f3d11ed8a4
opencv/prometheus: CWE-407 findings — stamp UNDF headers
2026-03-30 09:40:08 -04:00
7aee87ab40
CLAUDE.md: update UNDF count to 757
2026-03-30 09:39:06 -04:00
fbc56da95b
curl/ffmpeg: CWE-407 findings — awssigv4 bubble sort + filtergraph format merge
...
curl-0001 (UNDF-2026-000000040): lib/http_aws_sigv4.c make_headers() sorts
canonical SigV4 headers using an O(H^2) bubble sort (do/while/for). Every
SigV4 HTTP request pays H^2 comparisons. At H=200: 35,024 vs 794 (44x).
Fix: qsort on a temporary pointer array, O(H log H).
ffmpeg-0001 (UNDF-2026-000000070): libavfilter/formats.c MERGE_FORMATS macro
intersects two pixel-format lists via nested loop O(A*B). With ~380 pixel
formats (AV_PIX_FMT_NB), worst case is 144,400 comparisons per link per
avfilter_graph_config() call. At A=B=380: 72,390 vs 3,420 (21x).
Fix: sort b, bsearch for membership, O((A+B) log B).
Unit tests: CurlTest.java, FFmpegTest.java — both PASS.
2026-03-30 09:38:07 -04:00
d78b31eb6e
undf: assign UNDF numbers, stamp patches (cockroach-0001..0003, influxdb-0001..0002)
2026-03-30 09:36:45 -04:00
37836b498d
cockroach/influxdb: CWE-407 findings
2026-03-30 09:36:24 -04:00
95648fb2b0
undf: stamp panda3d-0001 → UNDF-2026-000000207, ogre-0001 → UNDF-2026-000000193
2026-03-30 09:28:43 -04:00
75edb2a0a9
panda3d/ogre: CWE-407 findings
...
panda3d-0001: NodePathCollection remove_duplicate_paths O(N^2) nested scan
and remove_paths_from has_path O(N*M) -> fix with pset, 499x at N=1000
ogre-0001: GLSLProgramWriter std::find(inParams) O(A*O*P) in nested loop
during GLSL shader code generation -> fix with unordered_set, 75x at A=200
2026-03-30 09:27:50 -04:00
780d7fde87
undf: assign UNDF-2026-000000751..752, stamp patches (bullet3-0001, three-0001)
2026-03-30 09:26:18 -04:00
0d33225dcc
sdl/box2d: CWE-407 findings
...
sdl-0001: SDL_gamepad.c SDL_PrivateAddMappingForGUID — O(M) tail walk of
s_pSupportedGamepads linked list on every mapping insert → O(M²) bulk load.
SDL_GameControllerDB ships >30 000 entries; fix: tail pointer s_pLastSupportedGamepad.
box2d-0001: broad_phase.c b2UnBufferMove — linear scan through moveArray to
find proxy key on destroy (acknowledged by code comment) → O(N²) on bulk destroy.
Fix: index map (proxyKey → slot) for O(1) swap-remove.
2026-03-30 09:25:48 -04:00
db92c9428a
bullet3/three.js: CWE-407 findings
...
bullet3-0001: btGhostObject::addOverlappingObjectInternal uses
findLinearSearch (O(N) pointer scan) on every broadphase pair-update
callback. With N objects overlapping a ghost, each tick is O(N²). Fix:
btHashMap<btHashPtr,int> shadow index → O(1) add/remove. 250x at N=500.
three-0001: NodeBuilder.addNode/addSequentialNode use Array.includes
(O(N)) per node during shader build traversal → O(N²). StackNode.generate
uses nodes.indexOf inside filter → O(N²). Fix: shadow with Set → O(1). 250x
at N=500.
2026-03-30 09:25:29 -04:00
99e1a862bd
undf: assign UNDF-2026-000000749/750 to consul-0002/nats-server-0002; stamp patches
2026-03-30 09:19:09 -04:00
750b27a453
CLAUDE.md: update UNDF count to 749
2026-03-30 09:16:28 -04:00
7ab4695e82
undf: assign UNDF-2026-000000748 to nomad-0005; stamp patch
...
nomad-0005: scheduler/reconciler/reconcile_cluster.go
handleReconnectingAllocs slices.Contains(replacements, alloc.ID)
O(A×R) inner linear scan — replaced with map[string]struct{} O(1)
Also confirm envoy-0001 through envoy-0004 were previously scanned
(UNDF-63, 390, 391, 699) and nomad-0001 through nomad-0004 (UNDF-476..479).
2026-03-30 09:15:20 -04:00
b577fa269f
undf: assign UNDF-2026-000000449/746/747 to libgdx-0002/0005/0006; stamp patches
2026-03-30 09:14:21 -04:00
783e406633
pygame/libgdx: CWE-407 findings
...
pygame: CLEAN — runtime uses dict/set throughout (O(1) membership)
libgdx-0002: ModelBuilder.rebuildReferences Array.contains O(P*M) — patch
libgdx-0005: Stage.touchDragged touchFocuses.contains O(F^2) — patch
libgdx-0006: AfterAction.delegate currentActions.indexOf O(W*A) per frame — patch
unit: extend LibGDXTest to 7 tests, all PASS (50x-1971x speedup measured)
2026-03-30 09:13:34 -04:00
ec395a01fc
undf: stamp freeswitch-0001 patch with UNDF-2026-000000073; update registry
2026-03-30 09:04:29 -04:00
e9b981a309
clickhouse-java/freeswitch: CWE-407 findings
...
clickhouse-java-0001: ClickHouseLoadBalancingPolicy nodes/faultyNodes
LinkedList.contains O(N*F) per node selection — fix: LinkedHashSet O(1).
120x speedup at F=500 faulty nodes.
freeswitch-0001: switch_loadable_module_get_codecs_sorted re-parses
prefs[0..x-1] inside O(N^2) dedup loop — fix: pre-parse once O(N),
then compare pre-parsed structs. 13x speedup at N=50 (SWITCH_MAX_CODECS).
2026-03-30 09:03:28 -04:00
ac7030d9a7
CLAUDE.md: update UNDF count to 745
2026-03-30 08:55:11 -04:00
032998cf74
undf: assign UNDF numbers, stamp quarkus patches (517, 518, 469, 678)
2026-03-30 08:54:16 -04:00
555896829a
vertx: 1 CWE-407 defect — HAManager nodeLeft List.contains O(N×M) in cluster failover loop
2026-03-30 08:54:06 -04:00
4483a2ee12
quarkus: 4 CWE-407 defects — Arc CDI interceptor/decorator dedup O(N^2), devmode class scan O(C*S), CORS origins O(O)/req
2026-03-30 08:53:29 -04:00
2b12adc044
grpc-java: 3 CWE-407 defects — priority-lb list.contains O(C×P), xds-client authorities list O(A×S×T), okhttp intersect O(N×M)
2026-03-30 08:45:32 -04:00
e72c6fb013
undf: assign UNDF-2026-000000740 through UNDF-2026-000000744; stamp micronaut-core patches
2026-03-30 08:44:51 -04:00
feda3896b9
micronaut-core: 2 CWE-407 defects — uri-variable O(A×V) per request; topological-sort O(B²) stream scan + ArrayList prepend
2026-03-30 08:44:25 -04:00
b0a9a83efc
pulsar: 3 CWE-407 defects — load-manager/replicator/namespace List.contains O(N^2)
...
pulsar-0001: ModularLoadManagerImpl.reapDeadBrokerPreallocations() receives
aliveBrokers as List<String> from listLocks(); .contains() inside O(B) loop
→ O(B^2); fix: HashSet wrap before loop.
pulsar-0002: PersistentTopic.removeOrphanReplicationCursors() and
checkReplicationStatus() call configuredClusters.contains() (List<String>)
inside loops over cursors and replicators → O(C×R); fix: HashSet wrap.
pulsar-0003: NamespacesBase.internalGetTopicHashPositionsAsync() calls
allTopicsInThisBundle.contains() (List<String>) inside for loop over query
topics → O(T×B); fix: HashSet wrap before loop.
UNDF-2026-000000505 through UNDF-2026-000000507; 3/3 unit tests PASS.
2026-03-30 08:43:51 -04:00
e72461aba9
undf: assign 737-739; stamp dragonfly/valkey/kafka patches; update UNDF count to 739
2026-03-30 08:35:14 -04:00
4ca032752d
dragonfly-0001/0002: ACL vector→flat_hash_map/set O(K×G)→O(K)
...
valkey-0001/0002: ACL linked-list→dict O(S×K×P)→O(S×K)
kafka-0001/0002/0003: rebalance ArrayList→HashSet O(P³/C)→O(P²/C)
All 7 defects patched and unit tested:
dragonfly-0001: key_globs vector scan → flat_hash_map exact lookup (33×)
dragonfly-0002: pub_sub globs vector scan → flat_hash_set (22×)
valkey-0001: ACL key pattern linked-list → dictFind O(1) (10×)
valkey-0002: ACL channel pattern linked-list → dictFind O(1) (11×)
kafka-0001: isBalanced currentAssignment ArrayList → HashSet (36×)
kafka-0002: consumer2AllPotentialTopics ArrayList<String> → HashSet (5.5×)
kafka-0003: RoundRobin topics() List.contains → pre-computed Set (16×)
2026-03-30 08:34:52 -04:00
0b37443f11
spring-framework: 3 CWE-407 defects (UNDF-2026-000000734 through UNDF-2026-000000736)
...
spring-framework-0001 (UNDF-734): CorsConfiguration.checkHeaders() O(R×A)
- requestHeaders list (R) × allowedHeaders ArrayList (A) nested loop
- equalsIgnoreCase() scan per header — 14x measured at R=20, A=50
- Fix: build lowercase LinkedHashSet once O(A), lookup O(1) per header
spring-framework-0002 (UNDF-735): AcceptHeaderLocaleResolver O(R×S)
- Accept-Language locales (R) × supportedLocales ArrayList (S)
- per-request linear scan: 9x at R=15, S=20
- Same defect in AcceptHeaderLocaleContextResolver (reactive)
- Fix: LinkedHashSet for O(1) full-locale match
spring-framework-0003 (UNDF-736): EncodedResourceResolver.contentCodings O(A×C)
- acceptedCodings (A) × contentCodings ArrayList (C) per static resource request
- 8x at A=10, C=8
- Fix: LinkedHashSet for O(1) contains per accepted encoding
- Both spring-webmvc and spring-webflux variants
3/3 unit tests PASS
2026-03-30 08:27:16 -04:00
be66177402
netty-0001: DnsResolveContext finalResult ArrayList.contains O(A²) → LinkedHashSet O(A)
2026-03-30 08:26:27 -04:00
192219a62f
undf: assign 734-736; stamp rabbitmq-0001/0002
2026-03-30 08:26:11 -04:00
3d0519f28d
rabbitmq-0001/0002: fifo service-queue O(C) member→O(1) map; blocked O(B) member→O(1) map
2026-03-30 08:26:01 -04:00
dff753904b
undf: stamp traefik-0001/0002 (UNDF-557/558)
2026-03-30 08:21:34 -04:00
76d1e3cc28
traefik-0001/0002: ip.Checker []net.IP→map O(1); CORS origin []string→map O(1)
2026-03-30 08:21:24 -04:00
9f9acfd5f5
undf: assign 732-733; stamp activemq-0002/0003
2026-03-30 08:02:58 -04:00
23fbfdca44
activemq-0002/0003: candidateConsumers List→Set O(1); ENDED_XA List→Set O(1)
2026-03-30 08:02:45 -04:00
e0486b7301
undf: stamp activemq-0001 with UNDF-2026-000000617
2026-03-30 08:00:11 -04:00
d1b6d0021e
activemq-0001: Queue.java consumer rotation remove+sort O(C log C) → cursor O(1)
2026-03-30 07:59:58 -04:00
e72b9fccde
undf: assign 731; stamp patches; postgres-0001/asterisk-0001/haproxy-0001/nginx-0001
2026-03-30 07:57:50 -04:00
ff6292d067
wave17: postgres-0001/asterisk-0001/haproxy-0001/nginx-0001; postfix+bevy CLEAN
...
postgres-0001: pg_inherits.c typeInheritsFrom() BFS visited List → HTAB O(1)
asterisk-0001: app_queue.c interface_exists() ao2_iterator walk → ao2_find O(1)
haproxy-0001: http_ana.c cookie-server scan linked-list → eb-tree index O(log S)
nginx-0001: ngx_http_link_multi_headers() O(H²) double-scan → O(H) hash pass
postfix: CLEAN (htable throughout; two marginal LOW admin-bounded candidates)
bevy: CLEAN (FixedBitSet/HashSet throughout; only hardware-bounded marginals)
2026-03-30 07:57:30 -04:00
da8b4a41d6
undf: stamp redis-0001 patch with UNDF-260
2026-03-30 07:47:03 -04:00
2ffc2001ab
wave17a: redis-0001 acl.c getUpcomingChannelList listSearchKey → dict (6x, MEDIUM)
...
redis-0001: src/acl.c getUpcomingChannelList() listSearchKey O(C×U) → dictFind O(1)
1 test: 1/1 PASS
2026-03-30 07:46:16 -04:00
c8bde8ddac
CLAUDE.md: update UNDF count to 730
2026-03-30 07:42:00 -04:00
2202a50f5c
undf: assign UNDF-730 to esbuild-0001; stamp patch
2026-03-30 07:41:36 -04:00
da26ffd2cf
wave16c: esbuild/deno CWE-407 scan results
...
esbuild-0001: serve_other.go hosts []string scan → map[string]struct{} (57x, MEDIUM)
deno: CLEAN (uses HashSet/HashMap throughout, no Vec.contains() in loops)
1 test: 1/1 PASS
2026-03-30 07:39:57 -04:00
38945e8138
undf: assign UNDF-729 to element-web-0001/0002 and bun-0001; stamp patches
2026-03-30 07:38:08 -04:00
c1f0ce8eda
wave16b: element-web/bun CWE-407 patches + unit tests
...
element-web-0001: TextForEvent.tsx user dedup array → Set (15x, HIGH)
element-web-0002: TextForEvent.tsx pinned filter indexOf → Set.has (13x, MEDIUM)
bun-0001: yarn.zig scoped version two-pass scan → single pass (4x, MEDIUM)
5 tests: 5/5 PASS
2026-03-30 07:37:28 -04:00
c830c29e8a
CLAUDE.md: update UNDF count to 728
2026-03-30 07:34:52 -04:00
f87eeeb302
undf: assign UNDF-728 to wave16 defects (nova/keystone/crystal/dovecot/wireshark); stamp patches
2026-03-30 07:34:08 -04:00
59ae52c7b4
wave16: nova/keystone/crystal/dovecot/wireshark CWE-407 patches + unit tests
...
nova-0001: scheduler/manager.py selected_hosts list → set (273x, CRITICAL)
nova-0002: scheduler/host_manager.py lowered_hosts_to_force list → set (43x, HIGH)
keystone-0001: api/users.py token_roles list → set (32x, HIGH)
crystal-0001: syntax/parser.cr type_vars Array#includes? → Set (25x, CRITICAL)
crystal-0002: semantic/restrictions.cr discarded Array#includes? → Set (5x, CRITICAL)
dovecot-0001: mail-storage-hooks.c array_lsearch → sort+bsearch (4x, HIGH)
wireshark-0001: proto_data.c GSList → wmem_map_t (8x, HIGH)
7 unit tests: 9/9 PASS
2026-03-30 07:33:49 -04:00
291620b115
opensmtpd-0002: strip stale stamp (UNDF-727 now assigned correctly)
2026-03-30 07:09:37 -04:00
