whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K

defects/cockroachdb/patch/cockroachdb-0001-indexes-used-map.patch

@@ -0,0 +1,34 @@
+--- a/pkg/sql/opt/exec/execbuilder/builder.go
++++ b/pkg/sql/opt/exec/execbuilder/builder.go
+@@ -197,16 +197,28 @@ type IndexesUsed struct {
+ // IndexesUsed is a list of indexes used in a query.
+ type IndexesUsed struct {
+ 	indexes []struct {
+ 		tableID cat.StableID
+ 		indexID cat.StableID
+ 	}
++	// seen is a set of already-added (tableID, indexID) pairs for O(1)
++	// deduplication. Without it, add() calls slices.Contains on the growing
++	// slice — O(N) per add, O(N²) total across N index references in a query.
++	seen map[[2]cat.StableID]struct{}
+ }
+
+-// add adds the given index to the list, if it is not already present.
++// add adds the given index to the list if it is not already present.
++// O(1) amortized via the seen map; previously O(N) via slices.Contains.
+ func (iu *IndexesUsed) add(tableID, indexID cat.StableID) {
+ 	s := struct {
+ 		tableID cat.StableID
+ 		indexID cat.StableID
+ 	}{tableID, indexID}
+-	if !slices.Contains(iu.indexes, s) {
+-		iu.indexes = append(iu.indexes, s)
++	key := [2]cat.StableID{tableID, indexID}
++	if iu.seen == nil {
++		iu.seen = make(map[[2]cat.StableID]struct{})
+ 	}
++	if _, ok := iu.seen[key]; !ok {
++		iu.seen[key] = struct{}{}
++		iu.indexes = append(iu.indexes, s)
++	}
+ }

defects/cockroachdb/unit/CockroachDBTest.java

@@ -0,0 +1,82 @@
+package unit;
+import java.util.*;
+
+/**
+ * CockroachDB CWE-407 unit tests — standalone, no JUnit.
+ *
+ *   cockroachdb-0001  IndexesUsed.add() slices.Contains on growing slice
+ *                     pkg/sql/opt/exec/execbuilder/builder.go:211
+ */
+public class CockroachDBTest {
+
+    // -----------------------------------------------------------------------
+    // cockroachdb-0001: IndexesUsed.add — slice contains vs map lookup
+    //
+    // Models adding N (tableID, indexID) pairs with deduplication.
+    // In a complex query the same index may be referenced multiple times;
+    // add() must skip duplicates.
+    // Slow: scan the existing slice for each add — O(N) per add, O(N²) total.
+    // Fast: maintain a HashSet of pairs alongside the list — O(1) per add.
+    // -----------------------------------------------------------------------
+
+    /** Slow: list-based dedup (models slices.Contains). Returns total comparison ops. */
+    static long indexesUsedSlowOps(int numAdds, int numUnique) {
+        // Each "index" is encoded as a long: tableID << 32 | indexID
+        List<Long> indexes = new ArrayList<>();
+        long ops = 0;
+        Random rng = new Random(42);
+        for (int i = 0; i < numAdds; i++) {
+            long key = (long)(rng.nextInt(numUnique / 10 + 1)) << 32
+                     | (rng.nextInt(numUnique + 1));
+            // Linear scan of existing list (models slices.Contains)
+            boolean found = false;
+            for (int j = 0; j < indexes.size(); j++) {
+                ops++;
+                if (indexes.get(j).equals(key)) { found = true; break; }
+            }
+            if (!found) indexes.add(key);
+        }
+        return ops;
+    }
+
+    /** Fast: HashSet-based dedup. Returns total comparison ops (1 per add). */
+    static long indexesUsedFastOps(int numAdds, int numUnique) {
+        List<Long> indexes = new ArrayList<>();
+        Set<Long> seen = new HashSet<>();
+        long ops = 0;
+        Random rng = new Random(42);
+        for (int i = 0; i < numAdds; i++) {
+            long key = (long)(rng.nextInt(numUnique / 10 + 1)) << 32
+                     | (rng.nextInt(numUnique + 1));
+            ops++; // O(1) set lookup
+            if (seen.add(key)) {
+                indexes.add(key);
+            }
+        }
+        return ops;
+    }
+
+    // -----------------------------------------------------------------------
+    // Test runner
+    // -----------------------------------------------------------------------
+
+    public static void main(String[] args) {
+        int passed = 0;
+        int failed = 0;
+
+        // N = number of add() calls (index references per query build)
+        int[] sizes = {50, 100, 200, 500};
+        for (int n : sizes) {
+            long slow = indexesUsedSlowOps(n, n);
+            long fast = indexesUsedFastOps(n, n);
+            // At N=50+, slow grows quadratically, fast is linear
+            boolean pass = slow > fast * 5;
+            System.out.printf("cockroachdb-0001 N=%-4d  slow=%6d  fast=%4d  ratio=%5.1fx  %s%n",
+                n, slow, fast, (double) slow / fast, pass ? "PASS" : "FAIL");
+            if (pass) passed++; else failed++;
+        }
+
+        System.out.printf("%nTotal: %d/%d PASS%n", passed, passed + failed);
+        if (failed > 0) System.exit(1);
+    }
+}