undf: stamp patches, update registry to 792

UNDF-REGISTRY.json

@@ -788,5 +788,7 @@
   "libreoffice-0002": "UNDF-2026-000000787",
   "libreoffice-0003": "UNDF-2026-000000788",
   "libreoffice-0004": "UNDF-2026-000000789",
-  "libreoffice-0005": "UNDF-2026-000000790"
+  "libreoffice-0005": "UNDF-2026-000000790",
+  "hive-0001": "UNDF-2026-000000791",
+  "hive-0003": "UNDF-2026-000000792"
 }

defects/beam/patch/CLEAN.md

@@ -1,25 +1,27 @@
-# CLEAN — Apache Beam
-Scanned 2026-03-29 for CWE-407.
+# Apache Beam — CWE-407 Scan Result: CLEAN
 
-## Scope
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** sdks/java/core/src/main/java/, runners/
 
-- `sdks/java/core/src/main/java` — PCollection DAG, PTransform graph, GreedyStageFuser
-- `runners/core-java/src/main/java` — InMemoryStateInternals, SimplePushbackSideInputDoFnRunner, WatermarkHold
-- `runners/google-cloud-dataflow-java/src/main/java` — DataflowRunner, DataflowPipelineTranslator
-- `runners/google-cloud-dataflow-java/worker/src/main/java` — WindmillOrderedList
-- `runners/jet/src/main/java` — DAGBuilder
+## Summary
 
-## Findings
+Apache Beam's Java SDK and runners are clean of CWE-407 algorithmic complexity
+defects. The codebase consistently uses HashSet/LinkedHashSet for membership
+tests in graph traversal, pipeline fusion, and transform hierarchy operations.
 
-| Location | Pattern | Type | Result |
-|----------|---------|------|--------|
-| `GreedyStageFuser` | `fusedCollections.contains` / `materializedPCollections.contains` | `LinkedHashSet` | CLEAN |
-| `DAGBuilder.sideInputCollections` | `contains` per edge | `HashSet<String>` | CLEAN |
-| `WindmillOrderedList.pendingDeletes` | `contains` in stream filter | `TreeRangeSet` (O(log N)) | CLEAN |
-| `DataflowRunner.experiments` | `experiments.contains(...)` | `List<String>` — called at job-submission time (once), not in hot loop | LOW — startup only |
-| `InMemoryStateInternals.contents` | `contains` | `Set` interface (HashSet impl) | CLEAN |
-| `SideInputHandler.readyWindows` | `contains` | `CopyOnWriteArraySet` | CLEAN |
+## Key observations
 
-The `DataflowRunner.experiments` pattern makes several `List<String>.contains` calls during job submission — a one-time initialization path, not a per-record or per-traversal hot path. Not actionable as CWE-407.
+- `GreedyStageFuser`: uses `LinkedHashSet` for fusedCollections/materializedPCollections
+- `GreedyPipelineFuser`: uses `LinkedHashSet`/`HashSet` throughout; has O(N²) comment
+  at groupSiblings but this is inherent sibling compatibility checking, not a membership defect
+- `Networks`: uses `visitedNodes` Set for BFS reachability
+- `TransformHierarchy`: all visited tracking uses `Set<Node>`
+- `PipelineTranslation`: viewTransforms is `HashSet<String>`
+- `Schema.indexOf()`: backed by `fieldIndices` HashMap
+- `PipelineOptionsFactory`: uses `HashSet` for usedDescriptors, `ImmutableSet` for IGNORED_METHODS
+- `ExperimentContext`: uses `EnumSet` for experiment lookup
+- `DataflowRunner.stageArtifacts`: uses `HashSet` for stagedNames dedup
+- `CombineFns.checkUniqueness`: List.contains() but N is number of composed combiners (2-5)
 
-**Result: No actionable CWE-407 defects.**
+No data-proportional linear scans inside loops found.

defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch

@@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000112
+# UNDF: UNDF-2026-000000791
 diff --git a/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java b/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java
 --- a/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java
 +++ b/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java

defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md

@@ -1,4 +1,4 @@
-# UNDF: UNDF-2026-000000703
+# UNDF: UNDF-2026-000000792
 # hive-0003: TaskTracker.updateTaskCount ArrayList visited O(T²) in REPL DAG traversal
 
 ## Classification

defects/imagemagick/unit/ImageMagickTest.java

@@ -0,0 +1,164 @@
+/**
+ * CWE-407 simulation tests for ImageMagick defects.
+ *
+ * imagemagick-0001: UHDR coder GetImageListLength() O(N) called N times in loop = O(N^2)
+ * imagemagick-0002: SyncImageList nested loop scene-number duplicate check = O(N^2)
+ */
+public class ImageMagickTest {
+
+    // ---------------------------------------------------------------
+    // imagemagick-0001: UHDR GetImageListLength in loop
+    // ---------------------------------------------------------------
+
+    /** Simulate a doubly-linked image list */
+    static class ImageNode {
+        int scene;
+        int depth;
+        ImageNode next;
+        ImageNode previous;
+
+        ImageNode(int scene, int depth) {
+            this.scene = scene;
+            this.depth = depth;
+        }
+    }
+
+    static ImageNode buildImageList(int n) {
+        ImageNode head = new ImageNode(0, 8);
+        ImageNode prev = head;
+        for (int i = 1; i < n; i++) {
+            ImageNode node = new ImageNode(i, 8);
+            node.previous = prev;
+            prev.next = node;
+            prev = node;
+        }
+        return head;
+    }
+
+    /** O(N) traversal — simulates GetImageListLength */
+    static int getImageListLength(ImageNode image) {
+        // Go to end first
+        ImageNode p = image;
+        while (p.next != null) p = p.next;
+        // Count backwards
+        int count = 0;
+        while (p != null) {
+            count++;
+            p = p.previous;
+        }
+        return count;
+    }
+
+    /** DEFECTIVE: calls getImageListLength inside loop = O(N^2) */
+    static long writeUhdrDefective(ImageNode image) {
+        long ops = 0;
+        for (int i = 0; i < getImageListLength(image); i++) {
+            ops += getImageListLength(image); // count traversal ops
+            // simulate per-frame work
+            if (image.next != null) image = image.next;
+        }
+        return ops;
+    }
+
+    /** FIXED: cache length before loop = O(N) */
+    static long writeUhdrFixed(ImageNode image) {
+        long ops = 0;
+        int numberScenes = getImageListLength(image);
+        ops += numberScenes; // one traversal
+        for (int i = 0; i < numberScenes; i++) {
+            ops++; // per-frame work
+            if (image.next != null) image = image.next;
+        }
+        return ops;
+    }
+
+    static void testUhdrGetImageListLength() {
+        int N = 500;
+        ImageNode list = buildImageList(N);
+
+        long defectOps = writeUhdrDefective(list);
+        long fixedOps = writeUhdrFixed(buildImageList(N));
+        double ratio = (double) defectOps / fixedOps;
+
+        System.out.printf("imagemagick-0001 UHDR GetImageListLength in loop:%n");
+        System.out.printf("  N=%d  defect_ops=%d  fixed_ops=%d  ratio=%.1fx%n",
+                N, defectOps, fixedOps, ratio);
+        assert ratio > 50.0 : "Expected significant overhead ratio, got " + ratio;
+        System.out.println("  PASS");
+    }
+
+    // ---------------------------------------------------------------
+    // imagemagick-0002: SyncImageList O(N^2) scene dedup
+    // ---------------------------------------------------------------
+
+    /** DEFECTIVE: nested loop duplicate scene check O(N^2) */
+    static long syncImageListDefective(ImageNode images) {
+        long ops = 0;
+        ImageNode p, q;
+        boolean hasDup = false;
+        for (p = images; p != null; p = p.next) {
+            for (q = p.next; q != null; q = q.next) {
+                ops++;
+                if (p.scene == q.scene) {
+                    hasDup = true;
+                    break;
+                }
+            }
+            if (hasDup) break;
+        }
+        if (!hasDup) {
+            // scenes are unique — no renumbering needed (worst case: full scan)
+        }
+        return ops;
+    }
+
+    /** FIXED: single-pass sequential check O(N) */
+    static long syncImageListFixed(ImageNode images) {
+        long ops = 0;
+        if (images == null || images.next == null) return 0;
+        boolean needsRenumber = false;
+        int expected = images.scene;
+        for (ImageNode p = images.next; p != null; p = p.next) {
+            ops++;
+            expected++;
+            if (p.scene != expected) {
+                needsRenumber = true;
+                break;
+            }
+        }
+        if (needsRenumber) {
+            for (ImageNode p = images.next; p != null; p = p.next) {
+                ops++;
+                p.scene = p.previous.scene + 1;
+            }
+        }
+        return ops;
+    }
+
+    static void testSyncImageListDedup() {
+        int N = 1000;
+        // Build list with unique sequential scenes (worst case for defective)
+        ImageNode list = buildImageList(N);
+        long defectOps = syncImageListDefective(list);
+
+        ImageNode list2 = buildImageList(N);
+        long fixedOps = syncImageListFixed(list2);
+        double ratio = (double) defectOps / fixedOps;
+
+        System.out.printf("imagemagick-0002 SyncImageList scene dedup:%n");
+        System.out.printf("  N=%d  defect_ops=%d  fixed_ops=%d  ratio=%.1fx%n",
+                N, defectOps, fixedOps, ratio);
+        assert ratio > 100.0 : "Expected significant overhead ratio, got " + ratio;
+        System.out.println("  PASS");
+    }
+
+    // ---------------------------------------------------------------
+    // Main
+    // ---------------------------------------------------------------
+
+    public static void main(String[] args) {
+        testUhdrGetImageListLength();
+        testSyncImageListDedup();
+        System.out.println("\nAll ImageMagick CWE-407 tests PASS");
+    }
+}

defects/krita/patch/CLEAN.md

@@ -0,0 +1,34 @@
+# Krita — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** libs/ (image, flake, ui, resources, global, pigment, command, widgetutils), plugins/
+
+## Summary
+
+Krita is clean of CWE-407 algorithmic complexity defects. The codebase
+consistently uses QHash/QMap/QSet for membership tests and lookup operations.
+Where QList/QVector linear scans appear, they operate on inherently small
+collections (selected shapes, layer counts, composite op IDs) and are not
+data-proportional.
+
+## Key observations
+
+- `KisNodeDummiesGraph.m_dummiesMap`: QHash<KisNodeSP, KisNodeDummy*> for node lookups
+- `KisResourceLocator`: QHash-based caches for resources and tags
+- `KisMemoryLeakTracker`: QHash for reference tracking
+- `SharedCache.*DeletedDuringPrewarm`: HashSet for prewarm dedup
+- `KoSelection::isSelected()`: std::find on selectedShapes list, but called per-click, not in loops
+- `KisWatershedWorker.groups[].levels`: QMap for level lookup — O(log N)
+
+Minor findings (no defect):
+- `KisNodeDummy::nextSibling/prevSibling`: indexOf on parent->m_children QList, O(C) per call, but
+  C is the number of sibling layers (typically <100) and not called in inner loops
+- `KisSavedMacroCommand::mergeWith`: QVector::contains for skipWhenOverride, but skip list is tiny
+  and called once per undo merge
+- `kis_layer_utils::scanForLastLayer`: KisNodeList::contains inside sibling walk, but N is the
+  number of layers selected for delete (typically <20)
+- `kis_layer_utils::CleanUpNodes::findPerfectParent`: KisNodeList::contains inside parent walk,
+  O(D*N) where D is tree depth (~10) and N is nodes to delete (~20), runs once per merge
+
+No data-proportional linear scans inside loops found.