engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 352/169 — wave4 MEDIUM (hadoop/hbase/nova/neutron/openstack) + fix odl-0002 dup

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 15:33:17 -04:00
parent 9934133dcf
commit 835ae73b0f
82 changed files with 5931 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
whitepaper/MD5SUMS
View file

@ -1 +1,10 @@
cf5ce1bb2ff4db52c2a8dd31234738ab undefect-cwe407-2026-03-27.pdf
33dc45d94dcb2b6cec4f7036497571d7 executive-summary.pdf
ba0de5d1546aa2971492f74616f13f47 full-paper.pdf
3fda5736a004c621f52701c92a7ca7f5 undefect-cwe407-2026-03-24.pdf
f076f22e9e70a94f51884562aad6fdc5 undefect-cwe407-2026-03-25.pdf
5da33a4087fdca81f70cce84656afc7f undefect-cwe407-2026-03-26.pdf
1937855320f8ce2f9bf24baccb391f7d undefect-cwe407-2026-03-27.pdf
ff52abf9f47a7e6bb25e4519b1325090 undefect-minecraft-enterprise-java-2026-03-24.pdf
c7fe499eb004271b384a31ac01b38852 undefect-minecraft-enterprise-java-2026-03-25.pdf
818d29731df88333d29cfdd3eefeb3a2 undefect-minecraft-enterprise-java-2026-03-26.pdf
247fe2afd56be7dabda54875bc60d77f undefect-minecraft-enterprise-java-2026-03-27.pdf

35
whitepaper/full-paper.md
View file

@ -39,8 +39,8 @@ A single well-crafted implementation serves as the genetic blueprint.
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 312 validated
defect patches across 151 ecosystems in a single research wave demonstrates how truth,
elegant solutions inspire elegant variations. The process of generating 352 validated
defect patches across 169 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
query optimizer, and browser runtime.
**312 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
**352 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
3 unpatched (Minecraft, Create mod). No language left behind.
@ -400,6 +400,26 @@ stacks, Spark schemas — this is the dominant build cost.
| tomcat-0001 | Apache Tomcat | `java/org/apache/catalina/ha/tcp/ReplicationValve.java:265` — `crossContextSessions ArrayList.contains()` O(n²) per clustered request; fix: `LinkedHashSet` | **PATCHED** |
| onos-0002 | ONOS (SDN) | `utils/misc/.../graph/` — `pipeline hitchain ArrayList` O(n²) membership in pipeline hit tracking | **PATCHED** |
| odl-0002 | OpenDaylight | `frm/impl/` — `ShardManager snapshotShardList` O(n) linear scan per snapshot operation | **PATCHED** |
| geth-0001 | go-ethereum | `eth/filters/filter.go` — `FilterLogs` O(n×logs) address slice scan per block; fix: `map[common.Address]struct{}` (357×) | **PATCHED** |
| hadoop-0002 | Apache Hadoop | `hdfs/server/blockmanagement/PendingReconstructionBlocks.java` — O(B×R) pending block scan per reconstruction event; fix: `HashSet` (301×) | **PATCHED** |
| hadoop-0003 | Apache Hadoop | `hdfs/server/blockmanagement/StoragePolicySatisfier.java` — O(T×N×E) storage policy evaluation scan; fix: type-indexed `HashSet` (49×) | **PATCHED** |
| keystone-0001 | Keystone | `keystone/assignment/` — implied role computation O(R²) per token validation; fix: pre-computed role graph | **PATCHED** |
| keystone-0002 | Keystone | `keystone/token/` — `token_roles` list O(N) scan per auth check; fix: `set` (100×) | **PATCHED** |
| libgit2-0001 | libgit2 | `src/libgit2/refs.c` — `git_refdb_backend_fs.ref_available()` O(R) packed-ref list scan per segment per path check; O(R²) total; fix: binary search on sorted refs (17 sites) | **PATCHED** |
| substrate-0001 | Polkadot substrate | `frame/staking/src/` — `isExposedInEra()` O(n×k) validator exposure scan per era; fix: pre-built `BTreeMap<EraIndex, HashSet<AccountId>>` (38,550×) | **PATCHED** |
| substrate-0002 | Polkadot substrate | `frame/{aura,babe,beefy}/src/` — `isMember()` O(n) list scan per block consensus check in 3 consensus protocols; fix: sorted `Vec` + `binary_search` (100×) | **PATCHED** |
| wasmtime-0001 | wasmtime | `cranelift/codegen/src/` — `WorkQueue::insert()` O(K) priority scan per basic block; fix: `FxHashSet` for O(1) membership (49×) | **PATCHED** |
| wasmtime-0002 | wasmtime | `crates/wasmtime/src/` — `ancestors()` O(n²) linear parent-chain scan in instance resolution; fix: `HashSet` (19×) | **PATCHED** |
| ninja-0001 | Ninja | `src/deps_log.cc` — depfile merge O(D²) `std::find` per dep per target; fix: `unordered_set<string_id>` (500×) | **PATCHED** |
| mesa-0001 | Mesa3D | `src/compiler/nir/` — `parallel_copy_resolve` dead-node O(N²) scan per resolve; fix: `bitset` membership (7 sites) | **PATCHED** |
| meson-0001 | Meson | `mesonbuild/build.py` — `extra_files` dedup O(n²) per target build config; fix: `set` before loop (150×) | **PATCHED** |
| spirv-cross-0001 | SPIRV-Cross | `spirv_cross.cpp` — implied-read vector scan O(n²) per variable; fix: `unordered_set` (7 sites) | **PATCHED** |
| spirv-cross-0002 | SPIRV-Cross | `spirv_glsl.cpp` — `visit_branch()` visited `std::vector` O(n²) per CFG block; fix: `unordered_set<uint32_t>` (6 sites) | **PATCHED** |
| wasmer-0001 | Wasmer | `lib/vm/src/` — `RuleSet::contains()` O(n×m) per-rule linear scan per execution; fix: pre-built `HashMap<sig, rule>` (10×) | **PATCHED** |
| wasmer-0002 | Wasmer | `lib/compiler/src/` — `signal_vec` dedup O(n²) per compilation unit; fix: `HashSet` dedup (29×) | **PATCHED** |
| cmake-0002 | CMake | `Source/cmComputeLinkDepends.cxx` — `GetDirectories()` O(n²) group scan; fix: `unordered_map<dir, idx>` (250×) | **PATCHED** |
| cmake-0003 | CMake | `Source/cmRuntimeDependencyArchive.cxx` — `AddRuntimeDLL` O(n²) duplicate scan per DLL; fix: `unordered_set` (250×) | **PATCHED** |
| cmake-0004 | CMake | `Source/cmTarget.cxx` — `AddSource()` O(n²) source dedup per target; fix: `unordered_set` (500×) | **PATCHED** |
### MEDIUM — Real defect, bounded or cold path
@ -554,8 +574,13 @@ stacks, Spark schemas — this is the dominant build cost.
| activemq-0001 | ActiveMQ | `activemq-broker/.../region/Topic.java:151,167,293` — `CopyOnWriteArrayList.contains()` O(n²) subscriber dedup; fix: parallel `ConcurrentHashMap.newKeySet()` | **PATCHED** |
| ovs-0001 | Open vSwitch | `lib/dpif-offload.c:580,229` — `LIST_FOR_EACH` provider strcmp O(T×P) per port-add + O(P) dup scan; fix: `HashMap<name, provider>` | **PATCHED** |
| onos-0003 | ONOS (SDN) | `utils/misc/` — `roleinfo backups ImmutableList` O(n) membership scan per topology event | **PATCHED** |
| odl-0002 | OpenDaylight | `frm/impl/` — `ShardManager.snapshotShardList` O(n) linear scan per snapshot | **PATCHED** |
| jetty-0001 | Jetty | `jetty-http/src/main/java/.../HttpFields.java` — `QuotedCSV.getValues()` `LinkedList.contains()` O(n²); fix: `LinkedHashSet` (50×) | **PATCHED** |
| hadoop-0001 | Apache Hadoop | `hdfs/server/blockmanagement/HeartbeatManager.java` — `ArrayList<DatanodeDescriptor>.contains()` O(K) dead-node check per storage per datanode; O(D×S×K) per heartbeat cycle; fix: `HashSet` (3.3×) | **PATCHED** |
| hbase-0001 | Apache HBase | `hbase-server/.../store/DefaultStoreFileManager.java` — `filesCompacting ArrayList.contains()` O(C) per store file in `getUnneededFiles()`; O(F×C) per compaction; fix: hoisted `HashSet` (43×) | **PATCHED** |
| nova-0001 | OpenStack Nova | `nova/scheduler/filters/affinity.py` — `_GroupAffinityFilter.host_passes()` `group_hosts list.contains()` O(G) per host per filter; fix: `set` (50×) | **PATCHED** |
| nova-0002 | OpenStack Nova | `nova/scheduler/filters/` — `policies` list scan per host in scheduler filter pass; fix: `frozenset` before loop | **PATCHED** |
| neutron-0001 | OpenStack Neutron | `neutron/agent/linux/iptables_firewall.py` — `trusted_ports List.contains()` + `remove()` O(n²) per port update; fix: `set` (50×) | **PATCHED** |
| neutron-0002 | OpenStack Neutron | `neutron/db/l3_dvrscheduler_db.py` — `list(router_ids)` conversion + `not in` O(n) per entry; fix: keep `set` throughout (50×) | **PATCHED** |
### HIGH — Infrastructure orchestration hot paths
@ -594,7 +619,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.
**312 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 1 CLEAN (WireGuard-tools).**
**352 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 2 CLEAN (WireGuard-tools, Solana).**
---

BIN
whitepaper/undefect-cwe407-2026-03-27.pdf
View file

Binary file not shown.