russell@unturf.com 6b80a87270 snort3: CWE-407 CHP match_tally O(M*T); pgbouncer: CWE-312 SCRAM secret logged

snort3-0002: chp_add_candidate_to_tally() in http_url_patterns.cc calls std::find_if
over CHPMatchTally vector for each Aho-Corasick HTTP key-pattern match callback,
O(M*T) per packet. Fix: add unordered_map index to ChpMatchDescriptor for O(1) lookup.
48x op-count reduction at T=100/M=20. 3/3 PASS.

pgbouncer-0001: scram_client_first() logs user->passwd (SCRAM verifier or plaintext
password) at slog_debug level, CWE-312. Fix: remove the log line. 5/5 PASS.

pgbouncer MOAD-0002/0003/0005 CLEAN (single-threaded libevent loop).
snort3 MOAD-0002/0003/0004/0005 CLEAN.

2026-03-31 20:06:15 -04:00

1.8 KiB

Raw Permalink Blame History

snort3-0002: CWE-407 — CHP match_tally O(M*T) linear scan per HTTP packet

Target

Snort3 network IDS: src/network_inspectors/appid/detector_plugins/http_url_patterns.cc

Defect

chp_add_candidate_to_tally() uses std::find_if over CHPMatchTally (a std::vector<CHPMatchCandidate>) to locate a CHPApp entry and decrement its key_pattern_countdown. This function is called from chp_key_pattern_match(), which is the Aho-Corasick match callback invoked for every key-pattern match in HTTP payload inspection.

With M pattern match callbacks per HTTP packet and T distinct CHPApp candidates in the tally, the total work is O(M * T) per packet.

Fix

Add std::unordered_map<CHPApp*, std::size_t> match_tally_index to ChpMatchDescriptor. The index maps each CHPApp pointer to its position in the match_tally vector. Lookup is O(1) amortized. Total work becomes O(M + T) per packet.

Complexity

O(M*T) -> O(M+T) per HTTP packet. Measured: 48x op-count reduction at T=100, M=20.

Severity

MEDIUM. HTTP inspection is a hot path in any network IDS deployment. Flows with many HTTP rule patterns (e.g., enterprise deployments with hundreds of CHP rules) see measurable per-packet overhead.

All 5 MOAD Results for Snort3

MOAD	Status	Notes
0001 (CWE-407)	DEFECT x2	snort3-0001 (service_candidates, patched); snort3-0002 (CHP match_tally, this)
0002 (Intertangle)	CLEAN	SnortConfig is immutable at runtime; per-thread flow state; no god object
0003 (Leaked Context)	CLEAN	THREAD_LOCAL used correctly: per-thread packet stats, cleared after each packet
0004 (CWE-312)	CLEAN	No sensitive headers logged verbatim; extractor does not log auth headers
0005 (Thundering Herd)	CLEAN	Per-thread flow/session caches (THREAD_LOCAL); no shared mutable cache without sync

1.8 KiB Raw Permalink Blame History