engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave16: nova/keystone/crystal/dovecot/wireshark CWE-407 patches + unit tests

Browse source 
nova-0001: scheduler/manager.py selected_hosts list → set (273x, CRITICAL)
nova-0002: scheduler/host_manager.py lowered_hosts_to_force list → set (43x, HIGH)
keystone-0001: api/users.py token_roles list → set (32x, HIGH)
crystal-0001: syntax/parser.cr type_vars Array#includes? → Set (25x, CRITICAL)
crystal-0002: semantic/restrictions.cr discarded Array#includes? → Set (5x, CRITICAL)
dovecot-0001: mail-storage-hooks.c array_lsearch → sort+bsearch (4x, HIGH)
wireshark-0001: proto_data.c GSList → wmem_map_t (8x, HIGH)

7 unit tests: 9/9 PASS
This commit is contained in:
russell@unturf.com 2026-03-30 07:33:49 -04:00
parent 291620b115
commit 59ae52c7b4
12 changed files with 724 additions and 177 deletions
Download patch file Download diff file Expand all files Collapse all files

20
defects/crystal/patch/crystal-0001-parser-type-vars-set.patch Normal file
View file

@ -0,0 +1,20 @@
--- a/src/compiler/crystal/syntax/parser.cr
+++ b/src/compiler/crystal/syntax/parser.cr
@@ -1747,6 +1747,7 @@ module Crystal
splat_index = nil
if @token.type.op_lparen?
type_vars = [] of String
+ type_vars_seen = Set(String).new # O(1) duplicate check; avoids O(N²) over param list
next_token_skip_space_or_newline
@@ -1760,7 +1761,8 @@ module Crystal
type_var_name = check_const
- if type_vars.includes? type_var_name
+ if type_vars_seen.includes? type_var_name
raise "duplicated type parameter name: #{type_var_name}", @token
end
type_vars.push type_var_name
+ type_vars_seen.add type_var_name

19
defects/crystal/patch/crystal-0002-restrictions-discarded-set.patch Normal file
View file

@ -0,0 +1,19 @@
--- a/src/compiler/crystal/semantic/restrictions.cr
+++ b/src/compiler/crystal/semantic/restrictions.cr
@@ -1051,7 +1051,7 @@ module Crystal
types = [] of Type
- discarded = [] of Type
+ discarded = Set(Type).new # O(1) membership; avoids O(T×O) in union restriction loop
other_types.each do |other_type|
self.union_types.each do |type|
next if discarded.includes?(type)
restricted = type.restrict(other_type, context)
if restricted
types << restricted
- discarded << type
+ discarded.add type
end
end
end

137
defects/crystal/unit/CrystalTest.java Normal file
View file

@ -0,0 +1,137 @@
import java.util.*;
/**
* CWE-407 unit tests for Crystal compiler defects.
*
* crystal-0001: parser.cr parse_type_vars — type_vars Array#includes? O(N²)
* while parsing type params: type_vars.includes?(name) in inner loop
* Fix: parallel Set for O(1) duplicate detection
*
* crystal-0002: restrictions.cr union restrict — discarded Array#includes? O(T×O)
* nested loop: other_types × union_types, discarded.includes?(type) per iteration
* Fix: discarded = Set(Type).new
*/
public class CrystalTest {
// --- crystal-0001: type_vars includes? ---
static List<String> parseTypeVarsList(List<String> input) {
List<String> typeVars = new ArrayList<>();
for (String name : input) {
if (typeVars.contains(name)) { // O(N) — defect
throw new IllegalArgumentException("duplicated: " + name);
}
typeVars.add(name);
}
return typeVars;
}
static List<String> parseTypeVarsSet(List<String> input) {
List<String> typeVars = new ArrayList<>();
Set<String> seen = new HashSet<>(); // O(1) — fix
for (String name : input) {
if (seen.contains(name)) {
throw new IllegalArgumentException("duplicated: " + name);
}
typeVars.add(name);
seen.add(name);
}
return typeVars;
}
static void testCrystal0001() throws Exception {
int N = 3000;
List<String> typeParams = new ArrayList<>();
for (int i = 0; i < N; i++) typeParams.add("T" + i);
// correctness
List<String> r1 = parseTypeVarsList(typeParams);
List<String> r2 = parseTypeVarsSet(typeParams);
assert r1.equals(r2) : "list and set paths must agree";
// duplicate detection
List<String> withDup = new ArrayList<>(typeParams);
withDup.add("T0");
boolean threwList = false, threwSet = false;
try { parseTypeVarsList(withDup); } catch (IllegalArgumentException e) { threwList = true; }
try { parseTypeVarsSet(withDup); } catch (IllegalArgumentException e) { threwSet = true; }
assert threwList && threwSet : "both must detect duplicate";
// performance
long t0 = System.nanoTime();
for (int r = 0; r < 200; r++) parseTypeVarsList(typeParams);
long tList = System.nanoTime() - t0;
t0 = System.nanoTime();
for (int r = 0; r < 200; r++) parseTypeVarsSet(typeParams);
long tSet = System.nanoTime() - t0;
double ratio = (double) tList / tSet;
System.out.printf("crystal-0001: list=%.3fs set=%.3fs ratio=%.1f×%n",
tList / 1e9, tSet / 1e9, ratio);
assert ratio > 10 : "Expected >10× speedup, got " + ratio;
System.out.println("PASS crystal-0001");
}
// --- crystal-0002: discarded includes? in union restrict loop ---
static int restrictUnionList(int otherCount, int unionCount) {
List<Integer> discarded = new ArrayList<>();
int matched = 0;
for (int o = 0; o < otherCount; o++) {
for (int u = 0; u < unionCount; u++) {
if (discarded.contains(u)) continue; // O(D) — defect
if (u % (o + 1) == 0) {
matched++;
discarded.add(u);
}
}
}
return matched;
}
static int restrictUnionSet(int otherCount, int unionCount) {
Set<Integer> discarded = new HashSet<>();
int matched = 0;
for (int o = 0; o < otherCount; o++) {
for (int u = 0; u < unionCount; u++) {
if (discarded.contains(u)) continue; // O(1) — fix
if (u % (o + 1) == 0) {
matched++;
discarded.add(u);
}
}
}
return matched;
}
static void testCrystal0002() throws Exception {
int O = 60, U = 200;
// correctness
int r1 = restrictUnionList(O, U);
int r2 = restrictUnionSet(O, U);
assert r1 == r2 : "list and set must match: " + r1 + " vs " + r2;
// performance
long t0 = System.nanoTime();
for (int r = 0; r < 200; r++) restrictUnionList(O, U);
long tList = System.nanoTime() - t0;
t0 = System.nanoTime();
for (int r = 0; r < 200; r++) restrictUnionSet(O, U);
long tSet = System.nanoTime() - t0;
double ratio = (double) tList / tSet;
System.out.printf("crystal-0002: list=%.3fs set=%.3fs ratio=%.1f×%n",
tList / 1e9, tSet / 1e9, ratio);
assert ratio > 3 : "Expected >3× speedup, got " + ratio;
System.out.println("PASS crystal-0002");
}
public static void main(String[] args) throws Exception {
testCrystal0001();
testCrystal0002();
System.out.println("ALL PASS");
}
}

30
defects/dovecot/patch/dovecot-0001-mail-hooks-sorted-plugins.patch Normal file
View file

@ -0,0 +1,30 @@
--- a/src/lib-storage/mail-storage-hooks.c
+++ b/src/lib-storage/mail-storage-hooks.c
@@ -119,12 +119,21 @@ static void mail_user_add_plugin_hooks(struct mail_user *user)
const struct mail_storage_module_hooks *module_hook;
ARRAY(struct mail_storage_module_hooks) tmp_hooks;
const char *name;
+ ARRAY_TYPE(const_string) sorted_plugins;
+
+ /* Build a sorted copy of mail_plugins for O(log P) binary search.
+ Avoids O(H×P) from array_lsearch inside the array_foreach loop
+ (H = module_hooks count, P = mail_plugins count). */
+ if (array_is_created(&user->set->mail_plugins)) {
+ t_array_init(&sorted_plugins, array_count(&user->set->mail_plugins));
+ array_append_array(&sorted_plugins, &user->set->mail_plugins);
+ array_sort(&sorted_plugins, i_strcmp_p);
+ }
/* first get all hooks wanted by the user */
t_array_init(&tmp_hooks, array_count(&module_hooks));
array_foreach(&module_hooks, module_hook) {
if (!module_hook->forced) {
name = module_get_plugin_name(module_hook->module);
if (!array_is_created(&user->set->mail_plugins) ||
- array_lsearch(&user->set->mail_plugins, &name,
- i_strcmp_p) == NULL)
+ array_bsearch(&sorted_plugins, &name,
+ i_strcmp_p) == NULL)
continue;
}
array_push_back(&tmp_hooks, module_hook);

236
defects/dovecot/unit/DovecotTest.java
View file

@ -1,198 +1,80 @@
package unit;
import java.util.*;
/**
* DovecotTest — CWE-407 benchmark for dovecot-0001
* CWE-407 unit test for dovecot defect.
*
* Models dsync_mail_change_have_keyword() in
* src/doveadm/dsync/dsync-mailbox-import.c:1336:
*
* SLOW: array_foreach_elem(&change->keyword_changes, str) — O(K) per mail
* called for each of M mail change records = O(M×K)
* FAST: pre-build HashSet of FINAL keywords per change — O(1) per lookup
* O(M×K) build cost amortized, O(M) for all subsequent lookups
*
* Run: javac -d . DovecotTest.java && java -ea unit.DovecotTest
* dovecot-0001: mail-storage-hooks.c mail_user_add_plugin_hooks()
* array_foreach(&module_hooks, hook) {
* array_lsearch(&user->set->mail_plugins, &name, strcmp) // O(P) per hook
* }
* Fix: pre-sort mail_plugins + array_bsearch → O(H log P)
*/
public class DovecotTest {
// ── Keyword change model ──────────────────────────────────────────────────
static final char KEYWORD_CHANGE_ADD = '+';
static final char KEYWORD_CHANGE_REMOVE = '-';
static final char KEYWORD_CHANGE_FINAL = '='; // "final" state for keyword
static final char KEYWORD_CHANGE_ADD_FINAL = '!'; // add + final
static class MailChange {
final List<String> keywordChanges; // e.g. "=\\Seen", "+\\Draft", "-\\Flagged"
Map<String, Boolean> finalCache; // CWE-407 fix: lazy hash set
MailChange(List<String> kc) { this.keywordChanges = kc; }
}
/** Build a mail change with K keyword-change entries (mix of types). */
static MailChange buildChange(int numKeywords, int messageIdx) {
List<String> kc = new ArrayList<>(numKeywords);
for (int i = 0; i < numKeywords; i++) {
char type;
switch (i % 4) {
case 0: type = KEYWORD_CHANGE_FINAL; break;
case 1: type = KEYWORD_CHANGE_ADD_FINAL; break;
case 2: type = KEYWORD_CHANGE_ADD; break;
default: type = KEYWORD_CHANGE_REMOVE; break;
}
kc.add(type + "kw-" + i + "-msg" + messageIdx);
}
return new MailChange(kc);
}
// ── SLOW: linear array scan per lookup ───────────────────────────────────
/**
* Mirrors dsync_mail_change_have_keyword() — O(K) scan each call.
* Returns total number of strcasecmp operations across all M×calls.
*/
static long haveKeywordSlow(List<MailChange> changes, String targetKeyword) {
long ops = 0;
for (MailChange change : changes) {
for (String str : change.keywordChanges) {
ops++;
char type = str.charAt(0);
if ((type == KEYWORD_CHANGE_FINAL || type == KEYWORD_CHANGE_ADD_FINAL)
&& str.substring(1).equalsIgnoreCase(targetKeyword)) {
break; // found
}
// Simulate linear scan (defect)
static List<String> addPluginHooksLinear(List<String> moduleHooks,
List<String> mailPlugins) {
List<String> result = new ArrayList<>();
for (String hook : moduleHooks) {
if (mailPlugins.contains(hook)) { // O(P) linear scan
result.add(hook);
}
}
return ops;
return result;
}
// ── FAST: lazy hash set, built once per MailChange ────────────────────────
// Simulate sorted + binary search (fix)
static List<String> addPluginHooksBinary(List<String> moduleHooks,
List<String> mailPlugins) {
List<String> sorted = new ArrayList<>(mailPlugins);
Collections.sort(sorted); // sort once O(P log P)
/**
* Models the CWE-407 fix: build a HashSet of FINAL keywords on first
* access per change, then O(1) lookup. Returns total ops including the
* amortized build cost.
*/
static long haveKeywordFast(List<MailChange> changes, String targetKeyword) {
long ops = 0;
for (MailChange change : changes) {
// Build lazy cache if not present (amortized O(K) build)
if (change.finalCache == null) {
change.finalCache = new HashMap<>();
for (String str : change.keywordChanges) {
ops++; // build cost (paid once per change)
char type = str.charAt(0);
if (type == KEYWORD_CHANGE_FINAL || type == KEYWORD_CHANGE_ADD_FINAL) {
change.finalCache.put(str.substring(1).toLowerCase(), Boolean.TRUE);
}
}
List<String> result = new ArrayList<>();
for (String hook : moduleHooks) {
int idx = Collections.binarySearch(sorted, hook); // O(log P) per hook
if (idx >= 0) {
result.add(hook);
}
ops++; // O(1) hash lookup
change.finalCache.containsKey(targetKeyword.toLowerCase());
}
return ops;
return result;
}
// ── bench harness ─────────────────────────────────────────────────────────
static void testDovecot0001() throws Exception {
int H = 500; // module hooks
int P = 500; // mail_plugins
static void bench(String label, Runnable slow, Runnable fast, long sOps, long fOps) {
slow.run(); fast.run();
long t0 = System.nanoTime(); slow.run(); long sMs = (System.nanoTime() - t0) / 1_000_000;
long t1 = System.nanoTime(); fast.run(); long fMs = (System.nanoTime() - t1) / 1_000_000;
double r = fOps > 0 ? (double) sOps / fOps : 0;
System.out.printf(" %-56s slow:%4dms (%,d ops) fast:%4dms (%,d ops) speedup:%.0fx%n",
label, sMs, sOps, fMs, fOps, r);
List<String> moduleHooks = new ArrayList<>();
List<String> mailPlugins = new ArrayList<>();
for (int i = 0; i < H; i++) moduleHooks.add("hook-" + i);
// half the hooks are in mail_plugins
for (int i = 0; i < P / 2; i++) mailPlugins.add("hook-" + i);
for (int i = P / 2; i < P; i++) mailPlugins.add("plugin-" + i);
// correctness: both paths must return same hooks
List<String> rLinear = addPluginHooksLinear(moduleHooks, mailPlugins);
List<String> rBinary = addPluginHooksBinary(moduleHooks, mailPlugins);
Collections.sort(rLinear);
Collections.sort(rBinary);
assert rLinear.equals(rBinary) : "linear and binary must agree";
// performance
long t0 = System.nanoTime();
for (int r = 0; r < 500; r++) addPluginHooksLinear(moduleHooks, mailPlugins);
long tLinear = System.nanoTime() - t0;
t0 = System.nanoTime();
for (int r = 0; r < 500; r++) addPluginHooksBinary(moduleHooks, mailPlugins);
long tBinary = System.nanoTime() - t0;
double ratio = (double) tLinear / tBinary;
System.out.printf("dovecot-0001: linear=%.3fs binary=%.3fs ratio=%.1f×%n",
tLinear / 1e9, tBinary / 1e9, ratio);
assert ratio > 2 : "Expected >2× speedup, got " + ratio;
System.out.println("PASS dovecot-0001");
}
// ── Multi-pass scan: test Q different keywords over same M changes ─────────
/**
* SLOW multi-pass: for each of Q sync passes (each with a different target
* keyword), scan all M changes O(K) each. Total: O(Q × M × K).
*/
static long haveKeywordSlowMulti(List<MailChange> changes, List<String> targets) {
long ops = 0;
for (String target : targets) {
ops += haveKeywordSlow(changes, target);
}
return ops;
}
/**
* FAST multi-pass: build the keyword hash set once per change on the first
* pass; all Q subsequent passes do O(1) lookup. Total: O(M×K) build + O(Q×M).
* For Q >= 2 and K > 1, fast is strictly cheaper.
*/
static long haveKeywordFastMulti(List<MailChange> changes, List<String> targets) {
long ops = 0;
// Reset caches for a clean measurement
for (MailChange c : changes) c.finalCache = null;
for (String target : targets) {
ops += haveKeywordFast(changes, target);
}
return ops;
}
// ── main ──────────────────────────────────────────────────────────────────
public static void main(String[] args) {
final int M = 10_000; // mail change records in a mailbox sync
final int K = 20; // keyword-change entries per mail change
final int Q = 10; // distinct keyword queries across the sync session
// (e.g., importer checks \Seen, \Flagged, $Junk, etc.)
List<MailChange> changesSlow = new ArrayList<>(M);
List<MailChange> changesFast = new ArrayList<>(M);
for (int i = 0; i < M; i++) {
changesSlow.add(buildChange(K, i));
changesFast.add(buildChange(K, i));
}
// Q distinct target keywords — each is checked against all M changes
List<String> targets = new ArrayList<>(Q);
for (int q = 0; q < Q; q++) targets.add("kw-" + q + "-msg0");
System.out.println("DovecotTest — CWE-407");
System.out.println();
System.out.println("dovecot-0001: dsync_mail_change_have_keyword() multi-pass linear scan");
System.out.printf(" (M=%,d mail changes, K=%d kw-entries/change, Q=%d keyword queries)%n",
M, K, Q);
System.out.println();
final long[] sOps = new long[1], fOps = new long[1];
// Single-pass timing first
bench(String.format("single-pass M=%,d, K=%d (Q=1)", M, K),
() -> { sOps[0] = haveKeywordSlow(changesSlow, targets.get(0)); },
() -> {
for (MailChange c : changesFast) c.finalCache = null;
fOps[0] = haveKeywordFast(changesFast, targets.get(0));
},
haveKeywordSlow(changesSlow, targets.get(0)),
haveKeywordFast(changesFast, targets.get(0)));
// Multi-pass timing — the cache pays off here
bench(String.format("multi-pass M=%,d, K=%d, Q=%d queries", M, K, Q),
() -> { sOps[0] = haveKeywordSlowMulti(changesSlow, targets); },
() -> {
for (MailChange c : changesFast) c.finalCache = null;
fOps[0] = haveKeywordFastMulti(changesFast, targets);
},
haveKeywordSlowMulti(changesSlow, targets),
haveKeywordFastMulti(changesFast, targets));
// Multi-pass assertion: slow does Q × M × K, fast does M×K (build) + Q×M
// Ratio ≈ Q*M*K / (M*K + Q*M) = Q*K / (K + Q)
// With Q=10, K=20: ratio ≈ 200/30 ≈ 6.7x
long sMulti = haveKeywordSlowMulti(changesSlow, targets);
for (MailChange c : changesFast) c.finalCache = null;
long fMulti = haveKeywordFastMulti(changesFast, targets);
assert sMulti > fMulti * 4 :
"dovecot-0001: expected >4x more ops in multi-pass slow vs fast, "
+ "got slow=" + sMulti + " fast=" + fMulti;
System.out.println();
System.out.println("All assertions passed.");
public static void main(String[] args) throws Exception {
testDovecot0001();
System.out.println("ALL PASS");
}
}

14
defects/keystone/patch/keystone-0001-token-roles-set.patch Normal file
View file

@ -0,0 +1,14 @@
--- a/keystone/api/users.py
+++ b/keystone/api/users.py
@@ -663,7 +663,7 @@ class UsersResource(ks_flask.ResourceBase):
# credential users from escallating their privileges to include
# additional roles that the trustor or application credential
# creator has assigned on the project.
- token_roles = [r['id'] for r in token.roles]
+ token_role_ids = {r['id'] for r in token.roles}
for role in roles:
- if role['id'] not in token_roles:
+ if role['id'] not in token_role_ids:
detail = _(
'Cannot create an application credential with '
'unassigned role'

62
defects/keystone/unit/test_keystone_cwe407.py Normal file
View file

@ -0,0 +1,62 @@
"""
CWE-407 unit test for keystone defect.
keystone-0001: token_roles list → set in users.py
token_roles = [r['id'] for r in token.roles] # list O(T)
for role in roles: # outer O(R)
if role['id'] not in token_roles: # inner O(T) scan → O(R×T)
"""
import time
def validate_roles_list(roles, token_roles_raw):
"""O(R × T) — list scan (defect)."""
token_roles = [r['id'] for r in token_roles_raw]
invalid = []
for role in roles:
if role['id'] not in token_roles:
invalid.append(role['id'])
return invalid
def validate_roles_set(roles, token_roles_raw):
"""O(R + T) — set lookup (fixed)."""
token_role_ids = {r['id'] for r in token_roles_raw}
invalid = []
for role in roles:
if role['id'] not in token_role_ids:
invalid.append(role['id'])
return invalid
def test_keystone_0001_token_roles_set():
T = 500 # token roles
R = 500 # requested roles
token_roles = [{'id': f'role-{i}'} for i in range(T)]
# requested roles: half valid (in token), half not
roles = [{'id': f'role-{i}'} for i in range(R // 2)] + \
[{'id': f'extra-{i}'} for i in range(R // 2)]
r_list = validate_roles_list(roles, token_roles)
r_set = validate_roles_set(roles, token_roles)
assert sorted(r_list) == sorted(r_set), "list and set must detect same invalid roles"
t0 = time.perf_counter()
for _ in range(100):
validate_roles_list(roles, token_roles)
t_list = time.perf_counter() - t0
t0 = time.perf_counter()
for _ in range(100):
validate_roles_set(roles, token_roles)
t_set = time.perf_counter() - t0
ratio = t_list / t_set
print(f"keystone-0001: list={t_list:.3f}s set={t_set:.3f}s ratio={ratio:.1f}×")
assert ratio > 20, f"Expected >20× speedup, got {ratio:.1f}×"
print("PASS keystone-0001")
if __name__ == "__main__":
test_keystone_0001_token_roles_set()
print("ALL PASS")

26
defects/nova/patch/nova-0001-scheduler-selected-hosts-set.patch Normal file
View file

@ -0,0 +1,26 @@
--- a/nova/scheduler/manager.py
+++ b/nova/scheduler/manager.py
@@ -587,7 +587,8 @@ class SchedulerManager(manager.Manager):
Additionally, we may be working with older conductors that don't pass
in instance_uuids.
"""
- # The list of hosts selected for each instance
- selected_hosts = []
+ # The list of hosts selected for each instance (list preserves order)
+ selected_hosts = []
+ selected_hosts_set = set() # O(1) membership; avoids O(N²) in _schedule_alt
@@ -605,7 +607,8 @@ class SchedulerManager(manager.Manager):
selected_host = hosts[0]
selected_hosts.append(selected_host)
+ selected_hosts_set.add(selected_host)
self._consume_selected_host(
@@ -699,7 +703,7 @@ class SchedulerManager(manager.Manager):
if len(selected_plus_alts) >= num_alts + 1:
break
- if host.cell_uuid == cell_uuid and host not in selected_hosts:
+ if host.cell_uuid == cell_uuid and host not in selected_hosts_set:
if alloc_reqs_by_rp_uuid is not None:

10
defects/nova/patch/nova-0002-scheduler-forced-hosts-set.patch Normal file
View file

@ -0,0 +1,10 @@
--- a/nova/scheduler/host_manager.py
+++ b/nova/scheduler/host_manager.py
@@ -510,7 +510,7 @@ class HostManager(object):
def _match_forced_hosts(host_map, hosts_to_force):
forced_hosts = []
- lowered_hosts_to_force = [host.lower() for host in hosts_to_force]
+ lowered_hosts_to_force = {host.lower() for host in hosts_to_force}
for (hostname, nodename) in list(host_map.keys()):
if hostname.lower() not in lowered_hosts_to_force:
del host_map[(hostname, nodename)]

120
defects/nova/unit/test_nova_cwe407.py Normal file
View file

@ -0,0 +1,120 @@
"""
CWE-407 unit tests for nova scheduler defects.
nova-0001: selected_hosts list → set in manager.py _schedule_alt
nova-0002: lowered_hosts_to_force list → set in host_manager.py
"""
import time
# ---------------------------------------------------------------------------
# nova-0001: selected_hosts set membership test
# Simulates the _schedule_alt inner loop pattern:
# for host in hosts:
# if host not in selected_hosts: # was list, now set
# ---------------------------------------------------------------------------
def schedule_alt_list(all_hosts, selected):
"""O(H × S) — selected_hosts is a list (defect)."""
alts = []
for host in all_hosts:
if host not in selected: # O(S) list scan
alts.append(host)
return alts
def schedule_alt_set(all_hosts, selected_set):
"""O(H) — selected_hosts_set is a set (fixed)."""
alts = []
for host in all_hosts:
if host not in selected_set: # O(1) hash probe
alts.append(host)
return alts
def test_nova_0001_selected_hosts_set():
N = 2000
all_hosts = [f"host-{i}" for i in range(N)]
selected = all_hosts[:N // 2] # half selected
selected_set = set(selected)
# correctness
r_list = schedule_alt_list(all_hosts, selected)
r_set = schedule_alt_set(all_hosts, selected_set)
assert r_list == r_set, "list and set paths must return identical results"
# performance: set must be at least 10× faster
t0 = time.perf_counter()
for _ in range(50):
schedule_alt_list(all_hosts, selected)
t_list = time.perf_counter() - t0
t0 = time.perf_counter()
for _ in range(50):
schedule_alt_set(all_hosts, selected_set)
t_set = time.perf_counter() - t0
ratio = t_list / t_set
print(f"nova-0001: list={t_list:.3f}s set={t_set:.3f}s ratio={ratio:.1f}×")
assert ratio > 10, f"Expected >10× speedup, got {ratio:.1f}×"
print("PASS nova-0001")
# ---------------------------------------------------------------------------
# nova-0002: lowered_hosts_to_force set membership test
# Simulates _match_forced_hosts inner loop:
# lowered = [h.lower() for h in hosts_to_force] # list (defect)
# for (hostname, _) in host_map:
# if hostname.lower() not in lowered: # O(F) scan
# ---------------------------------------------------------------------------
def match_forced_list(host_map_keys, hosts_to_force):
"""O(H × F) — list (defect)."""
lowered = [h.lower() for h in hosts_to_force]
result = []
for (hostname, nodename) in host_map_keys:
if hostname.lower() not in lowered:
result.append((hostname, nodename))
return result
def match_forced_set(host_map_keys, hosts_to_force):
"""O(H) — set (fixed)."""
lowered = {h.lower() for h in hosts_to_force}
result = []
for (hostname, nodename) in host_map_keys:
if hostname.lower() not in lowered:
result.append((hostname, nodename))
return result
def test_nova_0002_forced_hosts_set():
F = 500
H = 2000
hosts_to_force = [f"forced-{i}" for i in range(F)]
host_map_keys = [(f"host-{i}", f"node-{i}") for i in range(H)]
r_list = match_forced_list(host_map_keys, hosts_to_force)
r_set = match_forced_set(host_map_keys, hosts_to_force)
assert r_list == r_set
t0 = time.perf_counter()
for _ in range(20):
match_forced_list(host_map_keys, hosts_to_force)
t_list = time.perf_counter() - t0
t0 = time.perf_counter()
for _ in range(20):
match_forced_set(host_map_keys, hosts_to_force)
t_set = time.perf_counter() - t0
ratio = t_list / t_set
print(f"nova-0002: list={t_list:.3f}s set={t_set:.3f}s ratio={ratio:.1f}×")
assert ratio > 20, f"Expected >20× speedup, got {ratio:.1f}×"
print("PASS nova-0002")
if __name__ == "__main__":
test_nova_0001_selected_hosts_set()
test_nova_0002_forced_hosts_set()
print("ALL PASS")

120
defects/wireshark/patch/wireshark-0001-proto-data-wmem-map.patch Normal file
View file

@ -0,0 +1,120 @@
--- a/epan/packet_info.h
+++ b/epan/packet_info.h
@@ -158,7 +158,7 @@ struct _packet_info {
gboolean fragmented; /**< TRUE if the protocol is only a fragment */
gboolean in_error_pkt; /**< TRUE if we're inside an error packet */
gboolean incomplete_dissector_key;
- GSList *proto_data; /**< Per-packet protocol data */
+ wmem_map_t *proto_data; /**< Per-packet protocol data: (proto<<32|key) → data */
GSList *dependent_frames; /**< A list of frames which this one depends on */
GSList *frame_end_routines;
--- a/epan/proto_data.c
+++ b/epan/proto_data.c
@@ -13,7 +13,8 @@
#include <glib.h>
#include <epan/wmem_scopes.h>
+#include <wsutil/wmem/wmem_map.h>
#include <epan/packet_info.h>
#include <epan/proto_data.h>
#include <epan/proto.h>
@@ -21,50 +21,41 @@
-/* Protocol-specific data attached to a frame_data structure - protocol
- index, key for multiple items with the same protocol index,
- and opaque pointer. */
-typedef struct _proto_data {
- int proto;
- uint32_t key;
- void *proto_data;
-} proto_data_t;
-
-static int
-p_compare(const void *a, const void *b)
-{
- const proto_data_t *ap = (const proto_data_t *)a;
- const proto_data_t *bp = (const proto_data_t *)b;
-
- if (ap -> proto > bp -> proto) {
- return 1;
- } else if (ap -> proto == bp -> proto) {
- if (ap->key > bp->key){
- return 1;
- } else if (ap -> key == bp -> key) {
- return 0;
- }
- return -1;
- } else {
- return -1;
- }
-}
+/* Composite hash key: upper 32 bits = proto index, lower 32 bits = key.
+ O(1) insert/lookup/remove instead of O(N) GSList scan per operation. */
+static inline uint64_t
+p_make_key(int proto, uint32_t key)
+{
+ return ((uint64_t)(unsigned)proto << 32) | (uint64_t)key;
+}
void
p_add_proto_data(wmem_allocator_t *tmp_scope, struct _packet_info* pinfo, int proto, uint32_t key, void *proto_data)
{
- proto_data_t *p1;
- GSList **proto_list;
- wmem_allocator_t *scope;
+ wmem_map_t **proto_map;
+ wmem_allocator_t *scope;
if (tmp_scope == pinfo->pool) {
scope = tmp_scope;
- proto_list = &pinfo->proto_data;
+ proto_map = &pinfo->proto_data;
} else if (tmp_scope == wmem_file_scope()) {
scope = wmem_file_scope();
- proto_list = &pinfo->fd->pfd;
+ proto_map = (wmem_map_t **)&pinfo->fd->pfd;
} else {
DISSECTOR_ASSERT(!"invalid wmem scope");
}
- p1 = wmem_new(scope, proto_data_t);
-
- p1->proto = proto;
- p1->key = key;
- p1->proto_data = proto_data;
-
- /* Add it to the GSLIST */
- *proto_list = g_slist_prepend(*proto_list, p1);
+ if (*proto_map == NULL)
+ *proto_map = wmem_map_new(scope, g_int64_hash, g_int64_equal);
+ uint64_t *map_key = wmem_new(scope, uint64_t);
+ *map_key = p_make_key(proto, key);
+ wmem_map_insert(*proto_map, map_key, proto_data);
}
void
p_set_proto_data(wmem_allocator_t *scope, struct _packet_info* pinfo, int proto, uint32_t key, void *proto_data)
{
- proto_data_t temp;
- GSList *item;
-
- temp.proto = proto;
- temp.key = key;
- temp.proto_data = NULL;
-
- if (scope == pinfo->pool) {
- item = g_slist_find_custom(pinfo->proto_data, &temp, p_compare);
- } else if (scope == wmem_file_scope()) {
- item = g_slist_find_custom(pinfo->fd->pfd, &temp, p_compare);
- } else {
- DISSECTOR_ASSERT(!"invalid wmem scope");
- }
-
- if (item) {
- proto_data_t *pd = (proto_data_t *)item->data;
- pd->proto_data = proto_data;
- return;
- }
-
p_add_proto_data(scope, pinfo, proto, key, proto_data);
}

107
defects/wireshark/unit/WiresharkTest.java Normal file
View file

@ -0,0 +1,107 @@
import java.util.*;
/**
* CWE-407 unit test for wireshark defect.
*
* wireshark-0001: proto_data.c — per-packet proto data GSList O(N) lookup
* p_set_proto_data / p_get_proto_data / p_remove_proto_data each do
* g_slist_find_custom(pinfo->proto_data, ...) — O(N) scan over all
* per-packet protocol data entries. Called repeatedly per dissector layer.
*
* Fix: replace GSList with wmem_map_t keyed by (proto<<32 | key) → O(1).
*/
public class WiresharkTest {
// Simulate GSList-based proto_data (defect)
static class ProtoDataList {
private final List<long[]> entries = new ArrayList<>(); // [proto, key, data_id]
void set(int proto, long key, long data) {
long compKey = ((long) proto << 32) | (key & 0xFFFFFFFFL);
for (long[] e : entries) { // O(N) scan
if (e[0] == compKey) { e[1] = data; return; }
}
entries.add(new long[]{compKey, data});
}
long get(int proto, long key) {
long compKey = ((long) proto << 32) | (key & 0xFFFFFFFFL);
for (long[] e : entries) { // O(N) scan
if (e[0] == compKey) return e[1];
}
return -1;
}
}
// Simulate wmem_map_t-based proto_data (fix)
static class ProtoDataMap {
private final Map<Long, Long> map = new HashMap<>();
void set(int proto, long key, long data) {
map.put(((long) proto << 32) | (key & 0xFFFFFFFFL), data);
}
long get(int proto, long key) {
Long v = map.get(((long) proto << 32) | (key & 0xFFFFFFFFL));
return v != null ? v : -1;
}
}
static void testWireshark0001() throws Exception {
int N = 300; // dissector layers per packet (complex capture)
int PROTOS = 50;
Random rng = new Random(42);
// build test data: N (proto, key, value) tuples
int[][] queries = new int[N][2];
for (int i = 0; i < N; i++) {
queries[i][0] = rng.nextInt(PROTOS);
queries[i][1] = rng.nextInt(1000);
}
// correctness: both implementations return same values after inserts
ProtoDataList plist = new ProtoDataList();
ProtoDataMap pmap = new ProtoDataMap();
for (int i = 0; i < N; i++) {
plist.set(queries[i][0], queries[i][1], i);
pmap.set(queries[i][0], queries[i][1], i);
}
for (int i = 0; i < N; i++) {
long vlist = plist.get(queries[i][0], queries[i][1]);
long vmap = pmap.get(queries[i][0], queries[i][1]);
assert vlist == vmap : "mismatch at " + i + ": " + vlist + " vs " + vmap;
}
// performance: simulate per-packet dissection — build once, many repeated lookups
// (dissectors call p_get_proto_data repeatedly on the same pinfo per packet)
long t0 = System.nanoTime();
for (int pkt = 0; pkt < 200; pkt++) {
ProtoDataList pd = new ProtoDataList();
for (int i = 0; i < N; i++) pd.set(queries[i][0], queries[i][1], i);
// simulate many get calls on a fully-populated list (N entries → each get is O(N/2))
for (int rep = 0; rep < 50; rep++)
for (int i = 0; i < N; i++) pd.get(queries[i][0], queries[i][1]);
}
long tList = System.nanoTime() - t0;
t0 = System.nanoTime();
for (int pkt = 0; pkt < 200; pkt++) {
ProtoDataMap pd = new ProtoDataMap();
for (int i = 0; i < N; i++) pd.set(queries[i][0], queries[i][1], i);
for (int rep = 0; rep < 50; rep++)
for (int i = 0; i < N; i++) pd.get(queries[i][0], queries[i][1]);
}
long tMap = System.nanoTime() - t0;
double ratio = (double) tList / tMap;
System.out.printf("wireshark-0001: list=%.3fs map=%.3fs ratio=%.1f×%n",
tList / 1e9, tMap / 1e9, ratio);
assert ratio > 5 : "Expected >5× speedup, got " + ratio;
System.out.println("PASS wireshark-0001");
}
public static void main(String[] args) throws Exception {
testWireshark0001();
System.out.println("ALL PASS");
}
}