# UNDF: UNDF-2026-000000578
# Zig CWE-407 Scan — CLEAN

## Date
2026-03-27

## Scope
- `src/Sema.zig` — semantic analysis, type inference, comptime evaluation
- `src/InternPool.zig` — type/value interning
- `src/Zcu.zig`, `src/Zcu/PerThread.zig` — compilation unit management
- `src/Air/Liveness.zig` — liveness analysis
- `src/link/Elf.zig`, `src/link/Elf/` — ELF linker
- `src/link/MachO.zig`, `src/link/Elf/synthetic_sections.zig`
- `src/codegen/x86_64/CodeGen.zig`, `src/codegen/llvm.zig`

## Findings
No CWE-407 defects found. Zig's compiler is well-designed with O(1) data structures
throughout all hot paths:

- **Error set membership**: `InternPool.ErrorSetType.nameIndex` uses a hash map (`names_map`)
  — O(1) lookup.
- **Error set merge**: `errorSetMerge` builds via `InferredErrorSet.NameMap` (hash map) — O(N).
- **Liveness analysis**: `live_set` is `AutoHashMapUnmanaged` — O(1) operations.
- **Switch dedup**: `seen_errors` is `AutoHashMap` — O(1) operations.
- **GOT/PLT entries**: Indexed via `symbol.flags.has_got` / `symbol.addExtra` — O(1).
- **Rpath dedup**: `rpath_table` is a hash map — O(1).
- **Analysis tracking**: `outdated`, `failed_analysis`, `analysis_in_progress` are all
  `AutoHashMapUnmanaged` or `AutoArrayHashMap` — O(1) contains checks.

The one instance of `std.mem.indexOfScalar` found (`src/InternPool.zig:1890`) is a
null-check for underscore characters in strings — not a membership test in a hot loop.

## Conclusion
Zig CLEAN for CWE-407. The language team has consistently chosen hash-based data
structures for all compiler-internal membership tracking.