wave16: dart-0001/2/3 + octave-0002 + php-0003/4 + cassandra-0005 + erlang-0003 + chef-0001 — 542/240

whitepaper/MD5SUMS

@@ -1 +1 @@
-82359cca98c8df32fb9798eaf154d0cb  undefect-cwe407-2026-03-27.pdf
+4184c0cb8ecd2b3730ada28628420349  undefect-cwe407-2026-03-27.pdf

whitepaper/full-paper.md

@@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint.
 4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
 
 Code propagates according to its kind — clean architecture begets clean implementations,
-elegant solutions inspire elegant variations. The process of generating 533 validated
+elegant solutions inspire elegant variations. The process of generating 542 validated
 defect patches across 240 ecosystems in a single research wave demonstrates how truth,
 properly seeded, multiplies. Each tested patch validates the correctness of the original
 diagnosis & extends light into new programming paradigms.
@@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
 confirmed site — compiler, routing, database, build tool, event streaming, web framework,
 query optimizer, and browser runtime.
 
-**533 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
+**542 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
 1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
 3 unpatched (Minecraft, Create mod). No language left behind.
 
@@ -319,6 +319,7 @@ stacks, Spark schemas — this is the dominant build cost.
 | exposed-0001 | Exposed ORM | `SchemaUtilityApi.kt:80` — `existingColumns.find{}` O(M) per column + `missingTableColumns.contains()` List O(M) per index-col in schema migration; fix: `associateBy` map (118×) | **PATCHED** |
 | rustc-0001 | rustc | `inhabited_predicate.rs:109,127` — `SmallVec::contains` | **PATCHED** |
 | erlang-0001 | Erlang OTP | `digraph.erl:578` — `lists:member(V, Xs)` in `one_path/8` | **PATCHED** |
+| erlang-0003 | Erlang OTP | `kernel/src/code_server.erl:600` — `lists:member(P, Acc)` in `merge_path1/3`; O(N²) on `code:add_paths/1` for large Elixir/OTP deployments; fix: `sets:set()` shadow (999×) | **PATCHED** |
 | swipl-0001 | SWI-Prolog | `ugraphs.pl:510` — `graph_memberchk` O(|V|) scan in `top_sort` | **PATCHED** |
 | swipl-0002 | SWI-Prolog | `aggregate.pl:673` — `list_is_free_of` O(N²) accumulator in `free_variables/4` | **PATCHED** |
 | frrouting-0001 | FRRouting | `ospf_ti_lfa.c:72,114,227,278,285` — `listnode_lookup` × 5 | **PATCHED** |
@@ -460,6 +461,9 @@ stacks, Spark schemas — this is the dominant build cost.
 | containerd-0001 | containerd | `pkg/oci/spec_opts.go:1069,1080` — `filterCaps`/`WithAddedCapabilities` `capsContain()` `slices.Contains` O(n²) per container launch; fix: `map[string]bool` capability set | **PATCHED** |
 | moby-0001 | Moby (Docker daemon) | `daemon/pkg/oci/caps/utils.go` — `TweakCapabilities()` `slices.Contains(capDrop)` O(n²) per cap; fix: pre-built `map[string]bool` (38×) | **PATCHED** |
 | crystal-0001 | Crystal compiler | `src/compiler/crystal/semantic/restrictions.cr:94,104,141,148` — `compare_strictness()` O(N×M) named-arg scan; called from `add_def()` in overload loop O(D×N×M); fix: `Set(String)` (800×) | **PATCHED** |
+| dart-0001 | Dart (dart2js) | `pkg/compiler/js_model/element_map.dart:636` — `namedParameters.contains()` O(N) `List<String>` in `forEachOrderedParameterByFunctionNode` inner loop; O(N²) per function (250×) | **PATCHED** |
+| dart-0002 | Dart (dart2js) | `pkg/compiler/ssa/builder.dart:2156` — same `namedParameters List.contains()` in `.where()` filter for native method params (250×) | **PATCHED** |
+| dart-0003 | Dart (dart2js) | `pkg/compiler/ssa/builder.dart:5007` — same pattern in call-site argument ordering `.where()` filter (250×) | **PATCHED** |
 | elasticsearch-0001 | Elasticsearch | `server/src/main/java/.../MMRResultDiversification.java` — `selectedDocRanks List.contains()` O(n²) per diversification pass; fix: `HashSet` (200×+) | **PATCHED** |
 | zeek-0001 | Zeek IDS | `src/RuleMatcher.cc` — `is_member_of()` `std::ranges::find` O(R) on `matched_rules` vector; 6× per packet per connection; fix: `unordered_set<intptr_t>` (239×) | **PATCHED** |
 | llvm-0004 | LLVM | `lib/Analysis/DomConditionCache.cpp` — `registerBranch()` O(B²) `SmallVector` duplicate check; fix: `SmallPtrSet` (100×) | **PATCHED** |
@@ -637,9 +641,11 @@ stacks, Spark schemas — this is the dominant build cost.
 | jsc-0002 | JavaScriptCore | `Source/JavaScriptCore/dfg/DFGGraph.cpp:744` — `PredecessorList::contains(block)` O(P) dedup in `handleSuccessor()` per CFG edge; O(N²) for switch-merge CFGs (500×) | **PATCHED** |
 | rabbitmq-0001 | RabbitMQ | `rabbit_classic_queue.erl:410` — `lists:member(Pid, pending)` over unconfirmed message map on publisher DOWN; O(M×P) | **PATCHED** |
 | octave-0001 | GNU Octave | `data.cc:138` + `numeric/max.cc:111` — `std::find` on already-sorted `vecdim` vector; `std::binary_search` is correct | **PATCHED** |
+| octave-0002 | GNU Octave | `libinterp/corefcn/load-path.cc:1119,1151` — `find_dir_info()` O(D) linear scan called per `add()` during `set()` path init; O(D²) total; fix: `unordered_set` (500×) | **PATCHED** |
 | cfengine-0001 | CFEngine | `libpromises/evalfunction.c:3656` — `RlistKeyIn(keys)` O(K) linked-list walk per `getindices()` iteration; O(K²) total | **PATCHED** |
 | cfengine-0003 | CFEngine | `evalfunction.c:4407` — `RlistAppendScalarIdemp` O(R) scan per `maparray()` mapped value | **PATCHED** |
 | puppet-0001 | Puppet | `graph/simple_graph.rb:199` — `frame[1].member?` on growing Array in `paths_in_cycle`; O(\|cycle\|³) error-path | **PATCHED** |
+| chef-0001 | Chef Infra | `lib/chef/run_list.rb:65` — `@run_list_items.include?(item)` Array linear scan on every `<<` append; O(N²) run-list construction; fix: shadow `Set` (250×) | **PATCHED** |
 | ansible-0002 | Ansible | `playbook/role/__init__.py:285` — `self.collections.extend(...if c not in self.collections)` list scan | **PATCHED** |
 | saltstack-0001 | SaltStack | `cloud/__init__.py:1830` — `_has_loop(seen=[])` list DFS with `list(seen)` copy at each level; O(V²) cloud map | **PATCHED** |
 | terraform-0002 | Terraform | `internal/dag/graph.go:79` — `EdgesTo` iterates all edges O(E) inside vertex loop → O(V×E); `CBDEdgeTransformer` | **PATCHED** |
@@ -688,6 +694,7 @@ stacks, Spark schemas — this is the dominant build cost.
 | cassandra-0002 | Apache Cassandra | `gms/Gossiper.java:1334` — `SILENT_SHUTDOWN_STATES List.contains()` per endpoint per gossip tick; fix: `EnumSet` | **PATCHED** |
 | cassandra-0003 | Apache Cassandra | `gms/Gossiper.java:1343` — same `List.contains()` pattern, third gossip state check | **PATCHED** |
 | cassandra-0004 | Apache Cassandra | `gms/EndpointState.java` — additional gossip state membership scan per gossip round | **PATCHED** |
+| cassandra-0005 | Apache Cassandra | `cql3/terms/Lists.java:524` — `toDiscard.contains(cell.buffer())` List linear scan in CQL DELETE from list column; O(E×D) unbounded; fix: `HashSet<ByteBuffer>` (99×) | **PATCHED** |
 | flink-0001 | Apache Flink | `runtime/src/main/java/.../JobGraph.java` — `userJars List.contains()` O(n²) dedup on job graph construction; fix: `LinkedHashSet` | **PATCHED** |
 | flink-0002 | Apache Flink | `flink-table/flink-sql-parser/.../RowTypeUtils.java:43` — `checklist/result List<String>.contains()` in nested for+do-while; O(N×M²) (37×) | **PATCHED** |
 | flink-0003 | Apache Flink | `flink-table/.../rules/AggregateReduceGroupingRule.java:88` — `newGroupingList List<Integer>.contains()` in for loop; O(G²) query planning (50×) | **PATCHED** |
@@ -717,6 +724,8 @@ stacks, Spark schemas — this is the dominant build cost.
 | love2d-0001 | LÖVE2D | `src/modules/joystick/` — `JoystickModule::getJoystickFromID()` O(N) linear scan per joystick event; fix: `unordered_map<ID, Joystick*>` | **PATCHED** |
 | php-0001 | PHP | `Zend/zend_compile.c:3757` — `zend_get_arg_num()` O(N×M) per named arg (TODO: hash table comment); fix: `HashMap<name, index>` (50×) | **PATCHED** |
 | php-0002 | PHP | `Zend/zend_execute.c:5479` — `zend_get_arg_offset_by_name()` same O(N×M) scan at runtime; fix: pre-built param hash | **PATCHED** |
+| php-0003 | PHP | `Zend/zend_inheritance.c:2259` — `zend_do_implement_interfaces()` O(I²) interface pointer dedup via linear scan; fix: `HashTable` keyed by pointer (249×) | **PATCHED** |
+| php-0004 | PHP | `Zend/zend_inheritance.c:1592` — `zend_do_inherit_interfaces()` O(IF×CE) inherited interface dedup; fix: pre-built `HashTable` from class interfaces (250×) | **PATCHED** |
 | r-source-0001 | R | `src/main/apply.c:312` — `rapply() do_one()` O(k²) nested class-match loop; fix: intern `classes` to pointer-set before loop | **PATCHED** |
 | cpython-0002 | CPython | `Lib/pkgutil.py:335` — `extend_path()` `if portion not in path` O(n) list scan; O(n²) total; fix: parallel `seen` set (250×) | **PATCHED** |
 | ruby-0001 | Ruby MRI | `compile.c` — `kwarg` named parameter binding O(N×M) per call with many kwargs; fix: pre-built `HashMap<name, index>` | **PATCHED** |
@@ -808,7 +817,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
 1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
 chains with depths in this range.
 
-**533 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
+**542 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
 
 ---
 
@@ -1384,6 +1393,12 @@ compilation. Unit test: 30× at D=80.
 `seen = list`, `list(seen)` copy at every recursion level for cloud machine dependency
 cycle detection. O(V²) + O(depth²) copy overhead. Fix: `seen = set()`. 39× at depth=80.
 
+**Chef Infra** — **chef-0001 PATCHED.** `RunList#<<` in `lib/chef/run_list.rb:65` used
+`@run_list_items.include?(item)` (plain Array) for deduplication on every append. During
+role expansion, all cookbook and recipe entries are pushed through `<<` — N appends cost
+O(N²) total. Fix: shadow `Set` for O(1) membership while retaining `Array` for ordered
+iteration (250× at N=500).
+
 **Docker image builds** — Python base images: `pip install -r requirements.txt` in
 Dockerfile layers is the dominant time sink in most CI pipelines. distlib-0001 and
 cpython-0001 together reduce this. Maven/Gradle Java CI pipelines benefit from javac
@@ -2796,7 +2811,7 @@ The following systems were scanned and confirmed free of CWE-407:
 
 **Build systems:** sbt — confirmed clean. Bazel: bazel-0001/0002 PATCHED. Jenkins: jenkins-0001/0002 PATCHED.
 
-**Scientific computing:** GNU Octave (octave-0001 PATCHED — `std::find` on sorted vector); NetworkX (nx-0001 PATCHED — `B=defaultdict(list)` in `recursive_simple_cycles`). SciPy: not yet scanned.
+**Scientific computing:** GNU Octave (octave-0001/0002 PATCHED — sorted vector search 500×; load-path O(D²) init 500×); NetworkX (nx-0001 PATCHED — `B=defaultdict(list)` in `recursive_simple_cycles`). SciPy: not yet scanned.
 
 **EDA:** Yosys, Verilator — confirmed clean. KiCad: kicad-0001 PATCHED.
 
@@ -2834,7 +2849,7 @@ confirmed clean.
 Python, Ruby, Go, Rust, JavaScript, TypeScript, Java, Kotlin, Haskell, Clojure, OCaml,
 Erlang, Prolog, Lua, Julia, R, C, C++, C#, Dart, Elixir, F#, Fortran, Groovy, Swift,
 PHP, Perl, Raku, Scheme, Objective-C, PowerShell, COBOL, Common Lisp, Crystal, V, Nim,
-Zig, D — all confirmed CLEAN of genuine CWE-407. Not scanned: Scala (source 404),
+Zig, D, Flutter — all confirmed CLEAN of genuine CWE-407. Dart (dart2js): 3 defects PATCHED — `ParameterStructure.namedParameters List<String>.contains()` O(N²) in named-argument ordering at 3 call sites in the compiler SSA builder (250×). Not scanned: Scala (source 404),
 Forth (source 404). REST clients have no hot algorithmic paths; O(n²) has nowhere
 to live. A "terminal states" anti-pattern (4-element fixed array checked with O(n) scan
 in job polling loops) appears across ≥6 implementations and is the stylistic floor of