29 lines
1.2 KiB
Diff
29 lines
1.2 KiB
Diff
# UNDF: UNDF-2026-000001195
|
|
--- a/server/token.c
|
|
+++ b/server/token.c
|
|
@@ -808,14 +808,25 @@ static struct privilege *token_find_privilege( struct token *token, struct luid
|
|
{
|
|
struct privilege *privilege;
|
|
+ /* DEFECT (CWE-407): O(P) linear scan through token->privileges list
|
|
+ * for each LUID lookup. Called from token_adjust_privileges() and
|
|
+ * token_check_privileges() inside loops over the caller-supplied
|
|
+ * privilege array (count up to 1023 per AdjustTokenPrivileges call).
|
|
+ * Total cost: O(count * P) per syscall.
|
|
+ *
|
|
+ * Fix: index token->privileges by LUID into a wine_rb_tree or a
|
|
+ * fixed-size array (LUIDs 1-35 are all well-known; dynamic ones
|
|
+ * from AllocateLocallyUniqueId are rarely used in tokens).
|
|
+ * A flat array indexed by luid.low_part gives O(1) lookup for
|
|
+ * all standard privilege LUIDs at the cost of ~35 pointers.
|
|
+ */
|
|
LIST_FOR_EACH_ENTRY( privilege, &token->privileges, struct privilege, entry )
|
|
{
|
|
if (is_equal_luid( luid, privilege->luid ))
|
|
{
|
|
if (enabled_only && !privilege->enabled)
|
|
return NULL;
|
|
return privilege;
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|