java-topology/defects/gdb/patch/gdb-CLEAN.md

UNDF: UNDF-2026-000000403

GDB — CWE-407 Scan Result: CLEAN

Date: 2026-03-27 Repo: https://sourceware.org/git/binutils-gdb.git Files scanned: gdb/breakpoint.c, gdb/symtab.c, gdb/objfiles.c, gdb/dwarf2/read.c, gdb/varobj.c, gdb/value.c, gdb/linespec.c, gdb/solib-svr4.c

Findings

No CWE-407 defects found.

Notes

• all_bp_locations() is a sorted std::vector<bp_location*> with binary-search lookup (std::equal_range) for address queries — O(log N).
• filename_seen_cache uses gdb::unordered_set throughout — O(1) membership.
• gdb/dwarf2/read.c (18K lines) uses hash tables for symbol deduplication — no linear membership inside loops.
• Individual std::find calls in varobj.c, value.c, progspace.c are one-time non-loop lookups — not CWE-407.
• solib-svr4.c glibc_tls_slots linear scans are bounded (small constant number of TLS-bearing shared libraries in practice).