wave17 complete: systemd/emacs/vim/qemu/tcl/kafka-0007/spark-0004 + 559/240

defects/glib/patch/glib-CLEAN.md

@@ -0,0 +1,26 @@
+# GLib — CWE-407 scan CLEAN
+
+## Files scanned
+
+| File | Finding |
+|---|---|
+| `glib/glist.c` | Defines `g_list_find` / `g_list_find_custom` — no internal O(n²) usage |
+| `glib/ghash.c` | Hash table implementation — O(1) amortized; no list-find calls |
+| `gio/gsettings.c` | No `g_list_find` / `g_slist_find` calls found |
+| `gobject/gsignal.c` | No `g_list_find` calls found |
+| `gobject/gtype.c` | No `g_list_find` calls found |
+| `gio/giomodule.c` | No `g_list_find` calls found |
+
+## Near-misses
+
+- `glib/gtestutils.c` line 3115: `g_slist_find_custom(test_paths_skipped, ...)` inside the
+  test case runner loop.  `test_paths_skipped` is the list of `-s` (skip) flags passed on the
+  CLI; it is tiny in all real use and this is test infrastructure, not production code.
+  **Not filed as a defect.**
+
+- `glib/gmain.c` lines 2900/2941/2990: `g_slist_find(source->priv->fds, tag)` used as a
+  validity assertion (not in a loop). **Not a defect.**
+
+## Conclusion
+
+GLib production code is **CLEAN** for CWE-407 in the scanned modules.