russell@unturf.com 53a4e369b2 llama.cpp + aria2: 2 CWE-407 defects, MOAD 0002-0005 CLEAN

llamacpp-0001: llama-grammar.cpp advance_stack/accept_token stacks_new
  dedup via std::find on vector<vector<ptr>>, O(S^2) per grammar-constrained
  token. Fix: companion std::set<llama_grammar_stack> for O(S log S). ~16x at S=300.

aria2-0001: DHTPeerAnnounceEntry addPeerAddrEntry peerAddrEntries_ vector
  std::find dedup, O(P^2) as DHT peers accumulate per infohash. Fix:
  unordered_map keyed by ip:port for O(P) amortized. ~15x at P=3000.

Both: MOADs 0002-0005 CLEAN per scan markers.

2026-03-31 21:32:53 -04:00

2.2 KiB

Raw Permalink Blame History

aria2 — 5-MOAD scan

Scan Date

2026-03-31

Target

Repo: https://github.com/aria2/aria2
Commit: depth=1 HEAD as of 2026-03-31
Files scanned: src/ (all .cc and .h files)

Findings

MOAD-0001 (CWE-407) — 1 defect found (see aria2-0001)

src/DHTPeerAnnounceEntry.cc: addPeerAddrEntry() scans peerAddrEntries_ (a std::vector<PeerAddrEntry>) with std::find to deduplicate peer announcements. O(P^2) total cost as P unique peers are added for a single infohash. No size cap exists on peerAddrEntries_. Severity: MEDIUM. Fixed in aria2-0001.

Other potential sites reviewed and found bounded or non-hot:

DefaultPeerStorage::isPeerAlreadyAdded uses uniqPeers_ (std::set) — already O(log N).
DefaultPieceStorage::usedPieces_ is std::set — already O(log N).
DHTBucket::nodes_ max size K=8 (Kademlia K-bucket) — O(1) in practice.
FeedbackURISelector::selectRarer nested loop bounded by NUM_URI=10 — O(1).
CookieStorage bounded by MAX_COOKIE_PER_DOMAIN=50 — O(1).
UTMetadataRequestTracker bounded by torrent piece count — O(1).

MOAD-0002 (Intertangle) — CLEAN

DownloadEngine is the central coordinator but subsystems communicate via clean interfaces (EventPoll, RequestGroup, Command pattern). No shared mutable global god object coupling unrelated subsystems found.

MOAD-0003 (Leaked Context) — CLEAN

No thread_local or pthread_key usage found in src/. aria2 is event-driven (single-threaded event loop); there is no per-request identity in thread-local storage.

MOAD-0004 (CWE-312) — CLEAN

HTTP Authorization headers are handled via HttpHeader (multimap lookup, not logged). Tracker announce URLs do not embed user credentials in the standard BitTorrent protocol (info_hash and peer_id are not secrets). No verbatim logging of Authorization header or authentication tokens found. Netrc.cc handles credentials in memory only, no logging.

MOAD-0005 (Thundering Herd) — CLEAN

aria2 uses a single-threaded event loop (no concurrent cache access). DNS cache (DNSCache) and RPC method cache (RpcMethodFactory) are accessed from one thread. No concurrent get+null+compute+put pattern found.

Verdict

1 defect (aria2-0001). MOADs 0002-0005 CLEAN.

2.2 KiB Raw Permalink Blame History