34 lines
1.4 KiB
Markdown
34 lines
1.4 KiB
Markdown
# UNDF: UNDF-2026-000000187
|
|
# nmap — CWE-407 scan result: CLEAN (beyond nmap-0001)
|
|
|
|
**Scan date:** 2026-03-27
|
|
**Files scanned:**
|
|
- `scan_engine.cc` (probe management)
|
|
- `osscan2.cc` (OS fingerprint matching)
|
|
- `TargetGroup.cc` (target resolution)
|
|
- `FPEngine.cc` (fingerprint engine)
|
|
|
|
## Candidates Investigated
|
|
|
|
### HostOsScanStats::getActiveProbe() — osscan2.cc
|
|
Linear scan through `probesActive` (`std::list<OFProbe *>`). Called up to
|
|
6 times per received packet inside `processResp()`, which runs in a do-while
|
|
loop per scan round. However, `probesActive` is bounded by the total number
|
|
of OS detection probe types: NUM_SEQ_SAMPLES=6 + TUI probes ≤ ~20. This is
|
|
a constant-bounded list — O(20) = O(1) in practice. Not a qualifying CWE-407.
|
|
|
|
### UltraScanInfo::findHost() — scan_engine.cc
|
|
Uses `std::multiset::find()` with a comparator — O(log N), not O(N). Not a defect.
|
|
|
|
### TargetGroup DNS resolution — TargetGroup.cc
|
|
`std::find(nb_it, netblocks.end(), nb_old)` inside a loop over DNS requests.
|
|
The iterator `nb_it` advances monotonically (never resets to `begin()`),
|
|
making the total scan cost O(B) across all iterations — amortized O(1) per
|
|
request. Not a defect.
|
|
|
|
### osscan2.cc probe send loops
|
|
Multiple loops over `probesActive` (≤20 elements) and `FPtests` arrays
|
|
(NUM_FPTESTS=13). All bounded by compile-time constants. Not CWE-407.
|
|
|
|
## Verdict: CLEAN beyond nmap-0001
|
|
No new CWE-407 defects found in the scanned files.
|