578/240 — rustc-0004/vertx-0001/asterisk-0003/bitcoin-0001/actix-web-0003/hazelcast-0001+0002/rabbitmq-0005/nginx-0003/haproxy-0003/envoy-0003/istio-0003

defects/gdb/patch/gdb-CLEAN.md

@@ -0,0 +1,17 @@
+# GDB — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-27
+**Repo:** https://sourceware.org/git/binutils-gdb.git
+**Files scanned:** gdb/breakpoint.c, gdb/symtab.c, gdb/objfiles.c, gdb/dwarf2/read.c, gdb/varobj.c, gdb/value.c, gdb/linespec.c, gdb/solib-svr4.c
+
+## Findings
+
+No CWE-407 defects found.
+
+### Notes
+
+- `all_bp_locations()` is a sorted `std::vector<bp_location*>` with binary-search lookup (`std::equal_range`) for address queries — O(log N).
+- `filename_seen_cache` uses `gdb::unordered_set` throughout — O(1) membership.
+- `gdb/dwarf2/read.c` (18K lines) uses hash tables for symbol deduplication — no linear membership inside loops.
+- Individual `std::find` calls in `varobj.c`, `value.c`, `progspace.c` are one-time non-loop lookups — not CWE-407.
+- `solib-svr4.c` `glibc_tls_slots` linear scans are bounded (small constant number of TLS-bearing shared libraries in practice).