java-topology/defects/curl/patch/curl-CLEAN-altsvc-connect-cookie.md

UNDF: UNDF-2026-000000040

curl CLEAN — altsvc, connect, cookie (CWE-407 scan)

Files Analyzed

• lib/url.c
• lib/cookie.c
• lib/altsvc.c
• lib/connect.c

Findings

lib/cookie.c — CLEAN

Cookie storage uses a hash table (cookielist[COOKIE_HASH_SIZE] with cookiehash(domain)). Lookups and insertions are O(N/HASH_SIZE) = O(1) amortized. replace_existing() operates on a single hash bucket, not the full cookie jar. No O(N²) pattern.

lib/altsvc.c — CLEAN

altsvc_flush() is O(L) where L = list length, but it is guarded by if (!entries++) — called at most once per Curl_altsvc_parse() invocation, not inside the parse loop. Curl_altsvc_lookup() is a single O(L) scan called once per connection setup. No multiplication that creates O(N²).

lib/url.c — CLEAN

Curl_cpool_find() for connection reuse uses a destination hash (needle->destination) to narrow the candidate set before per-connection matching. The url_match_* predicates are called O(C/HASH_SIZE) times per new connection. No O(N²) pattern in the main hot paths.

priority_remove_child() is O(N) per call but is invoked once per Curl_data_priority_add_child(), not in a multiply-nested loop.

lib/connect.c — CLEAN

No list traversal of concern. Per-socket operations only.

Conclusion

No new CWE-407 defects found in these curl files beyond curl-0001 (already patched).