18 lines
927 B
Markdown
18 lines
927 B
Markdown
# UNDF: UNDF-2026-000000403
|
|
# GDB — CWE-407 Scan Result: CLEAN
|
|
|
|
**Date:** 2026-03-27
|
|
**Repo:** https://sourceware.org/git/binutils-gdb.git
|
|
**Files scanned:** gdb/breakpoint.c, gdb/symtab.c, gdb/objfiles.c, gdb/dwarf2/read.c, gdb/varobj.c, gdb/value.c, gdb/linespec.c, gdb/solib-svr4.c
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found.
|
|
|
|
### Notes
|
|
|
|
- `all_bp_locations()` is a sorted `std::vector<bp_location*>` with binary-search lookup (`std::equal_range`) for address queries — O(log N).
|
|
- `filename_seen_cache` uses `gdb::unordered_set` throughout — O(1) membership.
|
|
- `gdb/dwarf2/read.c` (18K lines) uses hash tables for symbol deduplication — no linear membership inside loops.
|
|
- Individual `std::find` calls in `varobj.c`, `value.c`, `progspace.c` are one-time non-loop lookups — not CWE-407.
|
|
- `solib-svr4.c` `glibc_tls_slots` linear scans are bounded (small constant number of TLS-bearing shared libraries in practice).
|