Flagship: weaviate authorization filter slices.Contains per item (O(N*K)).
Multi-tenant deployments with hundreds-thousands of permitted resources pay
this on every authorized read. Set hoist: 1735x speedup at N=50k K=5k.
Wave 11 honor roll: bash, coreutils. Cumulative: 49 projects.
10 observability/streaming targets scanned. Honor roll cumulative: 34 projects.
No flagship CWE-407 — VictoriaMetrics streamaggr.getInputOutputLabels real
but constant-factor at realistic config shapes (W <=10, L <=30, ~2-3x impact),
below the 5x wall-clock bar. Logged for re-scan if W >30 case surfaces.
29 mail/DNS/storage/VPN/RTOS/pg-eco targets scanned. No flagship CWE-407 patches
this pass — strong M1 candidates resolved to bounded fixed config tables
(strcmp on rule lookups), already-optimal data structures (RoaringTreemap,
ObjHashSet), or query-shape constants too small to cross the wall-clock bar.
Honor roll: 30 projects cumulative across waves 3-7. questdb `recordViews`
borderline real defect (O(N²) view dedup on ObjList) logged for future pass.
Scanned the three foundational Python documentation tools (Sphinx,
docutils, Pelican) and documented the triage outcome.
Pelican joins the clean-scan honor roll (now 25 projects). Both flagged
findings tested as false positives — utils.py:485 is String.index for
'\n', not list iteration; pelican_import.py:663 ReDoS pattern scales
linearly at N=40 (0.11ms).
Sphinx + docutils have multiple M1 hits in node-tree walks
(Node.findall via parent.index per ancestor). Investigated and
benchmarked: both old and new algorithms are O(D*S) — constant-factor
only, not CWE-407-grade complexity-class change. A real fix would
require maintaining a parent_index cache on Element nodes, a refactor
with cache-invalidation surface area beyond a single-defect patch.
No patches shipped this pass; the work is documented for the next
reviewer.
The Gatsby authors annotated each of the three call sites in
in-memory/indexing.ts with 'expensive at scale' comments. Their
diagnosis is correct: nodeTypeNames.includes(node.internal.type)
inside iterateNodes().forEach is O(N*T) per cache build.
For N=100k+ nodes typical of mature content sites and T=10-30
declared types per query, this fires on every type-filtered query.
gatsby develop in particular rebuilds caches per page render.
Fix: hoist Set<string> once at the top of each function. O(1) per
node lookup. Total cost O(N+T). Bench shows 8.4x at N=100k T=50;
2.7-4.7x at smaller scales.
Three call sites patched: ensureIndexByElemMatch (line 326),
ensureEmptyFilterCache (378), ensureIndexByElemMatchValue (504).
Author 'expensive at scale' comments updated to record the fix.
Investigated the top 2 triage-backlog items from the Wave 4 survey:
- PHP_CodeSniffer Tokenizers/PHP.php ReDoS: scanner flagged
((?<!\.)_[0-9A-F][0-9A-F.]*)+$ as catastrophic-backtracking shape.
Empirical test shows the underscore-anchored inner group prevents
overlap between outer iterations; Python re matches N=50 pathological
input in sub-millisecond time. False positive. Scanner could be taught
to recognize anchor-prefix inner groups as safe.
- aws-cdk region-info.ts limitedRegionMap: partitions.includes inside
per-region loop is a real O(R*P) shape. At realistic scale (R=35
regions, P=2-4 partitions) the wall-clock improvement is constant-
factor only; bench shows 2.9x at R=2000 P=100 but collapses to 1.0x
at production scale. Cleanup-grade, not CWE-407 complexity-class
emergency; no patch shipped.
Both findings documented in the Wave 4 triage section as investigated-
and-resolved. The remaining 5 items stay on the list for future waves.
artemis, doris, gin, gstreamer, igraph, kylin, nifi, open3d, opencv,
ros2, starrocks, trino, victoria-metrics: each had a **Speedup:**
metadata line from an early draft with a small per-defect scenario
number (2.5x, 5x worst case, etc.) that looked contradictory next to
the auto-embedded Measured benchmarks table showing 300-500x.
Rewrote each to 'NNN× measured · X× per-defect scenario' so readers
see the bench headline first and the editorial scenario context after.
Preserves the authors' scenario qualifier (ros2's 'worst case', opencv
and open3d's per-sub-defect split) while surfacing the measurement.
Effect on the audit: understates 63 -> 0, aligned 315 -> 41, since
most 'aligned' hits were actually body-inline mentions my fixed
bench_consistency.py no longer considers as headline claims.
Each of the 3 briefs flagged by bench_consistency.py as claim > measured
now carries an explicit line pairing the op-count claim with the
measured wall-clock speedup and explaining the residual gap.
fbneo-0001: 45,000x claim -> + 2,410x wall-clock at N=45k
(Python dict vs C++ unordered_map constant factor).
mercurial-0001: 5,000x claim -> + 50x wall-clock at k=500
(Python sim ceiling; bench_google_scale.py projects
to Google-scale via ops ratio).
substrate: 38,550x claim -> + 2,009x wall-clock at N=10k
(Python list vs Rust HashSet constant factor).
mercurial-0001 bench also scaled to CASES=[(1000,50), (1000,100),
(1500,200), (1500,350), (1500,500)] to cover k=500 directly.
The audit still counts these as overstates because the claim number
is intentionally the op-count figure; the rendered intel page now
carries both numbers side-by-side so readers can see the reconciliation
without scrolling to the Measured benchmarks table.
testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.
Outreach gap: 276 -> 0.
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
