java-topology/tools/tickets/scans/gnu-octave.md at master

russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems

B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.

2026-03-26 19:48:18 -04:00

2.9 KiB

Raw Permalink Blame History

id	priority	status	created
scan-gnu-octave	medium	unscanned	2026-03-23

Target

Repo: https://github.com/gnu-octave/octave Language: C++/m Why: Scientific computing MATLAB-compatible environment — ismember in DFS loops in .m graph scripts is O(N) per call; C++ graph code may carry std::find on vectors in topological sort.

Scan command

# Shallow clone
git clone --depth 1 https://github.com/gnu-octave/octave /tmp/gnu-octave

# Submit to unsandbox
cat > /tmp/scan-gnu-octave.sh << 'EOF'
#!/usr/bin/env bash
set -euo pipefail
GRAPH_KW="tarjan|strongly.connected|dfs|scc|topolog|topo.sort|cycle|reachab|postorder|dominator|liveness|digraph|shortest.path|path.find"
MEM_CPP="std::find|\.count\(|vector.*find|find.*begin.*end|push_back.*visited|visited\.push_back"
MEM_M="ismember|any.*==|find.*==|cellfun.*strcmp"

# C++ sources
find /tmp/gnu-octave/liboctave /tmp/gnu-octave/libinterp -name "*.cc" -o -name "*.h" | sort | while read f; do
  graph_lines=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
  [ -z "$graph_lines" ] && continue
  while IFS= read -r lineno; do
    s=$(( lineno > 20 ? lineno - 20 : 1 )); e=$(( lineno + 20 ))
    hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$MEM_CPP" | head -1 | sed 's/^\s*//' || true)
    [ -n "$hit" ] && echo "CANDIDATE\t${f}:${lineno}\t${hit}"
  done <<< "$graph_lines"
done

# .m scripts
find /tmp/gnu-octave/scripts -name "*.m" | sort | while read f; do
  graph_lines=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
  [ -z "$graph_lines" ] && continue
  while IFS= read -r lineno; do
    s=$(( lineno > 20 ? lineno - 20 : 1 )); e=$(( lineno + 20 ))
    hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$MEM_M" | head -1 | sed 's/^\s*//' || true)
    [ -n "$hit" ] && echo "CANDIDATE\t${f}:${lineno}\t${hit}"
  done <<< "$graph_lines"
done
EOF
export UNSANDBOX_PUBLIC_KEY=unsb-pk-russ-test-isth-best
export UNSANDBOX_SECRET_KEY=unsb-sk-rk46c-3zvpg-zjf6z-hjrge
~/git/un-inception/build/un /tmp/scan-gnu-octave.sh

Key files to check

scripts/graph/ — Graph algorithm .m scripts (if present); DFS/BFS/SCC implementations
scripts/sparse/ — Sparse matrix graph ops; reachability via matrix walk
liboctave/util/ — C++ utility data structures; any graph helper with visited tracking
Any .m file containing tarjan, dfs, or toposort

Expected pattern

Two sub-patterns to look for:

In .m files: ismember(node, visited) inside a DFS while/for loop — ismember on a plain array is O(N).
In C++ files: std::find(visited.begin(), visited.end(), v) where visited is a std::vector in a topological sort or SCC helper.

Acceptance criteria

Scan run and results saved to tools/scan-results/gnu-octave.txt
All CANDIDATE hits triaged (confirmed defect or false positive)
If confirmed: defect ticket created in tools/tickets/defects/

2.9 KiB Raw Permalink Blame History