a9cd5686fb
undf: stamp amarok + strawberry patches (UNDF-2026-000000833..840)
2026-03-30 14:41:25 -04:00
fb2c48dc37
undf: stamp kdenlive-0005..0008 (UNDF-2026-000000835..838)
2026-03-30 14:40:29 -04:00
0f9e84d300
amarok + strawberry: 4 CWE-407 defects — playlist queue O(N×Q), grouping proxy O(G×S), collection watcher O(S×F), scrobbler cache O(F×C)
...
amarok-0001: TrackNavigator::queueIds QQueue.contains in loop MEDIUM 1000x
amarok-0002: QtGroupingProxy::mapFromSource QList.contains/indexOf in nested iteration MEDIUM 2426x
strawberry-0001: CollectionWatcher::ScanSubdirectory QStringList files_on_disk contains+removeAll HIGH 2525x
strawberry-0002: ScrobblerCache::Flush QList.contains/removeAll in loop MEDIUM 334x
2026-03-30 14:40:10 -04:00
70741a6157
kdenlive: 4 new CWE-407 defects (0005-0008); deeper scan beyond thumbnail/timeline
...
kdenlive-0005 PreviewManager m_renderedChunks/m_dirtyChunks QVariantList .contains() O(N^2) MEDIUM 219x
kdenlive-0006 TimelineController canceled guides std::find O(G*C) MEDIUM 160x
kdenlive-0007 AssetParameterModel m_rows.indexOf in param loops O(P*R) MEDIUM 25x
kdenlive-0008 UrlListParamWidget addItemsInSameFolder std::find on QMap values O(E*M) MEDIUM 200x
8/8 unit tests PASS
2026-03-30 14:39:58 -04:00
6e6609dbdb
CLAUDE.md: update UNDF count to 832
2026-03-30 14:33:12 -04:00
9bdea940fc
undf: assign 828-832; stamp patches; tomcat-0001/hibernate-orm-0001/netty-0001/netty-0002
2026-03-30 13:55:42 -04:00
32cbeb5dcb
tomcat-0001/hibernate-orm-0001/netty-0001/netty-0002: 4 new CWE-407 defects
...
tomcat-0001: WebSocket getNegotiatedSubprotocol List.contains O(R×S) MEDIUM 52x
hibernate-orm-0001: FK ordering buildRecursiveOrderedFkSecondPasses List.contains O(N²) HIGH 2.8x
netty-0001: ALPN select/selected List.contains O(S×P) MEDIUM 26x
netty-0002: DnsResolveContext dedup ArrayList.contains O(R²) MEDIUM 30x
All 4/4 unit tests PASS.
2026-03-30 13:55:21 -04:00
7f2c2a1a36
undf: assign UNDF-2026-000000823; stamp terraform-0001/ansible-0002/ansible-0003
2026-03-30 13:29:54 -04:00
e0aba0e21e
terraform-0001/ansible-0002/ansible-0003: CWE-407 deeper scan — 3 defects, 6/6 PASS
...
terraform-0001: Tarjan SCC inStack linear scan O(E*V) — HIGH, 994x at V=2000
ansible-0002: Host.add_group() list membership O(A*G) — MEDIUM, 499x at G=1000
ansible-0003: Handler.notify_host() list membership O(H^2) — MEDIUM, 499x at H=1000
2026-03-30 13:29:25 -04:00
3d2957276d
undf: assign UNDF-2026-000000822; stamp telegraf-0001 patch
2026-03-30 13:28:35 -04:00
27382ae791
netdata CLEAN; telegraf-0001 dedup GetField O(F²) — 1 defect, 1/1 PASS
...
Netdata: well-engineered with Judy arrays, dictionaries, hash tables
throughout. No CWE-407 defects found.
Telegraf: dedup processor Apply() calls m.GetField(f.Key) O(F) inside
field comparison loop → O(F²). Fix: build field map for O(1) lookup.
125x overhead at F=500.
2026-03-30 13:27:58 -04:00
38634f0b25
keycloak+shiro: CWE-407 scan CLEAN — both use HashSet throughout for membership testing
2026-03-30 13:25:06 -04:00
2ccaf9e7fa
undf: assign UNDF-2026-000000821; stamp loki-0001 patch
2026-03-30 13:18:59 -04:00
689ec25d05
grafana: 3 CWE-407 defects; loki: 1 CWE-407 defect; 4/4 PASS
...
grafana-0001: getDashboardsSharedWithUser dashboard UID dedup O(P^2) MEDIUM 2.5x
grafana-0002: folder UID dedup slices.Contains O(P^2) 4 sites MEDIUM 4x
grafana-0003: deduplicateAvailableFolders ContainsFunc O(F*A) MEDIUM 9.3x
loki-0001: DAG AddEdge/Eliminate slices.Contains O(E^2) LOW 2.1x
2026-03-30 13:17:58 -04:00
cf2c734de1
undf: assign UNDF-2026-000000819 through 000000820; rename hive-0004/hive-0005; stamp patches
2026-03-30 13:17:14 -04:00
1a1abc2154
beam+hive: CWE-407 scan — Beam CLEAN, Hive 2 defects (mergeSchema + averageColumnSizes)
...
Beam: exhaustive scan of sdks/java/core + runners — all membership tests already
use proper Set types (HashSet, LinkedHashSet, ImmutableSet, TreeSet). CLEAN.
Hive hive-0001: SharedWorkOptimizer.mergeSchema() uses List.contains() in loops
for neededColumnIDs/neededColumns/virtualCols dedup. O(D*R) per list. MEDIUM, 3-4x.
Hive hive-0002: HiveRelMdSize.averageColumnSizes() uses ImmutableList.contains(i)
in column loop during Calcite metadata queries. O(C*L). MEDIUM, 3-5x.
Both patched with HashSet wrappers. 2/2 unit tests PASS.
2026-03-30 13:05:40 -04:00
db958a2038
CLAUDE.md: update UNDF count to 817
2026-03-30 13:05:14 -04:00
4f51d81913
undf: assign UNDF-2026-000000815 through 000000817; stamp superset patches
2026-03-30 13:04:50 -04:00
5c94ac750a
superset+metabase: CWE-407 scan — 3 defects in Superset, Metabase CLEAN
...
Superset:
- superset-0001: SecurityManager._get_pvms_from_builtin_role pvm list dedup O(Regex*PVMs*R) HIGH 8x
- superset-0002: DashboardDAO.update_native_filters_config filter dedup O(M*U) MEDIUM 40x
- superset-0003: import_datasource metric/column dedup O(N^2) list rebuild MEDIUM 68x
Metabase: CLEAN — Clojure backend uses sets/maps throughout for membership tests
2026-03-30 13:04:14 -04:00
0b80195515
CLAUDE.md: update UNDF count to 813
2026-03-30 12:57:39 -04:00
9b3008a2b1
undf: assign UNDF-2026-000000813; stamp neovim-0001 patch
2026-03-30 11:46:05 -04:00
178d9c03db
scan: HandBrake + Emacs CWE-407 — both CLEAN
...
HandBrake: libhb uses array-backed lists bounded by media metadata
sizes (tracks, subtitles, chapters, presets). No user-controlled
quadratic growth path found.
Emacs: C core uses Fmemq/Fmember on small bounded lists (property
lists, error conditions, flags). Larger lists (features ~1000,
charsets ~200) only scanned in non-hot-path code. Elisp delete-dups
already has hash optimization for >100 elements.
2026-03-30 11:45:36 -04:00
ae2eaf3be9
undf: assign UNDF-2026-000000807 through 000000812; stamp vscode+zed patches
2026-03-30 11:43:50 -04:00
05e4902a9e
vscode+zed: CWE-407 scan — 6 defects across 2 code editors
...
VS Code (4 defects):
- vscode-0001: extensionGalleryService uuid dedup O(N×M) MEDIUM 100x
- vscode-0002: abstractExtensionManagementService deps O(D²) MEDIUM 49x
- vscode-0003: userDataSync merge compare() O(N×M) across 8 files MEDIUM 250x
- vscode-0004: configurationModels override identifiers O(N×M) LOW-MEDIUM 18x
Zed (2 defects):
- zed-0001: lsp_store LSP edit dedup Vec::contains O(E²) MEDIUM 49x
- zed-0002: extension_builder manifest dedup Vec::contains O(N²) LOW 24x
6/6 unit tests PASS
2026-03-30 11:43:31 -04:00
d05d4bd6f0
CLAUDE.md: update UNDF count to 806
2026-03-30 11:34:10 -04:00
f8eb370fe4
undf: assign 806; stamp vlc+obs-studio patches
2026-03-30 11:33:21 -04:00
15a65b2227
vlc+obs-studio: CWE-407 scan — 2 defects (vlc-0001 randomizer_Remove O(N×C), obs-studio-0001 push_audio_tree da_find O(N²)/frame)
2026-03-30 11:33:01 -04:00
860b0ee52e
CLAUDE.md: update UNDF count to 805
2026-03-30 11:29:53 -04:00
20f60ee078
undf: assign 798-805; stamp kdenlive+shotcut patches
2026-03-30 11:28:35 -04:00
13db08af50
darktable+scribus: CWE-407 scan — 6 defects (3 darktable, 3 scribus)
...
darktable-0001: map_locations image diff g_list_find O(N*M) MEDIUM 375x
darktable-0002: tags _tag_add_tags_to_list g_list_find O(T*L) MEDIUM 375x
darktable-0003: map view clustering g_list_find(sel_imgs) O(I²×S) HIGH 160x
scribus-0001: getSortedStyleList retList.contains O(N²) MEDIUM 167x (×4 copies)
scribus-0002: getUsedPatterns results.contains O(I×R) MEDIUM 98x
scribus-0003: Selection::addItems m_SelList.contains O(N×M) MEDIUM 2100x
2026-03-30 11:28:25 -04:00
f4593ef84a
kdenlive+shotcut: CWE-407 scan — 5 defects (4 kdenlive, 1 shotcut)
...
kdenlive-0001: ThumbnailCache m_storedOnDisk vector<int> std::find dedup O(C*P*V) MEDIUM
kdenlive-0002: TimelineModel clipIds vector std::find in mix loop O(N^2) MEDIUM
kdenlive-0003: TimelineController sorted_clips vector std::find in moveGroup O(N^2) MEDIUM
kdenlive-0004: TimelineModel all_items list std::find in resize O(N^2) MEDIUM
shotcut-0001: PlaylistProxyModel m_hashes vector std::find in filterAcceptsRow O(N^2) MEDIUM
5/5 unit tests PASS
2026-03-30 11:28:05 -04:00
8a27ea4105
CLAUDE.md: update UNDF count to 794, add image/video/office priority targets
2026-03-30 11:22:42 -04:00
20089cbd72
undf: assign 793-794; stamp gimp patches
2026-03-30 11:22:14 -04:00
9b60b61e9c
imagemagick/gimp: CWE-407 findings
...
imagemagick-0001: UHDR coder GetImageListLength() O(N) in for-loop = O(N²) MEDIUM
imagemagick-0002: SyncImageList nested scene-dedup O(N²) MEDIUM
gimp-0001: layer_stack_cmp g_list_find in loop O(S²×L²) MEDIUM
gimp-0002: remove_from_layer_stack nested g_list_remove O(C×S×L) LOW-MEDIUM
4 defects total, 4/4 unit tests PASS
2026-03-30 11:21:24 -04:00
b5c2a3d989
undf: stamp patches, update registry to 792
2026-03-30 11:15:59 -04:00
bf6a727f08
audacity: add Java unit test for CWE-407 defects (audacity-0001/0002)
2026-03-30 11:15:03 -04:00
9b71d0d527
undf: assign 778-785; stamp inkscape/blender patches
2026-03-30 11:13:27 -04:00
bdfda13c7e
inkscape/blender: CWE-407 scan — 6 defects across 2 creative tool targets
...
Inkscape (3 defects):
- inkscape-0001: SPObject::getLinkedRecursive vector dedup O(N^2) HIGH
- inkscape-0002: ObjectSet::raise()/lower() vector membership O(S*N) MEDIUM
- inkscape-0003: get_all_items_recursive exclude scan O(C*E) MEDIUM
Blender (3 defects):
- blender-0001: node_runtime socket chain cycle detection Vector.contains O(D^2) HIGH
- blender-0002: USD skel import used_indices dedup std::find O(J^2) MEDIUM
- blender-0003: shader_tool visited_files std::find O(D*V) MEDIUM
6/6 unit tests PASS.
2026-03-30 11:13:03 -04:00
0b5409ff95
libtorrent-0001/qbittorrent: CWE-407 scan — 1 defect, 1 CLEAN
...
libtorrent-0001: file_storage::get_or_add_path std::find on m_paths vector O(F*P) MEDIUM 250x
qBittorrent: CLEAN (QSet/QHash throughout for membership tests)
2026-03-30 10:39:32 -04:00
a0dde8b41a
undf: assign 775-776; stamp deluge patches
2026-03-30 10:37:20 -04:00
176d9f88de
deluge: CWE-407 FilterManager+TorrentManager list.remove()/index() O(T^2)
...
deluge-0001: FilterManager filter_torrent_ids() and filter_state_active()
use list.remove(id) inside a loop — O(T^2). Fix: set-based removal / list
comprehension. 94x overhead at T=2000.
deluge-0002: TorrentManager get_torrent_list() uses list.index()+pop()
inside a loop — O(T^2). Fix: list comprehension. 98x overhead at T=2000.
Transmission: re-confirmed CLEAN (binary search blocklist, map peer pool,
bitfield piece tracking).
2 defects, 4/4 PASS.
2026-03-30 10:36:58 -04:00
c967910a44
undf: assign UNDF-2026-000000774; stamp llvm-0006 patch
2026-03-30 10:34:45 -04:00
d0cb5fa834
llvm-0006: PartialInlining IsSingleExit BlockList is_contained O(N^2)
...
CWE-407: is_contained(BlockList, Succ) inside nested for loops in
computeOutliningColdRegionsInfo. Fix: SmallPtrSet for O(1) membership.
GCC deep scan: CLEAN (bitmaps/hash_sets throughout).
2026-03-30 10:34:02 -04:00
36595d65fb
undf: stamp rustc/swift patches, update registry to 773
2026-03-30 10:27:44 -04:00
b37db35655
rustc/swift: CWE-407 scan — rustc CLEAN, swift 1 defect
...
rustc: Exemplary use of FxHashSet/BitSet/IntervalSet throughout;
no linear membership tests on hot paths.
swift-0001: LoadableByAddress.cpp StructLoweringState uses SmallVector
with std::find for largeLoadableArgs/applies membership — O(I×A)
per function, 322x overhead at A=500. Fix: SmallPtrSet shadow.
2026-03-30 10:26:11 -04:00
79a77db4f8
undf: assign 768-770; stamp minio patches
2026-03-30 10:25:20 -04:00
cb853893e5
minio: 3 CWE-407 defects; etcd: CLEAN (deeper scan)
...
minio-0001: healingTracker.isHealed() slices.Contains O(B×H) MEDIUM 25x
minio-0002: isBucketDecommissioned() slices.Contains O(P×D) MEDIUM 24x
minio-0003: isGroupDescEqual/isUserInfoEqual slices.Contains O(M²) MEDIUM 13x
etcd: maps + interval trees throughout; no CWE-407 defects found
2026-03-30 10:24:48 -04:00
ae8621d527
undf: stamp cpython-0001/0002 + ruby-0001 patches
2026-03-30 10:15:08 -04:00
44d513d045
cpython/ruby: CWE-407 scan — 2 CPython defects, 1 Ruby defect
2026-03-30 10:13:34 -04:00
76ffba4a60
tidb/scylladb: CWE-407 scan — renumber tidb patches, stamp UNDF
...
tidb-0001: partition drop name lookup O(P×D) → O(P+D) (27x at P=8192)
tidb-0002: predicate simplification (merged into tidb-0002 in prior commit)
tidb-0003: list partition group intersect O(G²) → O(G) (renumbered from 0002)
scylladb-0001: UNDF stamp added
2026-03-30 10:13:33 -04:00
