java-topology/whitepaper/outreach/rclone-0002.md

rclone — CWE-407 Disclosure Brief (rclone-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

O(S×D) nested loop in bisync recheck() where every source object is compared against every destination object to find matches, and a slices.Contains(resolved, ...) check adds another O(R) scan per source object.

The Defect

rclone-0002 (PATCHED — MEDIUM): cmd/bisync/listing.go:760

for _, srcObj := range srcObjs {
    for _, dstObj := range dstObjs {           // O(D) inner loop
        if srcObj.Remote() == dstObj.Remote() || ... {
            resolved = append(resolved, srcObj.Remote())
        }
    }
    if !slices.Contains(resolved, srcObj.Remote()) { // O(R) scan
        toRollback = append(toRollback, ...)
    }
}

With S source objects and D destination objects, the nested loop costs O(S×D). The slices.Contains check on resolved adds O(S×R).

Complexity Proof

At S=5,000 source and D=5,000 destination objects:

• Defective: 5,000 × 5,000 = 25,000,000 comparisons
• Fixed: 5,000 map insertions + 5,000 map lookups = 10,000 operations
• ~2,500× op reduction.

Impact

rclone bisync recheck fires when verifying file consistency after interrupted syncs. Large datasets with thousands of files compound the nested loop overhead, making recheck operations impractically slow for big file collections.

The Fix

Build dstByRemote and dstByAlias maps for O(1) destination lookup, and use resolvedSet map instead of resolved list:

dstByRemote := make(map[string]fs.Object)
resolvedSet := make(map[string]struct{})
// ... populate maps ...
dstObj, found := dstByRemote[remote]
if _, ok := resolvedSet[remote]; !ok { ... }

Patch

Fix available: defects/rclone-0002/patch/recheck_set.patch

Single-file patch in listing.go.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (rclone/rclone).
2. Assess severity — fires during bisync recheck with large file sets.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the rclone team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.