russell@unturf.com
8d4d60b421
ollama-0001: kvcache/causal.go buildMask() Except []int linear scan O(B*E).
For Gemma3 multi-image prompts, slices.Contains(opts.Except, i) is called
per batch token. With N images x 256 tokens/image, B and |except| both scale
as N*256 giving quadratic prefill cost. Fix: convert Except to map[int]struct{}
before the outer loop. 3.4x speedup at N=10 images. Unit test PASS.
dosbox-staging scanned for all 5 MOADs; all CLEAN. Linear scans operate on
fixed small palettes (16 CGA colors), hardcoded 3-item lists, or single-call
config paths. Mixer mutex consistent. No credential logging.
Updated defects/ollama/CLEAN.md to note the missed defect from prior scan.
1.2 KiB
1.2 KiB
Ollama — Previous CWE-407 Scan Result: CLEAN (superseded)
Date: 2026-03-30
Note: Superseded by deeper scan on 2026-03-31 that found ollama-0001.
See defects/ollama-0001/ for the Gemma3 multi-image kvcache buildMask defect.
Original Findings (2026-03-30, MOADs 0002-0005)
- MOAD-0002 (Intertangle): CLEAN. Server struct is lean (4 fields). Scheduler is separate. No god object.
- MOAD-0003 (Leaked Context): CLEAN. Go has no goroutine-local storage. context.Context used correctly.
- MOAD-0004 (CWE-312): CLEAN.
inference_request_log.gologs request body + Content-Type only, NOT Authorization headers. curl replay script omits auth headers. - MOAD-0005 (Thundering Herd): CLEAN.
loadedMu sync.Mutexconsistently guards all accesses to theloadedmap in sched.go.
What Was Missed in Original CWE-407 Scan
kvcache/causal.go:buildMask line 371: enabled := !slices.Contains(c.opts.Except, i)
inside for i := range c.curBatchSize.
opts.Except is a []int slice populated by Gemma3 for multimodal image token positions
(model/models/gemma3/model_text.go lines 230-237). For N images x 256 tokens/image, both B
and |except| scale as N256, giving O(BE) = O(N^2) total cost during prefill. See ollama-0001.