a86a765544
minetest (Luanti): 5 CWE-407 defects, all 5 MOADs scanned
...
minetest-0001: mg_ore.cpp c_wherein vector CONTAINS in voxel inner loop O(V*W) HIGH 3.3x
minetest-0002: mg_decoration.cpp c_place_on/c_spawnby vector CONTAINS O(S*P) MEDIUM 1.8x
minetest-0003: l_env.cpp find_node_near/find_nodes_in_area filter CONTAINS O(V*F) MEDIUM 1.6x
minetest-0004: nodedef.cpp nodeboxConnects sorted vector linear scan O(N) MEDIUM 2.1x
minetest-0005: blockmodifier.cpp ABM neighbor check sorted vector O(N) LOW-MEDIUM 1.5x
MOAD-0002: g_settings global singleton (architectural, not patchable)
MOAD-0003: thread_local log streams (properly scoped, not leaked context)
MOAD-0004: CLEAN (no credential logging found)
MOAD-0005: CLEAN (no unsynchronized cache patterns found)
2026-03-31 10:10:03 -04:00
a7907f0e12
supertuxkart-0001: item_manager randomItemsForArena O(N^2) invalid_location scan
...
CWE-407 defect in src/items/item_manager.cpp:635. std::find on
std::vector<int> invalid_location inside retry loop inside placement
loop. Fix: std::unordered_set<int> for O(1) membership. 13.8x at N=500.
MOAD-0002 through MOAD-0005 scanned CLEAN:
- MOAD-0002 (Intertangle): standard game engine singleton pattern
- MOAD-0003 (Leaked Context): thread_local g_process_type is process-scoped
- MOAD-0004 (Logged Secret): HTTP request logging already has credential denylist
- MOAD-0005 (Thundering Herd): no shared cache patterns in network code
2026-03-31 10:09:46 -04:00
77d70fdc46
mindustry CLEAN: all 5 MOADs scanned, no defects found
2026-03-31 10:09:04 -04:00
8ea8ad434f
undf: assign 935-937; cataclysm-dda 3 CWE-407 defects
...
cataclysm-0001: overmap_ui search dedup vector O(P*M), 79x
cataclysm-0002: dependency_tree dedup vector O(N^2), 2x
cataclysm-0003: surroundings_menu item/terfurn dedup O(N^2), 9x
2026-03-31 10:08:23 -04:00
3c1ab5459c
undf: assign 941-943; stamp monogame patches
2026-03-31 10:07:59 -04:00
ec50768d5c
monogame-0001/0002/0003: MonoGame CWE-407 scan, 3 defects
...
monogame-0001: IntermediateWriter.WriteSharedResources writtenSharedResources
List<string>.Contains in while loop O(R^2), fix: HashSet<string> MEDIUM
monogame-0002: IntermediateSerializer._scannedObjects List<object>.Contains
per object during scan O(N^2), fix: HashSet<object> MEDIUM
monogame-0003: OpenAssetImporter._bones List<Node>.Contains in recursive
tree import O(N*B), fix: HashSet<Node> MEDIUM
MOAD-0002 through 0005: CLEAN (single-threaded game framework, no secrets,
no leaked context, no thundering herd)
2026-03-31 10:07:48 -04:00
830b54936d
sparrow-0001/sparrow-0002: Sparrow Wallet CWE-407 scan, 2 defects
...
sparrow-0001: WalletUtxosEntry.updateUtxos() ArrayList.removeAll O(N^2)
UTXO diff uses List.removeAll which is O(current * previous).
Fix: Set-based diff via Sets.difference (same pattern already used
in WalletTransactionsEntry). MEDIUM, 250x at N=1000 UTXOs.
sparrow-0002: UtxoEntry.recountMixesDone stream().anyMatch O(M*I*T)
Whirlpool mix chain walk streams all wallet TXOs per input per mix.
Fix: HashMap<Sha256Hash, Set<Long>> index for O(1) lookup.
MEDIUM-HIGH, 50x at M=200 mixes, T=1000 TXOs.
MOAD-0002 (Intertangle): EventManager is a thin Guava EventBus singleton,
not a god object. Wallet/network/UI coupling is event-driven, acceptable.
MOAD-0003 (Leaked Context): CLEAN, no ThreadLocal usage found.
MOAD-0004 (Logged Secret): CLEAN, no private keys/mnemonics/passphrases
logged. SecureChannelSession has commented-out secret logging.
MOAD-0005 (Thundering Herd): CLEAN, no unsynchronized cache patterns.
4/4 unit tests PASS. UNDF-2026-000000931 through UNDF-2026-000000932.
2026-03-31 09:41:11 -04:00
34c888772f
CLAUDE.md: update UNDF count to 934
2026-03-31 09:40:19 -04:00
c2a1fc15cc
undf: assign 928-930; btcpayserver CWE-407 scan (3 defects)
...
btcpayserver-0001: WalletTransactionInfo.Merge Attachments.Any O(A*B) MEDIUM
btcpayserver-0002: AppService gap-fill series.All O(D*S) LOW-MEDIUM
btcpayserver-0003: StringExtensions.IsValidFileName GetInvalidFileNameChars O(F*I) MEDIUM
2026-03-31 09:39:59 -04:00
f92dc0f8aa
rust-bitcoin CLEAN: 5-MOAD scan, no defects found
...
BTreeMap/BTreeSet throughout, sort+windows for dedup, stateless design.
Rust type system prevents most MOAD patterns structurally.
2026-03-31 09:39:15 -04:00
44f4bf5253
bitcoinjs-lib CLEAN: 5-MOAD scan, all consensus-bounded
...
CWE-407 array scans exist but bounded by Bitcoin consensus (p2ms max
n=20, taptree max depth 128). No adversarial scaling possible.
No intertangle, leaked context, logged secrets, or thundering herd.
2026-03-31 09:38:24 -04:00
ede0450c2b
CLAUDE.md: update UNDF count to 927
2026-03-31 09:16:58 -04:00
995cd9af22
undf: assign 925-927; stamp cake_wallet patches
2026-03-31 09:16:17 -04:00
0f9405d169
cake_wallet 5-MOAD scan: 3 CWE-407 defects + 1 CWE-312 defect
...
MOAD-0001 (CWE-407):
- cake_wallet-0001: exchange_view_model token injection List.any() O(T*L), 275x
- cake_wallet-0002: currency_pairs_utils/pairs_utils List.contains() O(ALL*N), 139x
- cake_wallet-0003: monero/wownero _usedAddresses List.contains() O(S*U), 275x
MOAD-0004 (CWE-312):
- cake_wallet-0004: zcash_taddress_rotation prints wallet seeds to verbose log
MOAD-0002: NOTED (SettingsStore 2228 lines, DI 1765 lines, global currentWallet)
MOAD-0003: CLEAN (no Zone.current / zone-scoped wallet identity)
MOAD-0005: CLEAN (Dart single-threaded, no concurrent cache races)
8/8 unit tests PASS
2026-03-31 09:16:05 -04:00
b62fd27e28
undf: assign 920-922; stamp wasabi patches
2026-03-31 09:13:59 -04:00
737891b5a1
undf: assign 917; stamp bcoin patch
2026-03-31 09:13:04 -04:00
2002c492a0
bcoin 5-MOAD scan: 1 defect (bcoin-0001 gettxoutproof O(H*T) linear scan, 48x)
2026-03-31 09:12:53 -04:00
65389dd651
CLAUDE.md: update UNDF count to 916
2026-03-31 08:07:52 -04:00
36f9dd6a51
undf: assign 915-916; stamp wekan patches
2026-03-31 08:06:03 -04:00
d15b9b06d3
wekan-0001/wekan-0002, kodi CLEAN: 5-MOAD scan across PrusaSlicer/Kodi/Wekan
...
wekan-0001: boards.js setNewLabelOrder indexOf in sort comparator O(L^2 logL) MEDIUM 808x
wekan-0002: cards.js moveToBoard filter+includes O(M*A) MEDIUM 58x
kodi: CLEAN for CWE-407 (proper maps/sets/contains throughout)
prusaslicer-0002: fix test N parameter for reasonable runtime
cleanup: remove .class artifacts from prusaslicer tests
2026-03-31 08:05:29 -04:00
aff709eb3a
CLAUDE.md: update UNDF count to 914
2026-03-31 07:49:39 -04:00
3c3f9639cf
undf: assign 908-914; stamp transformers/ray-project/dask-project patches
2026-03-31 07:48:39 -04:00
13a4de8613
transformers-0001/ray-project-0001/dask-project-0001/dask-project-0002: 4 CWE-407 defects across 3 ML/data targets
...
transformers-0001: tokenization_python convert_ids_to_tokens O(T×S) property-rebuild-per-token MEDIUM 3.1x
ray-project-0001: dag_node _get_toplevel_child_nodes O(A²) list dedup MEDIUM 1.5x
dask-project-0001: parquet filter_partitions disjunction O(P×O) list dedup MEDIUM-HIGH 65x
dask-project-0002: methods describe_aggregate O(C²) column name dedup LOW-MEDIUM 12.7x
2026-03-31 07:48:07 -04:00
4560936024
CLAUDE.md: update UNDF count to 907
2026-03-31 07:39:47 -04:00
0606e6329a
undf: assign 907; stamp weechat-0001 patch
2026-03-31 07:38:34 -04:00
128d349072
weechat-0001: nicklist dedup O(N^2) linear search on join
...
gui_nicklist_add_nick calls gui_nicklist_search_nick which linearly
scans the nick linked list for each add. Joining a 2000-user IRC
channel causes O(N^2) work. Fix: hash table for O(1) dedup. 999x ratio.
2026-03-31 07:37:50 -04:00
53ce6d7ab6
undf: assign 898-906; stamp dosbox-x/rpcs3/ppsspp patches
2026-03-31 07:33:50 -04:00
50c1301928
dosbox-x-0001/0002, rpcs3-0001/0002/0003, ppsspp-0001/0002/0003: 8 CWE-407 defects across 3 emulators
...
DOSBox-X: overlay drive DOSnames_cache + deleted_files_in_base vector dedup (devs commented "set is probably better")
RPCS3: SPU recompiler predecessor/call vector dedup + cellSaveData blist sort comparator
PPSSPP: kernel thread/semaphore waitingThreads dedup + IR JIT byPage block removal
16/16 unit tests PASS, ratios 5-93x
2026-03-31 07:33:28 -04:00
87a11e22f9
undf: assign 895-897; stamp forgejo/snort3/tryton patches
2026-03-30 18:46:58 -04:00
8660303f5a
forgejo-0001/snort3-0001: 2 CWE-407 defects from MOAD multi-scan
...
forgejo-0001: Results.RepoIDs() slices.Contains dedup O(N^2) in code search — 107x at N=5000
snort3-0001: ServiceDiscovery service_candidates std::find dedup O(M*C) in AppID — 59x at M=10000
2026-03-30 18:46:38 -04:00
2798f926fc
CLAUDE.md: update UNDF count to 894
2026-03-30 17:40:39 -04:00
5802db9fc3
undf: assign 893-894; stamp proton patches
2026-03-30 17:39:33 -04:00
2f03245f7b
proton: 2 CWE-407 defects — find_iface_constructor O(C) linear scan + merge_user_dir list explosion
...
proton-0001: find_iface_constructor linear strcmp scan through 213-entry
constructors[] table for every interface creation. Fix: binary search.
4.6x speedup measured.
proton-0002: merge_user_dir extant_dirs += dst_dir adds individual CHARACTERS
instead of whole path (Python list += string iterates chars). Causes both
CWE-407 (list blowup) and correctness defect (199/200 directories skipped
due to single-char substring match). Fix: extant_dirs.append(dst_dir).
MOAD-0002 (Intertangle): CLEAN — env-var isolation between components
MOAD-0003 (Leaked Context): CLEAN — per-game Wine prefix isolation
MOAD-0004 (Logged Secret): CLEAN — no credential logging found
MOAD-0005 (CWE-362): CLEAN — FileLock + CRITICAL_SECTION discipline
Wine's ChangeServiceConfig password logging (wine-0001) inherited but not
in Proton's own codebase.
2026-03-30 17:38:41 -04:00
716a789008
CLAUDE.md: update UNDF count to 892
2026-03-30 17:34:31 -04:00
c12412cda6
undf: assign 887-892; stamp thunderbird patches
2026-03-30 17:33:38 -04:00
6a025795dc
thunderbird: 6 CWE-407 defects from 5-MOAD deep scan via Searchfox
...
thunderbird-0001: nsMsgAccountManager LoadAccounts IndexOf O(N^2) dedup MEDIUM 192x
thunderbird-0002: nsMsgCopyService DoNextCopy ContainsObject O(N^2) MEDIUM-HIGH 44x
thunderbird-0003: nsAutoSyncManager IndexOf in sync loops O(N^2) HIGH 751x
thunderbird-0004: nsImapFlagAndUidState Contains/IndexOf linear on sorted O(N) HIGH 107x
thunderbird-0005: nsMsgFilterList ComputeArbitraryHeaders FindInReadable O(H^2) MEDIUM 64x
thunderbird-0006: nsSpamSettings CheckWhiteList linear email scan O(M*E) MEDIUM 153x
MOAD-0002 (Intertangle): MEDIUM - singleton nsMsgAccountManager shared across protocols
MOAD-0003 (Leaked Context): LOW-MEDIUM - IMAP connection pool single auth boolean
MOAD-0004 (Logged Secret): MEDIUM - debug builds log credentials via MOZ_UPDATE_CHANNEL bypass
MOAD-0005 (CWE-362): LOW-MEDIUM - IMAP folder DB init and connection pool TOCTOU
12/12 unit tests PASS
2026-03-30 17:33:16 -04:00
f2d7a3127e
5-MOAD scan: pcsx2 2 defects, wine 1 defect + 1 MOAD-0004, thunderbird unavailable
...
PCSX2:
- pcsx2-0001: Patch::ReloadEnabledLists 4x std::find on vector O(N^2) MEDIUM 6-12x
- pcsx2-0002: GSCapture codec dedup std::find_if O(N^2) LOW 11x
- MOAD-0002/0003/0004/0005: CLEAN
Wine:
- wine-0001: ntdll/loader.c find_module_dependency O(D) linked-list dedup HIGH 7x
- MOAD-0004: ChangeServiceConfig logs password via debugstr_w MEDIUM
- MOAD-0002/0003/0005: CLEAN
Thunderbird: source unavailable (nicholasb2101/gecko-dev repo inaccessible)
2026-03-30 17:25:38 -04:00
4d2d38fe6e
undf: assign UNDF numbers, stamp patches; 886 total
2026-03-30 17:21:56 -04:00
3aaecab0e1
openscad-0001: AMF export vertex dedup std::find O(V²) → HashMap O(V)
...
Defect: export_amf.cc add_vertex() uses std::find on std::vector for every
vertex during AMF export. For meshes with V vertices, total cost is O(V²).
Fix: parallel unordered_map<vertex_str, size_t> for O(1) lookup.
Unit test: 5-16x ratio at V=500-5000, PASS.
2026-03-30 17:21:45 -04:00
e770a47477
undf: assign UNDF numbers, stamp patches; 882 total
2026-03-30 16:57:20 -04:00
0de158cd7a
monitoring scan: nagioscore 2 defects, zabbix 2 defects, zenoss CLEAN
...
nagioscore-0001: add_notification find_notification linked-list O(C²) HIGH 999x
nagioscore-0002: add_object_to_objectlist linked-list dedup O(N²) MEDIUM 1499x
zabbix-0001: process_problem_tags tag dedup O(T²) HIGH 1499x
zabbix-0002: discoverer_queue_lock job ID dedup O(N²) MEDIUM 1499x
zenoss: CLEAN — uses OrderedDict/set/catalog throughout
4/4 PASS, 4 defects across 2 targets
2026-03-30 16:56:56 -04:00
a4a1e444e6
undf: assign 741-880; stamp patches; generate_undf.py sync
2026-03-30 16:52:36 -04:00
c9f4953656
am-monitor: CWE-407 scan CLEAN — sets/dicts throughout, no algorithmic complexity defects
2026-03-30 16:51:45 -04:00
1f9babda46
happymon: CWE-407 scan CLEAN — no algorithmic complexity defects
...
Fox's own Python monitoring tool. All registries use dicts,
dedup uses sets, list membership checks are config-bounded (1-3 items).
2026-03-30 16:50:02 -04:00
494d1c82a3
undf: assign UNDF numbers, stamp patches; 878 total
2026-03-30 16:46:38 -04:00
8b5e3c35b1
undf: assign UNDF numbers, stamp patches; 875 total
2026-03-30 16:45:00 -04:00
0dbb699821
openai SDK dependency chain CWE-407 scan: all 5 targets CLEAN
...
openai-python, httpx, pydantic, tiktoken, openai-node — no CWE-407 defects.
All targets use proper dict/set/frozenset for membership tests in hot paths.
2026-03-30 16:44:33 -04:00
95008feda5
llm-infra scan: litellm-0001 _delete_deployment combined_id_list O(R*C); haystack CLEAN
...
litellm-0001: ProxyConfig._delete_deployment() checks model_id not in
combined_id_list (a plain Python list) for each router model ID during
config refresh. O(R*C) where R=router models, C=combined list. Fix:
convert to set before loop. MEDIUM severity, 6.5x at N=500. 1/1 PASS.
Haystack: no CWE-407 defects found. Uses dicts and sets throughout
for membership checks (scheduled_components set, storage dict, etc.).
2026-03-30 16:44:06 -04:00
7e717432dd
undf: assign UNDF-2026-000000874; stamp vllm-0001 patch
2026-03-30 16:42:12 -04:00
80b26e82b6
ml-inference scan: vllm-0001 LoRA convert_mapping list.index O(B*L); ollama+langchain CLEAN
...
vllm-0001: punica_wrapper/utils.py convert_mapping() calls
lora_index_to_id.index(x) per token in batch — O(B*L) where
B=batch_size, L=loaded_loras. Code has "TODO index can be slow"
comment. Fix: pre-build dict for O(1) lookup. 7x at B=2000/L=64.
Ollama: all slices.Contains on bounded slices (1-8 items).
LangChain: orchestration code, all membership bounded by k param.
2026-03-30 16:41:47 -04:00
