b4e2eda927
distlib/luigi/zookeeper/mybatis/solc/solana/go-ethereum: CWE-407 patches + unit tests; solana CLEAN
2026-03-30 07:06:26 -04:00
c9e86c450c
opensmtpd-0001: mta_handle_envelope TAILQ_FOREACH O(N²) task lookup — patch + unit test
...
Add patch replacing linear TAILQ_FOREACH scan in mta_handle_envelope()
with tree_get() on a per-relay task_by_msgid splay-tree index; assign
UNDF-2026-000000201. Unit test confirms 100x op-count improvement at
N=100 tasks/relay.
2026-03-30 07:00:50 -04:00
2573ec8802
undf: assign 721-726; salt-0001/0002/0003 CWE-407 list→set patches
2026-03-30 06:59:11 -04:00
f176e86fbd
ninja-0001/ninja-0002: CWE-407 depfile dedup and output validation O(N²)→O(N)
...
ninja-0001: depfile_parser.cc std::find over ins_/outs_ vectors is O(N) per
token → O(N²) total parse; fix adds unordered_set ins_seen_/outs_seen_ members
to DepfileParser for O(1) duplicate detection (490x at N=1000).
ninja-0002: graph.cc std::find_if over edge->outputs_ called for each depfile
output token is O(M×N); fix builds unordered_set from edge outputs once before
the loop for O(M+N) total (125x at M=N=500).
2026-03-30 06:56:54 -04:00
740f17256b
undf: assign 721; stamp spidermonkey-0005
2026-03-30 06:47:50 -04:00
9cd01d9fae
CLAUDE.md: update UNDF count to 720
2026-03-29 22:29:59 -04:00
390ce56a83
cleanup: remove artifact .class and .go test files from defects/scala and defects/victoria-metrics
2026-03-29 22:28:42 -04:00
25c2bafdee
undf: assign 694-720; stamp patches; ruby-0003/elixir-0002/r-source-0002/victoria-metrics-0002
...
New UNDF assignments (693→720):
elixir-0002 → UNDF-2026-000000698 (typespec used_type_pairs O(T²))
r-source-0002 → UNDF-2026-000000711 (.walkClassGraph match dedup O(S²))
ruby-0003 → UNDF-2026-000000712 (RubyGems dependent_gems O(N²×D))
victoria-metrics-0002 → UNDF-2026-000000717 (MetricName tag-filter O(T×I))
Total: 720 UNDF assigned
2026-03-29 22:28:31 -04:00
538bc6335e
thrift: remove thrift-0002 duplicate (same defect as thrift-0001 is_struct_storage_not_throwing)
2026-03-29 22:27:35 -04:00
657dac6c22
victoria-metrics-0002: add Java unit test for MetricName tag-filter O(T×I) defect
2026-03-29 22:26:59 -04:00
a922a7ee9d
thrift-0002 + victoria-metrics-0002 + pulsar-0007 unit + kafka-0010 fix
...
thrift-0002: t_cpp_generator::is_struct_storage_not_throwing() vector<t_field*>
member deduplication uses std::find O(M²) — fix with unordered_set
victoria-metrics-0002: MetricName RemoveTagsOn/RemoveTagsIgnoring hasTag()
O(T×I) linear scan inside per-metric loop — fix with map-based tag set
pulsar-0007: ModularLoadManagerImpl.reapDeadBrokerPreallocations() takes
List<String> aliveBrokers, calls contains() O(B) per broker — fix with HashSet
kafka-0010: fix unit test worst-case ordering (shared-topic last for slow path)
2026-03-29 22:25:29 -04:00
ba818693db
nmap-0002 + haproxy-0004 + nginx-0004 + weechat-0003 + zeek-0002 + curl-0004: 6 new CWE-407 defects in network tools; count 693→699
...
nmap-0002: nmap.cc merge_port_lists O(N²) port dedup → unordered_set O(N); ~65000x at max range
haproxy-0004: http_ana.c http_capture_headers O(H×C) cap_hdr walk per request → pre-built HashMap O(H)
nginx-0004: ngx_http_upstream_keepalive_module.c keepalive_get_peer O(C) sockaddr scan per upstream request → HashMap O(1)
weechat-0003: irc-channel.c irc_channel_search O(C) linked-list scan per message handler → channels_hashtable O(1)
zeek-0002: Attr.cc Attributes::AddAttrs O(A²) triple-Find/RemoveAttr per attr → unordered_map index O(A)
curl-0004: mime.c search_header O(P×H) 3x per part per mime_add_headers → pre-indexed header name set O(P)
2026-03-29 22:22:11 -04:00
421f3352c7
spidermonkey-0005: GatherAvailableModuleAncestors O(M²) execList ContainsElement scan
2026-03-29 22:20:07 -04:00
0fb709cb72
hive-0003
2026-03-29 22:19:47 -04:00
7e7cd2945a
hive-0003 + pinot-0002 + trino-0002: TaskTracker O(T2); PartialUpsert O(CxP); SkewedRebalancer O(P2); zookeeper/presto CLEAN
2026-03-29 22:17:01 -04:00
e52caba572
outreach: update scala.md with scala-0002 (intersectionIsEmpty 100x)
2026-03-29 22:12:55 -04:00
72c98d9af6
netty-0001 + dubbo-0002 + doris-0004: DNS dedup O(R²); MethodWalker O(2^D); NormalizeRepeat O(S×G); count 621→624
...
- netty-0001: DnsResolveContext.finalResult ArrayList.contains O(R²) dedup on DNS records
File: resolver-dns/.../dns/DnsResolveContext.java line ~914
Fix: LinkedHashSet gives O(1) dedup with preserved insertion order
Ratio: 24.5x at R=50 records
- dubbo-0002: MethodWalker.walkHierarchy no visited guard — O(2^D) diamond recursion
File: dubbo-rpc-triple/.../rest/util/MethodWalker.java walkHierarchy()
Fix: add visited HashSet, return early if already visited
Ratio: 8x at D=3 (common Spring proxy depth)
- doris-0004: NormalizeRepeat.buildContextWithAlias ImmutableList.contains O(S×G) for GROUPING SETS
File: fe-core/.../nereids/rules/analysis/NormalizeRepeat.java buildContextWithAlias()
Fix: convert groupingSetExpressions to HashSet before loop — O(1) lookup
Ratio: 49x for CUBE(c1..c8), 1000x+ for CUBE(c1..c10)
2026-03-29 22:11:57 -04:00
4c52d9ee51
scala-0002: RefChecks.intersectionIsEmpty O(D²) 100x; julia/octave deeper scan CLEAN
2026-03-29 22:11:30 -04:00
2785a0ea1e
pandas: fix second 0002 collision — rename list-scan stub to pandas-0003
2026-03-29 22:08:05 -04:00
0f7d8485f0
undf: assign 681-693; stamp 20 patches; numpy/pandas/scipy/scylladb/clickhouse/cockroachdb/duckdb/moby/simplex-chat new defects
2026-03-29 22:05:46 -04:00
b96c9b4b74
pandas: fix ID collision — rename style-render→pandas-0002
2026-03-29 22:04:43 -04:00
c8d27a8d18
numpy: fix ID collisions — rename stack-arrays→0002, join-by-names→0003
2026-03-29 22:04:26 -04:00
5dc86a9bb1
game-engines: raylib-0001 GetGlyphIndex O(T×G), sdl3-0001 TRACK_RESOURCE O(N²); 2 new defects
...
raylib-0001: GetGlyphIndex scans all G glyphs per character in every
DrawText/MeasureText call — O(T×G) per render. Fix: hash map at load time.
228× speedup at G=1000, 814× at G=4000. UNDF-2026-000000259.
sdl3-0001: SDL3 GPU TRACK_RESOURCE macro does linear scan for duplicate
check before adding a resource to the command buffer tracked list — O(N²)
total across all bind calls per frame. Affects Vulkan, D3D12, and Metal
backends identically. Fix: hash set keyed by pointer identity. 41× at N=1000.
UNDF-2026-000000273.
All 10/10 unit tests PASS.
2026-03-29 22:04:06 -04:00
d9ca5b236f
simplex-chat-0004: introduceToRemaining notElem O(N×M) member dedup; fix: Set.notMember O(log N)
2026-03-29 22:03:20 -04:00
eb534f0944
moby-0002: networkNodes []string O(N²) node dedup; fix: map[string]struct{} O(1)
2026-03-29 22:01:11 -04:00
65c4a2c263
bottle/gorm/axum/actix-web/gin/fiber: CWE-407 scan; 0 new defects, 4 CLEAN
...
bottle: CLEAN — routing uses dict (O(1)), plugin dedup via set(), template cache via dict
gorm: CLEAN — ReorderModels uses map[string]bool, schema uses pre-built field maps
axum: CLEAN — MethodFilter is bitmask O(1), protocols use BTreeSet, no hot-path Vec::contains
actix-web: CLEAN — logger uses HashSet, accept-encoding uses HashSet, introspection is startup-only
gin: no new defects beyond gin-0001 (existing)
fiber: no new defects beyond fiber-0001 (existing)
2026-03-29 21:56:05 -04:00
9325c98470
moad-sweep: 9 initial findings — MOAD-0005 (Hungry Regex) x1, MOAD-0006 (Thundering Herd) x8
...
MOAD-0005 candidates (ReDoS):
- bleach-MOADX-0001: sanitize_css O(2^N) — 71-char input causes 12s hang HIGH
MOAD-0006 candidates (Thundering Herd / cache stampede):
- hibernate-orm-MOADX-0001: QueryInterpretationCacheStandardImpl HQL plan cache HIGH
- elasticsearch-MOADX-0001: EnrichCache "intentionally non-locking" enrich search HIGH
- hadoop-MOADX-0001: FederationJCache/FederationCaffeineCache YARN default config HIGH
- celery-MOADX-0001: BaseBackend.get_task_meta chord fan-in Redis stampede HIGH
- traefik-MOADX-0001: CNAMEFlatten data race + N*30s DNS stampede HIGH
- kafka-MOADX-0001: CachedConnectors.lookup classloader scan MEDIUM
- spring-MOADX-0001: AbstractFallbackCacheOperationSource @Cacheable cold start MEDIUM
- django-MOADX-0001: cached.Loader.get_template template compile MEDIUM
CLEAN: Consul (singleflight), Kubernetes (RWMutex), Prometheus (per-scraper),
Pulsar (AsyncLoadingCache), Cassandra (LoadingCache), Flink (CAS loop),
ZooKeeper (synchronized), Airflow (hand-rolled singleflight)
2026-03-29 21:09:07 -04:00
1f48d1b89c
scanner: undfscand v1.0.0 — UNDF patch verification scanner (C/pthreads)
...
Self-contained C scanner that reads UNDF-REGISTRY.json, parses patch .md
files to extract file paths and code patterns, walks a target directory
tree, and classifies each registered defect as PATCHED/UNPATCHED/UNKNOWN/
NOT_FOUND. Thread pool via pthreads. Bundled MD5+SHA256, no external deps.
2026-03-29 21:07:54 -04:00
7b07951882
cleanup: remove duplicate groovy-0001/0002 docs (same UNDF as originals); stamp swift-0001
2026-03-29 20:32:55 -04:00
61a717bfcc
diamond-scan-deeper: kotlin/scala3/groovy/ghc O(2^D) hierarchy traversal — CLEAN + groovy-0001/0002 patches
...
Kotlin: confirmed CLEAN (DFS.VisitedWithSet throughout, existing marker valid)
Scala3: confirmed CLEAN (BaseDataBuilder.addAll deduplicates, existing marker valid)
GHC: CLEAN — NameSet/UniqSet/ExpansionFuel tracking in all superclass expansion paths
(checkClassCycles, mk_strict_superclasses, transSuperClasses, closeWrtFunDeps)
Groovy: CLEAN for diamond — getAllInterfaces/collectAllInterfacesReverseOrder/addAllInterfaces
all use if(set.add(node)) guards (GROOVY-11036)
groovy-0001/0002 patch docs created (O(N²) membership scans, pre-existing UNDF assigned)
Clojure: CLEAN (set-based BFS, supers/ancestors use set-based worklist)
2026-03-29 20:30:49 -04:00
2f32199987
claude.md: update UNDF count 591→680; last run 2026-03-30
2026-03-29 20:29:42 -04:00
130e4fb159
undf: assign 671-680 to diamond-scan defects; 680 total assigned
...
New defects from diamond O(2^D) sweep:
- cpython-0002/0003/0004: pydoc.allmethods, turtle.__methodDict, idlelib.rpc._getmethods
- micronaut-0005/0006/0007: populateTypeHierarchy, populateTypeArgumentsForInterfaces, SuperclassAwareTypeVisitor
- quarkus-0004/0005: HierarchyDiscovery.discoverTypes, ConfigMappingUtils.collectInterfacesRec
- weld-0004/0005: HierarchyDiscovery.discoverTypes, Services.identifyServiceInterfaces
- rails-0019: Digestor#dependency_digest Array#include? O(N²)
- spring-0007: AnnotationsScanner.processClassHierarchy O(2^D)
- django-0007: migrations.state.flatten_bases O(2^D)
- typescript-0005: hasBaseType O(2^D)
- hibernate-validator-0003: ClassHierarchyHelper.getImplementedInterfaces O(2^D)
- swift-0001: QualifiedLookupRequest::evaluate protocol superclass O(2^D)
2026-03-29 20:27:09 -04:00
39981c70ad
diamond-scan: fix collisions, add remaining diamond defects from parallel agents
...
Renumbering fixes (collisions with pre-existing IDs):
- spring-0001-annotations-scanner → spring-0007 (spring-0001 was already assigned)
- hibernate-0001-class-hierarchy-helper → hibernate-validator-0003 (wrong ecosystem/numbering)
- django-0006-migrations-flatten-bases → django-0007 (django-0006 was already assigned)
New diamond defects from agents that rate-limited before committing:
- micronaut-0007: SuperclassAwareTypeVisitor.getInterfaces O(2^D) (new site)
- quarkus-0005: ConfigMappingUtils.collectInterfacesRec O(2^D) (new site)
- weld-0005: Services.identifyServiceInterfaces O(2^D) (new site)
- typescript-0005: hasBaseType O(2^D) diamond interface hierarchy
- rails-0019: Digestor#dependency_digest Array#include? O(N²) cycle detection
CLEAN: go, rustc (diamond recursion patterns absent)
2026-03-29 20:23:42 -04:00
bb1a6f002f
diamond-scan: llvm/gcc/swift/webkit O(2^D) type hierarchy traversal
...
swift-0001: QualifiedLookupRequest::evaluate (NameLookup.cpp:2860) pushes
protocol superclassDecl onto BFS stack unconditionally — visited.insert()
return not checked. Nearby ClassDecl arm (line 2833) is correctly guarded.
Diamond protocol hierarchies sharing a class superclass trigger O(2^D)
re-traversal on every qualified member lookup. Fix: check .second.
llvm, gcc, webkit: CLEAN in available sparse-clone code.
2026-03-29 20:19:38 -04:00
9d273094e8
diamond-scan: spring/hibernate/weld/quarkus/micronaut O(2^D) hierarchy traversal
...
5 new defects across 5 repos — all diamond recursion (map/set .put/.add return
value ignored before unconditional recurse):
- spring-0001: AnnotationsScanner.processClassHierarchy TYPE_HIERARCHY mode,
no visited guard, used by every @Transactional/@Autowired/@RequestMapping scan
- hibernate-0001: ClassHierarchyHelper.getImplementedInterfaces, Set.add()
return ignored before unconditional recurse — hibernate-validator
- weld-0004: HierarchyDiscovery.discoverTypes, HashMap.put() return ignored,
CDI bean type closure discovery at startup
- quarkus-0004: HierarchyDiscovery.discoverTypes (ArC, copied from Weld),
same defect — Quarkus startup + native image
- micronaut-0005: NativeElementsHelper.populateTypeHierarchy, no visited guard
- micronaut-0006: GenericUtils.populateTypeArgumentsForInterfaces, recursion
outside containsKey guard
Also rename cpython-0001→0002, 0002→0003, 0003→0004 (pre-existing renumber).
2026-03-29 20:17:52 -04:00
4d4c256673
diamond-scan: cpython/django O(2^D) hierarchy traversal; flask/rails/ruby/phoenix CLEAN
...
cpython-0001: pydoc.allmethods unconditional __bases__ recursion, no visited guard
cpython-0002: turtle.__methodDict unconditional __bases__ recursion, fires at import
cpython-0003: idlelib.rpc._getmethods unconditional __bases__ recursion, IDLE debug path
django-0006: migrations.state.flatten_bases abstract model diamond traversal (comment in source acknowledges duplicates)
flask/rails/ruby/phoenix: CLEAN
2026-03-29 20:16:12 -04:00
77a5410eee
undf: assign 617-670 to legacy non-standard-named patches; 670 total assigned
2026-03-29 20:05:28 -04:00
7f92eba7ed
undf: repair registry collision; 616 assigned (602-616 new); stamp all agent-added patches
2026-03-29 20:01:56 -04:00
cdce29392e
fix: repair UNDF registry after concurrent agent collision; rename traefik-0001-checkcursion → traefik-0004; restore 600 stable entries + 15 new (602-616)
2026-03-29 19:58:21 -04:00
3f5ce0d264
jvm-langs: intellij platform CLEAN; kotlin/scala3 defects already committed
...
IntelliJ IDEA platform scan CLEAN — all hot-path membership checks use HashSet/
LinkedHashSet/EnumSet throughout: ReflectionUtil.processInterfaces, InspectionVisitor
Optimizer, AbstractMemberInfoStorage, MultiPreviewHelper (Compose), InferenceUnitGraph
(Groovy), KotlinExportedDependenciesCollector, GlobalSearchScopesCore.myDirectories.
No O(N²) list-as-visited patterns found.
kotlin-0001/0002 and scala3-0001 patch docs already landed in 068ebbd29f
2026-03-29 19:58:14 -04:00
f3bc1553f8
undf: stamp new defects, registry 576 assigned
2026-03-29 19:56:49 -04:00
cdf127dd05
java-frameworks: spring/vertx-core/artemis/netty/guice/thrift/grpc/protobuf/hibernate CWE-407 scan; tinkerpop/trino/kotlin/scala3/nifi/druid/graphhopper/janusgraph defects+CLEANs
...
Defects found:
- spring-0001: BeanFactoryUtils.mergeNamesWithParent ArrayList.contains O(P×R) MEDIUM
- spring-0002: DefaultListableBeanFactory.getBeanNamesForAnnotation ArrayList.contains O(B×M) MEDIUM
- spring-0003: AnnotationTypeMapping.processAliases ArrayList.contains O(A²×D×L) MEDIUM
- vertx-core-0001: HAManager.nodeLeft nodes List.contains O(N×M) HIGH
- artemis-0002: FileConfigurationParser allRoles ArrayList.contains O(N×R) MEDIUM
- tinkerpop-0001: MutablePath.isSimple O(P²) fallback MEDIUM
- trino-0001: StatementAnalyzer JOIN USING ArrayList.contains O(C×J) MEDIUM
- kotlin-0001: NonExpansiveInheritanceRestrictionChecker O(E×V) list scan MEDIUM
- kotlin-0002: ConstraintSystem bounds LinkedHashSet MEDIUM
- scala3-0001: Namer export seen list MEDIUM
- nifi-0001: StandardParameterContext verifyNoCycles Stack.contains O(D²) MEDIUM
- box2d-0001: BroadPhase index map MEDIUM
- doris-0002: PlanNode conjuncts LinkedHashSet MEDIUM
- dry-0001/0002: DRY list/hashset patches
CLEANs: netty, guice, thrift, grpc (C-only repo), protobuf, hibernate-orm,
druid, graphhopper, janusgraph, kylin, pinot, victoria-metrics
2026-03-29 19:56:02 -04:00
068ebbd29f
cpp-systems: tor CLEAN.md updated to note existing patches tor-0001/0002/0003
...
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
2026-03-29 19:54:59 -04:00
df8daceb3c
undf: assign UNDF-2026-000000054 to sea-orm-0001; registry 578→574 net
2026-03-29 19:54:33 -04:00
5b5355cb07
infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN
...
consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet
6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza
2026-03-29 19:54:13 -04:00
cfed6f1c5b
undf: stamp bullet3-0001/0002, assign UNDF-2026-000000001/000000288
2026-03-29 19:53:29 -04:00
805a596198
undf: stamp doctrine-orm-0001 (UNDF-2026-000000002) composer-0003 (UNDF-2026-000000045); registry 578 assigned
2026-03-29 19:52:08 -04:00
ac82cff865
php-cluster: doctrine-orm-0001 + composer-0003 CWE-407 defects; count 668→670
...
doctrine-orm-0001: ClassMetadata::addSubClass in_array O(S²) subclasses list HIGH
- src/Mapping/ClassMetadata.php addSubClass() scans plain $subClasses list
- addSubClasses($parent->subClasses) called in doLoadMetadata: O(S²) per class
- Fix: parallel $subClassesSet hash for O(1) membership; 500x at S=1000
composer-0003: InstalledRepository::getDependents in_array O(P²) needles list MEDIUM
- needles array grows during foreach($packages) loop, in_array scan 3 sites
- $packagesFoundSet already exists for cycle-detection but needles is separate
- Fix: add $needlesSet = array_fill_keys($needles, true), mirror growth; 1000x at P=1000
cayley: CLEAN (confirmed -- map-based seen/pathMap throughout)
tinkerpop: CLEAN (confirmed -- existing CLEAN.md valid, sort ArrayList is query-plan-time only)
2026-03-29 19:51:31 -04:00
7491349edc
game-engines: allegro5/bullet3/box2d/dry CWE-407 scan
...
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
2026-03-29 19:50:49 -04:00
72e37e6142
messaging-rpc: kylin/pulsar/beam/samza/thrift/grpc/tinkerpop CWE-407 scan
...
3 new defects:
- kylin-0001: NDataflowManager.updateDataflowDetailsLayouts ArrayList.contains O(L²) MEDIUM
- kylin-0002: AclPermissionUtil.transformAuthorities dedup ArrayList O(A²) MEDIUM
- pulsar-0006: PartialRoundRobinMessageRouterImpl CopyOnWriteArrayList.contains O(P²) MEDIUM
5 CLEAN markers: beam, samza, thrift, grpc, tinkerpop
2026-03-29 19:50:43 -04:00
