From b5c2a3d9898f9fdde3d2080b3bd7e13ed108d292 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Mon, 30 Mar 2026 11:15:59 -0400 Subject: [PATCH] undf: stamp patches, update registry to 792 --- UNDF-REGISTRY.json | 4 +- defects/audacity/unit/AudacityTest.class | Bin 0 -> 3986 bytes defects/beam/patch/CLEAN.md | 40 +++-- ...002-genmrproccontext-seenops-hashset.patch | 2 +- ...3-tasktracker-visited-arraylist-hashset.md | 2 +- .../unit/ImageMagickTest$ImageNode.class | Bin 0 -> 447 bytes .../imagemagick/unit/ImageMagickTest.class | Bin 0 -> 3649 bytes defects/imagemagick/unit/ImageMagickTest.java | 164 ++++++++++++++++++ defects/krita/patch/CLEAN.md | 34 ++++ 9 files changed, 224 insertions(+), 22 deletions(-) create mode 100644 defects/audacity/unit/AudacityTest.class create mode 100644 defects/imagemagick/unit/ImageMagickTest$ImageNode.class create mode 100644 defects/imagemagick/unit/ImageMagickTest.class create mode 100644 defects/imagemagick/unit/ImageMagickTest.java create mode 100644 defects/krita/patch/CLEAN.md diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index afe0ad43a..c978b12ea 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -788,5 +788,7 @@ "libreoffice-0002": "UNDF-2026-000000787", "libreoffice-0003": "UNDF-2026-000000788", "libreoffice-0004": "UNDF-2026-000000789", - "libreoffice-0005": "UNDF-2026-000000790" + "libreoffice-0005": "UNDF-2026-000000790", + "hive-0001": "UNDF-2026-000000791", + "hive-0003": "UNDF-2026-000000792" } diff --git a/defects/audacity/unit/AudacityTest.class b/defects/audacity/unit/AudacityTest.class new file mode 100644 index 0000000000000000000000000000000000000000..9e036289304051b72a52d0c6ad7287d1d5e37a35 GIT binary patch literal 3986 zcma)9T~Hg>75-LQX@yuDB)m3);wY}M`3Dn6jsat1uw!a|T#Mjf$E_D>fi*&lwJQf4 zr|FLyr%l^5{Y&h|(~e(wX*y{-O zUxL4>d9nf_R453msDvs(9muEkl<6!_7&cA))}k#z8dk7XLXGPx@0gj+fm}{s9x-hv zj4kk2B7&%b8Wr21N!VJl6DATureoxE$I40A-qbu&dOhsT_f}#DY8Av()S+HN^z$YX zlsVlVGnPbDP0eS;iUt)s@t6cT>rQVg`YuD;tKe}75!atPJ)CunStA!l9A8wi8;v5o ztTU-+@`meqSiIV+q6y9X=4CNIJ|hAj_98EL!@whGRndlaF4og&30hMDV0jSDXBBi7 z!*B^aq1$swgYDoCg}AilGu#136B{*;w< zbTey*nahJJdeF--X3PxPoyh5_d3(s15za0XVR!jgM0$G5^5H(0C&--;ZV##G7j7fv zZjYNwMp_im5tWs9lohgDw{0UQ!nTJ@Tc6GtWJF@JA{bI}Ot3B6<`qN1(-LY+Ss5rU zJC@5?xe$g~1E&o;pKFgWGOYmGv^r1anEj-aGxUYt5GEv?);$HZcXf5`i`$0CgOM%}885(($0rUorsGL* ziKkt1-QkQN#2vBRP3ur&$G(}R#%vgqIHTZMQB+gwq8hUDbZ;2v@SKA4 zD!ziR7WKD2W~zBnAYg^|l@}fnnc3OibDPxSrqF{&cC&r(C(6H+iZmG2js<<*7__n} z-8o}Aa~#=@o^{v}HpJ_FO;j_R!G5%gk}*|W#5}#E^z8V|jBPlB8FR6`7DG+vhR+QT zHJ=sc3o5e0yk@<*TVo+CN;p}bnC|%CIY z11(bXqxz!vT#+-`Ej0H`>@HHn&pniUi*|>RDc3ixPdb zye1zJ!7kR9%6R)yIBDf`DT7&H%#rdPsY4J%1s%04$98i1;;7-wS!p|jA4;e@wzTMK zHQv9kYbowZuq{4oIdQ2fh#!UVWBf$HPepP6Ov3IG*Jk#zHE(nlf+^JdaXrQTYFWaY z<*M=w3m-k9XVV$O-aTSj^Z7-OG`H(}sLHrqw{T*4(b&YioR`8@-CN!hJQss{CX?iT z%3iDvXR}7mEfm96a6>}l=P+#+s)C!M3{c;Is>lye+%V(Y?-=?s?nDFsFpC+ zejnQ<+DDOg%FVLf=X!0*nAtwSW2(GOC zMGM?ORhuT?!=C$S@!`zM+FNb!Fb7Zn;>upR9@U5ufYeLIHpJd<2N zJyL`?!vn`W9>epb^92Grrdsc!Yt&<6tiVK%9Fsku2gIlZG*ATErUhI~Pxwe!RlE08K=`Nj62d*? zAJ|KTO+2nOyBHH_Wk78hA=YQn$)45aqKU%4iUtMy3xImoLtw*XKAA(w0S}Gz`uB+R zuiol(UonkE5dMU$$#u7(l@otWmR8n2uB%TMU$&QJrSP(?{T`m`kqI#o5aYg{pcpf` zhi_u1AYzb5B_^J?Utr7oI6f6UaTj0uy%xBxDc7xop?5JFO@@94-;}?O^dzU`diNG^ z`AJR%HN|~aYD4$%O!5xSo^hSm*M_#?!W*{`6;5kI?_nAco<%ViO64f3Io?m`PofG5 z7Rdp0;~>VF*-7+~#C|S1j9Dt=6>8*l4B{4sSjB_*Bac5H@c<)A<^Y0gtg3*h6_!ne z68Q`}9zvFQTfZSic26g*nvYRN?|7JgWUd>3N^bRwT7??tkscsqTaD zX#EG_v7(Gb|I*}fS0n#)C+lw`LiyBb@`b|mKib->?qQC_tR!T2oN>niO}oP29v=i2Vm2a;JU( literal 0 HcmV?d00001 diff --git a/defects/beam/patch/CLEAN.md b/defects/beam/patch/CLEAN.md index 5165c633e..76e6c838f 100644 --- a/defects/beam/patch/CLEAN.md +++ b/defects/beam/patch/CLEAN.md @@ -1,25 +1,27 @@ -# CLEAN — Apache Beam -Scanned 2026-03-29 for CWE-407. +# Apache Beam — CWE-407 Scan Result: CLEAN -## Scope +**Date:** 2026-03-30 +**Scanner:** agent blackops +**Scope:** sdks/java/core/src/main/java/, runners/ -- `sdks/java/core/src/main/java` — PCollection DAG, PTransform graph, GreedyStageFuser -- `runners/core-java/src/main/java` — InMemoryStateInternals, SimplePushbackSideInputDoFnRunner, WatermarkHold -- `runners/google-cloud-dataflow-java/src/main/java` — DataflowRunner, DataflowPipelineTranslator -- `runners/google-cloud-dataflow-java/worker/src/main/java` — WindmillOrderedList -- `runners/jet/src/main/java` — DAGBuilder +## Summary -## Findings +Apache Beam's Java SDK and runners are clean of CWE-407 algorithmic complexity +defects. The codebase consistently uses HashSet/LinkedHashSet for membership +tests in graph traversal, pipeline fusion, and transform hierarchy operations. -| Location | Pattern | Type | Result | -|----------|---------|------|--------| -| `GreedyStageFuser` | `fusedCollections.contains` / `materializedPCollections.contains` | `LinkedHashSet` | CLEAN | -| `DAGBuilder.sideInputCollections` | `contains` per edge | `HashSet` | CLEAN | -| `WindmillOrderedList.pendingDeletes` | `contains` in stream filter | `TreeRangeSet` (O(log N)) | CLEAN | -| `DataflowRunner.experiments` | `experiments.contains(...)` | `List` — called at job-submission time (once), not in hot loop | LOW — startup only | -| `InMemoryStateInternals.contents` | `contains` | `Set` interface (HashSet impl) | CLEAN | -| `SideInputHandler.readyWindows` | `contains` | `CopyOnWriteArraySet` | CLEAN | +## Key observations -The `DataflowRunner.experiments` pattern makes several `List.contains` calls during job submission — a one-time initialization path, not a per-record or per-traversal hot path. Not actionable as CWE-407. +- `GreedyStageFuser`: uses `LinkedHashSet` for fusedCollections/materializedPCollections +- `GreedyPipelineFuser`: uses `LinkedHashSet`/`HashSet` throughout; has O(N²) comment + at groupSiblings but this is inherent sibling compatibility checking, not a membership defect +- `Networks`: uses `visitedNodes` Set for BFS reachability +- `TransformHierarchy`: all visited tracking uses `Set` +- `PipelineTranslation`: viewTransforms is `HashSet` +- `Schema.indexOf()`: backed by `fieldIndices` HashMap +- `PipelineOptionsFactory`: uses `HashSet` for usedDescriptors, `ImmutableSet` for IGNORED_METHODS +- `ExperimentContext`: uses `EnumSet` for experiment lookup +- `DataflowRunner.stageArtifacts`: uses `HashSet` for stagedNames dedup +- `CombineFns.checkUniqueness`: List.contains() but N is number of composed combiners (2-5) -**Result: No actionable CWE-407 defects.** +No data-proportional linear scans inside loops found. diff --git a/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch b/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch index 3affc4fd1..8b43cbb20 100644 --- a/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch +++ b/defects/hive/patch/hive-0001-0002-genmrproccontext-seenops-hashset.patch @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000112 +# UNDF: UNDF-2026-000000791 diff --git a/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java b/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java --- a/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java +++ b/ql/src/java/org/apache/hadoop/hive/ql/optimizer/GenMRProcContext.java diff --git a/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md b/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md index 95427fa47..b173fc7e2 100644 --- a/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md +++ b/defects/hive/patch/hive-0003-tasktracker-visited-arraylist-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000703 +# UNDF: UNDF-2026-000000792 # hive-0003: TaskTracker.updateTaskCount ArrayList visited O(T²) in REPL DAG traversal ## Classification diff --git a/defects/imagemagick/unit/ImageMagickTest$ImageNode.class b/defects/imagemagick/unit/ImageMagickTest$ImageNode.class new file mode 100644 index 0000000000000000000000000000000000000000..5e7ba0d18f9b62303fe3b175109bf1743ced2646 GIT binary patch literal 447 zcmZ`#Jx>Bb5Pb_A_u-v}SZYiRiSZJ|LPEbB6Fh`Ha(58_mIX1f@CW## zjB{I9kXY=zncaPF=FRud=NEuGoIA)NZ=&GBKvAH)kXzYbN;U64O&1iT0>zt9h3Tz8 zzSEu9uwa{TTpYj^X!t8Rr$;#tgV!-7XGz!iQ9D|48 z>?&I?qu2X@=rwmRd#xP~-}y?Q#<8L$s~l^vQAY_UOsMlqj{#T1?v|r Cz*dX^ literal 0 HcmV?d00001 diff --git a/defects/imagemagick/unit/ImageMagickTest.class b/defects/imagemagick/unit/ImageMagickTest.class new file mode 100644 index 0000000000000000000000000000000000000000..269963628d9470d05c1d5a6cceaea4956e61b926 GIT binary patch literal 3649 zcmai1TTmO<8U7AhX(h2-4H#i#Ha56ijPVr`uql{Jj4iMeVH2FT@ggl^jo4MCg+Q7n ztwY+zNi%JyX=2ZGnz|3XG&8+9W|C?9(s5_{+LykxGo3!P)8{;ST+{EYgpk2;7|@<` z^xwbl|IhN5hoAfbz#!fYqXa$`iUvOd0+rW{C8H~4*vYO7GuOyvy%|r+-IH=-F8d}lz2p+MOtZOb124|6|)J8p|ET`*Y#Dp??rpKd=)_?aT^f$ysKBnr7$+0b($%cM zsn(o#k0*3(*~z{ai;i;C>1+F(7>^4a)AfndEeTyuctv~3NoT$7tgJy{moZ$+Io)#j z=u|AF?wB;L!H9-YJWIRHMmB3^n2nts zwz3A*5(45%U|@`G$R8Ew1?soL8Qc^f$z+^NH6_M1OyGjR?geAs9CGZq;Z9lZ99LP_ zuwC}lwlMOzgmDhf$(DRxN)**(6Qs*QOcGmNzc?6+NgiC*FohRbO%Lvry-hD~H`m%% zG`xtfu-UV5(`G4z*H>TD@RH#VOsMA5h%vu>UQNT3j8m=6I9H>_~ z;)XalsTZ|ub7FB}#>`Ageh8FNE#Jrz&oM|C*nEN0^7 zs3q;x6vZ#c^L{>5l@ksCFHWGte2yMt5UGN z5a8z`ca3}sKK<=?A$~0dvBXdLwVWbBd7*JFMOUFv5$O38>a?#ico(5)$GFnp*l-)o z@~qK2>s2Dkp*zqHMU*?Jj40!)KC!m(_l{ptwZt=i5FxJjFp|9}V+6eXp!4=S$j?KJ zxQk~ed7HgVsS1=lM1=~Kzv4bGv!J}R^AXMQ>7!6{d$i+ssJw?#`G~GNxe2ha=a&t`OX4*%=6R~MUUq^3j+Fz%5&p>@(9bb;+ zM2Bx-Pko>UXW#!Rsz1fK>H5GYhyr(U@sH9F#V$#H<|uTGIe=d)7$=!7@O|(iF?^0F z#fa!6YkP^SNnSjc$=xY@6EAofRzhs>z%K}`qDbxp<<*kU@~^Zf5gI45-TwB8&U@(Z zB$ATS_i#YgncL}z!jBITQo8+XD3d!%tZn?G)_)U$HIzz~iM5SC)%tJ2R|G>h*$!M~ z3NyqvPW~rQ2b08`B?XeCr`wa4T%QS6G8@um-Q< zIN>^p*9hVY3Hxo<;X0vxgOIMWI@e+2yIxK9LVbWTMLa~AkbpMaN9X}UT;1ms3Cim@ zpZC95F*$RtSNZ-^pzl{b`buoqaka-!3j0Z6Rgx|K#T54EDXeazuv!DNKw6wa~X zZ6fl0#`Z2L`~%eBhn$N)V(0&uFV63AEc}GzeUI-%@3R&kuogGH%y&r|ukdYyxk@^C zOb)S>EBS?nD(PY8{oSK5tJ?ZDiH*CeCZ>OvdIKv7kHh>f&Yn>@Vo}! M 50.0 : "Expected significant overhead ratio, got " + ratio; + System.out.println(" PASS"); + } + + // --------------------------------------------------------------- + // imagemagick-0002: SyncImageList O(N^2) scene dedup + // --------------------------------------------------------------- + + /** DEFECTIVE: nested loop duplicate scene check O(N^2) */ + static long syncImageListDefective(ImageNode images) { + long ops = 0; + ImageNode p, q; + boolean hasDup = false; + for (p = images; p != null; p = p.next) { + for (q = p.next; q != null; q = q.next) { + ops++; + if (p.scene == q.scene) { + hasDup = true; + break; + } + } + if (hasDup) break; + } + if (!hasDup) { + // scenes are unique — no renumbering needed (worst case: full scan) + } + return ops; + } + + /** FIXED: single-pass sequential check O(N) */ + static long syncImageListFixed(ImageNode images) { + long ops = 0; + if (images == null || images.next == null) return 0; + boolean needsRenumber = false; + int expected = images.scene; + for (ImageNode p = images.next; p != null; p = p.next) { + ops++; + expected++; + if (p.scene != expected) { + needsRenumber = true; + break; + } + } + if (needsRenumber) { + for (ImageNode p = images.next; p != null; p = p.next) { + ops++; + p.scene = p.previous.scene + 1; + } + } + return ops; + } + + static void testSyncImageListDedup() { + int N = 1000; + // Build list with unique sequential scenes (worst case for defective) + ImageNode list = buildImageList(N); + long defectOps = syncImageListDefective(list); + + ImageNode list2 = buildImageList(N); + long fixedOps = syncImageListFixed(list2); + double ratio = (double) defectOps / fixedOps; + + System.out.printf("imagemagick-0002 SyncImageList scene dedup:%n"); + System.out.printf(" N=%d defect_ops=%d fixed_ops=%d ratio=%.1fx%n", + N, defectOps, fixedOps, ratio); + assert ratio > 100.0 : "Expected significant overhead ratio, got " + ratio; + System.out.println(" PASS"); + } + + // --------------------------------------------------------------- + // Main + // --------------------------------------------------------------- + + public static void main(String[] args) { + testUhdrGetImageListLength(); + testSyncImageListDedup(); + System.out.println("\nAll ImageMagick CWE-407 tests PASS"); + } +} diff --git a/defects/krita/patch/CLEAN.md b/defects/krita/patch/CLEAN.md new file mode 100644 index 000000000..0fa55cdb7 --- /dev/null +++ b/defects/krita/patch/CLEAN.md @@ -0,0 +1,34 @@ +# Krita — CWE-407 Scan Result: CLEAN + +**Date:** 2026-03-30 +**Scanner:** agent blackops +**Scope:** libs/ (image, flake, ui, resources, global, pigment, command, widgetutils), plugins/ + +## Summary + +Krita is clean of CWE-407 algorithmic complexity defects. The codebase +consistently uses QHash/QMap/QSet for membership tests and lookup operations. +Where QList/QVector linear scans appear, they operate on inherently small +collections (selected shapes, layer counts, composite op IDs) and are not +data-proportional. + +## Key observations + +- `KisNodeDummiesGraph.m_dummiesMap`: QHash for node lookups +- `KisResourceLocator`: QHash-based caches for resources and tags +- `KisMemoryLeakTracker`: QHash for reference tracking +- `SharedCache.*DeletedDuringPrewarm`: HashSet for prewarm dedup +- `KoSelection::isSelected()`: std::find on selectedShapes list, but called per-click, not in loops +- `KisWatershedWorker.groups[].levels`: QMap for level lookup — O(log N) + +Minor findings (no defect): +- `KisNodeDummy::nextSibling/prevSibling`: indexOf on parent->m_children QList, O(C) per call, but + C is the number of sibling layers (typically <100) and not called in inner loops +- `KisSavedMacroCommand::mergeWith`: QVector::contains for skipWhenOverride, but skip list is tiny + and called once per undo merge +- `kis_layer_utils::scanForLastLayer`: KisNodeList::contains inside sibling walk, but N is the + number of layers selected for delete (typically <20) +- `kis_layer_utils::CleanUpNodes::findPerfectParent`: KisNodeList::contains inside parent walk, + O(D*N) where D is tree depth (~10) and N is nodes to delete (~20), runs once per merge + +No data-proportional linear scans inside loops found.