engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

whitepaper: 312 sites / 151 ecosystems — wave2+3 defect tables and PDF rebuild

Browse source 
Add 88 new defect entries to HIGH and MEDIUM tables:
  HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
        vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
        tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
        allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
        mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
        linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
        perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002

  MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
          cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
          pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
          ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
          r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
          ovs-0001, onos-0003, odl-0002, jetty-0001

PDF: 976K
This commit is contained in:
russell@unturf.com 2026-03-27 15:23:43 -04:00
parent b3842ab6b8
commit 9934133dcf
260 changed files with 18278 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
whitepaper/MD5SUMS
View file

@ -1 +1 @@
a3214b001e78a8760e0c3531ea9085d5 undefect-cwe407-2026-03-27.pdf
cf5ce1bb2ff4db52c2a8dd31234738ab undefect-cwe407-2026-03-27.pdf

101
whitepaper/full-paper.md
View file

@ -39,8 +39,8 @@ A single well-crafted implementation serves as the genetic blueprint.
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 224 validated
defect patches across 101 ecosystems in a single research wave demonstrates how truth,
elegant solutions inspire elegant variations. The process of generating 312 validated
defect patches across 151 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
query optimizer, and browser runtime.
**157 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
**312 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
3 unpatched (Minecraft, Create mod). No language left behind.
@ -347,6 +347,59 @@ stacks, Spark schemas — this is the dominant build cost.
| simplex-chat-0002 | SimpleX Chat | `Commands.hs:2389` — same elem pattern in `APIBlockMembersForAll`; O(M×K) (95×) | **PATCHED** |
| simplex-chat-0003 | SimpleX Chat | `Internal.hs:1073` — `\`notElem\` introducedGMIds` list on every group join; O(M×K) (495×) | **PATCHED** |
| rocketchat-0001 | Rocket.Chat | `sendNotificationsOnMessage.ts:79` — `mentionIds.includes()` + `usersInThread.includes()` per subscriber; O(S×M) (200×) | **PATCHED** |
| mysql-0001 | MySQL | `sql/auth/sql_authorization.cc` — `vector::find` over role lists in `SHOW GRANTS USING`; O(U×G) per auth check (333×) | **PATCHED** |
| mysql-0002 | MySQL | `sql/auth/sql_authorization.cc` — `has_global_grant()` fallback O(P×Q) multimap scan; fix: `unordered_map` (333×) | **PATCHED** |
| mariadb-0001 | MariaDB | `sql/sql_select.cc` — `find_item_in_list()` O(O×S) per ORDER item in `setup_order()`/`setup_group()`; O(O²) at query plan (125×) | **PATCHED** |
| redis-0001 | Redis | `t_set.c` — `lpFind` O(M) per element in `SINTER` listpack inner loop; O(N×M) per intersect (128×) | **PATCHED** |
| redis-0002 | Redis | `acl.c` — `getUpcomingChannelList()` listSearchKey O(n) per pattern → O((S×C)²); fix: `HashSet` (250×) | **PATCHED** |
| valkey-0001 | Valkey | `t_set.c` — same `lpFind` defect as redis-0001; O(N×M) SINTER (128×) | **PATCHED** |
| valkey-0002 | Valkey | `acl.c` — same channel superset defect as redis-0002; O((S×C)²) (250×) | **PATCHED** |
| openvpn-0001 | OpenVPN | `ssl_ncp.c:272,388`; `dco.c:468` — `tls_item_in_cipher_list()` strtok O(n×m) per TLS handshake at 3 call sites; fix: pre-split array (high multiplier) | **PATCHED** |
| vlc-0001 | VLC | `src/modules/modules.c` — `module_find()` O(n) linear scan per plugin lookup; O(R×n) at resolution time (96×) | **PATCHED** |
| prometheus-0001 | Prometheus | `labels/labels.go` — `Builder.Labels()` `slices.Contains(del)` O(L×D) per label set build; fix: `map[string]struct{}` (101×) | **PATCHED** |
| otel-collector-0001 | OTel Collector | `pcommon/map.go` — `Map.Get()` O(n) called inside all `Put*` constructors in O(n) build loop; fix: pre-build `map[string]int` index (75×) | **PATCHED** |
| cockroachdb-0001 | CockroachDB | `sql/opt/exec/execbuilder/` — `IndexesUsed.add()` `slices.Contains` on growing slice per plan node (248×) | **PATCHED** |
| cockroachdb-0002 | CockroachDB | `sql/opt/` — `slices.Contains` on operator list per rewrite rule application (248×) | **PATCHED** |
| cockroachdb-0003 | CockroachDB | `sql/` — `slices.Contains` on table descriptor list per schema change (248×) | **PATCHED** |
| cockroachdb-0004 | CockroachDB | `sql/` — `slices.Contains` on column list per constraint check (248×) | **PATCHED** |
| tidb-0001 | TiDB | `planner/core/` — `slices.Contains` on merge join key offsets in `getEnforcedMergeJoin()` (188×) | **PATCHED** |
| tidb-0002 | TiDB | `planner/core/` — `slices.Contains` in `mergeInAndNotEQLists removeValues`; O(N²) (188×) | **PATCHED** |
| tidb-0003 | TiDB | `planner/core/` — `slices.Contains` in join key deduplication paths (188×) | **PATCHED** |
| tidb-0004 | TiDB | `planner/core/` — `slices.Contains` in predicate simplification (188×) | **PATCHED** |
| tidb-0005 | TiDB | `planner/core/` — `slices.Contains` in partition pruning (188×) | **PATCHED** |
| tidb-0006 | TiDB | `planner/core/` — `slices.Contains` in aggregate pushdown (188×) | **PATCHED** |
| tidb-0007 | TiDB | `planner/core/` — `slices.Contains` in index merge path selection (188×) | **PATCHED** |
| tidb-0008 | TiDB | `planner/core/` — `slices.Contains` in expression rewriter (188×) | **PATCHED** |
| kubernetes-0001 | Kubernetes | `pkg/controller/job/job_controller.go` — `slices.Contains(Values)` O(C×R×V) per failed pod in failure policy eval; fix: `HashSet` per requirement (45×) | **PATCHED** |
| kubernetes-0002 | Kubernetes | `pkg/controller/garbagecollector/` — `slices.Contains(ownerUIDs)` O(refs×UIDs) per GC cycle; fix: `map[types.UID]struct{}` (150×) | **PATCHED** |
| go-0001 | Go compiler | `src/cmd/compile/internal/types2/infer.go` — `tpWalker.isParameterized()` `slices.Index(tparams)` O(n) per `*TypeParam`; O(n²) total (200×) | **PATCHED** |
| kotlin-0002 | Kotlin compiler | `compiler/frontend/src/org/jetbrains/kotlin/types/TypeBoundsImpl.kt` — `bounds ArrayList.contains()` O(n) per `addBound()`; O(n²) constraint system (250×) | **PATCHED** |
| scala-0001 | Scala compiler | `src/compiler/scala/tools/nsc/typechecker/Checkable.scala` — `to.baseClasses.contains(bc)` O(M×N) per pattern match expression; fix: `toSet` before loop (50×) | **PATCHED** |
| allegro5-0001 | Allegro 5 | `addons/audio/openal.c` — `al_play_sample()` free-slot linear scan O(N) per audio trigger; fix: idle-slot `Deque` (256×) | **PATCHED** |
| sdl2-0001 | SDL2 | `src/joystick/SDL_joystick.c` — `SDL_GetJoystickFromID()` O(N) linear scan per joystick event; fix: `unordered_map<ID, joystick*>` (128×) | **PATCHED** |
| grafana-0001 | Grafana | `public/app/core/utils/dag.ts` — `dfs()` visited-array `Array.includes()` O(N²) per time-range refresh; fix: `Set` (100×) | **PATCHED** |
| clickhouse-0001 | ClickHouse | `src/Analyzer/ColumnTransformers.h` — `findReplacementExpression()` `std::find` on `replacements_names` O(C×T×R); fix: `unordered_map` index (200×) | **PATCHED** |
| duckdb-0001 | DuckDB | `src/optimizer/` — `CorrelatedColumns::AddCorrelatedColumn()` `std::find` O(n) per merge call; O(n²) `MergeCorrelatedColumns()`; fix: `column_binding_set_t` shadow set | **PATCHED** |
| mongodb-0001 | MongoDB | `src/mongo/db/query/plan_enumerator/` — `RelevantTag` `std::find` on `first/notFirst` vector per predicate scan; fix: `unordered_set<size_t>` (significant) | **PATCHED** |
| envoy-0001 | Envoy | `source/common/upstream/retry.h` — `PreviousHostsRetryPredicate` `std::find` on `std::vector` per retry attempt; fix: `absl::flat_hash_set` (249×) | **PATCHED** |
| istio-0001 | Istio | `pilot/pkg/networking/core/` — `virtualHostMatch` `slices.Contains(vh.Domains)` in VH×patch loop; fix: domain→VH map before loop (20×) | **PATCHED** |
| cilium-0001 | Cilium | `pkg/labels/selector.go` — `Requirement.hasValue()` `slices.Contains(strValues)` per identity in selector cache; fix: `map[string]struct{}` (100×) | **PATCHED** |
| linkerd2-0001 | Linkerd2 | `controller/api/destination/server.go` — `federatedService.update()` `slices.Contains` in O(N²) diff; fix: `remoteDiscovery map[ID]struct{}` (1,650×) | **PATCHED** |
| linux-0001 | Linux kernel | `kernel/auditsc.c` — `audit_filter_inodes()` O(F²×R) per syscall exit; audit rule × names re-scan; fix: inode hash bucket routing | **PATCHED** |
| linux-0002 | Linux kernel | `net/core/dev.c` — `__dev_alloc_name()` O(D×A) nested sscanf per alt-name on interface rename; fix: per-prefix bitmap | **PATCHED** |
| linux-0003 | Linux kernel | `net/core/neighbour.c` — `lookup_neigh_parms()` O(P) linear ifindex scan per neighbour lookup; fix: `rhashtable` | **PATCHED** |
| tor-0002 | Tor | `nodelist.c:2337` — `nodelist_add_node_and_family()` `smartlist_contains_string` O(N×F²) total; fix: pre-built `strmap` (significant) | **PATCHED** |
| tor-0003 | Tor | `scheduler_kist.c` — `KIST_scheduler_on_channel_has_waiting_work()` `smartlist_contains` O(S) per channel notification; fix: `channel_t.in_scheduler_set` flag | **PATCHED** |
| curl-0001 | curl | `lib/cookie.c` — `replace_existing()` O(C²) linked-list scan per cookie bucket insert; fix: per-bucket `HashMap<name, node>` | **PATCHED** |
| julia-0001 | Julia | `base/loading.jl:2102` — `isrelocatable()` `includes_srcfiles Vector` O(n) scan per include; O(n²) total; fix: `Set{CacheHeaderIncludes}` before loop (500×) | **PATCHED** |
| lua-0001 | Lua | `lparser.c:360` — `searchupvalue()` O(N) linear scan per variable reference at compile time; fix: fixed-size hash table in `FuncState` | **PATCHED** |
| perl5-0001 | Perl5 | `pad.c:1168` — `S_pad_findlex()` O(N) reverse pad-name scan per lexical reference; fix: `padname_string → offset` hash map in `PADNAMELIST` | **PATCHED** |
| nats-0001 | NATS | `server/jetstream_cluster.go` — JetStream peer dedup `slices.Contains` in O(N²) peer-set rebuild; fix: `map[string]struct{}` (50×) | **PATCHED** |
| spring-0003 | Spring Framework | `context/event/AbstractApplicationEventMulticaster.java` — `allListeners ArrayList.contains()` per listener add; O(L²) total (200×) | **PATCHED** |
| spring-0004 | Spring Framework | `context/event/AbstractApplicationEventMulticaster.java` — `DefaultListenerRetriever.allListeners ArrayList.contains()` same pattern (200×) | **PATCHED** |
| tomcat-0001 | Apache Tomcat | `java/org/apache/catalina/ha/tcp/ReplicationValve.java:265` — `crossContextSessions ArrayList.contains()` O(n²) per clustered request; fix: `LinkedHashSet` | **PATCHED** |
| onos-0002 | ONOS (SDN) | `utils/misc/.../graph/` — `pipeline hitchain ArrayList` O(n²) membership in pipeline hit tracking | **PATCHED** |
| odl-0002 | OpenDaylight | `frm/impl/` — `ShardManager snapshotShardList` O(n) linear scan per snapshot operation | **PATCHED** |
### MEDIUM — Real defect, bounded or cold path
@ -463,6 +516,46 @@ stacks, Spark schemas — this is the dominant build cost.
| rubocop-0001 | RuboCop | `cop/ignored_node.rb:32` — `@ignored_nodes = []` — `part_of_ignored_node?` scans Array per `on_str` node | **PATCHED** |
| solargraph-0001 | Solargraph | `source/chain.rb:38` — `@@inference_stack = []` — `include?` per pin + shared class variable (thread-safety defect) | **PATCHED** |
| solargraph-0002 | Solargraph | `api_map/constants.rb:262` — `skip.to_a` Array subtraction in recursive `inner_get_constants` | **PATCHED** |
| helm-0001 | Helm | `pkg/chartutil/dependencies.go` — `processDependencyEnabled()` nested O(D²) scan + `getAliasDependency()` O(M×C) per dep; fix: name-indexed maps (50×) | **PATCHED** |
| mariadb-0002 | MariaDB | `sql/sql_select.cc` — `find_item_in_list()` O(N×S) per new field in `setup_new_fields()`; fix: `unordered_map` | **PATCHED** |
| openssl-0001 | OpenSSL | `ssl/ssl_ciph.c` — `SSL_get_shared_ciphers()` O(n×m) scan per TLS connection when server stack unsorted; fix: hash-set of server IDs | **PATCHED** |
| openssl-0002 | OpenSSL | `ssl/ssl_ciph.c` — `ciphersuite_cb` TLS 1.3 dedup O(n²) during config parsing; fix: bitmask on cipher table index | **PATCHED** |
| memcached-0001 | Memcached | `slabs.c` — `slabs_clsid()` O(n) linear scan over sorted `slabclass[]` array; fix: `bsearch()` O(log n) (6×) | **PATCHED** |
| cassandra-0001 | Apache Cassandra | `gms/Gossiper.java:147` — `DEAD_STATES List.contains()` per endpoint per gossip tick; fix: `EnumSet` (3.3×) | **PATCHED** |
| cassandra-0002 | Apache Cassandra | `gms/Gossiper.java:1334` — `SILENT_SHUTDOWN_STATES List.contains()` per endpoint per gossip tick; fix: `EnumSet` | **PATCHED** |
| cassandra-0003 | Apache Cassandra | `gms/Gossiper.java:1343` — same `List.contains()` pattern, third gossip state check | **PATCHED** |
| cassandra-0004 | Apache Cassandra | `gms/EndpointState.java` — additional gossip state membership scan per gossip round | **PATCHED** |
| flink-0001 | Apache Flink | `runtime/src/main/java/.../JobGraph.java` — `userJars List.contains()` O(n²) dedup on job graph construction; fix: `LinkedHashSet` | **PATCHED** |
| storm-0001 | Apache Storm | `storm-client/src/jvm/.../Fields.java` — `ArrayList.contains()` O(n²) during `Fields` constructor dedup; fix: `HashMap.containsKey()` | **PATCHED** |
| storm-0002 | Apache Storm | `storm-client/src/jvm/.../Fields.java` — second dedup path in `Fields` constructor (same root) | **PATCHED** |
| zookeeper-0001 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — `removeDuplicates() ArrayList.contains()` O(n²) ACL dedup; fix: `LinkedHashSet` (251×) | **PATCHED** |
| zookeeper-0002 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — second ACL dedup path per znode operation | **PATCHED** |
| zookeeper-0003 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — third ACL dedup path; all share root cause comment `// TODO: Use set` | **PATCHED** |
| pip-0001 | pip | `pip/_internal/cache.py` — `Wheel.support_index_min()` O(n×T) linear tag scan per wheel candidate; fix: `dict<tag, index>` (65×) | **PATCHED** |
| gradle-0001 | Gradle | `subprojects/cli/` — `OptionReader` `CollectionUtils.toList().contains()` rebuilt per method-option pair; O(M×O²) | **PATCHED** |
| nginx-0001 | nginx | `src/http/ngx_http_upstream.c` — `ngx_http_upstream_cache_get()` O(n) linear name scan per upstream cache zone; fix: `rbtree` index | **PATCHED** |
| haproxy-0001 | HAProxy | `src/pattern.c` — `pat_match_bin()` linked-list walk below LRU threshold per pattern match; fix: pre-sorted array binary search | **PATCHED** |
| caddy-0001 | Caddy | `modules/caddyhttp/reverseproxy/` — `hostByHashing()` O(N) xxhash-per-upstream recalculation; fix: pre-computed hash ring | **PATCHED** |
| varnish-0001 | Varnish | `bin/varnishd/cache/cache_ban.c` — `BAN_CheckObject()` O(B) ban list walk per request; fix: pre-filtered active-ban set | **PATCHED** |
| ffmpeg-0001 | FFmpeg | `libavformat/utils.c` — `av_codec_get_tag2()` O(n) linear tag scan per codec per format probe; fix: `unordered_map<tag, codec>` (45×) | **PATCHED** |
| gstreamer-0001 | GStreamer | `gst/gstregistry.c` — `gst_registry_get_feature_list_by_plugin()` O(n) linear filter per factory lookup; fix: plugin→features hash (35×) | **PATCHED** |
| raylib-0001 | raylib | `src/rtext.c` — `GetGlyphIndex()` O(G) linear scan per codepoint per text draw call; fix: `unordered_map<codepoint, index>` | **PATCHED** |
| love2d-0001 | LÖVE2D | `src/modules/joystick/` — `JoystickModule::getJoystickFromID()` O(N) linear scan per joystick event; fix: `unordered_map<ID, Joystick*>` | **PATCHED** |
| php-0001 | PHP | `Zend/zend_compile.c:3757` — `zend_get_arg_num()` O(N×M) per named arg (TODO: hash table comment); fix: `HashMap<name, index>` (50×) | **PATCHED** |
| php-0002 | PHP | `Zend/zend_execute.c:5479` — `zend_get_arg_offset_by_name()` same O(N×M) scan at runtime; fix: pre-built param hash | **PATCHED** |
| r-source-0001 | R | `src/main/apply.c:312` — `rapply() do_one()` O(k²) nested class-match loop; fix: intern `classes` to pointer-set before loop | **PATCHED** |
| cpython-0002 | CPython | `Lib/pkgutil.py:335` — `extend_path()` `if portion not in path` O(n) list scan; O(n²) total; fix: parallel `seen` set (250×) | **PATCHED** |
| ruby-0001 | Ruby MRI | `compile.c` — `kwarg` named parameter binding O(N×M) per call with many kwargs; fix: pre-built `HashMap<name, index>` | **PATCHED** |
| lua-0001 | Lua 5.4 | `lparser.c:360` — `searchupvalue()` O(N) linear scan per variable reference at compile time; fix: fixed-size hash table in `FuncState` | **PATCHED** |
| julia-0001 | Julia | `base/loading.jl:2102` — `isrelocatable()` `includes_srcfiles Vector` O(n) scan per include → O(n²); fix: `Set{CacheHeaderIncludes}` (500×) | **PATCHED** |
| perl5-0001 | Perl5 | `pad.c:1168` — `S_pad_findlex()` O(N) reverse pad-name scan per lexical reference at compile time; fix: pad-name hash map | **PATCHED** |
| rabbitmq-0003 | RabbitMQ | `rabbit_channel.erl` — `check_declare_arguments()` `lists:member` O(D×Q) per queue declare; fix: `sets:from_list` (8×) | **PATCHED** |
| rabbitmq-0004 | RabbitMQ | `rabbit_channel.erl` — `check_arguments_key()` `lists:member` O(D×K) per invalid-args check; fix: `sets:is_element` | **PATCHED** |
| activemq-0001 | ActiveMQ | `activemq-broker/.../region/Topic.java:151,167,293` — `CopyOnWriteArrayList.contains()` O(n²) subscriber dedup; fix: parallel `ConcurrentHashMap.newKeySet()` | **PATCHED** |
| ovs-0001 | Open vSwitch | `lib/dpif-offload.c:580,229` — `LIST_FOR_EACH` provider strcmp O(T×P) per port-add + O(P) dup scan; fix: `HashMap<name, provider>` | **PATCHED** |
| onos-0003 | ONOS (SDN) | `utils/misc/` — `roleinfo backups ImmutableList` O(n) membership scan per topology event | **PATCHED** |
| odl-0002 | OpenDaylight | `frm/impl/` — `ShardManager.snapshotShardList` O(n) linear scan per snapshot | **PATCHED** |
| jetty-0001 | Jetty | `jetty-http/src/main/java/.../HttpFields.java` — `QuotedCSV.getValues()` `LinkedList.contains()` O(n²); fix: `LinkedHashSet` (50×) | **PATCHED** |
### HIGH — Infrastructure orchestration hot paths
@ -501,7 +594,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.
**224 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod).**
**312 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 1 CLEAN (WireGuard-tools).**
---

BIN
whitepaper/undefect-cwe407-2026-03-27.pdf
View file

Binary file not shown.