engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/r-lang-scan/CLEAN.md
russell@unturf.com 5df58dac32 octave+r-lang: 5-MOAD scan; 1 CWE-407 defect (r-lang-0001), octave MOAD 0002-0005 CLEAN 
r-lang-0001: namespace.R getNamespaceUsers() O(N*I) match() linear scan and
namespaceImportMethods() O(G*V) %in% double scan; fix: hash env + reverse index.
Unit test: 5.4x (namespace users) and 5.6x (import methods) speedup. PASS.

Octave: MOAD-0002 through 0005 all CLEAN (single-threaded, no ThreadLocal,
no credential logging found, no concurrent cache races).
2026-03-31 22:31:27 -04:00

2 KiB
Raw Blame History

r-lang 5-MOAD scan results

Scan Date

2026-03-31

Target

R (statistical computing language) Source: https://github.com/wch/r-source (shallow clone)

MOAD Results

MOAD-0001 CWE-407

DEFECT — r-lang-0001: src/library/base/R/namespace.R

  • getNamespaceUsers() lines 79–81: outer loop over N loaded namespaces, inner match(nsname, inames, 0L) O(I) linear scan. Total O(N × I). Fix: hash=TRUE env for O(1) lookup.
  • namespaceImportMethods() lines 1136–1150: outer loop over G generics, inner g %in% vars O(V) twice. Total O(G × 2V). Fix: convert vars to hash-env before loop.
  • See defects/r-lang-0001/ for full patch and unit test.

MOAD-0002 Intertangle

CLEAN

  • R interpreter state (R_GlobalEnv, R_GlobalContext, R_BaseEnv) is global by design for a single-threaded interpreter. No pathological coupling of independent subsystems through unintended shared globals.
  • R_GlobalContext is a well-defined call-stack pointer, not a god-object mixing unrelated state.

MOAD-0003 Leaked Context

CLEAN

  • R is single-threaded. No pthread_key_create or thread_local carrying request-scoped identity. RCNTXT is a stack of nested C structs, properly unwound on longjmp/endcontext. No ThreadLocal leakage.

MOAD-0004 CWE-312

CLEAN

  • CURLOPT_VERBOSE in src/modules/internet/libcurl.c line 315 is guarded by if (verbosity < 2). Our internet.info option defaults to 2L (confirmed in src/library/utils/R/zzz.R line 46), so verbose mode is OFF by default.
  • Response headers stored in static char headers[500][2049] buffer are returned to R callers, not printed verbatim.
  • No Authorization: header logging path found.

MOAD-0005 Thundering Herd

CLEAN

  • R is single-threaded. Cache patterns in coerce.c (lglcache, sficache) are simple static locals initialized once without concurrent access. No get+null+compute+put race possible.

Conclusion

1 CWE-407 defect found (r-lang-0001). MOADs 0002–0005 CLEAN.