diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index db369e120..b755e6beb 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -863,5 +863,14 @@ "erpnext-0001-0001": "UNDF-2026-000000862", "erpnext-0002-0002": "UNDF-2026-000000863", "ofbiz-0001-0001": "UNDF-2026-000000864", - "ofbiz-0002-0002": "UNDF-2026-000000865" + "ofbiz-0002-0002": "UNDF-2026-000000865", + "dolibarr-0001": "UNDF-2026-000000866", + "dolibarr-0002": "UNDF-2026-000000867", + "dolibarr-0003": "UNDF-2026-000000868", + "litellm-0001": "UNDF-2026-000000869", + "squid-0001-0001": "UNDF-2026-000000870", + "suitecrm-0001": "UNDF-2026-000000871", + "suitecrm-0002": "UNDF-2026-000000872", + "suitecrm-0003": "UNDF-2026-000000873", + "vllm-0001": "UNDF-2026-000000874" } diff --git a/defects/activemq-artemis/unit/unit/Artemis0001BindingsTest.class b/defects/activemq-artemis/unit/unit/Artemis0001BindingsTest.class deleted file mode 100644 index a56bd9d50..000000000 Binary files a/defects/activemq-artemis/unit/unit/Artemis0001BindingsTest.class and /dev/null differ diff --git a/defects/amarok/unit/AmarokTest.class b/defects/amarok/unit/AmarokTest.class deleted file mode 100644 index 5e68825e7..000000000 Binary files a/defects/amarok/unit/AmarokTest.class and /dev/null differ diff --git a/defects/ansible/unit/AnsibleTest.class b/defects/ansible/unit/AnsibleTest.class deleted file mode 100644 index 25140ab46..000000000 Binary files a/defects/ansible/unit/AnsibleTest.class and /dev/null differ diff --git a/defects/argo-cd/unit/ArgoCdTest.class b/defects/argo-cd/unit/ArgoCdTest.class deleted file mode 100644 index 1f06ce26a..000000000 Binary files a/defects/argo-cd/unit/ArgoCdTest.class and /dev/null differ diff --git a/defects/audacity/unit/AudacityTest.class b/defects/audacity/unit/AudacityTest.class deleted file mode 100644 index 9e0362893..000000000 Binary files a/defects/audacity/unit/AudacityTest.class and /dev/null differ diff --git a/defects/blender/unit/BlenderTest.class b/defects/blender/unit/BlenderTest.class deleted file mode 100644 index 0a07b8943..000000000 Binary files a/defects/blender/unit/BlenderTest.class and /dev/null differ diff --git a/defects/box2d/unit/unit/Box2dTest.class b/defects/box2d/unit/unit/Box2dTest.class deleted file mode 100644 index 5be7c6d9f..000000000 Binary files a/defects/box2d/unit/unit/Box2dTest.class and /dev/null differ diff --git a/defects/bullet3/unit/Bullet3Test.class b/defects/bullet3/unit/Bullet3Test.class deleted file mode 100644 index 5813aabf7..000000000 Binary files a/defects/bullet3/unit/Bullet3Test.class and /dev/null differ diff --git a/defects/calibre/test/CalibreGoogleTagDedupTest.class b/defects/calibre/test/CalibreGoogleTagDedupTest.class deleted file mode 100644 index b3bfe3e9c..000000000 Binary files a/defects/calibre/test/CalibreGoogleTagDedupTest.class and /dev/null differ diff --git a/defects/calibre/test/CalibreSeriesIndexTest.class b/defects/calibre/test/CalibreSeriesIndexTest.class deleted file mode 100644 index 6c7e73f4f..000000000 Binary files a/defects/calibre/test/CalibreSeriesIndexTest.class and /dev/null differ diff --git a/defects/cassandra/unit/CassandraTest.class b/defects/cassandra/unit/CassandraTest.class deleted file mode 100644 index 17a965ede..000000000 Binary files a/defects/cassandra/unit/CassandraTest.class and /dev/null differ diff --git a/defects/chef/unit/ChefRunListAlgorithm$Result.class b/defects/chef/unit/ChefRunListAlgorithm$Result.class deleted file mode 100644 index 5b11c0d0e..000000000 Binary files a/defects/chef/unit/ChefRunListAlgorithm$Result.class and /dev/null differ diff --git a/defects/chef/unit/ChefRunListAlgorithm.class b/defects/chef/unit/ChefRunListAlgorithm.class deleted file mode 100644 index 17764f394..000000000 Binary files a/defects/chef/unit/ChefRunListAlgorithm.class and /dev/null differ diff --git a/defects/clickhouse-java/unit/ClickHouseJavaTest.class b/defects/clickhouse-java/unit/ClickHouseJavaTest.class deleted file mode 100644 index 99b49d0ec..000000000 Binary files a/defects/clickhouse-java/unit/ClickHouseJavaTest.class and /dev/null differ diff --git a/defects/cockroach/unit/CockroachTest.class b/defects/cockroach/unit/CockroachTest.class deleted file mode 100644 index 650429d8f..000000000 Binary files a/defects/cockroach/unit/CockroachTest.class and /dev/null differ diff --git a/defects/cockroachdb/unit/CockroachDBTest.class b/defects/cockroachdb/unit/CockroachDBTest.class deleted file mode 100644 index e2a55dd35..000000000 Binary files a/defects/cockroachdb/unit/CockroachDBTest.class and /dev/null differ diff --git a/defects/conduit/unit/ConduitTest.class b/defects/conduit/unit/ConduitTest.class deleted file mode 100644 index 239bbb4a3..000000000 Binary files a/defects/conduit/unit/ConduitTest.class and /dev/null differ diff --git a/defects/consul/unit/ConsulTest.class b/defects/consul/unit/ConsulTest.class deleted file mode 100644 index 64ab5b89e..000000000 Binary files a/defects/consul/unit/ConsulTest.class and /dev/null differ diff --git a/defects/cpython/unit/CpythonTest.class b/defects/cpython/unit/CpythonTest.class deleted file mode 100644 index feeacc64b..000000000 Binary files a/defects/cpython/unit/CpythonTest.class and /dev/null differ diff --git a/defects/crystal/unit/__pycache__/test_crystal_0001.cpython-312.pyc b/defects/crystal/unit/__pycache__/test_crystal_0001.cpython-312.pyc deleted file mode 100644 index 92ae12f51..000000000 Binary files a/defects/crystal/unit/__pycache__/test_crystal_0001.cpython-312.pyc and /dev/null differ diff --git a/defects/curl/unit/CurlTest.class b/defects/curl/unit/CurlTest.class deleted file mode 100644 index 8cda6704f..000000000 Binary files a/defects/curl/unit/CurlTest.class and /dev/null differ diff --git a/defects/darktable/unit/DarktableTest.class b/defects/darktable/unit/DarktableTest.class deleted file mode 100644 index db76a04ae..000000000 Binary files a/defects/darktable/unit/DarktableTest.class and /dev/null differ diff --git a/defects/dart/unit/DartTest$FastName.class b/defects/dart/unit/DartTest$FastName.class deleted file mode 100644 index 1560851f6..000000000 Binary files a/defects/dart/unit/DartTest$FastName.class and /dev/null differ diff --git a/defects/dart/unit/DartTest$SlowName.class b/defects/dart/unit/DartTest$SlowName.class deleted file mode 100644 index 22ca56fca..000000000 Binary files a/defects/dart/unit/DartTest$SlowName.class and /dev/null differ diff --git a/defects/dart/unit/DartTest.class b/defects/dart/unit/DartTest.class deleted file mode 100644 index 0e261c308..000000000 Binary files a/defects/dart/unit/DartTest.class and /dev/null differ diff --git a/defects/deluge/unit/DelugeFilterManagerTest.class b/defects/deluge/unit/DelugeFilterManagerTest.class deleted file mode 100644 index dfea9f711..000000000 Binary files a/defects/deluge/unit/DelugeFilterManagerTest.class and /dev/null differ diff --git a/defects/deluge/unit/DelugeTorrentManagerTest.class b/defects/deluge/unit/DelugeTorrentManagerTest.class deleted file mode 100644 index 9c1398120..000000000 Binary files a/defects/deluge/unit/DelugeTorrentManagerTest.class and /dev/null differ diff --git a/defects/digikam/test/DigikamGPSTilerDedupTest.class b/defects/digikam/test/DigikamGPSTilerDedupTest.class deleted file mode 100644 index 8bb5a6cb6..000000000 Binary files a/defects/digikam/test/DigikamGPSTilerDedupTest.class and /dev/null differ diff --git a/defects/digikam/test/DigikamHaarTargetAlbumsTest.class b/defects/digikam/test/DigikamHaarTargetAlbumsTest.class deleted file mode 100644 index d92a7b3d0..000000000 Binary files a/defects/digikam/test/DigikamHaarTargetAlbumsTest.class and /dev/null differ diff --git a/defects/dolibarr/patch/dolibarr-0001-filecheck-insignature-in_array.patch b/defects/dolibarr/patch/dolibarr-0001-filecheck-insignature-in_array.patch new file mode 100644 index 000000000..5de57da6e --- /dev/null +++ b/defects/dolibarr/patch/dolibarr-0001-filecheck-insignature-in_array.patch @@ -0,0 +1,14 @@ +# UNDF: UNDF-2026-000000866 +--- a/htdocs/blockedlog/admin/filecheck.php ++++ b/htdocs/blockedlog/admin/filecheck.php +@@ -409,9 +409,10 @@ + // Complete with list of new files into $file_list['added'] + if (empty($onlymodifiedorremoved)) { ++ $insignature_set = array_flip($file_list['insignature']); // O(1) lookup instead of O(N) in_array + foreach ($scanfiles as $valfile) { + $tmprelativefilename = preg_replace('/^'.preg_quote(DOL_DOCUMENT_ROOT, '/').'/', '', $valfile['fullname']); +- if (!in_array($tmprelativefilename, $file_list['insignature'])) { ++ if (!isset($insignature_set[$tmprelativefilename])) { + $hashnewfile = @hash_file($algo, $valfile['fullname']); // Can fails if we don't have permission to open/read file + $file_list['added'][] = array('filename' => $tmprelativefilename, 'hash' => $hashnewfile, 'algo' => $algo); + } diff --git a/defects/dolibarr/patch/dolibarr-0002-datapolicycron-processedIds-in_array.patch b/defects/dolibarr/patch/dolibarr-0002-datapolicycron-processedIds-in_array.patch new file mode 100644 index 000000000..09f4cec60 --- /dev/null +++ b/defects/dolibarr/patch/dolibarr-0002-datapolicycron-processedIds-in_array.patch @@ -0,0 +1,28 @@ +# UNDF: UNDF-2026-000000867 +--- a/htdocs/datapolicy/class/datapolicycron.class.php ++++ b/htdocs/datapolicy/class/datapolicycron.class.php +@@ -335,6 +335,7 @@ + * @param int[] $processedIds Reference to the array of processed IDs. + * @param object $conf The global conf object. + * @param User $user The user object for history tracking. ++ * Note: $processedIds is used as both array and set; callers should also pass $processedSet for O(1) lookup. + * @return void + */ + private function _processPolicyAction($policy, $action, $object, &$processedIds, $conf, $user) +@@ -367,7 +368,8 @@ + + // Process the records found by the query ++ $processedSet = array_flip($processedIds); // O(1) lookup instead of O(N) in_array + while ($obj = $this->db->fetch_object($resql)) { +- if (in_array($obj->rowid, $processedIds) || ! method_exists($this, $handlerMethod)) { ++ if (isset($processedSet[$obj->rowid]) || ! method_exists($this, $handlerMethod)) { + continue; + } + /** @var CommonObject $object */ +@@ -383,6 +385,7 @@ + // Record the outcome and add to processed list on success + $this->_recordActionResult($result, $object, $action); + $processedIds[] = $obj->rowid; ++ $processedSet[$obj->rowid] = true; + } + } diff --git a/defects/dolibarr/patch/dolibarr-0003-bookkeeping-extourne-in_array.patch b/defects/dolibarr/patch/dolibarr-0003-bookkeeping-extourne-in_array.patch new file mode 100644 index 000000000..d4219618d --- /dev/null +++ b/defects/dolibarr/patch/dolibarr-0003-bookkeeping-extourne-in_array.patch @@ -0,0 +1,20 @@ +# UNDF: UNDF-2026-000000868 +--- a/htdocs/accountancy/class/bookkeeping.class.php ++++ b/htdocs/accountancy/class/bookkeeping.class.php +@@ -3720,6 +3720,7 @@ + $resqlAlreadyExtourne = $this->db->query($sqlAlreadyExtourne); + $alreadyExtourneT = array(); ++ $alreadyExtourneSet = array(); // Hash set for O(1) lookup instead of O(N) in_array + if ($resqlAlreadyExtourne) { + while ($obj4 = $this->db->fetch_object($resqlAlreadyExtourne)) { + $alreadyExtourneT []= $obj4->piece_num; ++ $alreadyExtourneSet[$obj4->piece_num] = true; + } + } +@@ -3753,7 +3755,7 @@ + + if ($bookKeeping->fetch($extourneId)) { +- if (in_array($bookKeeping->piece_num, $alreadyExtourneT)) { ++ if (isset($alreadyExtourneSet[$bookKeeping->piece_num])) { + setEventMessages($langs->trans("AlreadyReturnedAccount", $bookKeeping->piece_num), null, 'errors'); + } else { diff --git a/defects/dolibarr/test/DolibarrCWE407Test.class b/defects/dolibarr/test/DolibarrCWE407Test.class new file mode 100644 index 000000000..daaa80331 Binary files /dev/null and b/defects/dolibarr/test/DolibarrCWE407Test.class differ diff --git a/defects/dolibarr/test/DolibarrCWE407Test.java b/defects/dolibarr/test/DolibarrCWE407Test.java new file mode 100644 index 000000000..d3ead1afb --- /dev/null +++ b/defects/dolibarr/test/DolibarrCWE407Test.java @@ -0,0 +1,217 @@ +import java.util.*; + +/** + * CWE-407 unit tests for Dolibarr defects. + * + * dolibarr-0001: filecheck.php in_array($tmprelativefilename, $file_list['insignature']) + * — O(S*I) file membership check during integrity verification + * dolibarr-0002: datapolicycron.class.php in_array($obj->rowid, $processedIds) + * — O(N^2) dedup accumulator in GDPR data policy cron + * dolibarr-0003: bookkeeping.class.php in_array($bookKeeping->piece_num, $alreadyExtourneT) + * — O(P*E*A) reversal check in accounting journal extourne + */ +public class DolibarrCWE407Test { + + // ---- dolibarr-0001: filecheck insignature membership ---- + + /** Unpatched: in_array on plain array — O(S*I) */ + static int filecheckUnpatched(List scanFiles, List inSignature) { + List added = new ArrayList<>(); + for (String file : scanFiles) { + if (!inSignature.contains(file)) { // O(I) per file + added.add(file); + } + } + return added.size(); + } + + /** Patched: array_flip for O(1) lookup — O(S+I) */ + static int filecheckPatched(List scanFiles, List inSignature) { + Set sigSet = new HashSet<>(inSignature); // O(I) once + List added = new ArrayList<>(); + for (String file : scanFiles) { + if (!sigSet.contains(file)) { // O(1) per file + added.add(file); + } + } + return added.size(); + } + + // ---- dolibarr-0002: datapolicycron processedIds dedup ---- + + /** Unpatched: in_array on growing processedIds — O(N^2) */ + static int datapolicyCronUnpatched(List dbRows) { + List processedIds = new ArrayList<>(); + int processed = 0; + for (int rowid : dbRows) { + if (!processedIds.contains(rowid)) { // O(N) scan + processed++; + processedIds.add(rowid); + } + } + return processed; + } + + /** Patched: array_flip for O(1) lookup — O(N) total */ + static int datapolicyCronPatched(List dbRows) { + Set processedSet = new HashSet<>(); + int processed = 0; + for (int rowid : dbRows) { + if (!processedSet.contains(rowid)) { // O(1) lookup + processed++; + processedSet.add(rowid); + } + } + return processed; + } + + // ---- dolibarr-0003: bookkeeping extourne reversal check ---- + + /** Unpatched: in_array on alreadyExtourneT — O(P*E*A) */ + static int extourneUnpatched(List pieceNums, List alreadyExtourne) { + int reversed = 0; + for (int pieceNum : pieceNums) { + // Inner loop simulates fetching entries per piece + for (int entry = 0; entry < 5; entry++) { + if (alreadyExtourne.contains(pieceNum)) { // O(A) scan + // already reversed — skip + } else { + reversed++; + } + } + } + return reversed; + } + + /** Patched: hash set for O(1) lookup — O(P*E + A) */ + static int extournePatched(List pieceNums, List alreadyExtourne) { + Set alreadySet = new HashSet<>(alreadyExtourne); // O(A) once + int reversed = 0; + for (int pieceNum : pieceNums) { + for (int entry = 0; entry < 5; entry++) { + if (alreadySet.contains(pieceNum)) { // O(1) lookup + // already reversed — skip + } else { + reversed++; + } + } + } + return reversed; + } + + // ---- Test harness ---- + + static void testDolibarr0001() { + System.out.println("=== dolibarr-0001: filecheck insignature membership ==="); + int S = 16000; // scanned files (typical Dolibarr installation) + int I = 14000; // files in signature + + List scanFiles = new ArrayList<>(S); + List inSignature = new ArrayList<>(I); + for (int i = 0; i < I; i++) { + String name = "/htdocs/module" + (i / 100) + "/file" + i + ".php"; + inSignature.add(name); + scanFiles.add(name); + } + // Add some files not in signature + for (int i = I; i < S; i++) { + scanFiles.add("/htdocs/custom/file" + i + ".php"); + } + + // Warmup + filecheckPatched(scanFiles, inSignature); + + long t0 = System.nanoTime(); + int r1 = filecheckUnpatched(scanFiles, inSignature); + long unpatched = System.nanoTime() - t0; + + t0 = System.nanoTime(); + int r2 = filecheckPatched(scanFiles, inSignature); + long patched = System.nanoTime() - t0; + + assert r1 == r2 : "Result mismatch"; + assert r1 == (S - I) : "Expected " + (S - I) + " added files, got " + r1; + + double ratio = (double) unpatched / patched; + System.out.printf(" S=%d I=%d unpatched=%dms patched=%dms ratio=%.1fx%n", + S, I, unpatched / 1_000_000, patched / 1_000_000, ratio); + assert ratio > 5.0 : "Expected >5x ratio, got " + ratio; + System.out.println(" PASS"); + } + + static void testDolibarr0002() { + System.out.println("=== dolibarr-0002: datapolicycron processedIds dedup ==="); + int N = 10000; // GDPR records to process + + List dbRows = new ArrayList<>(N); + for (int i = 0; i < N; i++) { + dbRows.add(i); + } + // Add some duplicates + for (int i = 0; i < N / 10; i++) { + dbRows.add(i); + } + + // Warmup + datapolicyCronPatched(dbRows); + + long t0 = System.nanoTime(); + int r1 = datapolicyCronUnpatched(dbRows); + long unpatched = System.nanoTime() - t0; + + t0 = System.nanoTime(); + int r2 = datapolicyCronPatched(dbRows); + long patched = System.nanoTime() - t0; + + assert r1 == r2 : "Result mismatch"; + assert r1 == N : "Expected " + N + " unique, got " + r1; + + double ratio = (double) unpatched / patched; + System.out.printf(" N=%d unpatched=%dms patched=%dms ratio=%.1fx%n", + N, unpatched / 1_000_000, patched / 1_000_000, ratio); + assert ratio > 5.0 : "Expected >5x ratio, got " + ratio; + System.out.println(" PASS"); + } + + static void testDolibarr0003() { + System.out.println("=== dolibarr-0003: bookkeeping extourne reversal check ==="); + int P = 2000; // pieces to reverse + int A = 5000; // already-reversed pieces + + List pieceNums = new ArrayList<>(P); + for (int i = 0; i < P; i++) { + pieceNums.add(A + i); // new pieces not in already-reversed set + } + List alreadyExtourne = new ArrayList<>(A); + for (int i = 0; i < A; i++) { + alreadyExtourne.add(i); + } + + // Warmup + extournePatched(pieceNums, alreadyExtourne); + + long t0 = System.nanoTime(); + int r1 = extourneUnpatched(pieceNums, alreadyExtourne); + long unpatched = System.nanoTime() - t0; + + t0 = System.nanoTime(); + int r2 = extournePatched(pieceNums, alreadyExtourne); + long patched = System.nanoTime() - t0; + + assert r1 == r2 : "Result mismatch"; + assert r1 == P * 5 : "Expected " + (P * 5) + " reversed, got " + r1; + + double ratio = (double) unpatched / patched; + System.out.printf(" P=%d A=%d unpatched=%dms patched=%dms ratio=%.1fx%n", + P, A, unpatched / 1_000_000, patched / 1_000_000, ratio); + assert ratio > 5.0 : "Expected >5x ratio, got " + ratio; + System.out.println(" PASS"); + } + + public static void main(String[] args) { + testDolibarr0001(); + testDolibarr0002(); + testDolibarr0003(); + System.out.println("\nAll 3 Dolibarr CWE-407 tests PASSED."); + } +} diff --git a/defects/eclipse-jdt/unit/MinimalErasedCandidatesAlgorithm$Result.class b/defects/eclipse-jdt/unit/MinimalErasedCandidatesAlgorithm$Result.class deleted file mode 100644 index 8988be336..000000000 Binary files a/defects/eclipse-jdt/unit/MinimalErasedCandidatesAlgorithm$Result.class and /dev/null differ diff --git a/defects/eclipse-jdt/unit/MinimalErasedCandidatesAlgorithm.class b/defects/eclipse-jdt/unit/MinimalErasedCandidatesAlgorithm.class deleted file mode 100644 index 88b8d60be..000000000 Binary files a/defects/eclipse-jdt/unit/MinimalErasedCandidatesAlgorithm.class and /dev/null differ diff --git a/defects/element-web/unit/ElementWebTest.class b/defects/element-web/unit/ElementWebTest.class deleted file mode 100644 index 6bc14d1f0..000000000 Binary files a/defects/element-web/unit/ElementWebTest.class and /dev/null differ diff --git a/defects/exim/unit/unit/EximSameHosts0001Test$HostItem.class b/defects/exim/unit/unit/EximSameHosts0001Test$HostItem.class deleted file mode 100644 index d63230ec5..000000000 Binary files a/defects/exim/unit/unit/EximSameHosts0001Test$HostItem.class and /dev/null differ diff --git a/defects/exim/unit/unit/EximSameHosts0001Test.class b/defects/exim/unit/unit/EximSameHosts0001Test.class deleted file mode 100644 index 59d63a639..000000000 Binary files a/defects/exim/unit/unit/EximSameHosts0001Test.class and /dev/null differ diff --git a/defects/ffmpeg/unit/FFmpegTest.class b/defects/ffmpeg/unit/FFmpegTest.class deleted file mode 100644 index 75b83c3d0..000000000 Binary files a/defects/ffmpeg/unit/FFmpegTest.class and /dev/null differ diff --git a/defects/ffmpeg/unit/unit/FFmpegCodecTagTest.class b/defects/ffmpeg/unit/unit/FFmpegCodecTagTest.class deleted file mode 100644 index 747b560ad..000000000 Binary files a/defects/ffmpeg/unit/unit/FFmpegCodecTagTest.class and /dev/null differ diff --git a/defects/firefox/test/Firefox0001SanitizerListSetTest$ListSetDefective.class b/defects/firefox/test/Firefox0001SanitizerListSetTest$ListSetDefective.class deleted file mode 100644 index e9b126f93..000000000 Binary files a/defects/firefox/test/Firefox0001SanitizerListSetTest$ListSetDefective.class and /dev/null differ diff --git a/defects/firefox/test/Firefox0001SanitizerListSetTest$ListSetFixed.class b/defects/firefox/test/Firefox0001SanitizerListSetTest$ListSetFixed.class deleted file mode 100644 index ce0e3e8ef..000000000 Binary files a/defects/firefox/test/Firefox0001SanitizerListSetTest$ListSetFixed.class and /dev/null differ diff --git a/defects/firefox/test/Firefox0001SanitizerListSetTest.class b/defects/firefox/test/Firefox0001SanitizerListSetTest.class deleted file mode 100644 index ebd18ba6f..000000000 Binary files a/defects/firefox/test/Firefox0001SanitizerListSetTest.class and /dev/null differ diff --git a/defects/firefox/test/Firefox0002DOMTokenListTest.class b/defects/firefox/test/Firefox0002DOMTokenListTest.class deleted file mode 100644 index 6d772fae5..000000000 Binary files a/defects/firefox/test/Firefox0002DOMTokenListTest.class and /dev/null differ diff --git a/defects/flink/unit/FlinkTest.class b/defects/flink/unit/FlinkTest.class deleted file mode 100644 index 4f17355a9..000000000 Binary files a/defects/flink/unit/FlinkTest.class and /dev/null differ diff --git a/defects/freeswitch/unit/FreeSWITCHTest$CodecPref.class b/defects/freeswitch/unit/FreeSWITCHTest$CodecPref.class deleted file mode 100644 index b44e65c77..000000000 Binary files a/defects/freeswitch/unit/FreeSWITCHTest$CodecPref.class and /dev/null differ diff --git a/defects/freeswitch/unit/FreeSWITCHTest.class b/defects/freeswitch/unit/FreeSWITCHTest.class deleted file mode 100644 index 68815395a..000000000 Binary files a/defects/freeswitch/unit/FreeSWITCHTest.class and /dev/null differ diff --git a/defects/gimp/unit/GimpTest.class b/defects/gimp/unit/GimpTest.class deleted file mode 100644 index 4076ca3a0..000000000 Binary files a/defects/gimp/unit/GimpTest.class and /dev/null differ diff --git a/defects/gitlab-foss/unit/GitlabFossTest.class b/defects/gitlab-foss/unit/GitlabFossTest.class deleted file mode 100644 index 22e52b7d9..000000000 Binary files a/defects/gitlab-foss/unit/GitlabFossTest.class and /dev/null differ diff --git a/defects/godot/unit/GodotTest.class b/defects/godot/unit/GodotTest.class deleted file mode 100644 index 5e802b561..000000000 Binary files a/defects/godot/unit/GodotTest.class and /dev/null differ diff --git a/defects/godot/unit/unit/GodotFontCyclicTest$Font.class b/defects/godot/unit/unit/GodotFontCyclicTest$Font.class deleted file mode 100644 index 026c1ac3b..000000000 Binary files a/defects/godot/unit/unit/GodotFontCyclicTest$Font.class and /dev/null differ diff --git a/defects/godot/unit/unit/GodotFontCyclicTest.class b/defects/godot/unit/unit/GodotFontCyclicTest.class deleted file mode 100644 index a0f3672a1..000000000 Binary files a/defects/godot/unit/unit/GodotFontCyclicTest.class and /dev/null differ diff --git a/defects/godot/unit/unit/unit/GodotFontCyclicTest$Font.class b/defects/godot/unit/unit/unit/GodotFontCyclicTest$Font.class deleted file mode 100644 index 026c1ac3b..000000000 Binary files a/defects/godot/unit/unit/unit/GodotFontCyclicTest$Font.class and /dev/null differ diff --git a/defects/godot/unit/unit/unit/GodotFontCyclicTest.class b/defects/godot/unit/unit/unit/GodotFontCyclicTest.class deleted file mode 100644 index a0f3672a1..000000000 Binary files a/defects/godot/unit/unit/unit/GodotFontCyclicTest.class and /dev/null differ diff --git a/defects/gradle/unit/Gradle0002IncomingEdgesTest$DefectiveNodeState.class b/defects/gradle/unit/Gradle0002IncomingEdgesTest$DefectiveNodeState.class deleted file mode 100644 index 8a804bb98..000000000 Binary files a/defects/gradle/unit/Gradle0002IncomingEdgesTest$DefectiveNodeState.class and /dev/null differ diff --git a/defects/gradle/unit/Gradle0002IncomingEdgesTest$Edge.class b/defects/gradle/unit/Gradle0002IncomingEdgesTest$Edge.class deleted file mode 100644 index d31eeb7e0..000000000 Binary files a/defects/gradle/unit/Gradle0002IncomingEdgesTest$Edge.class and /dev/null differ diff --git a/defects/gradle/unit/Gradle0002IncomingEdgesTest$FixedNodeState.class b/defects/gradle/unit/Gradle0002IncomingEdgesTest$FixedNodeState.class deleted file mode 100644 index b1cb3dc73..000000000 Binary files a/defects/gradle/unit/Gradle0002IncomingEdgesTest$FixedNodeState.class and /dev/null differ diff --git a/defects/gradle/unit/Gradle0002IncomingEdgesTest.class b/defects/gradle/unit/Gradle0002IncomingEdgesTest.class deleted file mode 100644 index f34e35000..000000000 Binary files a/defects/gradle/unit/Gradle0002IncomingEdgesTest.class and /dev/null differ diff --git a/defects/grafana/unit/GrafanaTest$FolderRef.class b/defects/grafana/unit/GrafanaTest$FolderRef.class deleted file mode 100644 index 4b667ffbf..000000000 Binary files a/defects/grafana/unit/GrafanaTest$FolderRef.class and /dev/null differ diff --git a/defects/grafana/unit/GrafanaTest.class b/defects/grafana/unit/GrafanaTest.class deleted file mode 100644 index a6190fb2b..000000000 Binary files a/defects/grafana/unit/GrafanaTest.class and /dev/null differ diff --git a/defects/groovy/unit/GroovyNamedParamsTest.class b/defects/groovy/unit/GroovyNamedParamsTest.class deleted file mode 100644 index e83233fce..000000000 Binary files a/defects/groovy/unit/GroovyNamedParamsTest.class and /dev/null differ diff --git a/defects/grpc-java/unit/GrpcJavaTest.class b/defects/grpc-java/unit/GrpcJavaTest.class deleted file mode 100644 index 2d20a062d..000000000 Binary files a/defects/grpc-java/unit/GrpcJavaTest.class and /dev/null differ diff --git a/defects/gstreamer/unit/unit/GstreamerFactoryFilterTest$Factory.class b/defects/gstreamer/unit/unit/GstreamerFactoryFilterTest$Factory.class deleted file mode 100644 index e34b7bbc1..000000000 Binary files a/defects/gstreamer/unit/unit/GstreamerFactoryFilterTest$Factory.class and /dev/null differ diff --git a/defects/gstreamer/unit/unit/GstreamerFactoryFilterTest.class b/defects/gstreamer/unit/unit/GstreamerFactoryFilterTest.class deleted file mode 100644 index c7ce8790e..000000000 Binary files a/defects/gstreamer/unit/unit/GstreamerFactoryFilterTest.class and /dev/null differ diff --git a/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class b/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class deleted file mode 100644 index cbf02bf88..000000000 Binary files a/defects/hibernate-orm-0001/test/HibernateOrm0001Test$FkSecondPass.class and /dev/null differ diff --git a/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class b/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class deleted file mode 100644 index 38620d913..000000000 Binary files a/defects/hibernate-orm-0001/test/HibernateOrm0001Test.class and /dev/null differ diff --git a/defects/hibernate/unit/HibernateFkDiamondRecursionTest$FK.class b/defects/hibernate/unit/HibernateFkDiamondRecursionTest$FK.class deleted file mode 100644 index 419ff91d1..000000000 Binary files a/defects/hibernate/unit/HibernateFkDiamondRecursionTest$FK.class and /dev/null differ diff --git a/defects/hibernate/unit/HibernateFkDiamondRecursionTest.class b/defects/hibernate/unit/HibernateFkDiamondRecursionTest.class deleted file mode 100644 index 7ba9a9115..000000000 Binary files a/defects/hibernate/unit/HibernateFkDiamondRecursionTest.class and /dev/null differ diff --git a/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest$FK.class b/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest$FK.class deleted file mode 100644 index 419ff91d1..000000000 Binary files a/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest$FK.class and /dev/null differ diff --git a/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest$FakeFkPass.class b/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest$FakeFkPass.class deleted file mode 100644 index 8cfb8f7c6..000000000 Binary files a/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest$FakeFkPass.class and /dev/null differ diff --git a/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest.class b/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest.class deleted file mode 100644 index 7ba9a9115..000000000 Binary files a/defects/hibernate/unit/unit/unit/HibernateFkDiamondRecursionTest.class and /dev/null differ diff --git a/defects/hive/unit/HiveTest.class b/defects/hive/unit/HiveTest.class deleted file mode 100644 index 1ad347407..000000000 Binary files a/defects/hive/unit/HiveTest.class and /dev/null differ diff --git a/defects/imagemagick/unit/ImageMagickTest$ImageNode.class b/defects/imagemagick/unit/ImageMagickTest$ImageNode.class deleted file mode 100644 index 5e7ba0d18..000000000 Binary files a/defects/imagemagick/unit/ImageMagickTest$ImageNode.class and /dev/null differ diff --git a/defects/imagemagick/unit/ImageMagickTest.class b/defects/imagemagick/unit/ImageMagickTest.class deleted file mode 100644 index 269963628..000000000 Binary files a/defects/imagemagick/unit/ImageMagickTest.class and /dev/null differ diff --git a/defects/influxdb/unit/InfluxDBTest.class b/defects/influxdb/unit/InfluxDBTest.class deleted file mode 100644 index 2095665f5..000000000 Binary files a/defects/influxdb/unit/InfluxDBTest.class and /dev/null differ diff --git a/defects/inkscape/unit/InkscapeTest.class b/defects/inkscape/unit/InkscapeTest.class deleted file mode 100644 index c5f20a32f..000000000 Binary files a/defects/inkscape/unit/InkscapeTest.class and /dev/null differ diff --git a/defects/istio/unit/IstioTest.class b/defects/istio/unit/IstioTest.class deleted file mode 100644 index a6ab6128a..000000000 Binary files a/defects/istio/unit/IstioTest.class and /dev/null differ diff --git a/defects/jsc/unit/unit/JSCIntegerRangeLiveAtHeadTest.class b/defects/jsc/unit/unit/JSCIntegerRangeLiveAtHeadTest.class deleted file mode 100644 index 7eca08907..000000000 Binary files a/defects/jsc/unit/unit/JSCIntegerRangeLiveAtHeadTest.class and /dev/null differ diff --git a/defects/julia/unit/unit/JuliaReinferVisitedTest.class b/defects/julia/unit/unit/JuliaReinferVisitedTest.class deleted file mode 100644 index f27c78889..000000000 Binary files a/defects/julia/unit/unit/JuliaReinferVisitedTest.class and /dev/null differ diff --git a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$GracePeriodGraphNode.class b/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$GracePeriodGraphNode.class deleted file mode 100644 index cc2f0b0d5..000000000 Binary files a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$GracePeriodGraphNode.class and /dev/null differ diff --git a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$GraphNode.class b/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$GraphNode.class deleted file mode 100644 index f07028dbe..000000000 Binary files a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$GraphNode.class and /dev/null differ diff --git a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$TopologyException.class b/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$TopologyException.class deleted file mode 100644 index 2a57c6d96..000000000 Binary files a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest$TopologyException.class and /dev/null differ diff --git a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest.class b/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest.class deleted file mode 100644 index ab1fac46a..000000000 Binary files a/defects/kafka/unit/unit/KafkaGraphGraceSearchDiamondTest.class and /dev/null differ diff --git a/defects/kdenlive/unit/KdenliveTest.class b/defects/kdenlive/unit/KdenliveTest.class deleted file mode 100644 index 843527956..000000000 Binary files a/defects/kdenlive/unit/KdenliveTest.class and /dev/null differ diff --git a/defects/libreoffice/unit/LibreOfficeTest.class b/defects/libreoffice/unit/LibreOfficeTest.class deleted file mode 100644 index 609f5fdf2..000000000 Binary files a/defects/libreoffice/unit/LibreOfficeTest.class and /dev/null differ diff --git a/defects/libtorrent/unit/LibtorrentTest$FileStorageDefective.class b/defects/libtorrent/unit/LibtorrentTest$FileStorageDefective.class deleted file mode 100644 index bccf58a61..000000000 Binary files a/defects/libtorrent/unit/LibtorrentTest$FileStorageDefective.class and /dev/null differ diff --git a/defects/libtorrent/unit/LibtorrentTest$FileStorageFixed.class b/defects/libtorrent/unit/LibtorrentTest$FileStorageFixed.class deleted file mode 100644 index aa4347969..000000000 Binary files a/defects/libtorrent/unit/LibtorrentTest$FileStorageFixed.class and /dev/null differ diff --git a/defects/libtorrent/unit/LibtorrentTest.class b/defects/libtorrent/unit/LibtorrentTest.class deleted file mode 100644 index 719cab950..000000000 Binary files a/defects/libtorrent/unit/LibtorrentTest.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm$DefectiveUpdateLive.class b/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm$DefectiveUpdateLive.class deleted file mode 100644 index c4a16c4bc..000000000 Binary files a/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm$DefectiveUpdateLive.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm$FixedUpdateLive.class b/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm$FixedUpdateLive.class deleted file mode 100644 index bb54437a6..000000000 Binary files a/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm$FixedUpdateLive.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm.class b/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm.class deleted file mode 100644 index 515a5b495..000000000 Binary files a/defects/libvirt/unit/Libvirt0001CpuUpdateLiveAlgorithm.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0001Test.class b/defects/libvirt/unit/Libvirt0001Test.class deleted file mode 100644 index 40e76760e..000000000 Binary files a/defects/libvirt/unit/Libvirt0001Test.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm$DefectiveFeatureFind.class b/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm$DefectiveFeatureFind.class deleted file mode 100644 index 321b9f575..000000000 Binary files a/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm$DefectiveFeatureFind.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm$FixedFeatureFind.class b/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm$FixedFeatureFind.class deleted file mode 100644 index 403a13cba..000000000 Binary files a/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm$FixedFeatureFind.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm.class b/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm.class deleted file mode 100644 index 8c3d34615..000000000 Binary files a/defects/libvirt/unit/Libvirt0002CpuFeatureFindAlgorithm.class and /dev/null differ diff --git a/defects/libvirt/unit/Libvirt0002Test.class b/defects/libvirt/unit/Libvirt0002Test.class deleted file mode 100644 index ed498a853..000000000 Binary files a/defects/libvirt/unit/Libvirt0002Test.class and /dev/null differ diff --git a/defects/litellm/patch/litellm-0001-proxy-server-delete-deployment-list-membership.patch b/defects/litellm/patch/litellm-0001-proxy-server-delete-deployment-list-membership.patch new file mode 100644 index 000000000..12de7c3f3 --- /dev/null +++ b/defects/litellm/patch/litellm-0001-proxy-server-delete-deployment-list-membership.patch @@ -0,0 +1,14 @@ +# UNDF: UNDF-2026-000000869 +--- a/litellm/proxy/proxy_server.py ++++ b/litellm/proxy/proxy_server.py +@@ -3876,8 +3876,9 @@ class ProxyConfig: + router_model_ids = llm_router.get_model_ids() + # Check for model IDs in llm_router not present in combined_id_list and delete them + ++ combined_id_set = set(combined_id_list) # O(1) lookup instead of O(N) list scan + deleted_deployments = 0 + for model_id in router_model_ids: +- if model_id not in combined_id_list: ++ if model_id not in combined_id_set: + is_deleted = llm_router.delete_deployment(id=model_id) + if is_deleted is not None: diff --git a/defects/litellm/test/LitellmTest.class b/defects/litellm/test/LitellmTest.class new file mode 100644 index 000000000..3bcf53d1f Binary files /dev/null and b/defects/litellm/test/LitellmTest.class differ diff --git a/defects/litellm/test/LitellmTest.java b/defects/litellm/test/LitellmTest.java new file mode 100644 index 000000000..869af7de9 --- /dev/null +++ b/defects/litellm/test/LitellmTest.java @@ -0,0 +1,121 @@ +import java.util.*; + +/** + * Unit test for litellm-0001: ProxyConfig._delete_deployment combined_id_list + * linear membership test O(R*C) -> O(R) with set. + * + * Defect: litellm/proxy/proxy_server.py _delete_deployment() iterates + * router_model_ids and for each checks `model_id not in combined_id_list` + * where combined_id_list is a plain Python list. O(R*C) where R = router + * model count, C = combined list size. + * + * Fix: convert combined_id_list to a set before the loop for O(1) lookups. + */ +public class LitellmTest { + + // --- Defective: list membership in loop O(R*C) --- + static int deleteDeploymentsDefective(List routerModelIds, List combinedIdList) { + int deleted = 0; + long ops = 0; + for (String modelId : routerModelIds) { + // Linear scan of combinedIdList — O(C) per iteration + boolean found = false; + for (String cid : combinedIdList) { + ops++; + if (cid.equals(modelId)) { + found = true; + break; + } + } + if (!found) { + deleted++; + } + } + System.out.println(" defective ops: " + ops); + return deleted; + } + + // --- Fixed: set membership in loop O(R) --- + static int deleteDeploymentsFixed(List routerModelIds, List combinedIdList) { + int deleted = 0; + long ops = 0; + Set combinedIdSet = new HashSet<>(combinedIdList); + for (String modelId : routerModelIds) { + ops++; + if (!combinedIdSet.contains(modelId)) { + deleted++; + } + } + System.out.println(" fixed ops: " + ops); + return deleted; + } + + public static void main(String[] args) { + int[] sizes = {50, 200, 500}; + boolean allPass = true; + + for (int N : sizes) { + System.out.println("N=" + N + " (router models and combined IDs):"); + + // Router has N models; combined list has N models (half overlap) + List routerModelIds = new ArrayList<>(); + List combinedIdList = new ArrayList<>(); + for (int i = 0; i < N; i++) { + routerModelIds.add("model-" + i); + // Half overlap: combined has even-indexed models + some extras + if (i % 2 == 0) { + combinedIdList.add("model-" + i); + } else { + combinedIdList.add("extra-" + i); + } + } + + int defectiveResult = deleteDeploymentsDefective(routerModelIds, combinedIdList); + int fixedResult = deleteDeploymentsFixed(routerModelIds, combinedIdList); + + // Results must match + boolean match = (defectiveResult == fixedResult); + System.out.println(" deleted: defective=" + defectiveResult + " fixed=" + fixedResult + " match=" + match); + + if (!match) { + allPass = false; + System.out.println(" FAIL: results don't match"); + } else { + System.out.println(" PASS"); + } + } + + // Op-count ratio check at N=500 + // Defective: ~500 * 250 (avg) = 125,000 ops + // Fixed: 500 ops + // Ratio should be >= 50x + int N = 500; + List routerIds = new ArrayList<>(); + List combinedIds = new ArrayList<>(); + for (int i = 0; i < N; i++) { + routerIds.add("model-" + i); + combinedIds.add("model-" + (i + N / 2)); // partial overlap + } + + long startDef = System.nanoTime(); + for (int rep = 0; rep < 1000; rep++) { + deleteDeploymentsDefective(routerIds, combinedIds); + } + long defTime = System.nanoTime() - startDef; + + long startFix = System.nanoTime(); + for (int rep = 0; rep < 1000; rep++) { + deleteDeploymentsFixed(routerIds, combinedIds); + } + long fixTime = System.nanoTime() - startFix; + + double ratio = (double) defTime / fixTime; + System.out.println("\nTiming at N=" + N + ": defective=" + defTime / 1_000_000 + "ms fixed=" + fixTime / 1_000_000 + "ms ratio=" + String.format("%.1f", ratio) + "x"); + boolean ratioPass = ratio >= 5.0; + System.out.println("Ratio check (>=5x): " + (ratioPass ? "PASS" : "FAIL")); + if (!ratioPass) allPass = false; + + System.out.println("\n" + (allPass ? "ALL TESTS PASSED" : "SOME TESTS FAILED")); + System.exit(allPass ? 0 : 1); + } +} diff --git a/defects/llvm/unit/LlvmTest.class b/defects/llvm/unit/LlvmTest.class deleted file mode 100644 index d5a909261..000000000 Binary files a/defects/llvm/unit/LlvmTest.class and /dev/null differ diff --git a/defects/loki/unit/LokiTest$DagAfter.class b/defects/loki/unit/LokiTest$DagAfter.class deleted file mode 100644 index 1f20e5a07..000000000 Binary files a/defects/loki/unit/LokiTest$DagAfter.class and /dev/null differ diff --git a/defects/loki/unit/LokiTest$DagBefore.class b/defects/loki/unit/LokiTest$DagBefore.class deleted file mode 100644 index 7cc7787ab..000000000 Binary files a/defects/loki/unit/LokiTest$DagBefore.class and /dev/null differ diff --git a/defects/loki/unit/LokiTest.class b/defects/loki/unit/LokiTest.class deleted file mode 100644 index 4e322ac56..000000000 Binary files a/defects/loki/unit/LokiTest.class and /dev/null differ diff --git a/defects/mattermost/unit/MattermostTest.class b/defects/mattermost/unit/MattermostTest.class deleted file mode 100644 index e6ce52583..000000000 Binary files a/defects/mattermost/unit/MattermostTest.class and /dev/null differ diff --git a/defects/meson/unit/MesonLinkWholeDiamondTest.class b/defects/meson/unit/MesonLinkWholeDiamondTest.class deleted file mode 100644 index 7bc5399de..000000000 Binary files a/defects/meson/unit/MesonLinkWholeDiamondTest.class and /dev/null differ diff --git a/defects/meson/unit/unit/MesonLinkWholeDiamondTest.class b/defects/meson/unit/unit/MesonLinkWholeDiamondTest.class deleted file mode 100644 index 7bc5399de..000000000 Binary files a/defects/meson/unit/unit/MesonLinkWholeDiamondTest.class and /dev/null differ diff --git a/defects/micronaut-core/unit/MicronautCoreTest.class b/defects/micronaut-core/unit/MicronautCoreTest.class deleted file mode 100644 index 951dba84c..000000000 Binary files a/defects/micronaut-core/unit/MicronautCoreTest.class and /dev/null differ diff --git a/defects/micronaut/unit/unit/MicronautTest.class b/defects/micronaut/unit/unit/MicronautTest.class deleted file mode 100644 index eb46eb576..000000000 Binary files a/defects/micronaut/unit/unit/MicronautTest.class and /dev/null differ diff --git a/defects/minio/unit/MinioTest.class b/defects/minio/unit/MinioTest.class deleted file mode 100644 index 4b7426f23..000000000 Binary files a/defects/minio/unit/MinioTest.class and /dev/null differ diff --git a/defects/mpich/unit/unit/MpichGroupTest.class b/defects/mpich/unit/unit/MpichGroupTest.class deleted file mode 100644 index 558da0daa..000000000 Binary files a/defects/mpich/unit/unit/MpichGroupTest.class and /dev/null differ diff --git a/defects/nats-server/unit/NatsServerTest.class b/defects/nats-server/unit/NatsServerTest.class deleted file mode 100644 index d937709dd..000000000 Binary files a/defects/nats-server/unit/NatsServerTest.class and /dev/null differ diff --git a/defects/neovim/unit/NeovimTest.class b/defects/neovim/unit/NeovimTest.class deleted file mode 100644 index 26cb8d34f..000000000 Binary files a/defects/neovim/unit/NeovimTest.class and /dev/null differ diff --git a/defects/netty-0001/test/Netty0001Test.class b/defects/netty-0001/test/Netty0001Test.class deleted file mode 100644 index 48cf2d867..000000000 Binary files a/defects/netty-0001/test/Netty0001Test.class and /dev/null differ diff --git a/defects/netty-0002/test/Netty0002Test.class b/defects/netty-0002/test/Netty0002Test.class deleted file mode 100644 index 6428e0f09..000000000 Binary files a/defects/netty-0002/test/Netty0002Test.class and /dev/null differ diff --git a/defects/netty/unit/NettyDnsDeduplicateTest.class b/defects/netty/unit/NettyDnsDeduplicateTest.class deleted file mode 100644 index e1def01e4..000000000 Binary files a/defects/netty/unit/NettyDnsDeduplicateTest.class and /dev/null differ diff --git a/defects/networkx/unit/unit/NetworkXCyclesTest$DefectiveInferenceStack.class b/defects/networkx/unit/unit/NetworkXCyclesTest$DefectiveInferenceStack.class deleted file mode 100644 index a1dd60dcf..000000000 Binary files a/defects/networkx/unit/unit/NetworkXCyclesTest$DefectiveInferenceStack.class and /dev/null differ diff --git a/defects/networkx/unit/unit/NetworkXCyclesTest$FixedInferenceStack.class b/defects/networkx/unit/unit/NetworkXCyclesTest$FixedInferenceStack.class deleted file mode 100644 index 1b1636b26..000000000 Binary files a/defects/networkx/unit/unit/NetworkXCyclesTest$FixedInferenceStack.class and /dev/null differ diff --git a/defects/networkx/unit/unit/NetworkXCyclesTest.class b/defects/networkx/unit/unit/NetworkXCyclesTest.class deleted file mode 100644 index 47c41bde3..000000000 Binary files a/defects/networkx/unit/unit/NetworkXCyclesTest.class and /dev/null differ diff --git a/defects/networkx/unit/unit/NetworkXKcutsetsTest$IntArrayKey.class b/defects/networkx/unit/unit/NetworkXKcutsetsTest$IntArrayKey.class deleted file mode 100644 index 6a270b937..000000000 Binary files a/defects/networkx/unit/unit/NetworkXKcutsetsTest$IntArrayKey.class and /dev/null differ diff --git a/defects/networkx/unit/unit/NetworkXKcutsetsTest.class b/defects/networkx/unit/unit/NetworkXKcutsetsTest.class deleted file mode 100644 index d26083395..000000000 Binary files a/defects/networkx/unit/unit/NetworkXKcutsetsTest.class and /dev/null differ diff --git a/defects/ninja/unit/unit/NinjaTest.class b/defects/ninja/unit/unit/NinjaTest.class deleted file mode 100644 index 4fd60a1e6..000000000 Binary files a/defects/ninja/unit/unit/NinjaTest.class and /dev/null differ diff --git a/defects/nomad/unit/NomadTest.class b/defects/nomad/unit/NomadTest.class deleted file mode 100644 index f46234dc1..000000000 Binary files a/defects/nomad/unit/NomadTest.class and /dev/null differ diff --git a/defects/obs-studio/unit/ObsStudioTest.class b/defects/obs-studio/unit/ObsStudioTest.class deleted file mode 100644 index 505e27786..000000000 Binary files a/defects/obs-studio/unit/ObsStudioTest.class and /dev/null differ diff --git a/defects/ompi/unit/unit/OmpiGroupTest.class b/defects/ompi/unit/unit/OmpiGroupTest.class deleted file mode 100644 index 3fbb09ff5..000000000 Binary files a/defects/ompi/unit/unit/OmpiGroupTest.class and /dev/null differ diff --git a/defects/onos/unit/unit/ONOS0004ConnectivityResourcesTest$Resource.class b/defects/onos/unit/unit/ONOS0004ConnectivityResourcesTest$Resource.class deleted file mode 100644 index dc146d02d..000000000 Binary files a/defects/onos/unit/unit/ONOS0004ConnectivityResourcesTest$Resource.class and /dev/null differ diff --git a/defects/onos/unit/unit/ONOS0004ConnectivityResourcesTest.class b/defects/onos/unit/unit/ONOS0004ConnectivityResourcesTest.class deleted file mode 100644 index 75b92b2a1..000000000 Binary files a/defects/onos/unit/unit/ONOS0004ConnectivityResourcesTest.class and /dev/null differ diff --git a/defects/opencv/unit/OpenCVTest$Point2f.class b/defects/opencv/unit/OpenCVTest$Point2f.class deleted file mode 100644 index d609daded..000000000 Binary files a/defects/opencv/unit/OpenCVTest$Point2f.class and /dev/null differ diff --git a/defects/opencv/unit/OpenCVTest.class b/defects/opencv/unit/OpenCVTest.class deleted file mode 100644 index 04af4fabc..000000000 Binary files a/defects/opencv/unit/OpenCVTest.class and /dev/null differ diff --git a/defects/openvpn/unit/OpenVpnNcpCipherTest.class b/defects/openvpn/unit/OpenVpnNcpCipherTest.class deleted file mode 100644 index d0ecd81e7..000000000 Binary files a/defects/openvpn/unit/OpenVpnNcpCipherTest.class and /dev/null differ diff --git a/defects/pcl/unit/unit/PclRegionGrowingGetSegmentTest.class b/defects/pcl/unit/unit/PclRegionGrowingGetSegmentTest.class deleted file mode 100644 index fe4856529..000000000 Binary files a/defects/pcl/unit/unit/PclRegionGrowingGetSegmentTest.class and /dev/null differ diff --git a/defects/pgbouncer/CLEAN.md b/defects/pgbouncer/CLEAN.md new file mode 100644 index 000000000..65fb521e3 --- /dev/null +++ b/defects/pgbouncer/CLEAN.md @@ -0,0 +1,13 @@ +# PgBouncer — CLEAN (CWE-407) + +Scanned 2026-03-30. + +PgBouncer uses efficient data structures throughout: +- **User lookup**: AA-tree (`aatree_search`) — O(log N) +- **Prepared statements**: uthash — O(1) +- **Session variable cache**: uthash — O(1) +- **HBA name sets**: cbtree (crit-bit tree) for >10 entries — O(log N) +- **Database lookup**: `find_database()` is linear scan of `database_list`, + but databases are configuration-bounded (typically <100), not attacker-controlled. + +No CWE-407 defect found. diff --git a/defects/prometheus/unit/Prometheus0002DependenciesTest.class b/defects/prometheus/unit/Prometheus0002DependenciesTest.class deleted file mode 100644 index 1ead503e4..000000000 Binary files a/defects/prometheus/unit/Prometheus0002DependenciesTest.class and /dev/null differ diff --git a/defects/prometheus/unit/PrometheusTest$Rule.class b/defects/prometheus/unit/PrometheusTest$Rule.class deleted file mode 100644 index 7779635b0..000000000 Binary files a/defects/prometheus/unit/PrometheusTest$Rule.class and /dev/null differ diff --git a/defects/prometheus/unit/PrometheusTest.class b/defects/prometheus/unit/PrometheusTest.class deleted file mode 100644 index 986254547..000000000 Binary files a/defects/prometheus/unit/PrometheusTest.class and /dev/null differ diff --git a/defects/proxysql/test/ProxySQLConnectionPoolMetricsTest.class b/defects/proxysql/test/ProxySQLConnectionPoolMetricsTest.class deleted file mode 100644 index 2b97915f5..000000000 Binary files a/defects/proxysql/test/ProxySQLConnectionPoolMetricsTest.class and /dev/null differ diff --git a/defects/pulsar/unit/PulsarTest.class b/defects/pulsar/unit/PulsarTest.class deleted file mode 100644 index f44e2be63..000000000 Binary files a/defects/pulsar/unit/PulsarTest.class and /dev/null differ diff --git a/defects/puppet/unit/PuppetGraphTest.class b/defects/puppet/unit/PuppetGraphTest.class deleted file mode 100644 index 4fdc987d9..000000000 Binary files a/defects/puppet/unit/PuppetGraphTest.class and /dev/null differ diff --git a/defects/quarkus/unit/QuarkusTest.class b/defects/quarkus/unit/QuarkusTest.class deleted file mode 100644 index 409f5e800..000000000 Binary files a/defects/quarkus/unit/QuarkusTest.class and /dev/null differ diff --git a/defects/quarkus/unit/unit/QuarkusTest.class b/defects/quarkus/unit/unit/QuarkusTest.class deleted file mode 100644 index d9127a5ef..000000000 Binary files a/defects/quarkus/unit/unit/QuarkusTest.class and /dev/null differ diff --git a/defects/ruby/unit/RubyTest.class b/defects/ruby/unit/RubyTest.class deleted file mode 100644 index f4ff3a5f5..000000000 Binary files a/defects/ruby/unit/RubyTest.class and /dev/null differ diff --git a/defects/rustc/unit/FinalizeImportsAlgorithm$AmbiguityError.class b/defects/rustc/unit/FinalizeImportsAlgorithm$AmbiguityError.class deleted file mode 100644 index b1b1b1bdd..000000000 Binary files a/defects/rustc/unit/FinalizeImportsAlgorithm$AmbiguityError.class and /dev/null differ diff --git a/defects/rustc/unit/FinalizeImportsAlgorithm$FastResolver.class b/defects/rustc/unit/FinalizeImportsAlgorithm$FastResolver.class deleted file mode 100644 index 9e4a2d156..000000000 Binary files a/defects/rustc/unit/FinalizeImportsAlgorithm$FastResolver.class and /dev/null differ diff --git a/defects/rustc/unit/FinalizeImportsAlgorithm$Result.class b/defects/rustc/unit/FinalizeImportsAlgorithm$Result.class deleted file mode 100644 index 93d6a49cb..000000000 Binary files a/defects/rustc/unit/FinalizeImportsAlgorithm$Result.class and /dev/null differ diff --git a/defects/rustc/unit/FinalizeImportsAlgorithm$SlowResolver.class b/defects/rustc/unit/FinalizeImportsAlgorithm$SlowResolver.class deleted file mode 100644 index 97b481efe..000000000 Binary files a/defects/rustc/unit/FinalizeImportsAlgorithm$SlowResolver.class and /dev/null differ diff --git a/defects/rustc/unit/FinalizeImportsAlgorithm.class b/defects/rustc/unit/FinalizeImportsAlgorithm.class deleted file mode 100644 index 89eb86d04..000000000 Binary files a/defects/rustc/unit/FinalizeImportsAlgorithm.class and /dev/null differ diff --git a/defects/scribus/unit/ScribusTest.class b/defects/scribus/unit/ScribusTest.class deleted file mode 100644 index fb366b131..000000000 Binary files a/defects/scribus/unit/ScribusTest.class and /dev/null differ diff --git a/defects/sdl/unit/unit/SdlTest.class b/defects/sdl/unit/unit/SdlTest.class deleted file mode 100644 index 7ab3bd811..000000000 Binary files a/defects/sdl/unit/unit/SdlTest.class and /dev/null differ diff --git a/defects/shotcut/unit/ShotcutTest.class b/defects/shotcut/unit/ShotcutTest.class deleted file mode 100644 index b649aad7d..000000000 Binary files a/defects/shotcut/unit/ShotcutTest.class and /dev/null differ diff --git a/defects/squid-0001/patch/squid-0001-notepairs-appendnewonly-set.patch b/defects/squid-0001/patch/squid-0001-notepairs-appendnewonly-set.patch new file mode 100644 index 000000000..3ba746923 --- /dev/null +++ b/defects/squid-0001/patch/squid-0001-notepairs-appendnewonly-set.patch @@ -0,0 +1,29 @@ +# UNDF: UNDF-2026-000000870 +--- a/src/Notes.cc ++++ b/src/Notes.cc +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + Note::Value::~Value() + { +@@ -388,9 +389,16 @@ NotePairs::append(const NotePairs *src) + void + NotePairs::appendNewOnly(const NotePairs *src) + { ++ // Build a set of existing (name, value) pairs for O(1) lookup ++ // instead of linear hasPair() scan per source entry. ++ std::set> existing; ++ for (const auto &e: entries) ++ existing.emplace(e->name(), e->value()); ++ + for (const auto &e: src->entries) { +- if (!hasPair(e->name(), e->value())) ++ if (existing.find(std::make_pair(e->name(), e->value())) == existing.end()) { + entries.push_back(new NotePairs::Entry(e->name(), e->value())); ++ existing.emplace(e->name(), e->value()); ++ } + } + } diff --git a/defects/squid-0001/test/SquidNotePairsTest.class b/defects/squid-0001/test/SquidNotePairsTest.class new file mode 100644 index 000000000..91c7c031d Binary files /dev/null and b/defects/squid-0001/test/SquidNotePairsTest.class differ diff --git a/defects/squid-0001/test/SquidNotePairsTest.java b/defects/squid-0001/test/SquidNotePairsTest.java new file mode 100644 index 000000000..f92ac75c3 --- /dev/null +++ b/defects/squid-0001/test/SquidNotePairsTest.java @@ -0,0 +1,99 @@ +import java.util.*; + +/** + * Unit test for Squid CWE-407: NotePairs::appendNewOnly O(S*D) linear hasPair scan. + * + * Defect: NotePairs::appendNewOnly iterates source entries and calls hasPair() + * for each one, which does a linear scan of destination entries. + * Complexity: O(S * D) where S = source entries, D = destination entries. + * Called per HTTP request in ClientHttpRequest::initRequest() to merge + * connection annotations into request annotations. + * + * Fix: Build a HashSet of existing (name, value) pairs before the loop, + * reducing hasPair() from O(D) to O(1). Total: O(S + D) instead of O(S * D). + */ +public class SquidNotePairsTest { + + // --- Defective: linear scan per entry --- + static int hasPairOps = 0; + + static boolean hasPairDefective(List entries, String name, String value) { + for (String[] e : entries) { + hasPairOps++; + if (e[0].equals(name) && e[1].equals(value)) + return true; + } + return false; + } + + static void appendNewOnlyDefective(List dest, List src) { + for (String[] e : src) { + if (!hasPairDefective(dest, e[0], e[1])) + dest.add(new String[]{e[0], e[1]}); + } + } + + // --- Fixed: set-based lookup --- + static int fixedOps = 0; + + static void appendNewOnlyFixed(List dest, List src) { + Set existing = new HashSet<>(); + for (String[] e : dest) { + fixedOps++; + existing.add(e[0] + "\0" + e[1]); + } + for (String[] e : src) { + fixedOps++; + String key = e[0] + "\0" + e[1]; + if (!existing.contains(key)) { + dest.add(new String[]{e[0], e[1]}); + existing.add(key); + } + } + } + + public static void main(String[] args) { + int N = 500; // annotations in destination + int S = 500; // annotations from source (connection) + + // Build destination entries (existing annotations) + List destDefective = new ArrayList<>(); + for (int i = 0; i < N; i++) + destDefective.add(new String[]{"key-" + i, "val-" + i}); + + // Build source entries (all new, worst case) + List src = new ArrayList<>(); + for (int i = N; i < N + S; i++) + src.add(new String[]{"key-" + i, "val-" + i}); + + List destFixed = new ArrayList<>(destDefective); + + // Run defective version + hasPairOps = 0; + appendNewOnlyDefective(destDefective, src); + int defectiveOps = hasPairOps; + + // Run fixed version + fixedOps = 0; + appendNewOnlyFixed(destFixed, src); + int fixedOpsCount = fixedOps; + + double ratio = (double) defectiveOps / fixedOpsCount; + + System.out.println("=== Squid squid-0001: NotePairs::appendNewOnly O(S*D) ==="); + System.out.println("N (dest entries): " + N); + System.out.println("S (src entries): " + S); + System.out.println("Defective ops: " + defectiveOps); + System.out.println("Fixed ops: " + fixedOpsCount); + System.out.printf("Ratio: %.1fx%n", ratio); + + // Verify correctness + assert destDefective.size() == N + S : "Defective: wrong size"; + assert destFixed.size() == N + S : "Fixed: wrong size"; + + // Verify ratio shows quadratic vs linear + assert ratio > 10.0 : "Expected >10x ratio, got " + ratio; + + System.out.println("PASS"); + } +} diff --git a/defects/storm/unit/StormTest.class b/defects/storm/unit/StormTest.class deleted file mode 100644 index 5b92eb292..000000000 Binary files a/defects/storm/unit/StormTest.class and /dev/null differ diff --git a/defects/strawberry/unit/StrawberryTest.class b/defects/strawberry/unit/StrawberryTest.class deleted file mode 100644 index 9e442bd5a..000000000 Binary files a/defects/strawberry/unit/StrawberryTest.class and /dev/null differ diff --git a/defects/suitecrm/patch/suitecrm-0001-inboundemail-uids-in_array.patch b/defects/suitecrm/patch/suitecrm-0001-inboundemail-uids-in_array.patch new file mode 100644 index 000000000..94620ef26 --- /dev/null +++ b/defects/suitecrm/patch/suitecrm-0001-inboundemail-uids-in_array.patch @@ -0,0 +1,20 @@ +# UNDF: UNDF-2026-000000871 +--- a/modules/InboundEmail/InboundEmail.php ++++ b/modules/InboundEmail/InboundEmail.php +@@ -1236,6 +1236,7 @@ + $r = $this->db->query($q); + $uids = array(); ++ $uidsSet = array(); // O(1) lookup instead of O(N) in_array + + while ($a = $this->db->fetchByAssoc($r)) { + $uids[] = $a['imap_uid']; ++ $uidsSet[$a['imap_uid']] = true; + } +@@ -1261,7 +1263,7 @@ + } + foreach ($insert as $overview) { +- if (in_array($overview->imap_uid, $uids)) { ++ if (isset($uidsSet[$overview->imap_uid])) { + // fixing bug #49543: setting 'mbox' property for the following updating of other items in this box + if (!isset($overview->mbox)) { + $overview->mbox = $mbox; diff --git a/defects/suitecrm/patch/suitecrm-0002-jjwg_maps-records-in_array.patch b/defects/suitecrm/patch/suitecrm-0002-jjwg_maps-records-in_array.patch new file mode 100644 index 000000000..d75188dd3 --- /dev/null +++ b/defects/suitecrm/patch/suitecrm-0002-jjwg_maps-records-in_array.patch @@ -0,0 +1,23 @@ +# UNDF: UNDF-2026-000000872 +--- a/modules/jjwg_Maps/controller.php ++++ b/modules/jjwg_Maps/controller.php +@@ -938,6 +938,7 @@ + } + } + //var_dump($records); ++ $recordsSet = !empty($records) ? array_flip($records) : array(); // O(1) lookup + + // Find the Items to Display + // Assume there is no address at 0,0; it's in the Atlantic Ocean! +@@ -959,10 +960,10 @@ + while ($display = $this->bean->db->fetchByAssoc($display_result)) { + if (!empty($search_array['where'])) { // Select all records (advanced search) with where clause +- if (in_array($display['id'], $records)) { ++ if (isset($recordsSet[$display['id']])) { + $this->bean->map_markers[] = $this->getMarkerData($display_module, $display, false, $mod_strings_display); + } + } elseif (!empty($_REQUEST['uid'])) { // Several records selected or this page selected +- if (in_array($display['id'], $records)) { ++ if (isset($recordsSet[$display['id']])) { + $this->bean->map_markers[] = $this->getMarkerData($display_module, $display, false, $mod_strings_display); + } diff --git a/defects/suitecrm/patch/suitecrm-0003-email-knownEmails-in_array.patch b/defects/suitecrm/patch/suitecrm-0003-email-knownEmails-in_array.patch new file mode 100644 index 000000000..b6b3aacff --- /dev/null +++ b/defects/suitecrm/patch/suitecrm-0003-email-knownEmails-in_array.patch @@ -0,0 +1,22 @@ +# UNDF: UNDF-2026-000000873 +--- a/modules/Emails/Email.php ++++ b/modules/Emails/Email.php +@@ -2242,12 +2242,14 @@ + //// HANDLE EMAILS HAND-WRITTEN + $contactRecipients = array(); + $knownEmails = array(); ++ $knownEmailsSet = array(); // O(1) lookup instead of O(N) in_array + + foreach ($addrs_arr as $i => $v) { + if (trim($v) == "") { + continue; + } // skip any "blanks" - will always have 1 +@@ -2254,8 +2256,9 @@ + preg_match("/[A-Z0-9._%-\']+@[A-Z0-9.-]+\.[A-Z]{2,}/i", (string) $v, $match); + + +- if (!empty($match[0]) && !in_array(trim($match[0]), $knownEmails)) { ++ if (!empty($match[0]) && !isset($knownEmailsSet[trim($match[0])])) { + $knownEmails[] = $match[0]; ++ $knownEmailsSet[trim($match[0])] = true; + $recipient['email'] = $match[0]; diff --git a/defects/suitecrm/test/SuiteCRMCWE407Test.class b/defects/suitecrm/test/SuiteCRMCWE407Test.class new file mode 100644 index 000000000..059985701 Binary files /dev/null and b/defects/suitecrm/test/SuiteCRMCWE407Test.class differ diff --git a/defects/suitecrm/test/SuiteCRMCWE407Test.java b/defects/suitecrm/test/SuiteCRMCWE407Test.java new file mode 100644 index 000000000..e361a2a79 --- /dev/null +++ b/defects/suitecrm/test/SuiteCRMCWE407Test.java @@ -0,0 +1,204 @@ +import java.util.*; + +/** + * CWE-407 unit tests for SuiteCRM defects. + * + * suitecrm-0001: InboundEmail.php in_array($overview->imap_uid, $uids) + * — O(I*U) email cache UID membership check + * suitecrm-0002: jjwg_Maps/controller.php in_array($display['id'], $records) + * — O(D*R) map marker record filter + * suitecrm-0003: Email.php in_array(trim($match[0]), $knownEmails) + * — O(N^2) email dedup accumulator + */ +public class SuiteCRMCWE407Test { + + // ---- suitecrm-0001: InboundEmail UID membership ---- + + /** Unpatched: in_array on $uids array — O(I*U) */ + static int inboundEmailUnpatched(List insertUids, List cachedUids) { + int updateCount = 0; + for (String uid : insertUids) { + if (cachedUids.contains(uid)) { // O(U) per email + updateCount++; + } + } + return updateCount; + } + + /** Patched: hash set for O(1) lookup — O(I+U) */ + static int inboundEmailPatched(List insertUids, List cachedUids) { + Set uidSet = new HashSet<>(cachedUids); // O(U) once + int updateCount = 0; + for (String uid : insertUids) { + if (uidSet.contains(uid)) { // O(1) per email + updateCount++; + } + } + return updateCount; + } + + // ---- suitecrm-0002: jjwg_Maps record filter ---- + + /** Unpatched: in_array on $records — O(D*R) */ + static int mapMarkersUnpatched(List displayIds, List records) { + int markers = 0; + for (String id : displayIds) { + if (records.contains(id)) { // O(R) per display + markers++; + } + } + return markers; + } + + /** Patched: array_flip for O(1) lookup — O(D+R) */ + static int mapMarkersPatched(List displayIds, List records) { + Set recordsSet = new HashSet<>(records); // O(R) once + int markers = 0; + for (String id : displayIds) { + if (recordsSet.contains(id)) { // O(1) per display + markers++; + } + } + return markers; + } + + // ---- suitecrm-0003: Email knownEmails dedup ---- + + /** Unpatched: in_array on growing knownEmails — O(N^2) */ + static int emailDedupUnpatched(List addresses) { + List knownEmails = new ArrayList<>(); + int unique = 0; + for (String addr : addresses) { + if (!knownEmails.contains(addr)) { // O(N) scan + knownEmails.add(addr); + unique++; + } + } + return unique; + } + + /** Patched: hash set for O(1) lookup — O(N) total */ + static int emailDedupPatched(List addresses) { + Set knownEmailsSet = new HashSet<>(); + int unique = 0; + for (String addr : addresses) { + if (!knownEmailsSet.contains(addr)) { // O(1) lookup + knownEmailsSet.add(addr); + unique++; + } + } + return unique; + } + + // ---- Test harness ---- + + static void testSuiteCRM0001() { + System.out.println("=== suitecrm-0001: InboundEmail UID membership ==="); + int U = 10000; // cached UIDs in mailbox + int I = 500; // new emails to insert + + List cachedUids = new ArrayList<>(U); + for (int i = 0; i < U; i++) { + cachedUids.add("uid_" + i); + } + List insertUids = new ArrayList<>(I); + for (int i = U - I / 2; i < U + I / 2; i++) { + insertUids.add("uid_" + i); + } + + // Warmup + inboundEmailPatched(insertUids, cachedUids); + + long t0 = System.nanoTime(); + int r1 = inboundEmailUnpatched(insertUids, cachedUids); + long unpatched = System.nanoTime() - t0; + + t0 = System.nanoTime(); + int r2 = inboundEmailPatched(insertUids, cachedUids); + long patched = System.nanoTime() - t0; + + assert r1 == r2 : "Result mismatch"; + assert r1 == I / 2 : "Expected " + (I / 2) + " updates, got " + r1; + + double ratio = (double) unpatched / patched; + System.out.printf(" U=%d I=%d unpatched=%dms patched=%dms ratio=%.1fx%n", + U, I, unpatched / 1_000_000, patched / 1_000_000, ratio); + assert ratio > 5.0 : "Expected >5x ratio, got " + ratio; + System.out.println(" PASS"); + } + + static void testSuiteCRM0002() { + System.out.println("=== suitecrm-0002: jjwg_Maps record filter ==="); + int D = 5000; // display results + int R = 3000; // selected records + + List displayIds = new ArrayList<>(D); + for (int i = 0; i < D; i++) { + displayIds.add("id_" + i); + } + List records = new ArrayList<>(R); + for (int i = 0; i < R; i++) { + records.add("id_" + (i * 2)); // even IDs only + } + + // Warmup + mapMarkersPatched(displayIds, records); + + long t0 = System.nanoTime(); + int r1 = mapMarkersUnpatched(displayIds, records); + long unpatched = System.nanoTime() - t0; + + t0 = System.nanoTime(); + int r2 = mapMarkersPatched(displayIds, records); + long patched = System.nanoTime() - t0; + + assert r1 == r2 : "Result mismatch"; + + double ratio = (double) unpatched / patched; + System.out.printf(" D=%d R=%d unpatched=%dms patched=%dms ratio=%.1fx%n", + D, R, unpatched / 1_000_000, patched / 1_000_000, ratio); + assert ratio > 5.0 : "Expected >5x ratio, got " + ratio; + System.out.println(" PASS"); + } + + static void testSuiteCRM0003() { + System.out.println("=== suitecrm-0003: Email knownEmails dedup ==="); + int N = 10000; // email addresses in mass send + + List addresses = new ArrayList<>(N); + for (int i = 0; i < N; i++) { + addresses.add("user" + i + "@example.com"); + } + // Add duplicates + for (int i = 0; i < N / 5; i++) { + addresses.add("user" + i + "@example.com"); + } + + // Warmup + emailDedupPatched(addresses); + + long t0 = System.nanoTime(); + int r1 = emailDedupUnpatched(addresses); + long unpatched = System.nanoTime() - t0; + + t0 = System.nanoTime(); + int r2 = emailDedupPatched(addresses); + long patched = System.nanoTime() - t0; + + assert r1 == r2 : "Result mismatch"; + assert r1 == N : "Expected " + N + " unique, got " + r1; + + double ratio = (double) unpatched / patched; + System.out.printf(" N=%d unpatched=%dms patched=%dms ratio=%.1fx%n", + N, unpatched / 1_000_000, patched / 1_000_000, ratio); + assert ratio > 5.0 : "Expected >5x ratio, got " + ratio; + System.out.println(" PASS"); + } + + public static void main(String[] args) { + testSuiteCRM0001(); + testSuiteCRM0002(); + testSuiteCRM0003(); + System.out.println("\nAll 3 SuiteCRM CWE-407 tests PASSED."); + } +} diff --git a/defects/superset/unit/SupersetTest.class b/defects/superset/unit/SupersetTest.class deleted file mode 100644 index 0fa4f53b2..000000000 Binary files a/defects/superset/unit/SupersetTest.class and /dev/null differ diff --git a/defects/swift/unit/SwiftTest.class b/defects/swift/unit/SwiftTest.class deleted file mode 100644 index 1180bb436..000000000 Binary files a/defects/swift/unit/SwiftTest.class and /dev/null differ diff --git a/defects/synapse/test/SynapseSyncNewlyJoinedRoomsTest.class b/defects/synapse/test/SynapseSyncNewlyJoinedRoomsTest.class deleted file mode 100644 index ee773b79b..000000000 Binary files a/defects/synapse/test/SynapseSyncNewlyJoinedRoomsTest.class and /dev/null differ diff --git a/defects/syncthing/test/Syncthing0001Test$DefectiveDownloadState.class b/defects/syncthing/test/Syncthing0001Test$DefectiveDownloadState.class deleted file mode 100644 index 2b356ac04..000000000 Binary files a/defects/syncthing/test/Syncthing0001Test$DefectiveDownloadState.class and /dev/null differ diff --git a/defects/syncthing/test/Syncthing0001Test$FixedDownloadState.class b/defects/syncthing/test/Syncthing0001Test$FixedDownloadState.class deleted file mode 100644 index 455001804..000000000 Binary files a/defects/syncthing/test/Syncthing0001Test$FixedDownloadState.class and /dev/null differ diff --git a/defects/syncthing/test/Syncthing0001Test.class b/defects/syncthing/test/Syncthing0001Test.class deleted file mode 100644 index edcbb9014..000000000 Binary files a/defects/syncthing/test/Syncthing0001Test.class and /dev/null differ diff --git a/defects/telegraf/unit/TelegrafTest.class b/defects/telegraf/unit/TelegrafTest.class deleted file mode 100644 index ea0101726..000000000 Binary files a/defects/telegraf/unit/TelegrafTest.class and /dev/null differ diff --git a/defects/terraform/unit/TerraformTest$Graph.class b/defects/terraform/unit/TerraformTest$Graph.class deleted file mode 100644 index 98271549e..000000000 Binary files a/defects/terraform/unit/TerraformTest$Graph.class and /dev/null differ diff --git a/defects/terraform/unit/TerraformTest.class b/defects/terraform/unit/TerraformTest.class deleted file mode 100644 index 3d59afc01..000000000 Binary files a/defects/terraform/unit/TerraformTest.class and /dev/null differ diff --git a/defects/three.js/unit/ThreeJsTest.class b/defects/three.js/unit/ThreeJsTest.class deleted file mode 100644 index 0d8e991b2..000000000 Binary files a/defects/three.js/unit/ThreeJsTest.class and /dev/null differ diff --git a/defects/threejs/unit/unit/ThreeJSNodeTraverseTest$Node.class b/defects/threejs/unit/unit/ThreeJSNodeTraverseTest$Node.class deleted file mode 100644 index 4777bc6e8..000000000 Binary files a/defects/threejs/unit/unit/ThreeJSNodeTraverseTest$Node.class and /dev/null differ diff --git a/defects/threejs/unit/unit/ThreeJSNodeTraverseTest.class b/defects/threejs/unit/unit/ThreeJSNodeTraverseTest.class deleted file mode 100644 index e72366f3f..000000000 Binary files a/defects/threejs/unit/unit/ThreeJSNodeTraverseTest.class and /dev/null differ diff --git a/defects/tidb/unit/TiDBTest.class b/defects/tidb/unit/TiDBTest.class deleted file mode 100644 index 2285dd905..000000000 Binary files a/defects/tidb/unit/TiDBTest.class and /dev/null differ diff --git a/defects/tidb/unit/TidbTest.class b/defects/tidb/unit/TidbTest.class deleted file mode 100644 index f9cc4082f..000000000 Binary files a/defects/tidb/unit/TidbTest.class and /dev/null differ diff --git a/defects/tomcat-0001/test/Tomcat0001Test.class b/defects/tomcat-0001/test/Tomcat0001Test.class deleted file mode 100644 index 15d85ebc0..000000000 Binary files a/defects/tomcat-0001/test/Tomcat0001Test.class and /dev/null differ diff --git a/defects/traefik/unit/TraefikAlgorithmTest.class b/defects/traefik/unit/TraefikAlgorithmTest.class deleted file mode 100644 index 21a64f4ef..000000000 Binary files a/defects/traefik/unit/TraefikAlgorithmTest.class and /dev/null differ diff --git a/defects/typeorm/unit/unit/TypeORM0004ToposortTest.class b/defects/typeorm/unit/unit/TypeORM0004ToposortTest.class deleted file mode 100644 index 3a5873ecb..000000000 Binary files a/defects/typeorm/unit/unit/TypeORM0004ToposortTest.class and /dev/null differ diff --git a/defects/typeorm/unit/unit/unit/TypeORM0004ToposortTest.class b/defects/typeorm/unit/unit/unit/TypeORM0004ToposortTest.class deleted file mode 100644 index 3a5873ecb..000000000 Binary files a/defects/typeorm/unit/unit/unit/TypeORM0004ToposortTest.class and /dev/null differ diff --git a/defects/typescript/unit/TypeScriptHasBaseTypeTest.class b/defects/typescript/unit/TypeScriptHasBaseTypeTest.class deleted file mode 100644 index 2a8f024a3..000000000 Binary files a/defects/typescript/unit/TypeScriptHasBaseTypeTest.class and /dev/null differ diff --git a/defects/typescript/unit/unit/TypeScriptHasBaseTypeTest.class b/defects/typescript/unit/unit/TypeScriptHasBaseTypeTest.class deleted file mode 100644 index 2a8f024a3..000000000 Binary files a/defects/typescript/unit/unit/TypeScriptHasBaseTypeTest.class and /dev/null differ diff --git a/defects/v8/unit/unit/V8MaglevKnownMapsMergerTest.class b/defects/v8/unit/unit/V8MaglevKnownMapsMergerTest.class deleted file mode 100644 index 019fb0b2b..000000000 Binary files a/defects/v8/unit/unit/V8MaglevKnownMapsMergerTest.class and /dev/null differ diff --git a/defects/vertx/unit/VertxTest.class b/defects/vertx/unit/VertxTest.class deleted file mode 100644 index a2b431da5..000000000 Binary files a/defects/vertx/unit/VertxTest.class and /dev/null differ diff --git a/defects/vim/unit/VimTest$SignEntry.class b/defects/vim/unit/VimTest$SignEntry.class deleted file mode 100644 index 6047c1f27..000000000 Binary files a/defects/vim/unit/VimTest$SignEntry.class and /dev/null differ diff --git a/defects/vim/unit/VimTest.class b/defects/vim/unit/VimTest.class deleted file mode 100644 index 49c2ce73e..000000000 Binary files a/defects/vim/unit/VimTest.class and /dev/null differ diff --git a/defects/vlc/unit/VlcTest.class b/defects/vlc/unit/VlcTest.class deleted file mode 100644 index 1ebe703d1..000000000 Binary files a/defects/vlc/unit/VlcTest.class and /dev/null differ diff --git a/defects/vllm/patch/vllm-0001-lora-convert-mapping-index.patch b/defects/vllm/patch/vllm-0001-lora-convert-mapping-index.patch index d34e8f422..e87c8db24 100644 --- a/defects/vllm/patch/vllm-0001-lora-convert-mapping-index.patch +++ b/defects/vllm/patch/vllm-0001-lora-convert-mapping-index.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000874 --- a/vllm/lora/punica_wrapper/utils.py +++ b/vllm/lora/punica_wrapper/utils.py @@ -86,15 +86,18 @@ diff --git a/defects/vscode/unit/VscodeTest.class b/defects/vscode/unit/VscodeTest.class deleted file mode 100644 index f2369b49c..000000000 Binary files a/defects/vscode/unit/VscodeTest.class and /dev/null differ diff --git a/defects/wireshark/unit/unit/WiresharkQuicStreamsTest$WmemList.class b/defects/wireshark/unit/unit/WiresharkQuicStreamsTest$WmemList.class deleted file mode 100644 index f71907739..000000000 Binary files a/defects/wireshark/unit/unit/WiresharkQuicStreamsTest$WmemList.class and /dev/null differ diff --git a/defects/wireshark/unit/unit/WiresharkQuicStreamsTest.class b/defects/wireshark/unit/unit/WiresharkQuicStreamsTest.class deleted file mode 100644 index 4094a145a..000000000 Binary files a/defects/wireshark/unit/unit/WiresharkQuicStreamsTest.class and /dev/null differ diff --git a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$DefectiveBalanceLoad.class b/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$DefectiveBalanceLoad.class deleted file mode 100644 index b9c01d00b..000000000 Binary files a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$DefectiveBalanceLoad.class and /dev/null differ diff --git a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$FixedBalanceLoad.class b/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$FixedBalanceLoad.class deleted file mode 100644 index 9af6952f2..000000000 Binary files a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$FixedBalanceLoad.class and /dev/null differ diff --git a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$SwapPair.class b/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$SwapPair.class deleted file mode 100644 index 944c123b2..000000000 Binary files a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$SwapPair.class and /dev/null differ diff --git a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$Vcpu.class b/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$Vcpu.class deleted file mode 100644 index 18c363562..000000000 Binary files a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm$Vcpu.class and /dev/null differ diff --git a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm.class b/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm.class deleted file mode 100644 index 21851a705..000000000 Binary files a/defects/xen/unit/Xen0001CreditBalanceLoadAlgorithm.class and /dev/null differ diff --git a/defects/xen/unit/Xen0001Test.class b/defects/xen/unit/Xen0001Test.class deleted file mode 100644 index 5b7e436c8..000000000 Binary files a/defects/xen/unit/Xen0001Test.class and /dev/null differ diff --git a/defects/zed/unit/ZedTest.class b/defects/zed/unit/ZedTest.class deleted file mode 100644 index 75ecb7a96..000000000 Binary files a/defects/zed/unit/ZedTest.class and /dev/null differ