russell@unturf.com
9934133dcf
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
67 lines
2.4 KiB
Diff
67 lines
2.4 KiB
Diff
--- a/pkg/planner/core/operator/physicalop/physical_merge_join.go
|
|
+++ b/pkg/planner/core/operator/physicalop/physical_merge_join.go
|
|
@@ -150,7 +150,10 @@ func getEnforcedMergeJoin(p *logicalop.LogicalJoin, prop *property.PhysicalProp
|
|
offsets := make([]int, 0, len(leftJoinKeys))
|
|
+ // CWE-407 fix: use a map for O(1) membership test instead of
|
|
+ // slices.Contains which is O(len(offsets)) per call inside a nested loop.
|
|
+ offsetSet := make(map[int]struct{}, len(leftJoinKeys))
|
|
all, desc := prop.AllSameOrder()
|
|
if !all {
|
|
return nil
|
|
@@ -172,10 +175,9 @@ func getEnforcedMergeJoin(p *logicalop.LogicalJoin, prop *property.PhysicalProp
|
|
if key == nil {
|
|
continue
|
|
}
|
|
- if slices.Contains(offsets, joinKeyPos) {
|
|
+ if _, exists := offsetSet[joinKeyPos]; exists {
|
|
isExist = true
|
|
}
|
|
if !isExist {
|
|
offsets = append(offsets, joinKeyPos)
|
|
+ offsetSet[joinKeyPos] = struct{}{}
|
|
}
|
|
isExist = true
|
|
break
|
|
@@ -507,16 +509,22 @@ func getNewJoinKeysByOffsets(oldJoinKeys []*expression.Column, offsets []int) []
|
|
// Change JoinKeys order, by offsets array
|
|
// offsets array is generate by prop check
|
|
func getNewJoinKeysByOffsets(oldJoinKeys []*expression.Column, offsets []int) []*expression.Column {
|
|
newKeys := make([]*expression.Column, 0, len(oldJoinKeys))
|
|
for _, offset := range offsets {
|
|
newKeys = append(newKeys, oldJoinKeys[offset])
|
|
}
|
|
+ // CWE-407 fix: build a map once (O(|offsets|)) so the loop below is O(N)
|
|
+ // instead of O(N * |offsets|) with slices.Contains.
|
|
+ offsetSet := make(map[int]struct{}, len(offsets))
|
|
+ for _, o := range offsets {
|
|
+ offsetSet[o] = struct{}{}
|
|
+ }
|
|
for pos, key := range oldJoinKeys {
|
|
- isExist := slices.Contains(offsets, pos)
|
|
- if !isExist {
|
|
+ if _, exists := offsetSet[pos]; !exists {
|
|
newKeys = append(newKeys, key)
|
|
}
|
|
}
|
|
return newKeys
|
|
}
|
|
|
|
func getNewNullEQByOffsets(oldNullEQ []bool, offsets []int) []bool {
|
|
newNullEQ := make([]bool, 0, len(oldNullEQ))
|
|
for _, offset := range offsets {
|
|
newNullEQ = append(newNullEQ, oldNullEQ[offset])
|
|
}
|
|
+ // CWE-407 fix: same map pattern as getNewJoinKeysByOffsets.
|
|
+ offsetSet := make(map[int]struct{}, len(offsets))
|
|
+ for _, o := range offsets {
|
|
+ offsetSet[o] = struct{}{}
|
|
+ }
|
|
for pos, key := range oldNullEQ {
|
|
- isExist := slices.Contains(offsets, pos)
|
|
- if !isExist {
|
|
+ if _, exists := offsetSet[pos]; !exists {
|
|
newNullEQ = append(newNullEQ, key)
|
|
}
|
|
}
|
|
return newNullEQ
|
|
}
|