java-topology/defects/hurd/hurd-0004.md

hurd-0004 — CLEAN SCAN: check_owner / check_uid — no O(N²) pattern

Status: CLEAN — no UNDF ID assigned Files inspected: proc/info.c, proc/mgt.c Functions: check_owner, check_uid

Finding

Ticket was written speculatively. Actual check_owner (proc/info.c:41-47) does NOT loop over proc2's UIDs — it checks proc2->p_owner, a single UID, by calling check_uid() once. Total cost: O(nuids_proc1), which is O(N) for N ≤ 64.

// Actual check_owner — O(N), not O(N²)
int check_owner (struct proc *proc1, struct proc *proc2) {
  return proc2->p_noowner
    ? check_uid (proc1, 0) || proc1->p_login == proc2->p_login
    : check_uid (proc1, proc2->p_owner);   // single call, not a loop
}

No O(N×k) amplifier exists. Not a CWE-407 defect. No patch, no UNDF ID.