37 lines
1.2 KiB
Markdown
37 lines
1.2 KiB
Markdown
# UNDF: UNDF-2026-000000550
|
|
# tcpdump — CWE-407 scan result: CLEAN
|
|
|
|
**Scan date:** 2026-03-27
|
|
**Files scanned:**
|
|
- `print-ip.c` (IP packet printing)
|
|
- `addrtoname.c` (address to name cache)
|
|
|
|
## Candidates Investigated
|
|
|
|
### addrtoname.c — hash collision chains
|
|
`ipaddr_string()`, `ip6addr_string()`, `tcpport_string()`, `udpport_string()`,
|
|
`lookup_emem()` all traverse linked-list collision chains within a
|
|
HASHNAMESIZE=4096 bucket array.
|
|
|
|
Pattern:
|
|
```c
|
|
p = &hnametable[addr & (HASHNAMESIZE-1)];
|
|
for (; p->nxt; p = p->nxt) {
|
|
if (p->addr == addr)
|
|
return (p->name);
|
|
}
|
|
```
|
|
|
|
This is a standard open-chain hash table — O(1) average, O(B) worst case
|
|
per bucket where B = collision depth. The outer "loop" is the packet stream,
|
|
but each call is an independent hash lookup, not a membership test inside a
|
|
bounded outer loop. Bucket depth stays near O(1) with a good hash and
|
|
4096 buckets covering a 32-bit address space. This does not meet the
|
|
CWE-407 definition of "linear membership test inside a loop."
|
|
|
|
### print-ip.c — ip_optprint, ip_printroute, ip_printts
|
|
All loops are single-pass O(N) iterations over IP options or route entries.
|
|
No nested O(N) search inside a loop over options. Clean.
|
|
|
|
## Verdict: CLEAN
|
|
No CWE-407 defects found in the scanned files.
|