783e406633
pygame/libgdx: CWE-407 findings
...
pygame: CLEAN — runtime uses dict/set throughout (O(1) membership)
libgdx-0002: ModelBuilder.rebuildReferences Array.contains O(P*M) — patch
libgdx-0005: Stage.touchDragged touchFocuses.contains O(F^2) — patch
libgdx-0006: AfterAction.delegate currentActions.indexOf O(W*A) per frame — patch
unit: extend LibGDXTest to 7 tests, all PASS (50x-1971x speedup measured)
2026-03-30 09:13:34 -04:00
ec395a01fc
undf: stamp freeswitch-0001 patch with UNDF-2026-000000073; update registry
2026-03-30 09:04:29 -04:00
e9b981a309
clickhouse-java/freeswitch: CWE-407 findings
...
clickhouse-java-0001: ClickHouseLoadBalancingPolicy nodes/faultyNodes
LinkedList.contains O(N*F) per node selection — fix: LinkedHashSet O(1).
120x speedup at F=500 faulty nodes.
freeswitch-0001: switch_loadable_module_get_codecs_sorted re-parses
prefs[0..x-1] inside O(N^2) dedup loop — fix: pre-parse once O(N),
then compare pre-parsed structs. 13x speedup at N=50 (SWITCH_MAX_CODECS).
2026-03-30 09:03:28 -04:00
032998cf74
undf: assign UNDF numbers, stamp quarkus patches (517, 518, 469, 678)
2026-03-30 08:54:16 -04:00
555896829a
vertx: 1 CWE-407 defect — HAManager nodeLeft List.contains O(N×M) in cluster failover loop
2026-03-30 08:54:06 -04:00
4483a2ee12
quarkus: 4 CWE-407 defects — Arc CDI interceptor/decorator dedup O(N^2), devmode class scan O(C*S), CORS origins O(O)/req
2026-03-30 08:53:29 -04:00
2b12adc044
grpc-java: 3 CWE-407 defects — priority-lb list.contains O(C×P), xds-client authorities list O(A×S×T), okhttp intersect O(N×M)
2026-03-30 08:45:32 -04:00
e72c6fb013
undf: assign UNDF-2026-000000740 through UNDF-2026-000000744; stamp micronaut-core patches
2026-03-30 08:44:51 -04:00
feda3896b9
micronaut-core: 2 CWE-407 defects — uri-variable O(A×V) per request; topological-sort O(B²) stream scan + ArrayList prepend
2026-03-30 08:44:25 -04:00
b0a9a83efc
pulsar: 3 CWE-407 defects — load-manager/replicator/namespace List.contains O(N^2)
...
pulsar-0001: ModularLoadManagerImpl.reapDeadBrokerPreallocations() receives
aliveBrokers as List<String> from listLocks(); .contains() inside O(B) loop
→ O(B^2); fix: HashSet wrap before loop.
pulsar-0002: PersistentTopic.removeOrphanReplicationCursors() and
checkReplicationStatus() call configuredClusters.contains() (List<String>)
inside loops over cursors and replicators → O(C×R); fix: HashSet wrap.
pulsar-0003: NamespacesBase.internalGetTopicHashPositionsAsync() calls
allTopicsInThisBundle.contains() (List<String>) inside for loop over query
topics → O(T×B); fix: HashSet wrap before loop.
UNDF-2026-000000505 through UNDF-2026-000000507; 3/3 unit tests PASS.
2026-03-30 08:43:51 -04:00
e72461aba9
undf: assign 737-739; stamp dragonfly/valkey/kafka patches; update UNDF count to 739
2026-03-30 08:35:14 -04:00
4ca032752d
dragonfly-0001/0002: ACL vector→flat_hash_map/set O(K×G)→O(K)
...
valkey-0001/0002: ACL linked-list→dict O(S×K×P)→O(S×K)
kafka-0001/0002/0003: rebalance ArrayList→HashSet O(P³/C)→O(P²/C)
All 7 defects patched and unit tested:
dragonfly-0001: key_globs vector scan → flat_hash_map exact lookup (33×)
dragonfly-0002: pub_sub globs vector scan → flat_hash_set (22×)
valkey-0001: ACL key pattern linked-list → dictFind O(1) (10×)
valkey-0002: ACL channel pattern linked-list → dictFind O(1) (11×)
kafka-0001: isBalanced currentAssignment ArrayList → HashSet (36×)
kafka-0002: consumer2AllPotentialTopics ArrayList<String> → HashSet (5.5×)
kafka-0003: RoundRobin topics() List.contains → pre-computed Set (16×)
2026-03-30 08:34:52 -04:00
0b37443f11
spring-framework: 3 CWE-407 defects (UNDF-2026-000000734 through UNDF-2026-000000736)
...
spring-framework-0001 (UNDF-734): CorsConfiguration.checkHeaders() O(R×A)
- requestHeaders list (R) × allowedHeaders ArrayList (A) nested loop
- equalsIgnoreCase() scan per header — 14x measured at R=20, A=50
- Fix: build lowercase LinkedHashSet once O(A), lookup O(1) per header
spring-framework-0002 (UNDF-735): AcceptHeaderLocaleResolver O(R×S)
- Accept-Language locales (R) × supportedLocales ArrayList (S)
- per-request linear scan: 9x at R=15, S=20
- Same defect in AcceptHeaderLocaleContextResolver (reactive)
- Fix: LinkedHashSet for O(1) full-locale match
spring-framework-0003 (UNDF-736): EncodedResourceResolver.contentCodings O(A×C)
- acceptedCodings (A) × contentCodings ArrayList (C) per static resource request
- 8x at A=10, C=8
- Fix: LinkedHashSet for O(1) contains per accepted encoding
- Both spring-webmvc and spring-webflux variants
3/3 unit tests PASS
2026-03-30 08:27:16 -04:00
be66177402
netty-0001: DnsResolveContext finalResult ArrayList.contains O(A²) → LinkedHashSet O(A)
2026-03-30 08:26:27 -04:00
192219a62f
undf: assign 734-736; stamp rabbitmq-0001/0002
2026-03-30 08:26:11 -04:00
3d0519f28d
rabbitmq-0001/0002: fifo service-queue O(C) member→O(1) map; blocked O(B) member→O(1) map
2026-03-30 08:26:01 -04:00
dff753904b
undf: stamp traefik-0001/0002 (UNDF-557/558)
2026-03-30 08:21:34 -04:00
76d1e3cc28
traefik-0001/0002: ip.Checker []net.IP→map O(1); CORS origin []string→map O(1)
2026-03-30 08:21:24 -04:00
9f9acfd5f5
undf: assign 732-733; stamp activemq-0002/0003
2026-03-30 08:02:58 -04:00
23fbfdca44
activemq-0002/0003: candidateConsumers List→Set O(1); ENDED_XA List→Set O(1)
2026-03-30 08:02:45 -04:00
e0486b7301
undf: stamp activemq-0001 with UNDF-2026-000000617
2026-03-30 08:00:11 -04:00
d1b6d0021e
activemq-0001: Queue.java consumer rotation remove+sort O(C log C) → cursor O(1)
2026-03-30 07:59:58 -04:00
e72b9fccde
undf: assign 731; stamp patches; postgres-0001/asterisk-0001/haproxy-0001/nginx-0001
2026-03-30 07:57:50 -04:00
ff6292d067
wave17: postgres-0001/asterisk-0001/haproxy-0001/nginx-0001; postfix+bevy CLEAN
...
postgres-0001: pg_inherits.c typeInheritsFrom() BFS visited List → HTAB O(1)
asterisk-0001: app_queue.c interface_exists() ao2_iterator walk → ao2_find O(1)
haproxy-0001: http_ana.c cookie-server scan linked-list → eb-tree index O(log S)
nginx-0001: ngx_http_link_multi_headers() O(H²) double-scan → O(H) hash pass
postfix: CLEAN (htable throughout; two marginal LOW admin-bounded candidates)
bevy: CLEAN (FixedBitSet/HashSet throughout; only hardware-bounded marginals)
2026-03-30 07:57:30 -04:00
da8b4a41d6
undf: stamp redis-0001 patch with UNDF-260
2026-03-30 07:47:03 -04:00
2ffc2001ab
wave17a: redis-0001 acl.c getUpcomingChannelList listSearchKey → dict (6x, MEDIUM)
...
redis-0001: src/acl.c getUpcomingChannelList() listSearchKey O(C×U) → dictFind O(1)
1 test: 1/1 PASS
2026-03-30 07:46:16 -04:00
2202a50f5c
undf: assign UNDF-730 to esbuild-0001; stamp patch
2026-03-30 07:41:36 -04:00
da26ffd2cf
wave16c: esbuild/deno CWE-407 scan results
...
esbuild-0001: serve_other.go hosts []string scan → map[string]struct{} (57x, MEDIUM)
deno: CLEAN (uses HashSet/HashMap throughout, no Vec.contains() in loops)
1 test: 1/1 PASS
2026-03-30 07:39:57 -04:00
38945e8138
undf: assign UNDF-729 to element-web-0001/0002 and bun-0001; stamp patches
2026-03-30 07:38:08 -04:00
c1f0ce8eda
wave16b: element-web/bun CWE-407 patches + unit tests
...
element-web-0001: TextForEvent.tsx user dedup array → Set (15x, HIGH)
element-web-0002: TextForEvent.tsx pinned filter indexOf → Set.has (13x, MEDIUM)
bun-0001: yarn.zig scoped version two-pass scan → single pass (4x, MEDIUM)
5 tests: 5/5 PASS
2026-03-30 07:37:28 -04:00
f87eeeb302
undf: assign UNDF-728 to wave16 defects (nova/keystone/crystal/dovecot/wireshark); stamp patches
2026-03-30 07:34:08 -04:00
59ae52c7b4
wave16: nova/keystone/crystal/dovecot/wireshark CWE-407 patches + unit tests
...
nova-0001: scheduler/manager.py selected_hosts list → set (273x, CRITICAL)
nova-0002: scheduler/host_manager.py lowered_hosts_to_force list → set (43x, HIGH)
keystone-0001: api/users.py token_roles list → set (32x, HIGH)
crystal-0001: syntax/parser.cr type_vars Array#includes? → Set (25x, CRITICAL)
crystal-0002: semantic/restrictions.cr discarded Array#includes? → Set (5x, CRITICAL)
dovecot-0001: mail-storage-hooks.c array_lsearch → sort+bsearch (4x, HIGH)
wireshark-0001: proto_data.c GSList → wmem_map_t (8x, HIGH)
7 unit tests: 9/9 PASS
2026-03-30 07:33:49 -04:00
291620b115
opensmtpd-0002: strip stale stamp (UNDF-727 now assigned correctly)
2026-03-30 07:09:37 -04:00
b4e2eda927
distlib/luigi/zookeeper/mybatis/solc/solana/go-ethereum: CWE-407 patches + unit tests; solana CLEAN
2026-03-30 07:06:26 -04:00
c9e86c450c
opensmtpd-0001: mta_handle_envelope TAILQ_FOREACH O(N²) task lookup — patch + unit test
...
Add patch replacing linear TAILQ_FOREACH scan in mta_handle_envelope()
with tree_get() on a per-relay task_by_msgid splay-tree index; assign
UNDF-2026-000000201. Unit test confirms 100x op-count improvement at
N=100 tasks/relay.
2026-03-30 07:00:50 -04:00
2573ec8802
undf: assign 721-726; salt-0001/0002/0003 CWE-407 list→set patches
2026-03-30 06:59:11 -04:00
f176e86fbd
ninja-0001/ninja-0002: CWE-407 depfile dedup and output validation O(N²)→O(N)
...
ninja-0001: depfile_parser.cc std::find over ins_/outs_ vectors is O(N) per
token → O(N²) total parse; fix adds unordered_set ins_seen_/outs_seen_ members
to DepfileParser for O(1) duplicate detection (490x at N=1000).
ninja-0002: graph.cc std::find_if over edge->outputs_ called for each depfile
output token is O(M×N); fix builds unordered_set from edge outputs once before
the loop for O(M+N) total (125x at M=N=500).
2026-03-30 06:56:54 -04:00
740f17256b
undf: assign 721; stamp spidermonkey-0005
2026-03-30 06:47:50 -04:00
390ce56a83
cleanup: remove artifact .class and .go test files from defects/scala and defects/victoria-metrics
2026-03-29 22:28:42 -04:00
25c2bafdee
undf: assign 694-720; stamp patches; ruby-0003/elixir-0002/r-source-0002/victoria-metrics-0002
...
New UNDF assignments (693→720):
elixir-0002 → UNDF-2026-000000698 (typespec used_type_pairs O(T²))
r-source-0002 → UNDF-2026-000000711 (.walkClassGraph match dedup O(S²))
ruby-0003 → UNDF-2026-000000712 (RubyGems dependent_gems O(N²×D))
victoria-metrics-0002 → UNDF-2026-000000717 (MetricName tag-filter O(T×I))
Total: 720 UNDF assigned
2026-03-29 22:28:31 -04:00
538bc6335e
thrift: remove thrift-0002 duplicate (same defect as thrift-0001 is_struct_storage_not_throwing)
2026-03-29 22:27:35 -04:00
657dac6c22
victoria-metrics-0002: add Java unit test for MetricName tag-filter O(T×I) defect
2026-03-29 22:26:59 -04:00
a922a7ee9d
thrift-0002 + victoria-metrics-0002 + pulsar-0007 unit + kafka-0010 fix
...
thrift-0002: t_cpp_generator::is_struct_storage_not_throwing() vector<t_field*>
member deduplication uses std::find O(M²) — fix with unordered_set
victoria-metrics-0002: MetricName RemoveTagsOn/RemoveTagsIgnoring hasTag()
O(T×I) linear scan inside per-metric loop — fix with map-based tag set
pulsar-0007: ModularLoadManagerImpl.reapDeadBrokerPreallocations() takes
List<String> aliveBrokers, calls contains() O(B) per broker — fix with HashSet
kafka-0010: fix unit test worst-case ordering (shared-topic last for slow path)
2026-03-29 22:25:29 -04:00
ba818693db
nmap-0002 + haproxy-0004 + nginx-0004 + weechat-0003 + zeek-0002 + curl-0004: 6 new CWE-407 defects in network tools; count 693→699
...
nmap-0002: nmap.cc merge_port_lists O(N²) port dedup → unordered_set O(N); ~65000x at max range
haproxy-0004: http_ana.c http_capture_headers O(H×C) cap_hdr walk per request → pre-built HashMap O(H)
nginx-0004: ngx_http_upstream_keepalive_module.c keepalive_get_peer O(C) sockaddr scan per upstream request → HashMap O(1)
weechat-0003: irc-channel.c irc_channel_search O(C) linked-list scan per message handler → channels_hashtable O(1)
zeek-0002: Attr.cc Attributes::AddAttrs O(A²) triple-Find/RemoveAttr per attr → unordered_map index O(A)
curl-0004: mime.c search_header O(P×H) 3x per part per mime_add_headers → pre-indexed header name set O(P)
2026-03-29 22:22:11 -04:00
421f3352c7
spidermonkey-0005: GatherAvailableModuleAncestors O(M²) execList ContainsElement scan
2026-03-29 22:20:07 -04:00
0fb709cb72
hive-0003
2026-03-29 22:19:47 -04:00
7e7cd2945a
hive-0003 + pinot-0002 + trino-0002: TaskTracker O(T2); PartialUpsert O(CxP); SkewedRebalancer O(P2); zookeeper/presto CLEAN
2026-03-29 22:17:01 -04:00
72c98d9af6
netty-0001 + dubbo-0002 + doris-0004: DNS dedup O(R²); MethodWalker O(2^D); NormalizeRepeat O(S×G); count 621→624
...
- netty-0001: DnsResolveContext.finalResult ArrayList.contains O(R²) dedup on DNS records
File: resolver-dns/.../dns/DnsResolveContext.java line ~914
Fix: LinkedHashSet gives O(1) dedup with preserved insertion order
Ratio: 24.5x at R=50 records
- dubbo-0002: MethodWalker.walkHierarchy no visited guard — O(2^D) diamond recursion
File: dubbo-rpc-triple/.../rest/util/MethodWalker.java walkHierarchy()
Fix: add visited HashSet, return early if already visited
Ratio: 8x at D=3 (common Spring proxy depth)
- doris-0004: NormalizeRepeat.buildContextWithAlias ImmutableList.contains O(S×G) for GROUPING SETS
File: fe-core/.../nereids/rules/analysis/NormalizeRepeat.java buildContextWithAlias()
Fix: convert groupingSetExpressions to HashSet before loop — O(1) lookup
Ratio: 49x for CUBE(c1..c8), 1000x+ for CUBE(c1..c10)
2026-03-29 22:11:57 -04:00
4c52d9ee51
scala-0002: RefChecks.intersectionIsEmpty O(D²) 100x; julia/octave deeper scan CLEAN
2026-03-29 22:11:30 -04:00
2785a0ea1e
pandas: fix second 0002 collision — rename list-scan stub to pandas-0003
2026-03-29 22:08:05 -04:00
