russell@unturf.com
068ebbd29f
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional CWE-407 defects. All repos found CLEAN beyond previously recorded patches. Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.
22 lines
1.3 KiB
Markdown
22 lines
1.3 KiB
Markdown
# CLEAN — Tor Anonymity Network (beyond tor-0001/0002/0003)
|
|
Scanned 2026-03-29 for additional CWE-407 defects beyond existing patches.
|
|
|
|
## Existing Defects (already patched)
|
|
- `tor-0001` — `router_load_routers_from_string` requested_fingerprints smartlist O(R²) → digestmap
|
|
- `tor-0002` — `nodes_have_common_family_id` family ID string scan → strmap
|
|
- `tor-0003` — KIST scheduler re-add heap index O(N) → O(1)
|
|
|
|
## Additional Areas Scanned
|
|
- `src/feature/client/entrynodes.c` — guard selection, sampled/confirmed guard lists
|
|
- `src/feature/nodelist/node_select.c` — node exclusion via bitarray (already O(N))
|
|
- `src/feature/hs/hs_service.c` — previous_hsdirs tracking (bounded ≤6 entries)
|
|
- `src/feature/relay/dns.c` — dns_wildcard_list scan (bounded ≤10 entries)
|
|
- `src/feature/client/circpathbias.c` — circuit list scan (one-off at circuit close)
|
|
|
|
## Findings
|
|
- **`nodelist_subtract`** — already uses `bitarray_t` for O(N) subtraction. CLEAN.
|
|
- **`entrynodes.c` guard BUG-checks** — constant-bounded (MAX_SAMPLE_THRESHOLD dozens). CLEAN.
|
|
- **`hs_service.c` previous_hsdirs** — bounded by `REND_NUMBER_OF_CONSECUTIVE_REPLICAS` (6). CLEAN.
|
|
- **`dns.c` wildcard list** — bounded to ~10 hijacked IPs. CLEAN.
|
|
|
|
**Result: No additional CWE-407 defects beyond existing patches.**
|