java-topology/defects/nmap/patch/nmap-CLEAN.md

1.4 KiB

UNDF: UNDF-2026-000000187

nmap — CWE-407 scan result: CLEAN (beyond nmap-0001)

Scan date: 2026-03-27 Files scanned:

  • scan_engine.cc (probe management)
  • osscan2.cc (OS fingerprint matching)
  • TargetGroup.cc (target resolution)
  • FPEngine.cc (fingerprint engine)

Candidates Investigated

HostOsScanStats::getActiveProbe() — osscan2.cc

Linear scan through probesActive (std::list<OFProbe *>). Called up to 6 times per received packet inside processResp(), which runs in a do-while loop per scan round. However, probesActive is bounded by the total number of OS detection probe types: NUM_SEQ_SAMPLES=6 + TUI probes ≤ ~20. This is a constant-bounded list — O(20) = O(1) in practice. Not a qualifying CWE-407.

UltraScanInfo::findHost() — scan_engine.cc

Uses std::multiset::find() with a comparator — O(log N), not O(N). Not a defect.

TargetGroup DNS resolution — TargetGroup.cc

std::find(nb_it, netblocks.end(), nb_old) inside a loop over DNS requests. The iterator nb_it advances monotonically (never resets to begin()), making the total scan cost O(B) across all iterations — amortized O(1) per request. Not a defect.

osscan2.cc probe send loops

Multiple loops over probesActive (≤20 elements) and FPtests arrays (NUM_FPTESTS=13). All bounded by compile-time constants. Not CWE-407.

Verdict: CLEAN beyond nmap-0001

No new CWE-407 defects found in the scanned files.