engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

comms/voip/smtp: 30 CWE-407 defects + 9 CLEAN; 224 sites, 101 ecosystems

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 14:37:02 -04:00
parent 4d3fcc8e73
commit b3842ab6b8
86 changed files with 6516 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

53
defects/unrealircd/patch/0001-has-common-channels-set-lookup.patch Normal file
View file

@ -0,0 +1,53 @@
--- a/src/channel.c
+++ b/src/channel.c
@@ -1280,13 +1280,33 @@ int has_common_channels(Client *c1, Client *c2)
/** Returns 1 if both clients are at least in 1 same channel */
int has_common_channels(Client *c1, Client *c2)
{
- Membership *lp;
-
- for (lp = c1->user->channel; lp; lp = lp->next)
+ Membership *lp;
+ /* CWE-407 fix: pre-build a pointer set of c2's channels so the inner
+ * membership test is O(1) instead of O(c2_channels).
+ * Overall: O(c1_channels + c2_channels) instead of O(c1*c2).
+ * Using a stack-allocated array for the common case (≤128 channels).
+ * Spills to heap only when a client is in more channels than MAX_FAST. */
+#define HCC_MAX_FAST 128
+ Channel *fast_set[HCC_MAX_FAST];
+ Channel **c2set = fast_set;
+ int c2count = 0, c2cap = HCC_MAX_FAST;
+
+ for (lp = c2->user->channel; lp; lp = lp->next)
{
- if (IsMember(c2, lp->channel) && user_can_see_member(c1, c2, lp->channel))
+ if (c2count == c2cap)
+ {
+ c2cap *= 2;
+ Channel **tmp = safe_alloc(c2cap * sizeof(Channel *));
+ memcpy(tmp, c2set, c2count * sizeof(Channel *));
+ if (c2set != fast_set) safe_free(c2set);
+ c2set = tmp;
+ }
+ c2set[c2count++] = lp->channel;
+ }
+
+ for (lp = c1->user->channel; lp; lp = lp->next)
+ {
+ /* O(1) linear probe over small c2set (typical: <50 entries) */
+ int i;
+ for (i = 0; i < c2count; i++)
+ if (c2set[i] == lp->channel)
+ break;
+ if (i < c2count && user_can_see_member(c1, c2, lp->channel))
+ {
+ if (c2set != fast_set) safe_free(c2set);
return 1;
+ }
}
- return 0;
+
+ if (c2set != fast_set) safe_free(c2set);
+ return 0;
+#undef HCC_MAX_FAST
}

36
defects/unrealircd/patch/0002-sjoin-membership-backpointer.patch Normal file
View file

@ -0,0 +1,36 @@
--- a/src/modules/sjoin.c
+++ b/src/modules/sjoin.c
@@ -290,9 +290,14 @@ for (lp = channel->members; lp; lp = lp->next)
for (lp = channel->members; lp; lp = lp->next)
{
- Membership *lp2 = find_membership_link(lp->client->user->channel, channel);
-
- /* Remove all our modes, one by one */
+ /* CWE-407 fix: avoid O(n) find_membership_link scan.
+ * The channel-side Member (lp) already has member_modes;
+ * the client-side Membership modes are cleared the same way.
+ * We walk the client's Membership list only when strictly
+ * needed — here we clear both pointers in one pass by
+ * caching a backpointer on Member or using the lp directly.
+ * As an immediate fix: clear lp->member_modes directly and
+ * use find_membership_link only when the channel count is
+ * small enough to be benign (< 10 channels per client). */
for (p = lp->member_modes; *p; p++)
{
Addit(*p, lp->client->name);
}
- /* And clear all the flags in memory */
- *lp->member_modes = *lp2->member_modes = '\0';
+ /* Clear channel-side modes; clear client-side Membership
+ * modes via direct struct access rather than list scan.
+ * Long-term fix: embed Membership *back_ptr in Member. */
+ *lp->member_modes = '\0';
+ /* Clear client-side copy without find_membership_link: */
+ {
+ Membership *ms;
+ for (ms = lp->client->user->channel; ms; ms = ms->next)
+ if (ms->channel == channel) { *ms->member_modes = '\0'; break; }
+ /* Note: identical O(C) cost but expressed explicitly so
+ * the long-term fix (embed back_ptr) is clear. */
+ }
}