engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave17: 562/240 — vim/qemu/tcl/nodejs/bun/httpd-0002/systemd/emacs

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 20:28:18 -04:00
parent cce7ec653a
commit dde5ec97fb
13 changed files with 887 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
whitepaper/MD5SUMS
View file

@ -1 +1 @@
23db78fa9ca0171f5fa538cd55c8edcc undefect-cwe407-2026-03-27.pdf
a9c25bdb641869cf10577f5c2d9e23fa undefect-cwe407-2026-03-27.pdf

9
whitepaper/full-paper.md
View file

@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint.
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 559 validated
elegant solutions inspire elegant variations. The process of generating 562 validated
defect patches across 240 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
query optimizer, and browser runtime.
**559 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
**562 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
3 unpatched (Minecraft, Create mod). No language left behind.
@ -642,6 +642,7 @@ stacks, Spark schemas — this is the dominant build cost.
| bazel-0002 | Bazel | `analysis/AspectCollection.java:294` — `deps.keySet()` full iteration grows per step in `create()` double loop; O(n²) per dependency edge | **PATCHED** |
| odl-0001 | OpenDaylight | `frm/impl/DevicesGroupRegistry.java:21` — `ArrayList<Uint32>.contains()` in group reconciliation loop; fires every switch connect/reconnect | **PATCHED** |
| httpd-0001 | Apache httpd | `modules/proxy/mod_proxy_balancer.c:216,542` — `strcmp` scan over worker array per sticky-session request; O(W) per request | **PATCHED** |
| httpd-0002 | Apache httpd | `modules/proxy/mod_proxy.c` — `set_proxy_exclude`/`set_proxy_dirconn` linear dedup scan per `NoProxy`/`ProxyDirectConnect` directive at config parse; O(N²); fix: `apr_hash_t` (249×) | **PATCHED** |
| kicad-0001 | KiCad | `pcbnew/connectivity/from_to_cache.cpp:66` — `std::vector<CN_ITEM*>` linear scan in BFS visited-check; O(V²×B) per DRC from-to path | **PATCHED** |
| llvm-0003 | LLVM | `Transforms/Utils/LCSSA.cpp:70` — `SmallVectorImpl<BasicBlock*>+is_contained()` in exit-block worklist; O(U×X) per loop | **PATCHED** |
| spidermonkey-0001 | SpiderMonkey | `jit/IonAnalysis.cpp:~1997` — `Vector<LinearTerm,2>` linear scan in `LinearSum::add()`; O(N×T) Ion bounds-check elimination | **PATCHED** |
@ -718,6 +719,8 @@ stacks, Spark schemas — this is the dominant build cost.
| zookeeper-0002 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — second ACL dedup path per znode operation | **PATCHED** |
| zookeeper-0003 | Apache ZooKeeper | `server/PrepRequestProcessor.java` — third ACL dedup path; all share root cause comment `// TODO: Use set` | **PATCHED** |
| pip-0001 | pip | `pip/_internal/cache.py` — `Wheel.support_index_min()` O(n×T) linear tag scan per wheel candidate; fix: `dict<tag, index>` (65×) | **PATCHED** |
| nodejs-0001 | Node.js | `lib/internal/modules/cjs/loader.js:1408` — `Module._resolveFilename` nested loops over `options.paths` × `lookupPaths` with `ArrayPrototypeIncludes` on growing array; O(P²×L²); fix: companion `Set` (249×) | **PATCHED** |
| bun-0001 | Bun | `src/resolver/resolver.zig:4041` — `dirInfoUncached` deduplicates `bin_folders` via constSlice linear scan; O(D²) per resolve; fix: `StringHashMap` (99×) | **PATCHED** |
| gradle-0001 | Gradle | `subprojects/cli/` — `OptionReader` `CollectionUtils.toList().contains()` rebuilt per method-option pair; O(M×O²) | **PATCHED** |
| gradle-0002 | Gradle | `dependency-management/.../NodeState.java:77,674` — `incomingEdges ArrayList<EdgeState>.contains()` O(E) in `addIncomingEdge()` called O(E) times per node; O(E²) dependency graph resolution; fix: `LinkedHashSet` (249×) | **PATCHED** |
| groovy-0001 | Groovy | `stc/StaticTypeCheckingVisitor.java:3205` — `collectedNames ArrayList<String>.contains()` O(C) per entry in named-param annotation check; O(E×C) per static type check; fix: `HashSet` (500×) | **PATCHED** |
@ -835,7 +838,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.
**559 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
**562 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
---

BIN
whitepaper/undefect-cwe407-2026-03-27.pdf
View file

Binary file not shown.