# UNDF: UNDF-2026-000000404
# GLib — CWE-407 scan CLEAN

## Files scanned

| File | Finding |
|---|---|
| `glib/glist.c` | Defines `g_list_find` / `g_list_find_custom` — no internal O(n²) usage |
| `glib/ghash.c` | Hash table implementation — O(1) amortized; no list-find calls |
| `gio/gsettings.c` | No `g_list_find` / `g_slist_find` calls found |
| `gobject/gsignal.c` | No `g_list_find` calls found |
| `gobject/gtype.c` | No `g_list_find` calls found |
| `gio/giomodule.c` | No `g_list_find` calls found |

## Near-misses

- `glib/gtestutils.c` line 3115: `g_slist_find_custom(test_paths_skipped, ...)` inside the
  test case runner loop.  `test_paths_skipped` is the list of `-s` (skip) flags passed on the
  CLI; it is tiny in all real use and this is test infrastructure, not production code.
  **Not filed as a defect.**

- `glib/gmain.c` lines 2900/2941/2990: `g_slist_find(source->priv->fds, tag)` used as a
  validity assertion (not in a loop). **Not a defect.**

## Conclusion

GLib production code is **CLEAN** for CWE-407 in the scanned modules.