# UNDF: UNDF-2026-000000403
# GDB — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-27
**Repo:** https://sourceware.org/git/binutils-gdb.git
**Files scanned:** gdb/breakpoint.c, gdb/symtab.c, gdb/objfiles.c, gdb/dwarf2/read.c, gdb/varobj.c, gdb/value.c, gdb/linespec.c, gdb/solib-svr4.c

## Findings

No CWE-407 defects found.

### Notes

- `all_bp_locations()` is a sorted `std::vector<bp_location*>` with binary-search lookup (`std::equal_range`) for address queries — O(log N).
- `filename_seen_cache` uses `gdb::unordered_set` throughout — O(1) membership.
- `gdb/dwarf2/read.c` (18K lines) uses hash tables for symbol deduplication — no linear membership inside loops.
- Individual `std::find` calls in `varobj.c`, `value.c`, `progspace.c` are one-time non-loop lookups — not CWE-407.
- `solib-svr4.c` `glibc_tls_slots` linear scans are bounded (small constant number of TLS-bearing shared libraries in practice).