0606e6329a
undf: assign 907; stamp weechat-0001 patch
2026-03-31 07:38:34 -04:00
128d349072
weechat-0001: nicklist dedup O(N^2) linear search on join
...
gui_nicklist_add_nick calls gui_nicklist_search_nick which linearly
scans the nick linked list for each add. Joining a 2000-user IRC
channel causes O(N^2) work. Fix: hash table for O(1) dedup. 999x ratio.
2026-03-31 07:37:50 -04:00
53ce6d7ab6
undf: assign 898-906; stamp dosbox-x/rpcs3/ppsspp patches
2026-03-31 07:33:50 -04:00
50c1301928
dosbox-x-0001/0002, rpcs3-0001/0002/0003, ppsspp-0001/0002/0003: 8 CWE-407 defects across 3 emulators
...
DOSBox-X: overlay drive DOSnames_cache + deleted_files_in_base vector dedup (devs commented "set is probably better")
RPCS3: SPU recompiler predecessor/call vector dedup + cellSaveData blist sort comparator
PPSSPP: kernel thread/semaphore waitingThreads dedup + IR JIT byPage block removal
16/16 unit tests PASS, ratios 5-93x
2026-03-31 07:33:28 -04:00
87a11e22f9
undf: assign 895-897; stamp forgejo/snort3/tryton patches
2026-03-30 18:46:58 -04:00
8660303f5a
forgejo-0001/snort3-0001: 2 CWE-407 defects from MOAD multi-scan
...
forgejo-0001: Results.RepoIDs() slices.Contains dedup O(N^2) in code search — 107x at N=5000
snort3-0001: ServiceDiscovery service_candidates std::find dedup O(M*C) in AppID — 59x at M=10000
2026-03-30 18:46:38 -04:00
2798f926fc
CLAUDE.md: update UNDF count to 894
2026-03-30 17:40:39 -04:00
5802db9fc3
undf: assign 893-894; stamp proton patches
2026-03-30 17:39:33 -04:00
2f03245f7b
proton: 2 CWE-407 defects — find_iface_constructor O(C) linear scan + merge_user_dir list explosion
...
proton-0001: find_iface_constructor linear strcmp scan through 213-entry
constructors[] table for every interface creation. Fix: binary search.
4.6x speedup measured.
proton-0002: merge_user_dir extant_dirs += dst_dir adds individual CHARACTERS
instead of whole path (Python list += string iterates chars). Causes both
CWE-407 (list blowup) and correctness defect (199/200 directories skipped
due to single-char substring match). Fix: extant_dirs.append(dst_dir).
MOAD-0002 (Intertangle): CLEAN — env-var isolation between components
MOAD-0003 (Leaked Context): CLEAN — per-game Wine prefix isolation
MOAD-0004 (Logged Secret): CLEAN — no credential logging found
MOAD-0005 (CWE-362): CLEAN — FileLock + CRITICAL_SECTION discipline
Wine's ChangeServiceConfig password logging (wine-0001) inherited but not
in Proton's own codebase.
2026-03-30 17:38:41 -04:00
716a789008
CLAUDE.md: update UNDF count to 892
2026-03-30 17:34:31 -04:00
c12412cda6
undf: assign 887-892; stamp thunderbird patches
2026-03-30 17:33:38 -04:00
6a025795dc
thunderbird: 6 CWE-407 defects from 5-MOAD deep scan via Searchfox
...
thunderbird-0001: nsMsgAccountManager LoadAccounts IndexOf O(N^2) dedup MEDIUM 192x
thunderbird-0002: nsMsgCopyService DoNextCopy ContainsObject O(N^2) MEDIUM-HIGH 44x
thunderbird-0003: nsAutoSyncManager IndexOf in sync loops O(N^2) HIGH 751x
thunderbird-0004: nsImapFlagAndUidState Contains/IndexOf linear on sorted O(N) HIGH 107x
thunderbird-0005: nsMsgFilterList ComputeArbitraryHeaders FindInReadable O(H^2) MEDIUM 64x
thunderbird-0006: nsSpamSettings CheckWhiteList linear email scan O(M*E) MEDIUM 153x
MOAD-0002 (Intertangle): MEDIUM - singleton nsMsgAccountManager shared across protocols
MOAD-0003 (Leaked Context): LOW-MEDIUM - IMAP connection pool single auth boolean
MOAD-0004 (Logged Secret): MEDIUM - debug builds log credentials via MOZ_UPDATE_CHANNEL bypass
MOAD-0005 (CWE-362): LOW-MEDIUM - IMAP folder DB init and connection pool TOCTOU
12/12 unit tests PASS
2026-03-30 17:33:16 -04:00
f2d7a3127e
5-MOAD scan: pcsx2 2 defects, wine 1 defect + 1 MOAD-0004, thunderbird unavailable
...
PCSX2:
- pcsx2-0001: Patch::ReloadEnabledLists 4x std::find on vector O(N^2) MEDIUM 6-12x
- pcsx2-0002: GSCapture codec dedup std::find_if O(N^2) LOW 11x
- MOAD-0002/0003/0004/0005: CLEAN
Wine:
- wine-0001: ntdll/loader.c find_module_dependency O(D) linked-list dedup HIGH 7x
- MOAD-0004: ChangeServiceConfig logs password via debugstr_w MEDIUM
- MOAD-0002/0003/0005: CLEAN
Thunderbird: source unavailable (nicholasb2101/gecko-dev repo inaccessible)
2026-03-30 17:25:38 -04:00
4d2d38fe6e
undf: assign UNDF numbers, stamp patches; 886 total
2026-03-30 17:21:56 -04:00
3aaecab0e1
openscad-0001: AMF export vertex dedup std::find O(V²) → HashMap O(V)
...
Defect: export_amf.cc add_vertex() uses std::find on std::vector for every
vertex during AMF export. For meshes with V vertices, total cost is O(V²).
Fix: parallel unordered_map<vertex_str, size_t> for O(1) lookup.
Unit test: 5-16x ratio at V=500-5000, PASS.
2026-03-30 17:21:45 -04:00
e770a47477
undf: assign UNDF numbers, stamp patches; 882 total
2026-03-30 16:57:20 -04:00
0de158cd7a
monitoring scan: nagioscore 2 defects, zabbix 2 defects, zenoss CLEAN
...
nagioscore-0001: add_notification find_notification linked-list O(C²) HIGH 999x
nagioscore-0002: add_object_to_objectlist linked-list dedup O(N²) MEDIUM 1499x
zabbix-0001: process_problem_tags tag dedup O(T²) HIGH 1499x
zabbix-0002: discoverer_queue_lock job ID dedup O(N²) MEDIUM 1499x
zenoss: CLEAN — uses OrderedDict/set/catalog throughout
4/4 PASS, 4 defects across 2 targets
2026-03-30 16:56:56 -04:00
a4a1e444e6
undf: assign 741-880; stamp patches; generate_undf.py sync
2026-03-30 16:52:36 -04:00
c9f4953656
am-monitor: CWE-407 scan CLEAN — sets/dicts throughout, no algorithmic complexity defects
2026-03-30 16:51:45 -04:00
1f9babda46
happymon: CWE-407 scan CLEAN — no algorithmic complexity defects
...
Fox's own Python monitoring tool. All registries use dicts,
dedup uses sets, list membership checks are config-bounded (1-3 items).
2026-03-30 16:50:02 -04:00
494d1c82a3
undf: assign UNDF numbers, stamp patches; 878 total
2026-03-30 16:46:38 -04:00
8b5e3c35b1
undf: assign UNDF numbers, stamp patches; 875 total
2026-03-30 16:45:00 -04:00
0dbb699821
openai SDK dependency chain CWE-407 scan: all 5 targets CLEAN
...
openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects.
All targets use proper dict/set/frozenset for membership tests in hot paths.
2026-03-30 16:44:33 -04:00
95008feda5
llm-infra scan: litellm-0001 _delete_deployment combined_id_list O(R*C); haystack CLEAN
...
litellm-0001: ProxyConfig._delete_deployment() checks model_id not in
combined_id_list (a plain Python list) for each router model ID during
config refresh. O(R*C) where R=router models, C=combined list. Fix:
convert to set before loop. MEDIUM severity, 6.5x at N=500. 1/1 PASS.
Haystack: no CWE-407 defects found. Uses dicts and sets throughout
for membership checks (scheduled_components set, storage dict, etc.).
2026-03-30 16:44:06 -04:00
7e717432dd
undf: assign UNDF-2026-000000874; stamp vllm-0001 patch
2026-03-30 16:42:12 -04:00
80b26e82b6
ml-inference scan: vllm-0001 LoRA convert_mapping list.index O(B*L); ollama+langchain CLEAN
...
vllm-0001: punica_wrapper/utils.py convert_mapping() calls
lora_index_to_id.index(x) per token in batch — O(B*L) where
B=batch_size, L=loaded_loras. Code has "TODO index can be slow"
comment. Fix: pre-build dict for O(1) lookup. 7x at B=2000/L=64.
Ollama: all slices.Contains on bounded slices (1-8 items).
LangChain: orchestration code, all membership bounded by k param.
2026-03-30 16:41:47 -04:00
8044951658
CLAUDE.md: update UNDF count to 865
2026-03-30 15:25:53 -04:00
896a29f83b
erp scan: erpnext-0001/0002, ofbiz-0001/0002; odoo CLEAN; 4/4 PASS
...
erpnext-0001: BOM.get_children list dedup O(B^2) MEDIUM 4x
erpnext-0002: serial_batch_bundle serial/batch dedup O(N^2) HIGH 45x
ofbiz-0001: PaymentGatewayServices processList LinkedList O(N^2) HIGH 45x
ofbiz-0002: OrderReturnServices/OrderReadHelper payment dedup O(N^2) MEDIUM 36x
odoo: CLEAN (consistent set/frozenset/OrderedSet usage throughout)
2026-03-30 15:24:39 -04:00
15db2a0269
synapse-0001: sync handler newly_joined_rooms List membership O(J*N); matrix-js-sdk CLEAN
...
synapse/handlers/sync.py _get_rooms_changed: newly_joined_rooms is List[str]
checked with `in` inside for-loop over all joined rooms (line 2252).
O(J*N) where J=joined rooms, N=newly joined. Fix: use Set. 99x at J=5000.
2026-03-30 15:23:53 -04:00
7d89e30de9
emulator scan: MAME/Dolphin/ScummVM all CLEAN — no CWE-407 defects
...
Scanned three major emulator codebases for algorithmic complexity defects:
- MAME: proper maps/enumerators, std::find only on constant-bounded arrays
- Dolphin: exceptionally clean, HashMap/unordered_map throughout hot paths
- ScummVM: Common::find on tiny collections only, HashMap for config lookups
2026-03-30 15:23:14 -04:00
ee9d45d123
CLAUDE.md: update UNDF count to 861
2026-03-30 15:18:09 -04:00
dd20794faa
undf: assign 859-861; stamp patches; element-web-0003/element-web-0004/conduit-0001
2026-03-30 15:17:08 -04:00
ec186e286c
element-web-0003/0004 + conduit-0001: CWE-407 deep scan — 3 new defects, 6/6 PASS
...
element-web-0003: TextForEvent.tsx textForCanonicalAliasEvent alt_aliases
.filter(x => !arr.includes(x)) O(A*B) MEDIUM 19.5x — fix: Set.has()
element-web-0004: utils/arrays.ts arrayDiff + arrayIntersection
.filter(i => !arr.includes(i)) O(A*B) MEDIUM 18x — fix: Set.has()
Used by 15+ callsites: room-list, notifications, spaces, beacons, maps
conduit-0001: server_server.rs get_missing_events_route
earliest_events.contains() (Vec) in growing BFS loop O(Q*E) MEDIUM-HIGH 7.4x
Federation endpoint — remote server controls input size
matrix-rust-sdk: could not clone (GitHub HTTPS unreachable)
2026-03-30 15:16:54 -04:00
f35e47bab3
CLAUDE.md: update UNDF count to 858
2026-03-30 15:01:20 -04:00
2372d29c88
undf: assign UNDF-2026-000000858 for proxysql-0001; stamp patch
2026-03-30 14:59:38 -04:00
daaa6b8231
proxysql: rename patch to avoid false CLEAN match in generator
2026-03-30 14:59:22 -04:00
0fb51c7234
syncthing/nextcloud-server/gitea: CWE-407 scan — syncthing-0001 blockIndexes O(D*B^2) MEDIUM; nextcloud-server CLEAN; gitea CLEAN
...
syncthing-0001: deviceDownloadState.blockIndexes []int with slices.Contains O(B)
called per device per block in file sync hot path. Fix: map[int]struct{}.
UNDF-2026-000000850. 2.9x measured at B=1000.
nextcloud-server: 386 in_array() calls, all on constant-size or config-level arrays.
gitea: 91 slices.Contains, all on small lists; container.Set used for hot paths.
2026-03-30 14:57:08 -04:00
59e2f4e94d
calibre/digikam/proxysql: 5 CWE-407 defects — calibre-0001 series_indices list O(10000*S), calibre-0002 Google tag dedup O(T^2), digikam-0001 Haar targetAlbums QList O(N*A) HIGH, digikam-0002 GPS tiler dedup O(I^2), proxysql-0001 metrics cleanup O(M*S); 6/6 PASS
2026-03-30 14:56:51 -04:00
c31c569e45
undf: stamp gitlab-foss patches with UNDF numbers
2026-03-30 14:56:23 -04:00
99e627481e
gitlab-foss: 5 CWE-407 defects — Network::Graph find_free_space/overlap O(R*S), NotificationService mentioned_users O(R*M), RefreshService commit_ids O(MR*C), Project#members_among O(U*A); 4/4 PASS
2026-03-30 14:55:33 -04:00
0623a342b1
CLAUDE.md: update UNDF count to 854
2026-03-30 14:54:23 -04:00
4cc47349a5
undf: assign 847-849; stamp freecad/retroarch patches
2026-03-30 14:53:28 -04:00
e06902c99a
freecad/retroarch/mpv: CWE-407 scan — 3 defects, mpv CLEAN
...
freecad-0001: ifc_generator.py done-list O(N^2) dedup MEDIUM-HIGH 499x
freecad-0002: importDXF.py processededges list O(E^2) MEDIUM 469x
retroarch-0001: playlist_entry_exists O(R*P) linear scan in content scanner HIGH 749x
mpv: CLEAN (all data structures naturally bounded)
3/3 unit tests PASS.
2026-03-30 14:53:03 -04:00
37dc0c5179
CLAUDE.md: update UNDF count to 850
2026-03-30 14:52:48 -04:00
0d852be0a3
undf: assign 845-846; stamp firefox patches
2026-03-30 14:51:42 -04:00
026859bc00
firefox: 2 CWE-407 defects — Sanitizer ListSet O(N×E) HIGH, DOMTokenList O(T²) MEDIUM; chromium SKIPPED (clone unavailable)
2026-03-30 14:51:20 -04:00
558f0d30c2
undf: stamp clementine patches (UNDF-2026-000000841..842)
2026-03-30 14:43:28 -04:00
669ed13408
clementine: 2 CWE-407 defects; mpd + rhythmbox CLEAN
...
clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) +
files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with
HashMap + HashSet. HIGH severity, 250x at N=1000.
clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/
SendUrls loops — fix with integer counter + QSet for requested_ids.
MEDIUM severity, 500x at N=1000.
MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout.
Rhythmbox: CLEAN — uses g_hash_table for all membership checks.
4/4 unit tests PASS.
2026-03-30 14:42:15 -04:00
a9cd5686fb
undf: stamp amarok + strawberry patches (UNDF-2026-000000833..840)
2026-03-30 14:41:25 -04:00
fb2c48dc37
undf: stamp kdenlive-0005..0008 (UNDF-2026-000000835..838)
2026-03-30 14:40:29 -04:00
