2.1 KiB
2.1 KiB
UNDF: UNDF-2026-000000169
memcached CWE-407 Scan — CLEAN (deeper scan)
Date: 2026-03-27
Repo: https://github.com/memcached/memcached
Scan scope: items.c, thread.c, slabs.c, proto_text.c, proto_proxy.c, proxy_lua.c, assoc.c
Findings
No new CWE-407 defects found beyond the existing memcached-0001 patch.
Candidates examined
| File | Location | Pattern | Verdict |
|---|---|---|---|
slabs.c |
slabs_clsid() |
while (size > slabclass[res].size) linear scan — already patched as 0001-slabs-clsid-binary-search.patch |
PATCHED (0001) |
items.c |
lru_pull_tail() |
for (; tries > 0 && search != NULL; tries--, search=next_it) — bounded to 5 tries max, not scaling with N |
CLEAN (bounded) |
assoc.c |
_hashitem_before() |
while (*pos && memcmp(...)) — hash bucket chain traversal; expected hash collision resolution, not per-request linear scan of the full table |
CLEAN (hash bucket) |
proto_text.c |
process_command_ascii() |
Command dispatch uses switch(pr.command) on a pre-parsed enum — O(1) |
CLEAN |
proto_text.c |
process_stat_command() |
Stat subcommands dispatched via else if (strncmp(...)) chain — bounded to ~10 subcommands, constant factor |
CLEAN (bounded) |
memcached.c |
restart config loading | while (opts[type] != NULL && strcmp(key, opts[type]) != 0) — linear scan through restart config key table; startup path only, not per-request |
CLEAN (startup-only) |
proxy_lua.c |
_mcplib_backend_checkcache() |
strncmp for backend label match — called once per pool entry during configuration, not per-request routing |
CLEAN (config-time) |
thread.c |
connection queue | Linked-list queue operations using STAILQ_* macros — O(1) enqueue/dequeue, no membership test |
CLEAN |
Summary
The command dispatch path is O(1) via switch/enum. The only true linear scan on a
hot path was slabs_clsid(), already patched in 0001. All other loops in the
requested files are either startup-time, bounded by small constants, or are
expected hash-collision resolution in a proper hash table.