diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index afe0ad43a..c978b12ea 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -788,5 +788,7 @@ "libreoffice-0002": "UNDF-2026-000000787", "libreoffice-0003": "UNDF-2026-000000788", "libreoffice-0004": "UNDF-2026-000000789", - "libreoffice-0005": "UNDF-2026-000000790" + "libreoffice-0005": "UNDF-2026-000000790", + "hive-0001": "UNDF-2026-000000791", + "hive-0003": "UNDF-2026-000000792" } diff --git a/defects/audacity/unit/AudacityTest.class b/defects/audacity/unit/AudacityTest.class new file mode 100644 index 000000000..9e0362893 Binary files /dev/null and b/defects/audacity/unit/AudacityTest.class differ diff --git a/defects/beam/patch/CLEAN.md b/defects/beam/patch/CLEAN.md index 5165c633e..76e6c838f 100644 --- a/defects/beam/patch/CLEAN.md +++ b/defects/beam/patch/CLEAN.md @@ -1,25 +1,27 @@ -# CLEAN — Apache Beam -Scanned 2026-03-29 for CWE-407. +# Apache Beam — CWE-407 Scan Result: CLEAN -## Scope +**Date:** 2026-03-30 +**Scanner:** agent blackops +**Scope:** sdks/java/core/src/main/java/, runners/ -- `sdks/java/core/src/main/java` — PCollection DAG, PTransform graph, GreedyStageFuser -- `runners/core-java/src/main/java` — InMemoryStateInternals, SimplePushbackSideInputDoFnRunner, WatermarkHold -- `runners/google-cloud-dataflow-java/src/main/java` — DataflowRunner, DataflowPipelineTranslator -- `runners/google-cloud-dataflow-java/worker/src/main/java` — WindmillOrderedList -- `runners/jet/src/main/java` — DAGBuilder +## Summary -## Findings +Apache Beam's Java SDK and runners are clean of CWE-407 algorithmic complexity +defects. The codebase consistently uses HashSet/LinkedHashSet for membership +tests in graph traversal, pipeline fusion, and transform hierarchy operations. -| Location | Pattern | Type | Result | -|----------|---------|------|--------| -| `GreedyStageFuser` | `fusedCollections.contains` / `materializedPCollections.contains` | `LinkedHashSet` | CLEAN | -| `DAGBuilder.sideInputCollections` | `contains` per edge | `HashSet` | CLEAN | -| `WindmillOrderedList.pendingDeletes` | `contains` in stream filter | `TreeRangeSet` (O(log N)) | CLEAN | -| `DataflowRunner.experiments` | `experiments.contains(...)` | `List` — called at job-submission time (once), not in hot loop | LOW — startup only | -| `InMemoryStateInternals.contents` | `contains` | `Set` interface (HashSet impl) | CLEAN | -| `SideInputHandler.readyWindows` | `contains` | `CopyOnWriteArraySet` | CLEAN | +## Key observations -The `DataflowRunner.experiments` pattern makes several `List.contains` calls during job submission — a one-time initialization path, not a per-record or per-traversal hot path. Not actionable as CWE-407. +- `GreedyStageFuser`: uses `LinkedHashSet` for fusedCollections/materializedPCollections +- `GreedyPipelineFuser`: uses `LinkedHashSet`/`HashSet` throughout; has O(N²) comment + at groupSiblings but this is inherent sibling compatibility checking, not a membership defect +- `Networks`: uses `visitedNodes` Set for BFS reachability +- `TransformHierarchy`: all visited tracking uses `Set` +- `PipelineTranslation`: viewTransforms is `HashSet` +- `Schema.indexOf()`: backed by `fieldIndices` HashMap +- `PipelineOptionsFactory`: uses `HashSet` for usedDescriptors, `ImmutableSet` for IGNORED_METHODS +- `ExperimentContext`: uses `EnumSet` for experiment lookup +- `DataflowRunner.stageArtifacts`: uses `HashSet` for stagedNames dedup +- `CombineFns.checkUniqueness`: List.contains() but N is number of composed combiners (2-5) -**Result: No actionable CWE-407 defects.** +No data-proportional linear scans inside loops found. diff --git a/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch b/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch index 3affc4fd1..8b43cbb20 100644 --- a/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch +++ b/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000112 +# UNDF: UNDF-2026-000000791 diff --git a/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java b/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java --- a/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java +++ b/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java diff --git a/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md b/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md index 95427fa47..b173fc7e2 100644 --- a/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md +++ b/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000703 +# UNDF: UNDF-2026-000000792 # hive-0003: TaskTracker.updateTaskCount ArrayList visited O(T²) in REPL DAG traversal ## Classification diff --git a/defects/imagemagick/unit/ImageMagickTest$ImageNode.class b/defects/imagemagick/unit/ImageMagickTest$ImageNode.class new file mode 100644 index 000000000..5e7ba0d18 Binary files /dev/null and b/defects/imagemagick/unit/ImageMagickTest$ImageNode.class differ diff --git a/defects/imagemagick/unit/ImageMagickTest.class b/defects/imagemagick/unit/ImageMagickTest.class new file mode 100644 index 000000000..269963628 Binary files /dev/null and b/defects/imagemagick/unit/ImageMagickTest.class differ diff --git a/defects/imagemagick/unit/ImageMagickTest.java b/defects/imagemagick/unit/ImageMagickTest.java new file mode 100644 index 000000000..b87328d5b --- /dev/null +++ b/defects/imagemagick/unit/ImageMagickTest.java @@ -0,0 +1,164 @@ +/** + * CWE-407 simulation tests for ImageMagick defects. + * + * imagemagick-0001: UHDR coder GetImageListLength() O(N) called N times in loop = O(N^2) + * imagemagick-0002: SyncImageList nested loop scene-number duplicate check = O(N^2) + */ +public class ImageMagickTest { + + // --------------------------------------------------------------- + // imagemagick-0001: UHDR GetImageListLength in loop + // --------------------------------------------------------------- + + /** Simulate a doubly-linked image list */ + static class ImageNode { + int scene; + int depth; + ImageNode next; + ImageNode previous; + + ImageNode(int scene, int depth) { + this.scene = scene; + this.depth = depth; + } + } + + static ImageNode buildImageList(int n) { + ImageNode head = new ImageNode(0, 8); + ImageNode prev = head; + for (int i = 1; i < n; i++) { + ImageNode node = new ImageNode(i, 8); + node.previous = prev; + prev.next = node; + prev = node; + } + return head; + } + + /** O(N) traversal — simulates GetImageListLength */ + static int getImageListLength(ImageNode image) { + // Go to end first + ImageNode p = image; + while (p.next != null) p = p.next; + // Count backwards + int count = 0; + while (p != null) { + count++; + p = p.previous; + } + return count; + } + + /** DEFECTIVE: calls getImageListLength inside loop = O(N^2) */ + static long writeUhdrDefective(ImageNode image) { + long ops = 0; + for (int i = 0; i < getImageListLength(image); i++) { + ops += getImageListLength(image); // count traversal ops + // simulate per-frame work + if (image.next != null) image = image.next; + } + return ops; + } + + /** FIXED: cache length before loop = O(N) */ + static long writeUhdrFixed(ImageNode image) { + long ops = 0; + int numberScenes = getImageListLength(image); + ops += numberScenes; // one traversal + for (int i = 0; i < numberScenes; i++) { + ops++; // per-frame work + if (image.next != null) image = image.next; + } + return ops; + } + + static void testUhdrGetImageListLength() { + int N = 500; + ImageNode list = buildImageList(N); + + long defectOps = writeUhdrDefective(list); + long fixedOps = writeUhdrFixed(buildImageList(N)); + double ratio = (double) defectOps / fixedOps; + + System.out.printf("imagemagick-0001 UHDR GetImageListLength in loop:%n"); + System.out.printf(" N=%d defect_ops=%d fixed_ops=%d ratio=%.1fx%n", + N, defectOps, fixedOps, ratio); + assert ratio > 50.0 : "Expected significant overhead ratio, got " + ratio; + System.out.println(" PASS"); + } + + // --------------------------------------------------------------- + // imagemagick-0002: SyncImageList O(N^2) scene dedup + // --------------------------------------------------------------- + + /** DEFECTIVE: nested loop duplicate scene check O(N^2) */ + static long syncImageListDefective(ImageNode images) { + long ops = 0; + ImageNode p, q; + boolean hasDup = false; + for (p = images; p != null; p = p.next) { + for (q = p.next; q != null; q = q.next) { + ops++; + if (p.scene == q.scene) { + hasDup = true; + break; + } + } + if (hasDup) break; + } + if (!hasDup) { + // scenes are unique — no renumbering needed (worst case: full scan) + } + return ops; + } + + /** FIXED: single-pass sequential check O(N) */ + static long syncImageListFixed(ImageNode images) { + long ops = 0; + if (images == null || images.next == null) return 0; + boolean needsRenumber = false; + int expected = images.scene; + for (ImageNode p = images.next; p != null; p = p.next) { + ops++; + expected++; + if (p.scene != expected) { + needsRenumber = true; + break; + } + } + if (needsRenumber) { + for (ImageNode p = images.next; p != null; p = p.next) { + ops++; + p.scene = p.previous.scene + 1; + } + } + return ops; + } + + static void testSyncImageListDedup() { + int N = 1000; + // Build list with unique sequential scenes (worst case for defective) + ImageNode list = buildImageList(N); + long defectOps = syncImageListDefective(list); + + ImageNode list2 = buildImageList(N); + long fixedOps = syncImageListFixed(list2); + double ratio = (double) defectOps / fixedOps; + + System.out.printf("imagemagick-0002 SyncImageList scene dedup:%n"); + System.out.printf(" N=%d defect_ops=%d fixed_ops=%d ratio=%.1fx%n", + N, defectOps, fixedOps, ratio); + assert ratio > 100.0 : "Expected significant overhead ratio, got " + ratio; + System.out.println(" PASS"); + } + + // --------------------------------------------------------------- + // Main + // --------------------------------------------------------------- + + public static void main(String[] args) { + testUhdrGetImageListLength(); + testSyncImageListDedup(); + System.out.println("\nAll ImageMagick CWE-407 tests PASS"); + } +} diff --git a/defects/krita/patch/CLEAN.md b/defects/krita/patch/CLEAN.md new file mode 100644 index 000000000..0fa55cdb7 --- /dev/null +++ b/defects/krita/patch/CLEAN.md @@ -0,0 +1,34 @@ +# Krita — CWE-407 Scan Result: CLEAN + +**Date:** 2026-03-30 +**Scanner:** agent blackops +**Scope:** libs/ (image, flake, ui, resources, global, pigment, command, widgetutils), plugins/ + +## Summary + +Krita is clean of CWE-407 algorithmic complexity defects. The codebase +consistently uses QHash/QMap/QSet for membership tests and lookup operations. +Where QList/QVector linear scans appear, they operate on inherently small +collections (selected shapes, layer counts, composite op IDs) and are not +data-proportional. + +## Key observations + +- `KisNodeDummiesGraph.m_dummiesMap`: QHash for node lookups +- `KisResourceLocator`: QHash-based caches for resources and tags +- `KisMemoryLeakTracker`: QHash for reference tracking +- `SharedCache.*DeletedDuringPrewarm`: HashSet for prewarm dedup +- `KoSelection::isSelected()`: std::find on selectedShapes list, but called per-click, not in loops +- `KisWatershedWorker.groups[].levels`: QMap for level lookup — O(log N) + +Minor findings (no defect): +- `KisNodeDummy::nextSibling/prevSibling`: indexOf on parent->m_children QList, O(C) per call, but + C is the number of sibling layers (typically <100) and not called in inner loops +- `KisSavedMacroCommand::mergeWith`: QVector::contains for skipWhenOverride, but skip list is tiny + and called once per undo merge +- `kis_layer_utils::scanForLastLayer`: KisNodeList::contains inside sibling walk, but N is the + number of layers selected for delete (typically <20) +- `kis_layer_utils::CleanUpNodes::findPerfectParent`: KisNodeList::contains inside parent walk, + O(D*N) where D is tree depth (~10) and N is nodes to delete (~20), runs once per merge + +No data-proportional linear scans inside loops found.