comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

defects/dendrite/patch/dendrite-0001.patch

@@ -0,0 +1,29 @@
+--- a/syncapi/storage/shared/storage_consumer.go
++++ b/syncapi/storage/shared/storage_consumer.go
+@@ -238,14 +238,15 @@ func (d *Database) updateRoomIDsWithEventTypes(ctx context.Context, txn *sql.Tx
+ 	prevEvents, err := d.OutputEvents.SelectEvents(ctx, txn, ev.PrevEventIDs(), nil, false)
+ 	if err != nil {
+ 		return err
+ 	}
+-	var found bool
+-	for _, eID := range ev.PrevEventIDs() {
+-		found = false
+-		for _, prevEv := range prevEvents {
+-			if eID == prevEv.EventID() {
+-				found = true
+-			}
+-		}
+-		// If the event is missing, consider it a backward extremity.
+-		if !found {
++	// CWE-407 fix: pre-build a set of fetched event IDs for O(1) lookup
++	// instead of O(P*E) double loop (P=prevEventIDs count, E=fetched events count).
++	prevEventSet := make(map[string]bool, len(prevEvents))
++	for _, prevEv := range prevEvents {
++		prevEventSet[prevEv.EventID()] = true
++	}
++	for _, eID := range ev.PrevEventIDs() {
++		// If the event is missing from storage, consider it a backward extremity.
++		if !prevEventSet[eID] {
+ 			if err = d.BackwardExtremities.InsertsBackwardExtremity(ctx, txn, ev.RoomID().String(), ev.EventID(), eID); err != nil {
+ 				return err
+ 			}