UNDF: UNDF-2026-000000550

tcpdump — CWE-407 scan result: CLEAN

Scan date: 2026-03-27 Files scanned:

print-ip.c (IP packet printing)
addrtoname.c (address to name cache)

Candidates Investigated

addrtoname.c — hash collision chains

ipaddr_string(), ip6addr_string(), tcpport_string(), udpport_string(), lookup_emem() all traverse linked-list collision chains within a HASHNAMESIZE=4096 bucket array.

Pattern:

p = &hnametable[addr & (HASHNAMESIZE-1)];
for (; p->nxt; p = p->nxt) {
    if (p->addr == addr)
        return (p->name);
}

This is a standard open-chain hash table — O(1) average, O(B) worst case per bucket where B = collision depth. The outer "loop" is the packet stream, but each call is an independent hash lookup, not a membership test inside a bounded outer loop. Bucket depth stays near O(1) with a good hash and 4096 buckets covering a 32-bit address space. This does not meet the CWE-407 definition of "linear membership test inside a loop."

print-ip.c — ip_optprint, ip_printroute, ip_printts

All loops are single-pass O(N) iterations over IP options or route entries. No nested O(N) search inside a loop over options. Clean.

Verdict: CLEAN

No CWE-407 defects found in the scanned files.

1.2 KiB Raw Permalink Blame History