engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 92 sites, 42 ecosystems

Browse source 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
This commit is contained in:
russell@unturf.com 2026-03-26 19:48:18 -04:00
parent 0a580b313d
commit db29a08762
1311 changed files with 371202 additions and 1188 deletions
Download patch file Download diff file Expand all files Collapse all files

39
tools/scans/ant.sh Executable file
View file

@ -0,0 +1,39 @@
#!/usr/bin/env bash
# CWE-407 scan — Apache Ant (Java build tool)
# Old Java code (~2000s); high probability of ArrayList/Vector for visited sets
# Strategy: generic Java patterns — List.contains, ArrayList membership in loops
set -euo pipefail
echo "# scan=ant host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/apache/ant ant 2>&1 | tail -1
# O(n) membership patterns in Java
JAVA_MEM='\.contains\s*\(|\.indexOf\s*\(|Collections\.frequency\s*\('
# Loop constructs
JAVA_LOOP='for\s*\(|while\s*\(|\.forEach\s*\(|\.iterator\s*\('
for dir in \
src/main/org/apache/tools/ant \
src/main/org/apache/tools/ant/taskdefs \
src/main/org/apache/tools/ant/types; do
[ -d /tmp/ant/$dir ] || continue
echo "# roots: /tmp/ant/$dir"
find /tmp/ant/$dir -name "*.java" 2>/dev/null | sort | while IFS= read -r f; do
ml=$(grep -nE "$JAVA_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
# Only flag if context mentions graph/dag/dep/order/sort/visit/cycle/topo
graph_hit=$(echo "$ctx" | grep -iE 'graph|depend|topo|visit|cycle|dag|sort|stack|order|reachab|ancestor|transit' | head -1 | sed 's/^\s*//' || true)
[ -z "$graph_hit" ] && continue
loop_hit=$(echo "$ctx" | grep -iE "$JAVA_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
done
echo "# scan complete"

20
tools/scans/apache2.sh Executable file
View file

@ -0,0 +1,20 @@
#!/usr/bin/env bash
# CWE-407 scan — Apache httpd (module graph, proxy balancer)
set -euo pipefail
echo "# scan=apache2 host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/apache/httpd apache2 2>&1 | tail -1
GRAPH_KW="topolog\|cycle\b\|reachab\|dependency\|dfs\b\|module.*order\|order.*module\|load.*order\|balancer.*node"
C_MEM='apr_array_push.*==\|for.*elts\|ap_find_linked_module\|linear\|ap_array_.*find\|module.*contains'
echo "# roots: /tmp/apache2/server /tmp/apache2/modules"
find /tmp/apache2/server /tmp/apache2/modules -name "*.c" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

25
tools/scans/bazel.sh Executable file
View file

@ -0,0 +1,25 @@
#!/usr/bin/env bash
# CWE-407 scan — Bazel build system (dependency graph, SkyFrame, action graph)
set -euo pipefail
echo "# scan=bazel host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/bazelbuild/bazel bazel 2>&1 | tail -1
GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|dependency|tarjan|postorder|graph"
JAVA_MEM='ArrayList.*contains|List.*contains|\.indexOf[(]|LinkedList.*contains|new ArrayList.*visited|new ArrayList.*stack|ImmutableList.*contains'
for dir in src/main/java/com/google/devtools/build/lib/graph \
src/main/java/com/google/devtools/build/lib/skyframe \
src/main/java/com/google/devtools/build/lib/packages; do
[ -d /tmp/bazel/$dir ] || continue
echo "# roots: /tmp/bazel/$dir"
find /tmp/bazel/$dir -name "*.java" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$JAVA_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

23
tools/scans/bird.sh Executable file
View file

@ -0,0 +1,23 @@
#!/usr/bin/env bash
# CWE-407 scan — BIRD Internet Routing Daemon (BGP, OSPF, IS-IS, RIP)
set -euo pipefail
echo "# scan=bird host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://gitlab.nic.cz/labs/bird bird 2>&1 | tail -1
GRAPH_KW="shortest.path|dijkstra|spf\b|scc\b|topolog|cycle|reachab|path.find|dfs\b|bfs\b|strongly.connected|next.hop"
C_MEM='node_find|list_walk|WALK_LIST|WALK_TLIST|linear_search|find.*next|chain.*next.*next|loop.*->next.*->next'
for proto in proto/ospf proto/bgp proto/isis proto/rip nest; do
[ -d /tmp/bird/$proto ] || continue
echo "# roots: /tmp/bird/$proto"
find /tmp/bird/$proto -name "*.c" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

61
tools/scans/bundler.sh Executable file
View file

@ -0,0 +1,61 @@
#!/usr/bin/env bash
# CWE-407 scan — Bundler (Ruby gem dependency resolver)
# Uses Molinillo solver; dependency graph resolution with visited tracking
# Strategy: Ruby membership patterns (include?, member?, Array#include?) in graph context
set -euo pipefail
echo "# scan=bundler host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/rubygems/rubygems rubygems 2>&1 | tail -1
# bundler is inside rubygems
BUNDLER=/tmp/rubygems/bundler
[ -d "$BUNDLER" ] || { echo "ERROR: bundler dir not found"; exit 1; }
# O(n) membership patterns in Ruby
RUBY_MEM='\.include\?\s*\(|\.member\?\s*\(|Array#include|\.index\s*\(|\bin\s+\[|\bselect\b.*==\b'
# Loop constructs
RUBY_LOOP='\.each\s*\{|\.each\s*do\s*\||while\s+|for\s+.*in\s+|\.map\s*\{|\.reduce\s*\{'
for dir in \
lib/bundler \
lib/bundler/resolver \
lib/bundler/graph; do
[ -d "$BUNDLER/$dir" ] || [ -d "/tmp/rubygems/$dir" ] && target_dir="/tmp/rubygems/$dir" || continue
[ -d "/tmp/rubygems/$dir" ] || continue
echo "# roots: /tmp/rubygems/$dir"
find /tmp/rubygems/$dir -name "*.rb" 2>/dev/null | sort | while IFS= read -r f; do
ml=$(grep -nE "$RUBY_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
graph_hit=$(echo "$ctx" | grep -iE 'graph|depend|topo|visit|cycle|dag|sort|stack|order|reachab|ancestor|transit|resolver|package|gem' | head -1 | sed 's/^\s*//' || true)
[ -z "$graph_hit" ] && continue
loop_hit=$(echo "$ctx" | grep -iE "$RUBY_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
done
# Also scan Molinillo (bundler's solver) directly
echo "# roots: molinillo lib"
cd /tmp && git clone --depth 1 https://github.com/CocoaPods/Molinillo molinillo 2>&1 | tail -1
find /tmp/molinillo/lib -name "*.rb" 2>/dev/null | sort | while IFS= read -r f; do
ml=$(grep -nE "$RUBY_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
loop_hit=$(echo "$ctx" | grep -iE "$RUBY_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
echo "# scan complete"

39
tools/scans/composer.sh Executable file
View file

@ -0,0 +1,39 @@
#!/usr/bin/env bash
# CWE-407 scan — Composer (PHP package manager)
# Large PHP ecosystem; dep solver uses topological sort and cycle detection
# Strategy: PHP membership patterns in graph/dep/solver context
set -euo pipefail
echo "# scan=composer host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/composer/composer composer 2>&1 | tail -1
# O(n) membership patterns in PHP
PHP_MEM='in_array\s*\(|array_search\s*\(|\barray_key_exists\s*\('
# Loop constructs
PHP_LOOP='foreach\s*\(|for\s*\(|while\s*\('
for dir in \
src/Composer/DependencyResolver \
src/Composer/Package \
src/Composer/Repository \
src/Composer/Util; do
[ -d /tmp/composer/$dir ] || continue
echo "# roots: /tmp/composer/$dir"
find /tmp/composer/$dir -name "*.php" 2>/dev/null | sort | while IFS= read -r f; do
ml=$(grep -nE "$PHP_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
graph_hit=$(echo "$ctx" | grep -iE 'graph|depend|topo|visit|cycle|dag|sort|stack|order|reachab|ancestor|transit|package|solver|pool' | head -1 | sed 's/^\s*//' || true)
[ -z "$graph_hit" ] && continue
loop_hit=$(echo "$ctx" | grep -iE "$PHP_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
done
echo "# scan complete"

39
tools/scans/duckdb.sh Executable file
View file

@ -0,0 +1,39 @@
#!/usr/bin/env bash
# CWE-407 scan — DuckDB (analytical in-process database)
# C++ query optimizer with join ordering, expression analysis, DAG execution
# Strategy: C++ membership patterns (std::find, .count() on vector) in graph/plan context
set -euo pipefail
echo "# scan=duckdb host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/duckdb/duckdb duckdb 2>&1 | tail -1
# O(n) membership: std::find on vector, or .count() on std::map (O(log n) but worth flagging)
CPP_MEM='std::find\s*\(|\.find\s*\(.*\.end\s*\(\)|vector.*\.count\s*\(|\bfind_if\s*\('
# Loop constructs
CPP_LOOP='for\s*\(|while\s*\(|for\s*\(auto\b'
for dir in \
src/optimizer \
src/planner \
src/execution \
src/common/graph; do
[ -d /tmp/duckdb/$dir ] || continue
echo "# roots: /tmp/duckdb/$dir"
find /tmp/duckdb/$dir -name "*.cpp" -o -name "*.hpp" 2>/dev/null | sort | while IFS= read -r f; do
ml=$(grep -nE "$CPP_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
graph_hit=$(echo "$ctx" | grep -iE 'graph|depend|topo|visit|cycle|dag|sort|stack|order|reachab|ancestor|transit|join|plan' | head -1 | sed 's/^\s*//' || true)
[ -z "$graph_hit" ] && continue
loop_hit=$(echo "$ctx" | grep -iE "$CPP_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
done
echo "# scan complete"

22
tools/scans/exabgp.sh Executable file
View file

@ -0,0 +1,22 @@
#!/usr/bin/env bash
# CWE-407 scan — ExaBGP (Python BGP implementation)
# Network mode: semitrusted
set -euo pipefail
echo "# scan=exabgp host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/Exa-Networks/exabgp exabgp 2>&1 | tail -1
GRAPH_KW="loop|cycle|path|route|reachab|topolog|dfs\b|scc\b|visit"
PY_MEM="[^a-z]in (path|stack|visited|seen|queue|aspath|peers)\b|not in (path|stack|visited)\b|\.index\b|list\.append.*\bin "
echo "# roots: /tmp/exabgp/src"
find /tmp/exabgp/src -name "*.py" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$PY_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

22
tools/scans/frr-tilfa-detail.sh Executable file
View file

@ -0,0 +1,22 @@
#!/usr/bin/env bash
set -euo pipefail
cd /tmp && git clone --depth 1 https://github.com/FRRouting/frr frr 2>/dev/null
echo "=== ospf_ti_lfa.c:260-300 ==="
sed -n '260,310p' frr/ospfd/ospf_ti_lfa.c
echo ""
echo "=== listnode_lookup definition ==="
grep -n "listnode_lookup" frr/lib/linklist.h frr/lib/linklist.c 2>/dev/null | head -10
echo ""
echo "=== all listnode_lookup in ospf_ti_lfa ==="
grep -n "listnode_lookup" frr/ospfd/ospf_ti_lfa.c
echo ""
echo "=== bgpd/bgp_aspath.c loop detection ==="
grep -n "aspath_loop\|loop_check\|as_in\|own_as\|my_as\|confed" frr/bgpd/bgp_aspath.c | head -20
echo ""
echo "=== bgp aspath loop check implementation ==="
grep -n "aspath_loop_check\|aspath_private_as_check" frr/bgpd/bgp_aspath.c | head -5

25
tools/scans/frrouting.sh Executable file
View file

@ -0,0 +1,25 @@
#!/usr/bin/env bash
# CWE-407 scan — FRRouting (ospfd, bgpd, isisd, ldpd)
# Network mode: semitrusted (requires git clone)
set -euo pipefail
echo "# scan=frrouting host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/FRRouting/frr frr 2>&1 | tail -1
GRAPH_KW="shortest.path|dijkstra|spf\b|scc\b|topolog|cycle|reachab|path.find|dfs\b|bfs\b|strongly.connected"
C_MEM="listnode_lookup|list_lookup|listnode_add_sort|list_search|for.*->next.*->next|linear_search|aspath_loop_check|as_in_path|contain.*asn"
for daemon in ospfd bgpd isisd ldpd; do
[ -d /tmp/frr/$daemon ] || continue
echo "# roots: /tmp/frr/$daemon"
find /tmp/frr/$daemon -name "*.c" -o -name "*.h" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

39
tools/scans/gnu-octave.sh Executable file
View file

@ -0,0 +1,39 @@
#!/usr/bin/env bash
# CWE-407 scan — GNU Octave (graph toolbox, sparse, dep resolver)
set -euo pipefail
echo "# scan=gnu-octave host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/gnu-octave/octave octave 2>&1 | tail -1
GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|tarjan|graph|shortest.path|spanning"
C_MEM='std::find[(]|\.count[(].*==|find.*begin.*end|linear_search|vector.*find|std::list.*find'
M_MEM='ismember\b|find(.*==.*)\b|any(.*==.*)\b'
# C++ sources
for dir in liboctave/util liboctave/array scripts/graph; do
[ -d /tmp/octave/$dir ] || continue
echo "# roots: /tmp/octave/$dir"
find /tmp/octave/$dir -name "*.cc" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
# .m scripts
for dir in scripts scripts/graph; do
[ -d /tmp/octave/$dir ] || continue
find /tmp/octave/$dir -name "*.m" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$M_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

23
tools/scans/kicad.sh Executable file
View file

@ -0,0 +1,23 @@
#!/usr/bin/env bash
# CWE-407 scan — KiCad EDA (netlist, ratsnest, DRC connectivity graph)
set -euo pipefail
echo "# scan=kicad host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://gitlab.com/kicad/code/kicad kicad 2>&1 | tail -1
GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|ratsnest|connectivity|netlist|graph"
C_MEM='std::find[(]|\.count[(].*==|find.*begin.*end|linear_search|vector.*find|std::list.*find|SEARCH_RESULT'
for dir in pcbnew/connectivity eeschema/netlist_exporters common; do
[ -d /tmp/kicad/$dir ] || continue
echo "# roots: /tmp/kicad/$dir"
find /tmp/kicad/$dir -name "*.cpp" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

20
tools/scans/memcached.sh Executable file
View file

@ -0,0 +1,20 @@
#!/usr/bin/env bash
# CWE-407 scan — Memcached (connection/item graph, consistent hash ring)
set -euo pipefail
echo "# scan=memcached host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/memcached/memcached memcached 2>&1 | tail -1
GRAPH_KW="topolog|cycle|graph|reachab|consistent.hash|ring|node.*next|chain|slab.*chain"
C_MEM='linear_search|find_item_locked|item_get_locked|STAILQ_FOREACH.*==|TAILQ_FOREACH.*==|for.*->next.*==.*->next'
echo "# roots: /tmp/memcached"
find /tmp/memcached -name "*.c" -o -name "*.h" 2>/dev/null | grep -v t/ | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

23
tools/scans/mysql.sh Executable file
View file

@ -0,0 +1,23 @@
#!/usr/bin/env bash
# CWE-407 scan — MySQL Server (optimizer, graph, dependency resolution)
set -euo pipefail
echo "# scan=mysql host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/mysql/mysql-server mysql 2>&1 | tail -1
GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|dependency|graph|tarjan|postorder"
C_MEM='std::find[(]|\.count[(]|list_search|find.*begin.*end|linear_search|List_iterator.*find|std::list.*find'
for dir in sql storage/innobase; do
[ -d /tmp/mysql/$dir ] || continue
echo "# roots: /tmp/mysql/$dir"
find /tmp/mysql/$dir -name "*.cc" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

22
tools/scans/networkx.sh Executable file
View file

@ -0,0 +1,22 @@
#!/usr/bin/env bash
# CWE-407 scan — NetworkX (Python graph library)
# Network mode: semitrusted
set -euo pipefail
echo "# scan=networkx host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/networkx/networkx networkx 2>&1 | tail -1
GRAPH_KW="tarjan|strongly.connected|dfs\b|scc\b|topolog|cycle|reachab|postorder|dominator|digraph|shortest.path"
PY_MEM="[^a-z]in (path|stack|visited|seen|queue|ancestors)\b|not in (path|stack|visited)\b|path\.index\b|stack\.index\b"
echo "# roots: /tmp/networkx/networkx/algorithms"
find /tmp/networkx/networkx/algorithms -name "*.py" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$PY_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

20
tools/scans/nginx.sh Executable file
View file

@ -0,0 +1,20 @@
#!/usr/bin/env bash
# CWE-407 scan — nginx (resolver CNAME chains, upstream graph)
set -euo pipefail
echo "# scan=nginx host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/nginx/nginx nginx 2>&1 | tail -1
GRAPH_KW="cycle\b|reachab\|topolog\|cname.*chain\|chain.*cname\|upstream.*graph\|dependency\|dfs\b\|visited"
C_MEM='ngx_array_push.*==\|for.*elts\|ngx_str_set.*find\|linear\|ngx_list_push.*==\b'
echo "# roots: /tmp/nginx/src"
find /tmp/nginx/src -name "*.c" -o -name "*.h" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

25
tools/scans/onos.sh Executable file
View file

@ -0,0 +1,25 @@
#!/usr/bin/env bash
# CWE-407 scan — ONOS SDN Controller (topology, routing, link graph)
set -euo pipefail
echo "# scan=onos host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/opennetworkinglab/onos onos 2>&1 | tail -1
GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|dijkstra|shortest.path|spanning.tree|tarjan"
JAVA_MEM='ArrayList.*contains|List.*contains|\.indexOf[(]|LinkedList.*contains|new ArrayList.*visited|new ArrayList.*stack|List<.*>.*stack'
for dir in core/api/src/main/java/org/onosproject/net \
core/net/src/main/java/org/onosproject/net \
apps/routing; do
[ -d /tmp/onos/$dir ] || continue
echo "# roots: /tmp/onos/$dir"
find /tmp/onos/$dir -name "*.java" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$JAVA_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

24
tools/scans/opendaylight.sh Executable file
View file

@ -0,0 +1,24 @@
#!/usr/bin/env bash
# CWE-407 scan — OpenDaylight MD-SAL (topology, graph, dependency)
set -euo pipefail
echo "# scan=opendaylight host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/opendaylight/mdsal mdsal 2>&1 | tail -1
cd /tmp && git clone --depth 1 https://github.com/opendaylight/bgpcep bgpcep 2>&1 | tail -1
GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|dijkstra|shortest.path|tarjan|graph"
JAVA_MEM='ArrayList.*contains|List.*contains|\.indexOf[(]|LinkedList.*contains|new ArrayList.*visited|new ArrayList.*stack|List<.*>.*stack'
for repo in mdsal bgpcep; do
[ -d /tmp/$repo ] || continue
echo "# roots: /tmp/$repo"
find /tmp/$repo -name "*.java" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$JAVA_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

22
tools/scans/php-zend.sh Executable file
View file

@ -0,0 +1,22 @@
#!/usr/bin/env bash
# CWE-407 scan — PHP Zend Engine (CFG, DFG, SSA, OPcache optimizer)
set -euo pipefail
echo "# scan=php-zend host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/php/php-src php-src 2>&1 | tail -1
GRAPH_KW="cfg\b|dfg\b|ssa\b|dominator|liveness|reachab|topolog|cycle|dfs\b|scc\b|postorder|strongly.connected|basic.block|dataflow"
C_MEM='std::find[(]|linear_search|zend_bitset_in\b|in_list\b|zend_llist_.*find|ZEND_HASH_FOREACH.*==|zend_linked_list'
for dir in Zend "ext/opcache/Optimizer"; do
echo "# roots: /tmp/php-src/$dir"
find /tmp/php-src/$dir -name "*.c" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

41
tools/scans/postgresql.sh Executable file
View file

@ -0,0 +1,41 @@
#!/usr/bin/env bash
# CWE-407 scan — PostgreSQL query planner and executor
# PostgreSQL uses its own list API: list_member(), foreach()/lfirst(), lappend()
# Strategy: lead with pg-specific O(n) membership calls, check ±20 lines for loop context.
set -euo pipefail
echo "# scan=postgresql host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/postgres/postgres postgres 2>&1 | tail -1
# O(n) membership patterns in PostgreSQL's list API
PG_MEM='list_member\b|list_member_ptr\b|list_member_int\b|list_member_oid\b|list_member_xid\b'
# Loop constructs that would make the above O(n²)
PG_LOOP='foreach\b|for\s*\(.*List\|while\s*\(.*List\|do\s*{.*List'
for dir in \
src/backend/optimizer \
src/backend/nodes \
src/backend/rewrite \
src/backend/executor \
src/backend/parser \
src/backend/planner; do
[ -d /tmp/postgres/$dir ] || continue
echo "# roots: /tmp/postgres/$dir"
find /tmp/postgres/$dir -name "*.c" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
# Find all list_member* call sites
ml=$(grep -nE "$PG_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
# Emit candidate if a loop construct appears in the same ±20-line window
loop_hit=$(echo "$ctx" | grep -iE "$PG_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE ${f}:${ln} ${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
done
echo "# scan complete"

20
tools/scans/redis.sh Executable file
View file

@ -0,0 +1,20 @@
#!/usr/bin/env bash
# CWE-407 scan — Redis (cluster topology, module graph)
set -euo pipefail
echo "# scan=redis host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/redis/redis redis 2>&1 | tail -1
GRAPH_KW="topolog|reachab|cluster.*path|path.*cluster|cycle|dfs\b|scc\b|strongly.connected|dependency|failover|slot.*migrat"
C_MEM='listSearchKey\|listNodeValue\|listIndex\|listRotate\|for.*next\b.*->next\b|linear.*search\|listTypeGet'
echo "# roots: /tmp/redis/src"
find /tmp/redis/src -name "*.c" -o -name "*.h" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

39
tools/scans/sbt.sh Executable file
View file

@ -0,0 +1,39 @@
#!/usr/bin/env bash
# CWE-407 scan — sbt (Scala Build Tool)
# Scala/Java build tool; uses Ivy for dep resolution and has its own DAG execution
# Strategy: Scala/Java membership patterns in graph/dep/task context
set -euo pipefail
echo "# scan=sbt host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/sbt/sbt sbt 2>&1 | tail -1
# O(n) membership patterns — Scala and Java
SCALA_MEM='\.contains\s*\(|\.indexOf\s*\(|\.find\s*\(_\s*==|\.exists\s*\(_\s*==|\bcontains\b'
# Loop/traversal constructs
SCALA_LOOP='for\s*\(|\.foreach\s*\(|\.foldLeft\s*\(|\.map\s*\(|while\s*\(|\.flatMap\s*\('
for dir in \
main/src/main/scala \
compile/src/main/scala \
tasks/src/main/scala \
librarymanagement; do
[ -d /tmp/sbt/$dir ] || continue
echo "# roots: /tmp/sbt/$dir"
find /tmp/sbt/$dir -name "*.scala" -o -name "*.java" 2>/dev/null | sort | while IFS= read -r f; do
ml=$(grep -nE "$SCALA_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
graph_hit=$(echo "$ctx" | grep -iE 'graph|depend|topo|visit|cycle|dag|sort|stack|order|reachab|ancestor|transit|scc|task' | head -1 | sed 's/^\s*//' || true)
[ -z "$graph_hit" ] && continue
loop_hit=$(echo "$ctx" | grep -iE "$SCALA_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
done
echo "# scan complete"

28
tools/scans/spidermonkey.sh Executable file
View file

@ -0,0 +1,28 @@
#!/usr/bin/env bash
# CWE-407 scan — SpiderMonkey JS engine (IonMonkey compiler, CFG, SCC)
set -euo pipefail
echo "# scan=spidermonkey host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
# Sparse clone of gecko-dev — only js/src
cd /tmp
git clone --depth 1 --filter=blob:none --sparse \
https://github.com/mozilla/gecko-dev geckosrc 2>&1 | tail -1
cd geckosrc
git sparse-checkout set js/src 2>&1 | tail -1
SMROOT=/tmp/geckosrc/js/src
GRAPH_KW="topolog|scc\b|strongly.connected|cycle|dfs\b|postorder|dominator|liveness|reachab|tarjan|register.alloc|ion\b"
C_MEM='std::find[(]|\.Contains[(]|IsInVector\b|vector.*find\b|linear_search|Vector.*Contains|NodeVector.*find'
[ -d "$SMROOT" ] || { echo "# ERROR: SpiderMonkey source not found"; exit 0; }
echo "# roots: $SMROOT"
find "$SMROOT" -name "*.cpp" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

58
tools/scans/sqlite.sh Executable file
View file

@ -0,0 +1,58 @@
#!/usr/bin/env bash
# CWE-407 scan — SQLite query planner and optimizer
# SQLite uses array-backed list types: ExprList, SrcList, IdList
# Membership via linear loops: for(i=0; i<pList->n; i++) + equality
# Strategy: lead with known O(n) scan patterns, check ±20 lines for outer loop.
set -euo pipefail
echo "# scan=sqlite host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/sqlite/sqlite sqlite 2>&1 | tail -1
# O(n) membership patterns: linear scans over SQLite list types
# - sqlite3ExprListFind: linear scan returning index
# - loops over nExpr/nSrc/nId with equality/comparison inside
SQ_MEM='sqlite3ExprListFind\b|sqlite3IdListIndex\b|for\s*\(.*->nExpr\b|for\s*\(.*->nSrc\b|for\s*\(.*->nId\b|while\s*\(.*->nExpr\b'
# Outer loop constructs that would make the above O(n²)
# Include both for-loop over list fields and recursive traversal
SQ_LOOP='for\s*\(.*pList\|for\s*\(.*pExpr\|for\s*\(.*pSrc\|for\s*\(.*->a\[|while\s*\(.*->a\[|sqlite3WalkExprList\b|sqlite3WalkSelectExpr\b'
for dir in \
src \
tool; do
[ -d /tmp/sqlite/$dir ] || continue
echo "# roots: /tmp/sqlite/$dir"
find /tmp/sqlite/$dir -name "*.c" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
ml=$(grep -nE "$SQ_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
[ -z "$ml" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
loop_hit=$(echo "$ctx" | grep -iE "$SQ_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
done
done
# Also scan the amalgamation for patterns missed in src/
# (some logic only exists in sqlite3.c after preprocessing)
echo "# roots: /tmp/sqlite/sqlite3.c (amalgamation)"
f=/tmp/sqlite/sqlite3.c
if [ -f "$f" ]; then
ml=$(grep -nE "$SQ_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
while IFS= read -r ln; do
[ -z "$ln" ] && continue
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
loop_hit=$(echo "$ctx" | grep -iE "$SQ_LOOP" | head -1 | sed 's/^\s*//' || true)
[ -n "$loop_hit" ] && {
mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
echo "CANDIDATE\t${f}:${ln}\t${mem_line} [loop: ${loop_hit}]"
}
done <<< "$ml"
fi
echo "# scan complete"

17
tools/scans/triage-exabgp.sh Executable file
View file

@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -euo pipefail
cd /tmp && git clone --depth 1 https://github.com/Exa-Networks/exabgp exabgp 2>/dev/null
echo "=== peer.py seen type ==="
grep -n "seen\s*=" exabgp/src/exabgp/reactor/api/command/peer.py | head -5
sed -n '95,110p' exabgp/src/exabgp/reactor/api/command/peer.py
echo "=== rib/cache.py index context ==="
sed -n '10,35p' exabgp/src/exabgp/rib/cache.py
echo "=== AS-path loop detection ==="
find exabgp/src -name "*.py" | xargs grep -l "loop\|as_path\|aspath" 2>/dev/null | head -5
grep -rn "in self\.\|in path\|in visited\|in seen" exabgp/src/exabgp/bgp/ 2>/dev/null | grep -v "\.pyc" | head -15
echo "=== frr ti_lfa context ==="
echo "needs separate submission"

16
tools/scans/triage-verilator.sh Executable file
View file

@ -0,0 +1,16 @@
#!/usr/bin/env bash
set -euo pipefail
cd /tmp && git clone --depth 1 https://github.com/verilator/verilator verilator 2>/dev/null
echo "=== V3ExecGraph.cpp:945-965 — schedule.contains type ==="
grep -n "schedule\b" verilator/src/V3ExecGraph.cpp | grep -v "//" | head -10
sed -n '945,970p' verilator/src/V3ExecGraph.cpp
echo ""
echo "=== V3Gate.cpp:710-730 — readVscps type ==="
grep -n "readVscps\s*[;=]" verilator/src/V3Gate.cpp | head -5
sed -n '710,735p' verilator/src/V3Gate.cpp
echo ""
echo "=== V3GraphAlg.cpp — SCC implementation type check ==="
grep -n "m_onStack\|m_visited\|m_seen\|pool<\|unordered_set\|std::set" verilator/src/V3GraphAlg.cpp 2>/dev/null | head -15

15
tools/scans/triage-verilator2.sh Executable file
View file

@ -0,0 +1,15 @@
#!/usr/bin/env bash
set -euo pipefail
cd /tmp && git clone --depth 1 https://github.com/verilator/verilator verilator 2>/dev/null
echo "=== ThreadSchedule::contains implementation ==="
grep -n "bool contains\|contains.*mtask\|contains.*ExecMTask" verilator/src/V3ExecGraph.cpp | head -10
grep -n "struct ThreadSchedule\|class ThreadSchedule" verilator/src/V3ExecGraph.cpp | head -5
echo ""
echo "=== ThreadSchedule struct ==="
awk '/struct ThreadSchedule|class ThreadSchedule/{found=1} found{print NR": "$0} /^};/{if(found){found=0}}' verilator/src/V3ExecGraph.cpp | head -40
echo ""
echo "=== V3Gate.cpp readVscps local type at line 722 ==="
sed -n '695,730p' verilator/src/V3Gate.cpp

5
tools/scans/triage-verilator3.sh Executable file
View file

@ -0,0 +1,5 @@
#!/usr/bin/env bash
set -euo pipefail
cd /tmp && git clone --depth 1 https://github.com/verilator/verilator verilator 2>/dev/null
echo "=== V3Gate.cpp:695-735 ==="
sed -n '695,735p' verilator/src/V3Gate.cpp

18
tools/scans/triage-yosys.sh Executable file
View file

@ -0,0 +1,18 @@
#!/usr/bin/env bash
set -euo pipefail
cd /tmp && git clone --depth 1 https://github.com/YosysHQ/yosys yosys 2>/dev/null
echo "=== scc.cc workQueue and cellLabels types ==="
grep -n "workQueue\|cellLabels" yosys/passes/cmds/scc.cc | head -20
echo ""
echo "=== scc.cc:40-100 ==="
sed -n '40,100p' yosys/passes/cmds/scc.cc
echo ""
echo "=== glift.cc:330-355 — ports vector + std::find context ==="
sed -n '330,355p' yosys/passes/cmds/glift.cc
echo ""
echo "=== does Yosys use pool<> (hash) vs std::set (tree)? ==="
grep -n "pool<\|dict<\|std::set<\|std::map<\|std::unordered" yosys/passes/cmds/scc.cc | head -10

23
tools/scans/v8.sh Executable file
View file

@ -0,0 +1,23 @@
#!/usr/bin/env bash
# CWE-407 scan — V8 JavaScript engine (compiler, CFG, register allocator)
set -euo pipefail
echo "# scan=v8 host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://chromium.googlesource.com/v8/v8 v8 2>&1 | tail -1
GRAPH_KW="topolog|scc\b|strongly.connected|cycle|dfs\b|postorder|dominator|liveness|reachab|tarjan|register.alloc|graph"
C_MEM='std::find[(]|\.Contains[(]|IsInSet\b|vector.*find\b|linear_search|ZoneVector.*Contains|NodeVector.*find|std::count[(]'
for dir in src/compiler src/codegen src/interpreter; do
[ -d /tmp/v8/$dir ] || continue
echo "# roots: /tmp/v8/$dir"
find /tmp/v8/$dir -name "*.cc" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

23
tools/scans/varnish.sh Executable file
View file

@ -0,0 +1,23 @@
#!/usr/bin/env bash
# CWE-407 scan — Varnish Cache (VCL compiler, backend graph)
set -euo pipefail
echo "# scan=varnish host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/varnishcache/varnish-cache varnish 2>&1 | tail -1
GRAPH_KW="topolog|cycle|reachab|dfs\b|scc\b|dominator|postorder|dependency|vcl.*graph|graph.*vcl"
C_MEM='VTAILQ_FOREACH.*==\|VSB_.*find\|for.*next.*next\b\|linear.*search\|vcc_.*find'
for dir in lib/libvcc bin/varnishd; do
[ -d /tmp/varnish/$dir ] || continue
echo "# roots: /tmp/varnish/$dir"
find /tmp/varnish/$dir -name "*.c" -o -name "*.h" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
done
echo "# scan complete"

22
tools/scans/verilator.sh Executable file
View file

@ -0,0 +1,22 @@
#!/usr/bin/env bash
# CWE-407 scan — Verilator (RTL hardware simulator, V3Graph)
# Network mode: semitrusted
set -euo pipefail
echo "# scan=verilator host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/verilator/verilator verilator 2>&1 | tail -1
GRAPH_KW="scc\b|tarjan|topolog|dfs\b|cycle|dominator|reachab|strongly.connected|liveness|postorder"
CPP_MEM='std::find[(]|[.]count[(]|find.*begin.*end|is_contained|linear_search|\.contains[(]'
echo "# roots: /tmp/verilator/src"
find /tmp/verilator/src -name "*.cpp" -o -name "*.h" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$CPP_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"

22
tools/scans/yosys.sh Executable file
View file

@ -0,0 +1,22 @@
#!/usr/bin/env bash
# CWE-407 scan — Yosys (open-source synthesis)
# Network mode: semitrusted
set -euo pipefail
echo "# scan=yosys host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/YosysHQ/yosys yosys 2>&1 | tail -1
GRAPH_KW="scc\b|tarjan|topolog|dfs\b|cycle|dominator|reachab|strongly.connected|liveness|postorder"
CPP_MEM='std::find[(]|[.]count[(]|find.*begin.*end|is_contained|linear_search|\.contains[(]'
echo "# roots: /tmp/yosys/kernel /tmp/yosys/passes"
find /tmp/yosys/kernel /tmp/yosys/passes -name "*.cc" -o -name "*.h" | sort | while IFS= read -r f; do
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
[ -z "$gl" ] && continue
while IFS= read -r ln; do
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$CPP_MEM" | head -1 | sed 's/^\s*//' || true)
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
done <<< "$gl"
done
echo "# scan complete"