undefect. CWE-407 — 92 sites, 42 ecosystems

B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.

defects/llvm/patch/llvm-0002-aliasset-memorylocations-denseset.patch

@@ -0,0 +1,69 @@
+diff --git a/llvm/include/llvm/Analysis/AliasSetTracker.h b/llvm/include/llvm/Analysis/AliasSetTracker.h
+index a1b2c3d..b4e5f6a 100644
+--- a/llvm/include/llvm/Analysis/AliasSetTracker.h
++++ b/llvm/include/llvm/Analysis/AliasSetTracker.h
+@@ -13,6 +13,7 @@
+ #ifndef LLVM_ANALYSIS_ALIASSETTRACKER_H
+ #define LLVM_ANALYSIS_ALIASSETTRACKER_H
+
++#include "llvm/ADT/DenseSet.h"
+ #include "llvm/ADT/DenseMap.h"
+ #include "llvm/ADT/ilist.h"
+ #include "llvm/ADT/ilist_node.h"
+@@ -52,8 +53,8 @@ class AliasSet : public ilist_node<AliasSet> {
+   // Forwarding pointer.
+   AliasSet *Forward = nullptr;
+
+-  /// Memory locations in this alias set.
+-  SmallVector<MemoryLocation, 0> MemoryLocs;
++  /// Memory locations in this alias set.  CWE-407 fix: DenseSet for O(1)
++  /// membership test; replaces SmallVector whose is_contained was O(N).
++  DenseSet<MemoryLocation> MemoryLocs;
+
+   /// All instructions without a specific address in this alias set.
+   std::vector<AssertingVH<Instruction>> UnknownInsts;
+@@ -119,8 +120,9 @@ public:
+
+   // Alias Set iteration - Allow access to all of the memory locations which are
+   // part of this alias set.
+-  using iterator = SmallVectorImpl<MemoryLocation>::const_iterator;
+-  iterator begin() const { return MemoryLocs.begin(); }
+-  iterator end() const { return MemoryLocs.end(); }
++  using iterator = DenseSet<MemoryLocation>::const_iterator;
++  iterator begin() const { return MemoryLocs.begin(); }
++  iterator end()   const { return MemoryLocs.end(); }
+
+   unsigned size() const { return MemoryLocs.size(); }
+
+diff --git a/llvm/lib/Analysis/AliasSetTracker.cpp b/llvm/lib/Analysis/AliasSetTracker.cpp
+index 295e267..f1a2b3c 100644
+--- a/llvm/lib/Analysis/AliasSetTracker.cpp
++++ b/llvm/lib/Analysis/AliasSetTracker.cpp
+@@ -62,9 +62,9 @@ void AliasSet::mergeSetIn(AliasSet &AS, AliasSetTracker &AST,
+
+   // Merge the list of constituent memory locations...
+   if (MemoryLocs.empty()) {
+-    std::swap(MemoryLocs, AS.MemoryLocs);
++    MemoryLocs = std::move(AS.MemoryLocs);
++    AS.MemoryLocs.clear();
+   } else {
+-    append_range(MemoryLocs, AS.MemoryLocs);
++    MemoryLocs.insert(AS.MemoryLocs.begin(), AS.MemoryLocs.end());
+     AS.MemoryLocs.clear();
+   }
+
+@@ -119,7 +119,7 @@ void AliasSet::addMemoryLocation(AliasSetTracker &AST,
+   // If we cannot find a must-alias with any of the existing MemoryLocs, we
+   // upgrade the alias lattice to may-alias.
+   ...
+-  MemoryLocs.push_back(MemLoc);
++  MemoryLocs.insert(MemLoc);
+ }
+
+@@ -275,7 +275,8 @@ AliasSet &AliasSetTracker::getAliasSetFor(const MemoryLocation &MemLoc) {
+   if (MapEntry) {
+     collapseForwardingIn(MapEntry);
+-    if (is_contained(MapEntry->MemoryLocs, MemLoc))  // O(N) — CWE-407
++    if (MapEntry->MemoryLocs.count(MemLoc))          // CWE-407 fix: O(1)
+       return *MapEntry;
+   }

defects/llvm/patch/llvm-0003-lcssa-exitblocks-smallptrset.patch

@@ -0,0 +1,49 @@
+diff --git a/llvm/lib/Transforms/Utils/LCSSA.cpp b/llvm/lib/Transforms/Utils/LCSSA.cpp
+index 1a2b3c4..2d3e4f5 100644
+--- a/llvm/lib/Transforms/Utils/LCSSA.cpp
++++ b/llvm/lib/Transforms/Utils/LCSSA.cpp
+@@ -65,9 +65,12 @@ static cl::opt<bool, true>
+                        cl::desc("Verify loop lcssa form (time consuming)"));
+
+ /// Return true if the specified block is in the list.
++// CWE-407 fix: caller now passes a SmallPtrSet for O(1) membership instead of
++// a SmallVectorImpl whose is_contained was O(X) per use in the worklist loop.
+ static bool isExitBlock(BasicBlock *BB,
+-                        const SmallVectorImpl<BasicBlock *> &ExitBlocks) {
+-  return is_contained(ExitBlocks, BB);
++                        const SmallPtrSetImpl<BasicBlock *> &ExitBlockSet) {
++  return ExitBlockSet.count(BB);  // CWE-407 fix: O(1)
+ }
+
+ // Cache the Loop ExitBlocks computed during the analysis.  We expect to get a
+@@ -74,7 +77,9 @@ static bool isExitBlock(BasicBlock *BB,
+ // expensive, and we're not mutating the loop structure.
+-using LoopExitBlocksTy = SmallDenseMap<Loop *, SmallVector<BasicBlock *, 1>>;
++// CWE-407 fix: store both a vector (for iteration) and a set (for O(1) lookup).
++using LoopExitVecTy = SmallVector<BasicBlock *, 1>;
++using LoopExitSetTy = SmallPtrSet<BasicBlock *, 4>;
++using LoopExitBlocksTy = SmallDenseMap<Loop *, std::pair<LoopExitVecTy, LoopExitSetTy>>;
+
+ /// For every instruction from the worklist, check to see if it has any uses
+ /// that are outside the current loop.  If so, insert LCSSA PHI nodes and
+@@ -97,13 +103,17 @@ formLCSSAForInstructionsImpl(SmallVectorImpl<Instruction *> &Worklist,
+     auto [It, Inserted] = LoopExitBlocks.try_emplace(L);
+     if (Inserted)
+-      L->getExitBlocks(It->second);
+-    const SmallVectorImpl<BasicBlock *> &ExitBlocks = It->second;
++    {
++      L->getExitBlocks(It->second.first);
++      It->second.second.insert(It->second.first.begin(),
++                               It->second.first.end());
++    }
++    const LoopExitVecTy          &ExitBlocks    = It->second.first;
++    const SmallPtrSetImpl<BasicBlock *> &ExitBlockSet = It->second.second;
+
+     if (ExitBlocks.empty())
+       continue;
+@@ -225,7 +235,7 @@ formLCSSAForInstructionsImpl(SmallVectorImpl<Instruction *> &Worklist,
+       if (isa<PHINode>(UserBB->begin()) && isExitBlock(UserBB, ExitBlocks)) {
++      if (isa<PHINode>(UserBB->begin()) && isExitBlock(UserBB, ExitBlockSet)) {
+         UseToRewrite->set(&UserBB->front());
+         continue;
+       }