engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

blockchain-p2p: solang/tor/bitcoin/transmission/libtorrent/solc CWE-407 scan

Browse source 
solang-0001: add_external_functions emits_events Vec::contains O(F×E²) MEDIUM
  src/sema/external_functions.rs:93-103 — dedup accumulator Vec uses linear scan
  for each event per function; fix: IndexSet (already a dependency) for O(1) dedup

tor/bitcoin/transmission/libtorrent/solc: CLEAN markers added after full scan
  Tor: nodes_have_common_family_id F=1-3 IDs, O(N×F²) ≈ O(9N), not scalable issue
  Bitcoin: TxGraph/sets throughout, no linear scan in hot paths
  Transmission: bitfields for piece tracking, sorted binary search for string table
  libtorrent: sorted vectors with lower_bound, DHT uses binary search on results
  solc: unordered_set/set throughout OverrideChecker, SMTEncoder, FunctionCallGraph
This commit is contained in:
russell@unturf.com 2026-03-29 19:49:57 -04:00
parent a17b91d5c4
commit a7b08c7e05
6 changed files with 195 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
defects/tor/patch/CLEAN.md Normal file
View file

@ -0,0 +1,21 @@
# CLEAN — Tor Anonymity Network
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
## Scope
- `src/feature/client/entrynodes.c` — guard node selection, sampled/confirmed guard lists
- `src/feature/client/circpathbias.c` — circuit path bias tracking
- `src/feature/nodelist/node_select.c` — node selection with exclusion lists
- `src/feature/nodelist/nodelist.c` — family membership, `nodes_have_common_family_id`
- `src/feature/nodelist/routerlist.c` — router descriptor ingestion
- `src/feature/hs/hs_service.c` — hidden service hsdir tracking
- `src/feature/relay/dns.c` — DNS wildcard detection
## Findings
- **`nodelist_subtract`** (`node_select.c:890`) — explicitly noted in comments as "delivers linear performance when smartlist_subtract would be quadratic." Uses `bitarray_t` indexed by `node->nodelist_idx`. O(N+M). CLEAN.
- **`nodes_have_common_family_id`** (`nodelist.c:2190`) — O(|ids_a| × |ids_b|) nested loop over family certificate IDs. Both lists are tiny (typically 1–3 IDs per relay). Outer loop in `nodelist_add_node_and_family` iterates all ~7000 relays but inner product is O(F²) where F≪1. Not a scalable O(N²). CLEAN.
- **`entrynodes.c` guard lists** — `smartlist_contains` on `primary_entry_guards` and `confirmed_entry_guards`: bounded by `MAX_SAMPLE_THRESHOLD` (dozens), called in setup/error paths (BUG assertions), not hot per-circuit. CLEAN.
- **`hs_service.c` `previous_hsdirs`** — `smartlist_contains_string` on a list bounded by `REND_NUMBER_OF_CONSECUTIVE_REPLICAS` (6). CLEAN.
- **`dns.c` `dns_wildcard_list`** — linear scan on a list of hijacked IPs. In practice contains 0–10 entries; called once per DNS response. CLEAN.
- **Router descriptor ingestion** — `requested_fingerprints` shrinks as each router is processed (O(N) total). CLEAN.
**Result: No actionable CWE-407 defects. Tor's hot node-selection paths use bitarray-indexed O(N) exclusion; all family/guard list scans operate on constant-bounded collections.**