java-topology/defects/openbgpd/patch/openbgpd-CLEAN.md

UNDF: UNDF-2026-000000484

OpenBGPD CWE-407 Scan — CLEAN

Scan date: 2026-03-28 Source: usr.sbin/bgpd/ in openbsd-src

Findings

rde_community.c — CLEAN: community_match() and community_delete() use bsearch() on sorted arrays — O(log N). Wildcard/masked match is a single O(N) linear scan, not nested.

rde_filter.c — CLEAN: MAX_COMM_MATCH loop bounded at compile-time constant (3).

rde_attr.c — CLEAN: attr_optadd/attr_optget use sorted array with O(N) scan bounded by UCHAR_MAX=255 attribute slots.

Prefix sets use rde_trie.c — O(prefix length). AS sets use sorted arrays with binary search. No O(N²) community/prefix operations found.

Conclusion

OpenBGPD's community infrastructure is deliberately designed around sorted arrays + bsearch — no CWE-407 defects found.