engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pygame/libgdx: CWE-407 findings

Browse source 
pygame: CLEAN — runtime uses dict/set throughout (O(1) membership)
libgdx-0002: ModelBuilder.rebuildReferences Array.contains O(P*M) — patch
libgdx-0005: Stage.touchDragged touchFocuses.contains O(F^2) — patch
libgdx-0006: AfterAction.delegate currentActions.indexOf O(W*A) per frame — patch
unit: extend LibGDXTest to 7 tests, all PASS (50x-1971x speedup measured)
This commit is contained in:
russell@unturf.com 2026-03-30 09:13:34 -04:00
parent ec395a01fc
commit 783e406633
11 changed files with 816 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

59
defects/consul/patch/consul-0001-summarize-services-tag-dedup-map.patch Normal file
View file

@ -0,0 +1,59 @@
# UNDF: (leave blank)
--- a/agent/ui_endpoint.go
+++ b/agent/ui_endpoint.go
@@ -516,6 +516,8 @@ func summarizeServices(dump structs.ServiceDump, cfg *config.RuntimeConfig, dc s
sum := getService(psn)
svc := csn.Service
+ // nodesSet and tagsSet are transient per-summary dedup helpers; they are
+ // stored on ServiceSummary during the loop and cleared before return.
- found := false
- for _, existing := range sum.Nodes {
- if existing == csn.Node.Node {
- found = true
- break
- }
- }
- if !found {
+ if sum.nodesSet == nil {
+ sum.nodesSet = make(map[string]struct{})
+ }
+ if _, seen := sum.nodesSet[csn.Node.Node]; !seen {
+ sum.nodesSet[csn.Node.Node] = struct{}{}
sum.Nodes = append(sum.Nodes, csn.Node.Node)
}
@@ -611,15 +613,13 @@ func summarizeServices(dump structs.ServiceDump, cfg *config.RuntimeConfig, dc s
- for _, tag := range svc.Tags {
- found := false
- for _, existing := range sum.Tags {
- if existing == tag {
- found = true
- break
- }
- }
- if !found {
- sum.Tags = append(sum.Tags, tag)
- }
+ if sum.tagsSet == nil {
+ sum.tagsSet = make(map[string]struct{})
+ }
+ for _, tag := range svc.Tags {
+ if _, seen := sum.tagsSet[tag]; !seen {
+ sum.tagsSet[tag] = struct{}{}
+ sum.Tags = append(sum.Tags, tag)
+ }
}
--- a/agent/ui_endpoint.go (ServiceSummary struct)
+++ b/agent/ui_endpoint.go (ServiceSummary struct)
@@ -460,6 +460,10 @@ type ServiceSummary struct {
// internal fields to track uniqueness
externalSourceSet map[string]struct{}
checks map[string]*structs.HealthCheck
+
+ // Transient dedup sets used during summarizeServices; nil after construction.
+ nodesSet map[string]struct{}
+ tagsSet map[string]struct{}
}

201
defects/consul/unit/ConsulTest.java Normal file
View file

@ -0,0 +1,201 @@
import java.util.*;
/**
* CWE-407 unit test — Consul consul-0001
*
* agent/ui_endpoint.go summarizeServices()
*
* For each service instance in the catalog dump the function deduplicates:
* (a) Node names → sum.Nodes []string — linear scan O(N) per instance
* (b) Service tags → sum.Tags []string — linear scan O(T) per tag
*
* When iterating over I instances of S services (outer dump loop), the tag
* dedup becomes O(S×I×T²): for each instance, for each tag, scan the already-
* accumulated sum.Tags slice. In large Consul deployments (S=500 services,
* I=20 instances each, T=30 tags) this is millions of comparisons per API call.
*
* Fix: add nodesSet map[string]struct{} and tagsSet map[string]struct{} fields
* to ServiceSummary. O(1) set-membership replaces O(N)/O(T) slice scan.
* Total complexity drops from O(S×I×T²) → O(S×I×T).
*/
public class ConsulTest {
// ---- defect simulation --------------------------------------------------
/** Simulate the defect: sum.Tags is a List with linear-scan dedup. */
static List<String> summarizeTags_quadratic(List<List<String>> instanceTagLists) {
List<String> tags = new ArrayList<>();
for (List<String> instanceTags : instanceTagLists) {
for (String tag : instanceTags) {
boolean found = false;
for (String existing : tags) { // O(T) linear scan — the defect
if (existing.equals(tag)) { found = true; break; }
}
if (!found) tags.add(tag);
}
}
return tags;
}
/** Simulate the fix: use a HashSet for O(1) membership. */
static List<String> summarizeTags_linear(List<List<String>> instanceTagLists) {
Set<String> tagsSet = new LinkedHashSet<>(); // preserves insertion order
for (List<String> instanceTags : instanceTagLists) {
tagsSet.addAll(instanceTags);
}
return new ArrayList<>(tagsSet);
}
// Node dedup — same pattern
static List<String> deduplicateNodes_quadratic(List<String> nodeNames) {
List<String> nodes = new ArrayList<>();
for (String node : nodeNames) {
boolean found = false;
for (String existing : nodes) {
if (existing.equals(node)) { found = true; break; }
}
if (!found) nodes.add(node);
}
return nodes;
}
static List<String> deduplicateNodes_linear(List<String> nodeNames) {
Set<String> seen = new LinkedHashSet<>(nodeNames);
return new ArrayList<>(seen);
}
// ---- helpers ------------------------------------------------------------
/** Build instanceTagLists: I instances each sharing the same T tags. */
static List<List<String>> makeInstanceTags(int instances, int tagsPerInstance) {
List<String> tags = new ArrayList<>();
for (int t = 0; t < tagsPerInstance; t++) {
tags.add("tag-" + t);
}
List<List<String>> result = new ArrayList<>();
for (int i = 0; i < instances; i++) {
result.add(new ArrayList<>(tags)); // each instance has all tags
}
return result;
}
// ---- tests --------------------------------------------------------------
static void testTagCorrectnessSmall() {
List<List<String>> instanceTags = Arrays.asList(
Arrays.asList("web", "v1", "prod"),
Arrays.asList("v1", "prod", "dc1"),
Arrays.asList("web", "dc1", "v2")
);
List<String> q = summarizeTags_quadratic(instanceTags);
List<String> l = summarizeTags_linear(instanceTags);
Collections.sort(q); Collections.sort(l);
assert q.equals(l) : "tag mismatch: " + q + " vs " + l;
System.out.println("PASS testTagCorrectnessSmall");
}
static void testNodeDeduplicateCorrectness() {
List<String> nodeNames = Arrays.asList(
"node-1", "node-2", "node-1", "node-3", "node-2", "node-4"
);
List<String> q = deduplicateNodes_quadratic(nodeNames);
List<String> l = deduplicateNodes_linear(nodeNames);
Collections.sort(q); Collections.sort(l);
assert q.equals(l) : "node dedup mismatch: " + q + " vs " + l;
assert q.size() == 4 : "expected 4 unique nodes, got " + q.size();
System.out.println("PASS testNodeDeduplicateCorrectness");
}
static void testEmptyInstanceList() {
List<List<String>> instanceTags = Collections.emptyList();
List<String> q = summarizeTags_quadratic(instanceTags);
List<String> l = summarizeTags_linear(instanceTags);
assert q.equals(l) && q.isEmpty() : "empty instance list should yield empty tags";
System.out.println("PASS testEmptyInstanceList");
}
static void testSingleInstanceSingleTag() {
List<List<String>> instanceTags = Collections.singletonList(
Collections.singletonList("only-tag")
);
List<String> q = summarizeTags_quadratic(instanceTags);
List<String> l = summarizeTags_linear(instanceTags);
assert q.equals(l) && q.equals(Collections.singletonList("only-tag")) :
"single tag mismatch";
System.out.println("PASS testSingleInstanceSingleTag");
}
static void testBenchmarkTagDedup() {
// Simulate: 20 instances each carrying 40 tags (all the same → max dedup pressure)
int INSTANCES = 20;
int TAGS = 40;
int ITERS = 300;
List<List<String>> instanceTags = makeInstanceTags(INSTANCES, TAGS);
long t0 = System.nanoTime();
for (int i = 0; i < ITERS; i++) {
summarizeTags_quadratic(instanceTags);
}
long quadraticNs = System.nanoTime() - t0;
long t1 = System.nanoTime();
for (int i = 0; i < ITERS; i++) {
summarizeTags_linear(instanceTags);
}
long linearNs = System.nanoTime() - t1;
double ratio = (double) quadraticNs / linearNs;
System.out.printf(
"BENCH instances=%d tags=%d iters=%d quadratic=%.2fms linear=%.2fms ratio=%.1fx%n",
INSTANCES, TAGS, ITERS,
quadraticNs / 1e6, linearNs / 1e6, ratio);
assert ratio >= 2.0 :
"Expected >=2x speedup for I=" + INSTANCES + " T=" + TAGS + ", got " + ratio;
System.out.println("PASS testBenchmarkTagDedup");
}
static void testBenchmarkLargeDeployment() {
// Simulate a large Consul deployment: 50 instances × 30 tags
int INSTANCES = 50;
int TAGS = 30;
int ITERS = 500;
List<List<String>> instanceTags = makeInstanceTags(INSTANCES, TAGS);
// JIT warmup
for (int i = 0; i < 200; i++) {
summarizeTags_quadratic(instanceTags);
summarizeTags_linear(instanceTags);
}
long t0 = System.nanoTime();
for (int i = 0; i < ITERS; i++) {
summarizeTags_quadratic(instanceTags);
}
long quadraticNs = System.nanoTime() - t0;
long t1 = System.nanoTime();
for (int i = 0; i < ITERS; i++) {
summarizeTags_linear(instanceTags);
}
long linearNs = System.nanoTime() - t1;
double ratio = (double) quadraticNs / linearNs;
System.out.printf(
"BENCH large instances=%d tags=%d iters=%d quadratic=%.2fms linear=%.2fms ratio=%.1fx%n",
INSTANCES, TAGS, ITERS,
quadraticNs / 1e6, linearNs / 1e6, ratio);
assert ratio >= 2.0 :
"Expected >=2x speedup for large deployment, got " + ratio;
System.out.println("PASS testBenchmarkLargeDeployment");
}
public static void main(String[] args) {
testTagCorrectnessSmall();
testNodeDeduplicateCorrectness();
testEmptyInstanceList();
testSingleInstanceSingleTag();
testBenchmarkTagDedup();
testBenchmarkLargeDeployment();
System.out.println("ALL PASS");
}
}

43
defects/libgdx/patch/libgdx-0002-model-builder-rebuild-refs-o-n2.patch Normal file
View file

@ -0,0 +1,43 @@
# UNDF:
--- a/gdx/src/com/badlogic/gdx/graphics/g3d/utils/ModelBuilder.java
+++ b/gdx/src/com/badlogic/gdx/graphics/g3d/utils/ModelBuilder.java
@@ -361,18 +361,30 @@
/** Resets the references to {@link Material}s, {@link Mesh}es and {@link MeshPart}s within the model to the ones used within
* it's nodes. This will make the model responsible for disposing all referenced meshes. */
public static void rebuildReferences (final Model model) {
model.materials.clear();
model.meshes.clear();
model.meshParts.clear();
- for (final Node node : model.nodes)
- rebuildReferences(model, node);
+ // CWE-407 fix: build identity-keyed ObjectSets before recursion to avoid O(P*M) Array.contains().
+ ObjectSet<Object> seenMaterials = new ObjectSet<>();
+ ObjectSet<Object> seenMeshParts = new ObjectSet<>();
+ ObjectSet<Object> seenMeshes = new ObjectSet<>();
+ for (final Node node : model.nodes)
+ rebuildReferences(model, node, seenMaterials, seenMeshParts, seenMeshes);
}
- private static void rebuildReferences (final Model model, final Node node) {
+ private static void rebuildReferences (final Model model, final Node node,
+ final ObjectSet<Object> seenMaterials, final ObjectSet<Object> seenMeshParts,
+ final ObjectSet<Object> seenMeshes) {
for (final NodePart mpm : node.parts) {
- if (!model.materials.contains(mpm.material, true)) model.materials.add(mpm.material);
- if (!model.meshParts.contains(mpm.meshPart, true)) {
+ // Previously: Array.contains() is O(M) called per NodePart → O(P*M) total.
+ // Fix: ObjectSet.add() returns false if already present → O(1) per check.
+ if (seenMaterials.add(mpm.material)) model.materials.add(mpm.material);
+ if (seenMeshParts.add(mpm.meshPart)) {
model.meshParts.add(mpm.meshPart);
- if (!model.meshes.contains(mpm.meshPart.mesh, true)) model.meshes.add(mpm.meshPart.mesh);
+ if (seenMeshes.add(mpm.meshPart.mesh)) model.meshes.add(mpm.meshPart.mesh);
model.manageDisposable(mpm.meshPart.mesh);
}
}
for (final Node child : node.getChildren())
- rebuildReferences(model, child);
+ rebuildReferences(model, child, seenMaterials, seenMeshParts, seenMeshes);
}
@@ -1,3 +1,4 @@
+import com.badlogic.gdx.utils.ObjectSet;

33
defects/libgdx/patch/libgdx-0005-stage-touch-dragged-o-n2.patch Normal file
View file

@ -0,0 +1,33 @@
# UNDF:
--- a/gdx/src/com/badlogic/gdx/scenes/scene2d/Stage.java
+++ b/gdx/src/com/badlogic/gdx/scenes/scene2d/Stage.java
@@ -296,7 +296,7 @@
/** Applies a touch moved event to the stage and returns true if an actor in the scene {@link Event#handle() handled} the
* event. Only {@link InputListener listeners} that returned true for touchDown will receive this event. */
public boolean touchDragged (int screenX, int screenY, int pointer) {
- pointerScreenX[pointer] = screenX;
+ pointerScreenX[pointer] = screenX; // CWE-407 fix: use snapshot-index membership, not Array.contains()
pointerScreenY[pointer] = screenY;
mouseScreenX = screenX;
mouseScreenY = screenY;
@@ -313,8 +313,16 @@
SnapshotArray<TouchFocus> touchFocuses = this.touchFocuses;
TouchFocus[] focuses = touchFocuses.begin();
- for (int i = 0, n = touchFocuses.size; i < n; i++) {
+ // Build a Set<TouchFocus> from the snapshot array for O(1) membership tests.
+ // Previously: touchFocuses.contains(focus, true) was O(F) called inside an O(F) loop → O(F²).
+ // Fix: snapshot index via ObjectSet for O(1) per-element check → O(F) total.
+ ObjectSet<TouchFocus> focusSet = new ObjectSet<>(touchFocuses.size);
+ for (int i = 0, n = touchFocuses.size; i < n; i++)
+ focusSet.add(focuses[i]);
+ for (int i = 0, n = touchFocuses.size; i < n; i++) {
TouchFocus focus = focuses[i];
if (focus.pointer != pointer) continue;
- if (!touchFocuses.contains(focus, true)) continue; // Touch focus already gone.
+ if (!focusSet.contains(focus)) continue; // Touch focus already gone. O(1) via ObjectSet.
event.setTarget(focus.target);
event.setListenerActor(focus.listenerActor);
if (focus.listener.handle(event)) event.handle();
@@ -1,3 +1,4 @@
+import com.badlogic.gdx.utils.ObjectSet;

24
defects/libgdx/patch/libgdx-0006-after-action-delegate-o-n2.patch Normal file
View file

@ -0,0 +1,24 @@
# UNDF:
--- a/gdx/src/com/badlogic/gdx/scenes/scene2d/actions/AfterAction.java
+++ b/gdx/src/com/badlogic/gdx/scenes/scene2d/actions/AfterAction.java
@@ -38,12 +38,17 @@
protected boolean delegate (float delta) {
Array<Action> currentActions = target.getActions();
if (currentActions.size == 1) waitForActions.clear();
- for (int i = waitForActions.size - 1; i >= 0; i--) {
+ // CWE-407 fix: build an ObjectSet from currentActions once (O(A)) instead of
+ // calling indexOf() O(A) for each of the W waitForActions → was O(W*A) per frame.
+ ObjectSet<Action> currentSet = new ObjectSet<>(currentActions.size);
+ for (int i = 0, n = currentActions.size; i < n; i++)
+ currentSet.add(currentActions.get(i));
+ for (int i = waitForActions.size - 1; i >= 0; i--) {
Action action = waitForActions.get(i);
- int index = currentActions.indexOf(action, true);
- if (index == -1) waitForActions.removeIndex(i);
+ if (!currentSet.contains(action)) waitForActions.removeIndex(i);
}
if (waitForActions.size > 0) return false;
return action.act(delta);
}
@@ -1,3 +1,4 @@
+import com.badlogic.gdx.utils.ObjectSet;

109
defects/libgdx/unit/LibGDXTest.java
View file

@ -3,13 +3,15 @@ package unit;
import java.util.*;
/**
* LibGDXTest — libgdx-0001..0004
* LibGDXTest — libgdx-0001..0006
*
* Proves CWE-407 in libGDX:
* libgdx-0001: Model.loadNode() — nested for-loop string-ID scan O(parts × meshes + parts × materials)
* libgdx-0002: ModelBuilder.rebuildReferences() — Array.contains() in node-part loop O(parts × materials)
* libgdx-0003: ModelInstance.invalidate() — Array.contains() in node-part loop O(parts × materials)
* libgdx-0004: Kerning.readSubtable2() — IntArray.contains() in GPOS coverage loop O(coverage × classes × K)
* libgdx-0005: Stage.touchDragged() — touchFocuses.contains(focus, true) inside touchFocuses loop O(F^2)
* libgdx-0006: AfterAction.delegate() — currentActions.indexOf(action, true) inside waitForActions loop O(W*A)
*
* Run: javac -d . LibGDXTest.java && java -ea unit.LibGDXTest
*/
@ -267,8 +269,89 @@ public class LibGDXTest {
return ops;
}
// ── libgdx-0005: Stage.touchDragged SnapshotArray.contains O(F^2) ─────────
/**
* SLOW: simulates Stage.touchDragged() — for each focus in touchFocuses,
* calls touchFocuses.contains(focus, true) which is an O(F) linear scan.
* Total: O(F^2) per touchDragged event.
*/
static long stageTouchDraggedSlow(int focusCount) {
List<Object> focuses = new ArrayList<>();
for (int i = 0; i < focusCount; i++) focuses.add(new Object());
long ops = 0;
// Outer loop: iterate all focuses
for (int i = 0; i < focuses.size(); i++) {
Object focus = focuses.get(i);
// Inner: Array.contains(focus, identity=true) — linear scan
for (int j = focuses.size() - 1; j >= 0; j--) {
ops++;
if (focuses.get(j) == focus) break;
}
}
return ops;
}
/**
* FAST: build ObjectSet once (O(F)), then O(1) per focus check → O(F) total.
*/
static long stageTouchDraggedFast(int focusCount) {
List<Object> focuses = new ArrayList<>();
for (int i = 0; i < focusCount; i++) focuses.add(new Object());
Set<Object> focusSet = new HashSet<>(focuses); // O(F)
long ops = (long) focusCount; // set construction cost
for (int i = 0; i < focuses.size(); i++) {
Object focus = focuses.get(i);
ops++; // O(1) hash lookup
focusSet.contains(focus);
}
return ops;
}
// ── libgdx-0006: AfterAction.delegate indexOf O(W*A) per frame ───────────
/**
* SLOW: simulates AfterAction.delegate() — for each action in waitForActions,
* calls currentActions.indexOf(action, true) which is an O(A) linear scan.
* Total: O(W*A) per frame.
*/
static long afterActionSlow(int waitCount, int actionCount) {
List<Object> currentActions = new ArrayList<>();
List<Object> waitForActions = new ArrayList<>();
for (int i = 0; i < actionCount; i++) currentActions.add(new Object());
for (int i = 0; i < waitCount && i < actionCount; i++) waitForActions.add(currentActions.get(i));
long ops = 0;
for (int i = waitForActions.size() - 1; i >= 0; i--) {
Object action = waitForActions.get(i);
// indexOf scans all A current actions
for (int j = 0; j < currentActions.size(); j++) {
ops++;
if (currentActions.get(j) == action) break;
}
}
return ops;
}
/**
* FAST: build ObjectSet from currentActions once (O(A)), then O(1) per waitForActions check.
*/
static long afterActionFast(int waitCount, int actionCount) {
List<Object> currentActions = new ArrayList<>();
List<Object> waitForActions = new ArrayList<>();
for (int i = 0; i < actionCount; i++) currentActions.add(new Object());
for (int i = 0; i < waitCount && i < actionCount; i++) waitForActions.add(currentActions.get(i));
Set<Object> currentSet = new HashSet<>(currentActions); // O(A)
long ops = (long) actionCount; // set construction cost
for (int i = waitForActions.size() - 1; i >= 0; i--) {
Object action = waitForActions.get(i);
ops++; // O(1)
currentSet.contains(action);
}
return ops;
}
public static void main(String[] args) {
System.out.println("=== UNIT libgdx-0001..0004: LibGDX CWE-407 ===");
System.out.println("=== UNIT libgdx-0001..0006: LibGDX CWE-407 ===");
// libgdx-0001: Model.loadNode
System.out.println();
@ -312,6 +395,24 @@ public class LibGDXTest {
bench(String.format("libgdx-0004 coverage=%d classes=%d glyphs/class=%d", KC, KN, KG),
() -> kerningGposSlow(KC, KN, KG), () -> kerningGposFast(KC, KN, KG), s4, f4);
// libgdx-0005: Stage.touchDragged
System.out.println();
System.out.println(" libgdx-0005: Stage.touchDragged SnapshotArray.contains O(F^2)");
final int FC = 200;
long s5 = stageTouchDraggedSlow(FC);
long f5 = stageTouchDraggedFast(FC);
bench(String.format("libgdx-0005 focuses=%d", FC),
() -> stageTouchDraggedSlow(FC), () -> stageTouchDraggedFast(FC), s5, f5);
// libgdx-0006: AfterAction.delegate
System.out.println();
System.out.println(" libgdx-0006: AfterAction.delegate indexOf O(W*A)");
final int WC = 100, AC = 200;
long s6 = afterActionSlow(WC, AC);
long f6 = afterActionFast(WC, AC);
bench(String.format("libgdx-0006 wait=%d actions=%d", WC, AC),
() -> afterActionSlow(WC, AC), () -> afterActionFast(WC, AC), s6, f6);
System.out.println();
int pass = 0;
@ -320,6 +421,8 @@ public class LibGDXTest {
assert s2 > f2 * 5 : "libgdx-0002 expected >5x speedup"; pass++;
assert s3 > f3 * 5 : "libgdx-0003 expected >5x speedup"; pass++;
assert s4 > f4 * 5 : "libgdx-0004 expected >5x speedup"; pass++;
System.out.printf("%d/5 PASS%n", pass);
assert s5 > f5 * 5 : "libgdx-0005 expected >5x speedup"; pass++;
assert s6 > f6 * 5 : "libgdx-0006 expected >5x speedup"; pass++;
System.out.printf("%d/7 PASS%n", pass);
}
}

55
defects/nats-server/patch/nats-server-0001-diff-routes-map.patch Normal file
View file

@ -0,0 +1,55 @@
# UNDF: (leave blank)
--- a/server/reload.go
+++ b/server/reload.go
@@ -2605,26 +2605,27 @@ func diffProxiesTrustedKeys(old, new []*ProxyConfig) ([]string, []string) {
// diffRoutes diffs the old routes and the new routes and returns the ones that
// should be added and removed from the server.
func diffRoutes(old, new []*url.URL) (add, remove []*url.URL) {
- // Find routes to remove.
-removeLoop:
- for _, oldRoute := range old {
- for _, newRoute := range new {
- if urlsAreEqual(oldRoute, newRoute) {
- continue removeLoop
- }
+ // Build O(1)-lookup sets from each list's canonical URL strings.
+ // This replaces two O(R²) nested loops with two O(R) passes.
+ newSet := make(map[string]struct{}, len(new))
+ for _, u := range new {
+ if u != nil {
+ newSet[u.String()] = struct{}{}
}
- remove = append(remove, oldRoute)
}
-
- // Find routes to add.
-addLoop:
- for _, newRoute := range new {
- for _, oldRoute := range old {
- if urlsAreEqual(oldRoute, newRoute) {
- continue addLoop
- }
+ oldSet := make(map[string]struct{}, len(old))
+ for _, u := range old {
+ if u != nil {
+ oldSet[u.String()] = struct{}{}
}
- add = append(add, newRoute)
}
+ for _, oldRoute := range old {
+ if oldRoute != nil {
+ if _, found := newSet[oldRoute.String()]; !found {
+ remove = append(remove, oldRoute)
+ }
+ }
+ }
+ for _, newRoute := range new {
+ if newRoute != nil {
+ if _, found := oldSet[newRoute.String()]; !found {
+ add = append(add, newRoute)
+ }
+ }
+ }
return add, remove
}

165
defects/nats-server/unit/NatsServerTest.java Normal file
View file

@ -0,0 +1,165 @@
import java.util.*;
/**
* CWE-407 unit test — NATS Server nats-server-0001
*
* server/reload.go diffRoutes()
* Two nested O(R) loops compare every old URL against every new URL.
* Complexity: O(R²) where R = number of route URLs.
* Large NATS clusters can carry hundreds of route URLs; config-reload
* (triggered by SIGHUP or file watcher) executes diffRoutes on every reload.
*
* Fix: build map[string]struct{} keyed on url.String() for each list,
* then two single-pass O(R) sweeps replace the double loop → O(R) total.
*/
public class NatsServerTest {
// ---- defect simulation --------------------------------------------------
/** O(R²): for each old URL, scan all new URLs for a match. */
static void diffRoutes_quadratic(List<String> old, List<String> newList,
List<String> add, List<String> remove) {
outer:
for (String oldRoute : old) {
for (String newRoute : newList) {
if (oldRoute.equals(newRoute)) {
continue outer;
}
}
remove.add(oldRoute);
}
outer:
for (String newRoute : newList) {
for (String oldRoute : old) {
if (newRoute.equals(oldRoute)) {
continue outer;
}
}
add.add(newRoute);
}
}
// ---- fix simulation -----------------------------------------------------
/** O(R): build HashSets, then single-pass each list. */
static void diffRoutes_linear(List<String> old, List<String> newList,
List<String> add, List<String> remove) {
Set<String> newSet = new HashSet<>(newList);
Set<String> oldSet = new HashSet<>(old);
for (String o : old) {
if (!newSet.contains(o)) remove.add(o);
}
for (String n : newList) {
if (!oldSet.contains(n)) add.add(n);
}
}
// ---- helpers ------------------------------------------------------------
static List<String> makeRoutes(int base, int count) {
List<String> urls = new ArrayList<>(count);
for (int i = 0; i < count; i++) {
urls.add("nats://node-" + (base + i) + ".cluster.local:6222");
}
return urls;
}
// ---- tests --------------------------------------------------------------
static void testCorrectnessSmall() {
List<String> old = Arrays.asList(
"nats://a:6222", "nats://b:6222", "nats://c:6222"
);
List<String> newList = Arrays.asList(
"nats://b:6222", "nats://c:6222", "nats://d:6222"
);
List<String> addQ = new ArrayList<>(), removeQ = new ArrayList<>();
List<String> addL = new ArrayList<>(), removeL = new ArrayList<>();
diffRoutes_quadratic(old, newList, addQ, removeQ);
diffRoutes_linear(old, newList, addL, removeL);
Collections.sort(addQ); Collections.sort(addL);
Collections.sort(removeQ); Collections.sort(removeL);
assert addQ.equals(addL) : "add mismatch: " + addQ + " vs " + addL;
assert removeQ.equals(removeL) : "remove mismatch: " + removeQ + " vs " + removeL;
assert addL.equals(Arrays.asList("nats://d:6222")) : "expected d to be added";
assert removeL.equals(Arrays.asList("nats://a:6222")) : "expected a to be removed";
System.out.println("PASS testCorrectnessSmall");
}
static void testEmptyOld() {
List<String> old = Collections.emptyList();
List<String> newList = Arrays.asList("nats://x:6222", "nats://y:6222");
List<String> addQ = new ArrayList<>(), removeQ = new ArrayList<>();
List<String> addL = new ArrayList<>(), removeL = new ArrayList<>();
diffRoutes_quadratic(old, newList, addQ, removeQ);
diffRoutes_linear(old, newList, addL, removeL);
assert addQ.equals(addL) && removeQ.equals(removeL) : "empty-old mismatch";
System.out.println("PASS testEmptyOld");
}
static void testEmptyNew() {
List<String> old = Arrays.asList("nats://x:6222", "nats://y:6222");
List<String> newList = Collections.emptyList();
List<String> addQ = new ArrayList<>(), removeQ = new ArrayList<>();
List<String> addL = new ArrayList<>(), removeL = new ArrayList<>();
diffRoutes_quadratic(old, newList, addQ, removeQ);
diffRoutes_linear(old, newList, addL, removeL);
assert addQ.equals(addL) && removeQ.equals(removeL) : "empty-new mismatch";
System.out.println("PASS testEmptyNew");
}
static void testIdenticalLists() {
List<String> old = Arrays.asList("nats://a:6222", "nats://b:6222");
List<String> newList = new ArrayList<>(old);
List<String> addQ = new ArrayList<>(), removeQ = new ArrayList<>();
List<String> addL = new ArrayList<>(), removeL = new ArrayList<>();
diffRoutes_quadratic(old, newList, addQ, removeQ);
diffRoutes_linear(old, newList, addL, removeL);
assert addQ.isEmpty() && removeQ.isEmpty() : "identical: unexpected diff (quadratic)";
assert addL.isEmpty() && removeL.isEmpty() : "identical: unexpected diff (linear)";
System.out.println("PASS testIdenticalLists");
}
static void testBenchmarkRatio() {
// Simulate a large NATS cluster: R=300 route URLs, 1 change on reload
int R = 300;
List<String> old = makeRoutes(0, R);
List<String> newList = makeRoutes(1, R); // shifted by 1 → 1 remove, 1 add
int ITERS = 200;
long t0 = System.nanoTime();
for (int i = 0; i < ITERS; i++) {
List<String> add = new ArrayList<>(), remove = new ArrayList<>();
diffRoutes_quadratic(old, newList, add, remove);
}
long quadraticNs = System.nanoTime() - t0;
long t1 = System.nanoTime();
for (int i = 0; i < ITERS; i++) {
List<String> add = new ArrayList<>(), remove = new ArrayList<>();
diffRoutes_linear(old, newList, add, remove);
}
long linearNs = System.nanoTime() - t1;
double ratio = (double) quadraticNs / linearNs;
System.out.printf("BENCH R=%d iters=%d quadratic=%.1fms linear=%.1fms ratio=%.1fx%n",
R, ITERS,
quadraticNs / 1e6,
linearNs / 1e6,
ratio);
assert ratio >= 2.0 : "Expected >=2x speedup at R=" + R + ", got " + ratio;
System.out.println("PASS testBenchmarkRatio");
}
public static void main(String[] args) {
testCorrectnessSmall();
testEmptyOld();
testEmptyNew();
testIdenticalLists();
testBenchmarkRatio();
System.out.println("ALL PASS");
}
}

34
defects/nomad/patch/nomad-0005-reconnect-replacements-map.patch Normal file
View file

@ -0,0 +1,34 @@
# UNDF: (leave blank)
--- a/scheduler/reconciler/reconcile_cluster.go
+++ b/scheduler/reconciler/reconcile_cluster.go
@@ -1,6 +1,7 @@
import (
+ "golang.org/x/exp/maps"
"golang.org/x/exp/slices"
)
@@ -1310,13 +1310,14 @@ func (a *allocReconciler) handleReconnectingAllocs(...) {
// A replacement allocation could fail and be replaced with another
// so follow the replacements in a linked list style
- replacements := []string{}
+ replacementsSet := make(map[string]struct{})
nextAlloc := reconnectingAlloc.NextAllocation
for {
val, ok := all[nextAlloc]
if !ok {
break
}
- replacements = append(replacements, val.ID)
+ replacementsSet[val.ID] = struct{}{}
nextAlloc = val.NextAllocation
}
// Find replacement allocations and decide which one to stop.
for _, replacementAlloc := range all {
if replacementAlloc == reconnectingAlloc {
continue
}
- if !slices.Contains(replacements, replacementAlloc.ID) || replacementAlloc.ServerTerminalStatus() {
+ if _, ok := replacementsSet[replacementAlloc.ID]; !ok || replacementAlloc.ServerTerminalStatus() {
continue
}

76
defects/nomad/unit/NomadTest.java Normal file
View file

@ -0,0 +1,76 @@
import java.util.*;
/**
* CWE-407 unit tests for Nomad new defects.
*
* nomad-0005: scheduler/reconciler/reconcile_cluster.go ~line 1337
* handleReconnectingAllocs() builds a []string replacements slice by following
* the NextAllocation linked list, then iterates all allocs with:
* slices.Contains(replacements, replacementAlloc.ID)
* This is O(|all| × |replacements|) = O(A × R).
* In a deployment with many reconnecting allocations and a large alloc set,
* this becomes effectively O(A²).
* Fix: map[string]struct{} built from the linked-list walk → O(1) membership.
*
* Note: nomad-0001 through nomad-0004 (bitmap port alloc, stream namespace
* filter, vault secrets dedup, checkstore difference) were found in a prior
* scan and carry UNDF-2026-000000476 through UNDF-2026-000000479.
* nomad-0005 is the reconnect reconciler defect first identified here.
*/
public class NomadTest {
// --- nomad-0005 simulation ---
static boolean containsReplacements_slice(List<String> replacements, String allocID) {
return replacements.contains(allocID); // O(R) — defect
}
static boolean containsReplacements_map(Set<String> replacementsSet, String allocID) {
return replacementsSet.contains(allocID); // O(1) — fix
}
static void testNomad0005() throws Exception {
int A = 2000; // total allocations in a large deployment
int R = 500; // length of replacement chain per reconnecting alloc
List<String> replacementsSlice = new ArrayList<>(R);
Set<String> replacementsSet = new HashSet<>(R);
for (int i = 0; i < R; i++) {
String id = "alloc-replace-" + i;
replacementsSlice.add(id);
replacementsSet.add(id);
}
// alloc IDs that the outer loop iterates over all allocations
List<String> allAllocIDs = new ArrayList<>(A);
for (int i = 0; i < A; i++) allAllocIDs.add("alloc-" + i);
// worst-case candidate: last entry in replacements (tail of chain)
String targetID = "alloc-replace-" + (R - 1);
long t0 = System.nanoTime();
int hitSlice = 0;
for (String id : allAllocIDs) {
if (containsReplacements_slice(replacementsSlice, targetID)) hitSlice++;
}
long sliceNs = System.nanoTime() - t0;
long t1 = System.nanoTime();
int hitMap = 0;
for (String id : allAllocIDs) {
if (containsReplacements_map(replacementsSet, targetID)) hitMap++;
}
long mapNs = System.nanoTime() - t1;
if (hitSlice != hitMap) throw new AssertionError("result mismatch: " + hitSlice + " vs " + hitMap);
double ratio = (double) sliceNs / Math.max(mapNs, 1);
System.out.printf("nomad-0005 PASS A=%d R=%d slice=%dns map=%dns ratio=%.1fx%n",
A, R, sliceNs, mapNs, ratio);
if (ratio < 5.0) throw new AssertionError("expected speedup >= 5x, got " + ratio);
}
public static void main(String[] args) throws Exception {
testNomad0005();
System.out.println("ALL PASS");
}
}

20
defects/pygame/patch/CLEAN.md Normal file
View file

@ -0,0 +1,20 @@
# pygame — CWE-407 Scan Result: CLEAN
**Scanned:** 2026-03-30
**Scope:** Python layer (`src_py/`), Cython layer (`src_c/cython/`), event C layer (`src_c/event.c`)
## Findings
No CWE-407 defects found in the runtime Python/Cython/C layers.
### Why pygame is clean
- `AbstractGroup` uses `dict` (`spritedict`) for all sprite membership — O(1) `in` checks.
- `Sprite.__g` is a `set` — O(1) group membership.
- Event blocking (`set_blocked`/`get_blocked`) uses SDL's native `SDL_EventState` array — O(1).
- `LayeredUpdates` uses `_spritelayers` dict for layer lookups — O(1).
- `sysfont` module uses `dict` for font registry — O(1).
- `OrderedUpdates._spritelist.remove()` is O(N) but is a single-shot operation, not nested.
The build infrastructure (`buildconfig/`) contains some list membership patterns but these
run once at build time, not in game loops, and are not relevant to runtime complexity.