652608142a
feat: close outreach doc gap — 276 docs (batches 11-16)
...
All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.
Outreach gap: 276 -> 0.
2026-04-15 13:57:42 -04:00
aeb084c9ae
feat: add 30 outreach docs (batches 9-10)
...
Batch 9 (15): bun, bzflag (3), cake_wallet (4), calligra, caprice32 (2),
cataclysm (3), cemu
Batch 10 (15): cemu-0002, citra, clickhouse-java, cmake (3), cocos2d (3),
conduit, cura (2), curaengine, clamav, contiki
2026-04-14 19:51:36 -04:00
6784cdf1cf
feat: add 39 outreach docs (batches 6-8)
...
Batch 6 (9): dolibarr, jitsi-videobridge, zed, tryton, suricata,
strawberry, zulip, zesarux, zephyr
Batch 7 (15): xonotic (4), xash3d (3), xenia, xtuple, zabbix (2),
zathura, zebra, yabause, zephyr-0001
Batch 8 (15): woodpecker (2), wine (4), widelands (3), wesnoth (3),
wekan (3)
Mix of CWE-407 and CWE-312.
2026-04-14 17:06:28 -04:00
9a78d1afbe
feat: add 15 outreach docs (15 defects) for 1-patch projects
...
0ad (4), aranym, ardour, argo-cd, aria2, azahar, bcoin, bind9,
btcpayserver (3), bullet3. Mix of CWE-407 and CWE-312.
2026-04-14 14:33:17 -04:00
4f1965397a
feat: add 10 outreach docs (20 defects) for 2-patch batch 2
...
firefox, go-ethereum, imagemagick, influxdb, micronaut-core, openbsd,
proton, proxysql, sqlite, vim. All CWE-407.
2026-04-14 14:09:18 -04:00
7e7ec2c3d3
feat: add 10 outreach docs (20 defects) for 2-patch projects
...
amarok, arrow, audacity, cargo, clementine, composer, dask,
deluge, dosbox-x, dragonfly. All CWE-407.
2026-04-14 13:50:33 -04:00
283a490d6d
feat: add 5 outreach docs (15 defects) for batch 4
...
distlib (3, Python), redmine (3, Ruby), grape (3, Ruby),
solc (3, Solidity/C++), grpc-java (3, Java).
2026-04-13 16:55:04 -04:00
d1f82fd8e3
feat: add 8 outreach docs (26 defects) for batch 3
...
rpcs3 (4, C++), ppsspp (4, C++), spring-framework (3, Java),
nats-server (3, Go), minio (3, Go), gimp (3, C), cockroach (3, Go),
superset (3, Python). Note: rpcs3-0004 is CWE-312, rest are CWE-407.
2026-04-13 15:35:53 -04:00
ee04b13f01
feat: add 8 outreach docs (36 defects) for batch 2
...
gitlab-foss (5, Ruby), darktable (5, C), suitecrm (6, PHP),
inkscape (4, C++), calibre (4, Python), scribus (4, C++),
vscode (4, TypeScript), digikam (4, C++).
Note: darktable-0004 and digikam-0004 are CWE-312 (cleartext credential
logging), not CWE-407.
2026-04-13 14:46:34 -04:00
c24246e2e2
feat: add 5 outreach docs (33 defects) + mastodon CWE-1333 benchmark
...
Outreach docs (unblock intel page generation):
- kdenlive: 10 defects (8 CWE-407 + 1 CWE-362 + 1 keyframe), C++
- libreoffice: 5 defects (Writer, Calc, SFX, Impress), C++
- maven: 7 defects (graph, lifecycle, sort-by-indexOf), Java
- cpython: 7 defects (pkgutil, codegen, mock, pmerge MRO, pydoc), C/Python
- blender: 4 defects (node runtime, USD skel, shader, anim), C++
Mastodon CWE-1333 benchmark:
- test_mastodon_cwe1333.rb: validates (.+\.)? -> ([^@]+\.)? fix
eliminates O(2^N) backtracking in email validator
2026-04-13 14:03:16 -04:00
9134c083c3
feat: update lean4 outreach doc with confirmed benchmark speedups
...
Replace "up to 1000x" with measured results: 34x/678x/210x.
Status: patch-ready on unlean4 branch, 7 patches complete.
2026-04-13 10:30:36 -04:00
5451e1748b
outreach: add lean4 disclosure brief — 7 defects, MOAD references
2026-04-13 09:27:50 -04:00
716ef7cb2d
undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407)
2026-04-05 19:46:54 -04:00
6050e1b741
hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch
2026-04-05 15:57:48 -04:00
e94a4b17b3
hurd: 6 CWE-407 defects confirmed — auth, libports, proc, idvec
2026-04-04 16:19:59 -04:00
d01d210351
hurd: queue CWE-407 scan — libports, dispatch loops, translator tables
2026-04-04 16:14:54 -04:00
9cc2a89d0f
linux: add complexity gate headers to all 8 patches; fix 0003/0007/0008 code issues
...
- All 8 patches now carry required # CWE-407 / # Defect / # Fix / # Complexity gate
header blocks per patch file format spec
- linux-0001 (headerdep.pl): header only — code was correct
- linux-0002 (auditsc.c): header + explicit break to prevent ctx->names_list fall-through
- linux-0003 (dev.c): rewrote fix — skip altname loop when format has no percent-d
placeholder; removes duplicate bounds check from prior draft
- linux-0004 (neighbour.c): header + cleaned up ifdef guards; xarray with fallback
- linux-0005 (component.c): header + existing hash fast-path retained
- linux-0006 (btf.c): header + fixed cache hit path — no longer re-runs
btf_find_by_name_kind on hit; uses stored btf_id directly
- linux-0007 (pktgen.c): rewrote fix — replaced xa_for_each (O(N)) with dual
DECLARE_HASHTABLE: dev_ht (by dev*) and name_ht (by jhash(ifname))
- linux-0008 (taskstats.c): fixed mixed list_for_each_entry/hash_for_each_possible
syntax; clean replacement of duplicate-pid list scan with hash_for_each_possible
- Combined patch: linux-0001..0008-hashstruct.patch (8 defects, was missing 0004)
- outreach/linux.md: updated to 8 defects, corrected numbering (0001=headerdep,
0002=auditsc, 0003=dev, 0004=neighbour, 0005-0008 as before)
2026-04-04 11:33:15 -04:00
fdbb9a1aa9
redot: 12 CWE-407 defects, patches, outreach brief, UNDF-2026-000001231..1242
...
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
2026-04-03 21:00:29 -04:00
e52caba572
outreach: update scala.md with scala-0002 (intersectionIsEmpty 100x)
2026-03-29 22:12:55 -04:00
b680523c79
sync: UNDF stamps, unit classes, 146 outreach briefs, CLAUDE.md #1 priority MOAD-1
2026-03-29 15:56:35 -04:00
16cc7ecf1d
wave8 complete + outreach: 452/202, 40 outreach briefs, buck2/ant CLEAN
2026-03-27 16:45:01 -04:00
a4b0cf4edd
whitepaper: 366/178 — wave5 defect tables + PDF rebuild
2026-03-27 15:37:42 -04:00
0a580b313d
undefect. CWE-407 — 63 sites patched across 27 ecosystems
...
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com
Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
2026-03-26 17:11:57 -04:00
