001 | HAProxy | `src/pattern.c` — `pat_match_bin()` linked-list walk below LRU threshold per pattern match; fix: pre-sorted array binary search | **PATCHED** |
| haproxy-0002 | HAProxy | `src/flt_spoe.c:1583,1607` — nested `while(args)+list_for_each_entry+strcmp` O(N²) during SPOE config parsing; fix: hash table (99×) | **PATCHED** |
@ -801,6 +807,7 @@ stacks, Spark schemas — this is the dominant build cost.
| jenkins-0002 | Jenkins | `AbstractProject.java:1651` — `getChildJobs()` returns `List<Job>` scanned per upstream project | **PATCHED** |
| rubocop-0002 | RuboCop | `cop/style/redundant_self.rb:62` — `@allowed_send_nodes = []` — `include?` per `on_send` call | **PATCHED** |
| cmake-0001 | CMake | `cmComputeLinkDepends.cxx:1167,521,1363` — `std::find` on group vectors | **PATCHED** |
| make-0001 | GNU Make | `src/implicit.c:~796` — `pattern_search` inner loop `file->deps` linked-list walk `streq()` per dep per rule per file; O(R×D×F); fix: pre-built `unordered_set<string>` (336×) | **PATCHED** |
| swift-0001 | Swift | `RewriteContext.cpp:454` — assert-only, debug builds | NOT-WORTH-FIXING |
| debian-0001 | Debian | `DebianLinux.pm:140` — config parse, 6-item list | NOT-WORTH-FIXING |
| minecraft-0002 | Minecraft | `PistonStructureResolver` — `List<BlockPos>.contains()`, bounded at 12 | Unpatched |
@ -817,7 +824,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.
**542 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
**549 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
---
@ -1382,6 +1389,10 @@ infrastructure deployment. Unit test: 100× at V=100, exact triangular count con
**HashiCorp Vault** — **vault-0001 PATCHED.** `sanitizeAndUpsertGroup()` in `vault/identity_store_util.go` calls `strutil.StrListContains(memberGroupIDs, currentMemberGroupID)` — a linear scan — for each member in `currentMemberGroupIDs`. O(G²) total where G = group size. This function executes on every `PUT /identity/group/:id` API call. LDAP sync workflows and external IdP integrations routinely produce groups with hundreds to thousands of members. Fix: `memberGroupIDSet := make(map[string]bool)` before the loop. **72× op reduction at G=1000.**
**OpenSSH** — **openssh-0001/0002 PATCHED.** `kex_assemble_server_sig_algs()` in `kex.c` iterates over every sig-alg token using `match_list()` — a linear scan of the accumulated token list — to deduplicate entries during key-exchange advertisement. O(N²) where N = number of supported signature algorithms. openssh-0002: `kex_names_cat()` performs O(M×N+N²) work combining two token lists with per-token dedup. Both fire on every SSH handshake's key-exchange phase. Fix: `HashSet<String>` shadow for O(1) membership. **249× op reduction at N=500.**
**strongSwan** — **strongswan-0001 PATCHED.** `proposal_select()` in `libstrongswan/crypto/proposal/proposal.c` uses a five-level nested loop: client proposals × server proposals × algorithm types × client algorithms × server algorithms. Each inner comparison is a linear walk looking for matching algorithm IDs. The total work is O(P_c×P_s×T×A₁×A₂) per IKE/ESP SA negotiation. This code runs before authentication — an unauthenticated client controls the proposal list and can amplify CPU cost on the responder. Fix: pre-build a type-keyed `hashtable_t` from server algorithms for O(T) lookup per client entry. **4-5× per negotiation; unbounded DoS amplifier before fix.**
**Ansible** — **ans-0001/0002 PATCHED.** `Role.get_vars()` used `seen = []` for
transitive role dependency deduplication — O(D²) where D = transitive dep count. Ansible
codebase had a `TODO: re-examine dep loading` comment acknowledging the problem. Fix:

BIN
whitepaper/undefect-cwe407-2026-03-27.pdf
View file

Binary file not shown.