engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

curl-0002/0003 + libevent-0001: header lookup O(K×H), HSTS O(N²), route dispatch O(C); libuv CLEAN; count 603→606

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 22:46:05 -04:00
parent 212d313185
commit ae91f05bf3
8 changed files with 505 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
whitepaper/MD5SUMS
View file

@ -3,7 +3,7 @@ ba0de5d1546aa2971492f74616f13f47 full-paper.pdf
3fda5736a004c621f52701c92a7ca7f5 undefect-cwe407-2026-03-24.pdf
f076f22e9e70a94f51884562aad6fdc5 undefect-cwe407-2026-03-25.pdf
5da33a4087fdca81f70cce84656afc7f undefect-cwe407-2026-03-26.pdf
791d5fd391e5f6186f59848004fcf204 undefect-cwe407-2026-03-27.pdf
87845a2ecd45c1b032b30e44bff2292f undefect-cwe407-2026-03-27.pdf
ff52abf9f47a7e6bb25e4519b1325090 undefect-minecraft-enterprise-java-2026-03-24.pdf
c7fe499eb004271b384a31ac01b38852 undefect-minecraft-enterprise-java-2026-03-25.pdf
818d29731df88333d29cfdd3eefeb3a2 undefect-minecraft-enterprise-java-2026-03-26.pdf

9
whitepaper/full-paper.md
View file

@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint.
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 603 validated
elegant solutions inspire elegant variations. The process of generating 606 validated
defect patches across 240 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
query optimizer, and browser runtime.
**603 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
**606 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
3 unpatched (Minecraft, Create mod). No language left behind.
@ -432,6 +432,9 @@ stacks, Spark schemas — this is the dominant build cost.
| tor-0002 | Tor | `nodelist.c:2337` — `nodelist_add_node_and_family()` `smartlist_contains_string` O(N×F²) total; fix: pre-built `strmap` (significant) | **PATCHED** |
| tor-0003 | Tor | `scheduler_kist.c` — `KIST_scheduler_on_channel_has_waiting_work()` `smartlist_contains` O(S) per channel notification; fix: `channel_t.in_scheduler_set` flag | **PATCHED** |
| curl-0001 | curl | `lib/cookie.c` — `replace_existing()` O(C²) linked-list scan per cookie bucket insert; fix: per-bucket `HashMap<name, node>` | **PATCHED** |
| curl-0002 | curl | `lib/transfer.c:85` — `Curl_checkheaders()` O(H) slist scan called K≈20 times per HTTP request → O(K×H); fix: `HashMap<name, node>` built at `CURLOPT_HTTPHEADER` (500×) | **PATCHED** |
| curl-0003 | curl | `lib/hsts.c:225,389` — `Curl_hsts()` O(N) llist scan in `hsts_load` dedup (O(N²) file load) + per-request HTTPS upgrade check; fix: `HashMap<hostname>` (499×) | **PATCHED** |
| libevent-0001 | libevent | `http.c:3697,4290` — `evhttp_dispatch_callback()` O(C) TAILQ scan per request + `evhttp_set_cb()` O(C²) setup dedup; fix: `HashMap<uri, cb>` alongside TAILQ (200×) | **PATCHED** |
| systemd-0001 | systemd | `src/basic/strv.c` — `strv_extend_strv(filter_duplicates=true)` calls `strv_contains()` O(N) per element, O(N²) total dedup; fix: pre-built hash set (249-749×) | **PATCHED** |
| systemd-0002 | systemd | `src/shared/install.c` — `unit_file_get_list()` `strv_contains(states)` O(S) per unit file in `FOREACH_DIRENT` loop; O(U×S) total; fix: hash set before loop (5-10×) | **PATCHED** |
| julia-0001 | Julia | `base/loading.jl:2102` — `isrelocatable()` `includes_srcfiles Vector` O(n) scan per include; O(n²) total; fix: `Set{CacheHeaderIncludes}` before loop (500×) | **PATCHED** |
@ -883,7 +886,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.
**603 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
**606 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
---

BIN
whitepaper/undefect-cwe407-2026-03-27.pdf
View file

Binary file not shown.