russell@unturf.com
a629bd0bbf
New defects (all PASS): - exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20 - minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24 - minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N) - minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N) - minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N) - mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000 - ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x - pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup, prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools, linux-kernel (pointer to linux/)
1.6 KiB
wireguard-tools CWE-407 Scan — CLEAN
Scan date: 2026-03-29
Target: WireGuard/wireguard-tools
Source root: src/
Hot paths scanned: config.c, wg.c, set.c, setconf.c, show.c, ipc.c
Summary
No CWE-407 defects found. The codebase is a CLI tool (not a server). Peer lists are small by design (WireGuard limits to ~10,000 peers per interface), and all multi-peer operations use sort-then-merge rather than nested linear scans.
Findings
config.c — parse_allowedips / process_line / config_read_cmd
No membership checks inside loops. AllowedIPs parsing builds a singly-linked list
(new_allowedip->next_allowedip = ...) in O(N) with no deduplication scan.
setconf.c — sync_conf
The only multi-peer algorithm: merges file-peers and runtime-peers to compute the delta.
Uses qsort(peers, peer_count, sizeof(*peers), peer_cmp) then a single O(N) sorted merge.
Total: O(N log N). Correct algorithm, no O(N²) pattern.
show.c — pretty_print / dump_print / ugly_print
Nested for_each_wgpeer { for_each_wgallowedip } loops are pure rendering (printf).
No membership test inside the inner loop. No deduplication. O(P×A) for output only.
wg.c — main dispatch
Static subcommand array of 9 entries, linear scanned once per invocation. Constant time in practice (N=9 always).
ipc.c — ipc_list_devices
Builds a null-delimited string buffer. No membership checks.
Conclusion
wireguard-tools is clean for CWE-407. The tool is a thin CLI wrapper over the kernel WireGuard interface. All multi-peer operations are O(N log N) or pure output loops. No O(N²) membership checks found.