wave17: postgres-0001/asterisk-0001/haproxy-0001/nginx-0001; postfix+bevy CLEAN

postgres-0001: pg_inherits.c typeInheritsFrom() BFS visited List → HTAB O(1)
asterisk-0001: app_queue.c interface_exists() ao2_iterator walk → ao2_find O(1)
haproxy-0001: http_ana.c cookie-server scan linked-list → eb-tree index O(log S)
nginx-0001: ngx_http_link_multi_headers() O(H²) double-scan → O(H) hash pass
postfix: CLEAN (htable throughout; two marginal LOW admin-bounded candidates)
bevy: CLEAN (FixedBitSet/HashSet throughout; only hardware-bounded marginals)
This commit is contained in:
russell@unturf.com 2026-03-30 07:57:30 -04:00
parent da8b4a41d6
commit ff6292d067
10 changed files with 627 additions and 252 deletions

View file

@ -0,0 +1,16 @@
# postfix — CLEAN
Scanned 2026-03-30. No CWE-407 defects warranting a patch.
Postfix systematically uses `htable` (hash table) for all hot-path membership
tests: `been_here()` for recipient dedup, `delivered_hdr_find()` for loop
detection, `qmgr_transport_find()` for transport lookup.
Two marginal candidates found, both LOW severity and admin-bounded:
- `src/qmgr/qmgr_message.c:1214`: O(R×T) defer_transports check — T is
admin-configured, not inflatable by remote senders.
- `src/global/sasl_mech_filter.c:90`: O(M×P) SASL filter — M ≈ 5–20 mechs,
P admin-configured.
Neither creates a situation where a remote party can inflate both dimensions
of a nested loop.