44d513d045
cpython/ruby: CWE-407 scan — 2 CPython defects, 1 Ruby defect
2026-03-30 10:13:34 -04:00
76ffba4a60
tidb/scylladb: CWE-407 scan — renumber tidb patches, stamp UNDF
...
tidb-0001: partition drop name lookup O(P×D) → O(P+D) (27x at P=8192)
tidb-0002: predicate simplification (merged into tidb-0002 in prior commit)
tidb-0003: list partition group intersect O(G²) → O(G) (renumbered from 0002)
scylladb-0001: UNDF stamp added
2026-03-30 10:13:33 -04:00
e45af3961b
undf: stamp duckdb/arrow patches; update registry to 767
2026-03-30 10:12:10 -04:00
6b975a3b9e
duckdb/arrow: CWE-407 scan — 4 DuckDB defects, 2 Arrow defects
...
DuckDB (C++ query engine):
- duckdb-0001: Binder::AddCorrelatedColumn vector dedup O(C²) MEDIUM 200x
- duckdb-0002: HasCorrelatedExpressions vector scan O(N×M) MEDIUM 100x
- duckdb-0003: ComputeOverlappingBindings vector scan O(N×H) MEDIUM 219x
- duckdb-0004: Deliminator group-join binding check O(G×J) MEDIUM 125x
Apache Arrow (C++ analytics):
- arrow-0001: AsofJoin IsTimeOrKeyColumn vector scan O(F×K) MEDIUM 114x
- arrow-0002: Scanner AddFieldsNeededForFilter vector dedup O(F×C) MEDIUM 250x
All 6/6 unit tests PASS.
2026-03-30 10:10:27 -04:00
0772cf539a
undf: assign UNDF-2026-000000761..762, 000000301; stamp flink-0006/0007/storm-0001 patches
2026-03-30 09:53:25 -04:00
05e6aace95
istio/argo-cd: CWE-407 findings
...
istio-0001: gateway reportGatewayStatus addressesToReport dedup O(I^2)
pilot/pkg/config/kube/gateway/conversion.go +
pilot/pkg/config/kube/agentgateway/gateway_status.go
Fix: map[string]struct{} seen-set replaces slices.Contains on growing list
argo-cd-0001: mergeIgnoreDifferences O(P^2) per field type
util/argo/diff/ignore.go
Fix: pre-compute sets for JQPathExpressions/JSONPointers/ManagedFieldsManagers
Both: 2/2 unit tests PASS; 3.4x and 3.7x speedup measured
2026-03-30 09:53:12 -04:00
b31ac644bb
flink-deeper/storm: CWE-407 findings
...
flink-0006: MultipleInputNodeCreationProcessor.createMultipleInputNode() group.members ArrayList.contains inside nested loop O(M2*I); fix: HashSet membersSet before loop
flink-0007: MLPredictTypeStrategy.validateTableAndDescriptorArguments() tableFieldNames List<String>.contains in for loop O(D*T); fix: HashSet<String> conversion before loop
storm-0001: WorkerState.refreshConnections() localTaskIds ArrayList<Integer>.contains in per-task loop O(T_out*L); fix: change to HashSet<Integer>
2026-03-30 09:52:27 -04:00
cb15f957b5
undf: assign UNDF-2026-000000758..759, stamp godot-0011/0012 patches
2026-03-30 09:51:06 -04:00
4d73070504
unreal/godot-deeper: CWE-407 findings
...
unreal: clone unavailable (EpicGames/UnrealEngine requires GitHub auth) — CLEAN.md added.
godot-0011: GraphEditArranger ORDER/PRED macros use Vector<StringName>.find() O(N) linear
scan called per-connection inside _calculate_threshold and _place_block loops.
Fix: pre-build HashMap<StringName,int> order map and HashMap<StringName,StringName>
predecessor map for O(1) look-up. Severity: MEDIUM (~6x at N=200 nodes).
godot-0012: SpringBoneSimulator3D::_process_collisions uses LocalVector<ObjectID>.has()
and .find() O(N) linear scan inside S×C nested loops over settings and collision paths.
Fix: pre-build HashSet<ObjectID> + HashMap<ObjectID,int> for O(1) look-up.
Severity: MEDIUM-HIGH (~20x at N=500, S=50, C=100).
Both: 2/2 unit tests PASS.
2026-03-30 09:50:15 -04:00
f3d11ed8a4
opencv/prometheus: CWE-407 findings — stamp UNDF headers
2026-03-30 09:40:08 -04:00
7aee87ab40
CLAUDE.md: update UNDF count to 757
2026-03-30 09:39:06 -04:00
fbc56da95b
curl/ffmpeg: CWE-407 findings — awssigv4 bubble sort + filtergraph format merge
...
curl-0001 (UNDF-2026-000000040): lib/http_aws_sigv4.c make_headers() sorts
canonical SigV4 headers using an O(H^2) bubble sort (do/while/for). Every
SigV4 HTTP request pays H^2 comparisons. At H=200: 35,024 vs 794 (44x).
Fix: qsort on a temporary pointer array, O(H log H).
ffmpeg-0001 (UNDF-2026-000000070): libavfilter/formats.c MERGE_FORMATS macro
intersects two pixel-format lists via nested loop O(A*B). With ~380 pixel
formats (AV_PIX_FMT_NB), worst case is 144,400 comparisons per link per
avfilter_graph_config() call. At A=B=380: 72,390 vs 3,420 (21x).
Fix: sort b, bsearch for membership, O((A+B) log B).
Unit tests: CurlTest.java, FFmpegTest.java — both PASS.
2026-03-30 09:38:07 -04:00
d78b31eb6e
undf: assign UNDF numbers, stamp patches (cockroach-0001..0003, influxdb-0001..0002)
2026-03-30 09:36:45 -04:00
37836b498d
cockroach/influxdb: CWE-407 findings
2026-03-30 09:36:24 -04:00
95648fb2b0
undf: stamp panda3d-0001 → UNDF-2026-000000207, ogre-0001 → UNDF-2026-000000193
2026-03-30 09:28:43 -04:00
75edb2a0a9
panda3d/ogre: CWE-407 findings
...
panda3d-0001: NodePathCollection remove_duplicate_paths O(N^2) nested scan
and remove_paths_from has_path O(N*M) -> fix with pset, 499x at N=1000
ogre-0001: GLSLProgramWriter std::find(inParams) O(A*O*P) in nested loop
during GLSL shader code generation -> fix with unordered_set, 75x at A=200
2026-03-30 09:27:50 -04:00
780d7fde87
undf: assign UNDF-2026-000000751..752, stamp patches (bullet3-0001, three-0001)
2026-03-30 09:26:18 -04:00
0d33225dcc
sdl/box2d: CWE-407 findings
...
sdl-0001: SDL_gamepad.c SDL_PrivateAddMappingForGUID — O(M) tail walk of
s_pSupportedGamepads linked list on every mapping insert → O(M²) bulk load.
SDL_GameControllerDB ships >30 000 entries; fix: tail pointer s_pLastSupportedGamepad.
box2d-0001: broad_phase.c b2UnBufferMove — linear scan through moveArray to
find proxy key on destroy (acknowledged by code comment) → O(N²) on bulk destroy.
Fix: index map (proxyKey → slot) for O(1) swap-remove.
2026-03-30 09:25:48 -04:00
db92c9428a
bullet3/three.js: CWE-407 findings
...
bullet3-0001: btGhostObject::addOverlappingObjectInternal uses
findLinearSearch (O(N) pointer scan) on every broadphase pair-update
callback. With N objects overlapping a ghost, each tick is O(N²). Fix:
btHashMap<btHashPtr,int> shadow index → O(1) add/remove. 250x at N=500.
three-0001: NodeBuilder.addNode/addSequentialNode use Array.includes
(O(N)) per node during shader build traversal → O(N²). StackNode.generate
uses nodes.indexOf inside filter → O(N²). Fix: shadow with Set → O(1). 250x
at N=500.
2026-03-30 09:25:29 -04:00
99e1a862bd
undf: assign UNDF-2026-000000749/750 to consul-0002/nats-server-0002; stamp patches
2026-03-30 09:19:09 -04:00
750b27a453
CLAUDE.md: update UNDF count to 749
2026-03-30 09:16:28 -04:00
7ab4695e82
undf: assign UNDF-2026-000000748 to nomad-0005; stamp patch
...
nomad-0005: scheduler/reconciler/reconcile_cluster.go
handleReconnectingAllocs slices.Contains(replacements, alloc.ID)
O(A×R) inner linear scan — replaced with map[string]struct{} O(1)
Also confirm envoy-0001 through envoy-0004 were previously scanned
(UNDF-63, 390, 391, 699) and nomad-0001 through nomad-0004 (UNDF-476..479).
2026-03-30 09:15:20 -04:00
b577fa269f
undf: assign UNDF-2026-000000449/746/747 to libgdx-0002/0005/0006; stamp patches
2026-03-30 09:14:21 -04:00
783e406633
pygame/libgdx: CWE-407 findings
...
pygame: CLEAN — runtime uses dict/set throughout (O(1) membership)
libgdx-0002: ModelBuilder.rebuildReferences Array.contains O(P*M) — patch
libgdx-0005: Stage.touchDragged touchFocuses.contains O(F^2) — patch
libgdx-0006: AfterAction.delegate currentActions.indexOf O(W*A) per frame — patch
unit: extend LibGDXTest to 7 tests, all PASS (50x-1971x speedup measured)
2026-03-30 09:13:34 -04:00
ec395a01fc
undf: stamp freeswitch-0001 patch with UNDF-2026-000000073; update registry
2026-03-30 09:04:29 -04:00
e9b981a309
clickhouse-java/freeswitch: CWE-407 findings
...
clickhouse-java-0001: ClickHouseLoadBalancingPolicy nodes/faultyNodes
LinkedList.contains O(N*F) per node selection — fix: LinkedHashSet O(1).
120x speedup at F=500 faulty nodes.
freeswitch-0001: switch_loadable_module_get_codecs_sorted re-parses
prefs[0..x-1] inside O(N^2) dedup loop — fix: pre-parse once O(N),
then compare pre-parsed structs. 13x speedup at N=50 (SWITCH_MAX_CODECS).
2026-03-30 09:03:28 -04:00
ac7030d9a7
CLAUDE.md: update UNDF count to 745
2026-03-30 08:55:11 -04:00
032998cf74
undf: assign UNDF numbers, stamp quarkus patches (517, 518, 469, 678)
2026-03-30 08:54:16 -04:00
555896829a
vertx: 1 CWE-407 defect — HAManager nodeLeft List.contains O(N×M) in cluster failover loop
2026-03-30 08:54:06 -04:00
4483a2ee12
quarkus: 4 CWE-407 defects — Arc CDI interceptor/decorator dedup O(N^2), devmode class scan O(C*S), CORS origins O(O)/req
2026-03-30 08:53:29 -04:00
2b12adc044
grpc-java: 3 CWE-407 defects — priority-lb list.contains O(C×P), xds-client authorities list O(A×S×T), okhttp intersect O(N×M)
2026-03-30 08:45:32 -04:00
e72c6fb013
undf: assign UNDF-2026-000000740 through UNDF-2026-000000744; stamp micronaut-core patches
2026-03-30 08:44:51 -04:00
feda3896b9
micronaut-core: 2 CWE-407 defects — uri-variable O(A×V) per request; topological-sort O(B²) stream scan + ArrayList prepend
2026-03-30 08:44:25 -04:00
b0a9a83efc
pulsar: 3 CWE-407 defects — load-manager/replicator/namespace List.contains O(N^2)
...
pulsar-0001: ModularLoadManagerImpl.reapDeadBrokerPreallocations() receives
aliveBrokers as List<String> from listLocks(); .contains() inside O(B) loop
→ O(B^2); fix: HashSet wrap before loop.
pulsar-0002: PersistentTopic.removeOrphanReplicationCursors() and
checkReplicationStatus() call configuredClusters.contains() (List<String>)
inside loops over cursors and replicators → O(C×R); fix: HashSet wrap.
pulsar-0003: NamespacesBase.internalGetTopicHashPositionsAsync() calls
allTopicsInThisBundle.contains() (List<String>) inside for loop over query
topics → O(T×B); fix: HashSet wrap before loop.
UNDF-2026-000000505 through UNDF-2026-000000507; 3/3 unit tests PASS.
2026-03-30 08:43:51 -04:00
e72461aba9
undf: assign 737-739; stamp dragonfly/valkey/kafka patches; update UNDF count to 739
2026-03-30 08:35:14 -04:00
4ca032752d
dragonfly-0001/0002: ACL vector→flat_hash_map/set O(K×G)→O(K)
...
valkey-0001/0002: ACL linked-list→dict O(S×K×P)→O(S×K)
kafka-0001/0002/0003: rebalance ArrayList→HashSet O(P³/C)→O(P²/C)
All 7 defects patched and unit tested:
dragonfly-0001: key_globs vector scan → flat_hash_map exact lookup (33×)
dragonfly-0002: pub_sub globs vector scan → flat_hash_set (22×)
valkey-0001: ACL key pattern linked-list → dictFind O(1) (10×)
valkey-0002: ACL channel pattern linked-list → dictFind O(1) (11×)
kafka-0001: isBalanced currentAssignment ArrayList → HashSet (36×)
kafka-0002: consumer2AllPotentialTopics ArrayList<String> → HashSet (5.5×)
kafka-0003: RoundRobin topics() List.contains → pre-computed Set (16×)
2026-03-30 08:34:52 -04:00
0b37443f11
spring-framework: 3 CWE-407 defects (UNDF-2026-000000734 through UNDF-2026-000000736)
...
spring-framework-0001 (UNDF-734): CorsConfiguration.checkHeaders() O(R×A)
- requestHeaders list (R) × allowedHeaders ArrayList (A) nested loop
- equalsIgnoreCase() scan per header — 14x measured at R=20, A=50
- Fix: build lowercase LinkedHashSet once O(A), lookup O(1) per header
spring-framework-0002 (UNDF-735): AcceptHeaderLocaleResolver O(R×S)
- Accept-Language locales (R) × supportedLocales ArrayList (S)
- per-request linear scan: 9x at R=15, S=20
- Same defect in AcceptHeaderLocaleContextResolver (reactive)
- Fix: LinkedHashSet for O(1) full-locale match
spring-framework-0003 (UNDF-736): EncodedResourceResolver.contentCodings O(A×C)
- acceptedCodings (A) × contentCodings ArrayList (C) per static resource request
- 8x at A=10, C=8
- Fix: LinkedHashSet for O(1) contains per accepted encoding
- Both spring-webmvc and spring-webflux variants
3/3 unit tests PASS
2026-03-30 08:27:16 -04:00
be66177402
netty-0001: DnsResolveContext finalResult ArrayList.contains O(A²) → LinkedHashSet O(A)
2026-03-30 08:26:27 -04:00
192219a62f
undf: assign 734-736; stamp rabbitmq-0001/0002
2026-03-30 08:26:11 -04:00
3d0519f28d
rabbitmq-0001/0002: fifo service-queue O(C) member→O(1) map; blocked O(B) member→O(1) map
2026-03-30 08:26:01 -04:00
dff753904b
undf: stamp traefik-0001/0002 (UNDF-557/558)
2026-03-30 08:21:34 -04:00
76d1e3cc28
traefik-0001/0002: ip.Checker []net.IP→map O(1); CORS origin []string→map O(1)
2026-03-30 08:21:24 -04:00
9f9acfd5f5
undf: assign 732-733; stamp activemq-0002/0003
2026-03-30 08:02:58 -04:00
23fbfdca44
activemq-0002/0003: candidateConsumers List→Set O(1); ENDED_XA List→Set O(1)
2026-03-30 08:02:45 -04:00
e0486b7301
undf: stamp activemq-0001 with UNDF-2026-000000617
2026-03-30 08:00:11 -04:00
d1b6d0021e
activemq-0001: Queue.java consumer rotation remove+sort O(C log C) → cursor O(1)
2026-03-30 07:59:58 -04:00
e72b9fccde
undf: assign 731; stamp patches; postgres-0001/asterisk-0001/haproxy-0001/nginx-0001
2026-03-30 07:57:50 -04:00
ff6292d067
wave17: postgres-0001/asterisk-0001/haproxy-0001/nginx-0001; postfix+bevy CLEAN
...
postgres-0001: pg_inherits.c typeInheritsFrom() BFS visited List → HTAB O(1)
asterisk-0001: app_queue.c interface_exists() ao2_iterator walk → ao2_find O(1)
haproxy-0001: http_ana.c cookie-server scan linked-list → eb-tree index O(log S)
nginx-0001: ngx_http_link_multi_headers() O(H²) double-scan → O(H) hash pass
postfix: CLEAN (htable throughout; two marginal LOW admin-bounded candidates)
bevy: CLEAN (FixedBitSet/HashSet throughout; only hardware-bounded marginals)
2026-03-30 07:57:30 -04:00
da8b4a41d6
undf: stamp redis-0001 patch with UNDF-260
2026-03-30 07:47:03 -04:00
2ffc2001ab
wave17a: redis-0001 acl.c getUpcomingChannelList listSearchKey → dict (6x, MEDIUM)
...
redis-0001: src/acl.c getUpcomingChannelList() listSearchKey O(C×U) → dictFind O(1)
1 test: 1/1 PASS
2026-03-30 07:46:16 -04:00
