russell@unturf.com
9934133dcf
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
54 lines
2 KiB
Diff
54 lines
2 KiB
Diff
--- a/lparser.h
|
|
+++ b/lparser.h
|
|
@@ -60,6 +60,10 @@ typedef struct FuncState {
|
|
struct FuncState *prev; /* enclosing function */
|
|
struct LexState *ls; /* lexical state */
|
|
BlockCnt *bl; /* chain of current blocks */
|
|
+ /* CWE-407 fix: hash map for O(1) upvalue name lookup.
|
|
+ * upval_ht[name->hash & (UPVAL_HT_SIZE-1)] = upvalue index + 1, 0 = empty.
|
|
+ * Collisions fall back to the linear scan in searchupvalue_slow(). */
|
|
+ int upval_ht[256];
|
|
} FuncState;
|
|
|
|
--- a/lparser.c
|
|
+++ b/lparser.c
|
|
@@ -357,11 +357,37 @@ static int searchupvalue (FuncState *fs, TString *name) {
|
|
** Search the upvalues of the function 'fs' for one
|
|
** with the given 'name'.
|
|
*/
|
|
+/* CWE-407: full O(n) fallback — only used on hash collision */
|
|
+static int searchupvalue_slow (FuncState *fs, TString *name) {
|
|
+ int i;
|
|
+ Upvaldesc *up = fs->f->upvalues;
|
|
+ for (i = 0; i < fs->nups; i++) {
|
|
+ if (eqstr(up[i].name, name)) return i;
|
|
+ }
|
|
+ return -1;
|
|
+}
|
|
+
|
|
static int searchupvalue (FuncState *fs, TString *name) {
|
|
int i;
|
|
- Upvaldesc *up = fs->f->upvalues;
|
|
- for (i = 0; i < fs->nups; i++) {
|
|
- if (eqstr(up[i].name, name)) return i;
|
|
+ int slot = (int)(name->hash & 255u);
|
|
+ /* probe up to 8 slots before falling back to linear scan */
|
|
+ for (i = 0; i < 8; i++, slot = (slot + 1) & 255) {
|
|
+ int entry = fs->upval_ht[slot];
|
|
+ if (entry == 0) return -1; /* empty slot — not present */
|
|
+ if (eqstr(fs->f->upvalues[entry - 1].name, name))
|
|
+ return entry - 1;
|
|
}
|
|
- return -1; /* not found */
|
|
+ return searchupvalue_slow(fs, name); /* collision fallback */
|
|
}
|
|
|
|
@@ -382,6 +408,10 @@ static int newupvalue (FuncState *fs, TString *name, expdesc *v) {
|
|
Upvaldesc *up = allocupvalue(fs);
|
|
FuncState *prev = fs->prev;
|
|
+ /* CWE-407 fix: register new upvalue in hash table */
|
|
+ int slot = (int)(name->hash & 255u);
|
|
+ while (fs->upval_ht[slot]) slot = (slot + 1) & 255;
|
|
+ fs->upval_ht[slot] = fs->nups; /* store index+1 (0 = empty sentinel) */
|
|
+
|
|
if (v->k == VLOCAL) {
|