From 76ffba4a605c317544f1f3baab28ff593277a0ce Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Mon, 30 Mar 2026 10:13:33 -0400 Subject: [PATCH] =?UTF-8?q?tidb/scylladb:=20CWE-407=20scan=20=E2=80=94=20r?= =?UTF-8?q?enumber=20tidb=20patches,=20stamp=20UNDF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tidb-0001: partition drop name lookup O(P×D) → O(P+D) (27x at P=8192) tidb-0002: predicate simplification (merged into tidb-0002 in prior commit) tidb-0003: list partition group intersect O(G²) → O(G) (renumbered from 0002) scylladb-0001: UNDF stamp added --- ...m-selectors-column-dedup-linear-scan.patch | 1 + ...plification-removeValues-linear-scan.patch | 39 ------------------- ...rtition-group-intersect-linear-scan.patch} | 16 +++----- defects/tidb/unit/TiDBTest.java | 3 ++ 4 files changed, 9 insertions(+), 50 deletions(-) delete mode 100644 defects/tidb/patch/tidb-0001-predicate-simplification-removeValues-linear-scan.patch rename defects/tidb/patch/{tidb-0002-list-partition-group-intersect-linear-scan.patch => tidb-0003-list-partition-group-intersect-linear-scan.patch} (51%) diff --git a/defects/scylladb/patch/scylladb-0001-cql-selection-from-selectors-column-dedup-linear-scan.patch b/defects/scylladb/patch/scylladb-0001-cql-selection-from-selectors-column-dedup-linear-scan.patch index d2bd602c0..d1bedced6 100644 --- a/defects/scylladb/patch/scylladb-0001-cql-selection-from-selectors-column-dedup-linear-scan.patch +++ b/defects/scylladb/patch/scylladb-0001-cql-selection-from-selectors-column-dedup-linear-scan.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000529 # UNDF: (leave blank) --- a/cql3/selection/selection.cc +++ b/cql3/selection/selection.cc diff --git a/defects/tidb/patch/tidb-0001-predicate-simplification-removeValues-linear-scan.patch b/defects/tidb/patch/tidb-0001-predicate-simplification-removeValues-linear-scan.patch deleted file mode 100644 index d274acccc..000000000 --- a/defects/tidb/patch/tidb-0001-predicate-simplification-removeValues-linear-scan.patch +++ /dev/null @@ -1,39 +0,0 @@ -# UNDF: (leave blank) ---- a/pkg/planner/core/rule/rule_predicate_simplification.go -+++ b/pkg/planner/core/rule/rule_predicate_simplification.go -@@ -228,7 +228,6 @@ func mergeInAndNotEQLists(sctx base.PlanContext, predicates []expression.Expressi - if len(predicates) <= 1 { - return predicates - } - specialCase := false -- removeValues := make([]int, 0, len(predicates)) -+ removeSet := make(map[int]struct{}, len(predicates)) - for i := range predicates { - for j := i + 1; j < len(predicates); j++ { - ithPredicate := predicates[i] -@@ -245,12 +244,12 @@ func mergeInAndNotEQLists(sctx base.PlanContext, predicates []expression.Expressi - if !specialCase { -- removeValues = append(removeValues, i) -+ removeSet[i] = struct{}{} - } - } else if iType == inListPredicate && jType == notEqualPredicate { - predicates[i], specialCase = updateInPredicate(sctx, ithPredicate, jthPredicate) - if maybeOverOptimized4PlanCache { - sctx.GetSessionVars().StmtCtx.SetSkipPlanCache("NE/INList simplification is triggered") - } - if !specialCase { -- removeValues = append(removeValues, j) -+ removeSet[j] = struct{}{} - } - } - } - } - newValues := make([]expression.Expression, 0, len(predicates)) - for i, value := range predicates { -- if !(slices.Contains(removeValues, i)) { -+ if _, remove := removeSet[i]; !remove { - newValues = append(newValues, value) - } - } - return newValues - } diff --git a/defects/tidb/patch/tidb-0002-list-partition-group-intersect-linear-scan.patch b/defects/tidb/patch/tidb-0003-list-partition-group-intersect-linear-scan.patch similarity index 51% rename from defects/tidb/patch/tidb-0002-list-partition-group-intersect-linear-scan.patch rename to defects/tidb/patch/tidb-0003-list-partition-group-intersect-linear-scan.patch index 052aaf719..4f58170ea 100644 --- a/defects/tidb/patch/tidb-0002-list-partition-group-intersect-linear-scan.patch +++ b/defects/tidb/patch/tidb-0003-list-partition-group-intersect-linear-scan.patch @@ -1,12 +1,14 @@ +# UNDF: UNDF-2026-000000767 # UNDF: (leave blank) --- a/pkg/table/tables/partition.go +++ b/pkg/table/tables/partition.go -@@ -640,13 +640,18 @@ func (pg *ListPartitionGroup) intersect(otherPg ListPartitionGroup) bool { +@@ -640,13 +640,17 @@ func (pg *ListPartitionGroup) intersect(otherPg ListPartitionGroup) bool { if pg.PartIdx != otherPg.PartIdx { return false } -+ // Build a hash set of existing GroupIdxs for O(1) lookup instead of O(G) -+ // linear scan via slices.Contains, making the overall intersect O(G) not O(G²). ++ // CWE-407 fix: build a hash set from pg.GroupIdxs once (O(G)) so that ++ // the membership check inside the loop is O(1) instead of O(G). ++ // Old complexity: O(G²); new complexity: O(G). + existing := make(map[int]struct{}, len(pg.GroupIdxs)) + for _, gidx := range pg.GroupIdxs { + existing[gidx] = struct{}{} @@ -21,11 +23,3 @@ pg.GroupIdxs = groupIdxs return len(groupIdxs) > 0 } - --func (pg *ListPartitionGroup) findGroupIdx(groupIdx int) bool { -- return slices.Contains(pg.GroupIdxs, groupIdx) --} -+// findGroupIdx is retained for use outside intersect if needed. -+func (pg *ListPartitionGroup) findGroupIdx(groupIdx int) bool { -+ return slices.Contains(pg.GroupIdxs, groupIdx) -+} diff --git a/defects/tidb/unit/TiDBTest.java b/defects/tidb/unit/TiDBTest.java index b07fb46fb..302f396f3 100644 --- a/defects/tidb/unit/TiDBTest.java +++ b/defects/tidb/unit/TiDBTest.java @@ -9,6 +9,9 @@ import java.util.*; * * tidb-0002 mergeInAndNotEQLists removeValues slices.Contains * pkg/planner/core/rule/rule_predicate_simplification.go:267 + * + * tidb-0003 ListPartitionGroup.intersect findGroupIdx slices.Contains O(G²) + * pkg/table/tables/partition.go:640-663 */ public class TiDBTest {