java-topology/defects/pulsar/patch/pulsar-0001-modular-load-manager-reap-dead-broker-list-contains.patch
russell@unturf.com b0a9a83efc pulsar: 3 CWE-407 defects — load-manager/replicator/namespace List.contains O(N^2)
pulsar-0001: ModularLoadManagerImpl.reapDeadBrokerPreallocations() receives
  aliveBrokers as List<String> from listLocks(); .contains() inside O(B) loop
  → O(B^2); fix: HashSet wrap before loop.
pulsar-0002: PersistentTopic.removeOrphanReplicationCursors() and
  checkReplicationStatus() call configuredClusters.contains() (List<String>)
  inside loops over cursors and replicators → O(C×R); fix: HashSet wrap.
pulsar-0003: NamespacesBase.internalGetTopicHashPositionsAsync() calls
  allTopicsInThisBundle.contains() (List<String>) inside for loop over query
  topics → O(T×B); fix: HashSet wrap before loop.

UNDF-2026-000000505 through UNDF-2026-000000507; 3/3 unit tests PASS.
2026-03-30 08:43:51 -04:00

16 lines
986 B
Diff

# UNDF: UNDF-2026-000000505
# UNDF:
--- a/pulsar-broker/src/main/java/org/apache/pulsar/broker/loadbalance/impl/ModularLoadManagerImpl.java
+++ b/pulsar-broker/src/main/java/org/apache/pulsar/broker/loadbalance/impl/ModularLoadManagerImpl.java
@@ -320,7 +320,8 @@ public class ModularLoadManagerImpl implements ModularLoadManager {
// For each broker that we have a recent load report, see if they are still alive
- private void reapDeadBrokerPreallocations(List<String> aliveBrokers) {
+ private void reapDeadBrokerPreallocations(List<String> aliveBrokers) {
+ Set<String> aliveBrokerSet = new HashSet<>(aliveBrokers);
for (String broker : loadData.getBrokerData().keySet()) {
- if (!aliveBrokers.contains(broker)) {
+ if (!aliveBrokerSet.contains(broker)) {
if (log.isDebugEnabled()) {
log.debug("Broker {} appears to have stopped; now reclaiming any preallocations", broker);
}