russell@unturf.com
53a4e369b2
llamacpp-0001: llama-grammar.cpp advance_stack/accept_token stacks_new dedup via std::find on vector<vector<ptr>>, O(S^2) per grammar-constrained token. Fix: companion std::set<llama_grammar_stack> for O(S log S). ~16x at S=300. aria2-0001: DHTPeerAnnounceEntry addPeerAddrEntry peerAddrEntries_ vector std::find dedup, O(P^2) as DHT peers accumulate per infohash. Fix: unordered_map keyed by ip:port for O(P) amortized. ~15x at P=3000. Both: MOADs 0002-0005 CLEAN per scan markers.
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# aria2 — 5-MOAD scan
|
|
|
|
## Scan Date
|
|
|
|
2026-03-31
|
|
|
|
## Target
|
|
|
|
- Repo: https://github.com/aria2/aria2
|
|
- Commit: depth=1 HEAD as of 2026-03-31
|
|
- Files scanned: src/ (all .cc and .h files)
|
|
|
|
## Findings
|
|
|
|
### MOAD-0001 (CWE-407) — 1 defect found (see aria2-0001)
|
|
|
|
`src/DHTPeerAnnounceEntry.cc`: `addPeerAddrEntry()` scans `peerAddrEntries_`
|
|
(a `std::vector<PeerAddrEntry>`) with `std::find` to deduplicate peer
|
|
announcements. O(P^2) total cost as P unique peers are added for a single
|
|
infohash. No size cap exists on `peerAddrEntries_`. Severity: MEDIUM.
|
|
Fixed in aria2-0001.
|
|
|
|
Other potential sites reviewed and found bounded or non-hot:
|
|
- `DefaultPeerStorage::isPeerAlreadyAdded` uses `uniqPeers_` (`std::set`) — already O(log N).
|
|
- `DefaultPieceStorage::usedPieces_` is `std::set` — already O(log N).
|
|
- `DHTBucket::nodes_` max size K=8 (Kademlia K-bucket) — O(1) in practice.
|
|
- `FeedbackURISelector::selectRarer` nested loop bounded by NUM_URI=10 — O(1).
|
|
- `CookieStorage` bounded by MAX_COOKIE_PER_DOMAIN=50 — O(1).
|
|
- `UTMetadataRequestTracker` bounded by torrent piece count — O(1).
|
|
|
|
### MOAD-0002 (Intertangle) — CLEAN
|
|
|
|
`DownloadEngine` is the central coordinator but subsystems communicate via
|
|
clean interfaces (EventPoll, RequestGroup, Command pattern). No shared
|
|
mutable global god object coupling unrelated subsystems found.
|
|
|
|
### MOAD-0003 (Leaked Context) — CLEAN
|
|
|
|
No `thread_local` or `pthread_key` usage found in `src/`. aria2 is
|
|
event-driven (single-threaded event loop); there is no per-request identity
|
|
in thread-local storage.
|
|
|
|
### MOAD-0004 (CWE-312) — CLEAN
|
|
|
|
HTTP Authorization headers are handled via `HttpHeader` (multimap lookup,
|
|
not logged). Tracker announce URLs do not embed user credentials in the
|
|
standard BitTorrent protocol (info_hash and peer_id are not secrets). No
|
|
verbatim logging of Authorization header or authentication tokens found.
|
|
`Netrc.cc` handles credentials in memory only, no logging.
|
|
|
|
### MOAD-0005 (Thundering Herd) — CLEAN
|
|
|
|
aria2 uses a single-threaded event loop (no concurrent cache access). DNS
|
|
cache (`DNSCache`) and RPC method cache (`RpcMethodFactory`) are accessed
|
|
from one thread. No concurrent get+null+compute+put pattern found.
|
|
|
|
## Verdict
|
|
|
|
1 defect (aria2-0001). MOADs 0002-0005 CLEAN.
|