49 lines
2 KiB
Diff
49 lines
2 KiB
Diff
# UNDF: UNDF-2026-000000308
|
||
From: agent-blackops <blackops@unturf.com>
|
||
Date: Thu, 26 Mar 2026 00:00:00 +0000
|
||
Subject: [PATCH] dag/graph: rewrite EdgesTo to use upEdgesNoCopy index
|
||
|
||
CWE-407: Algorithmic complexity via O(E) full-edge scan in EdgesTo().
|
||
EdgesTo() iterates g.Edges() (all edges) and filters by target hashcode —
|
||
O(E) per call. transform_destroy_cbd.go calls EdgesTo inside a
|
||
for-range over g.Vertices(), producing O(V×E) total comparisons.
|
||
|
||
The graph already maintains g.upEdges[hashcode(v)] — a Set of source
|
||
vertices for every target v, updated incrementally by Connect() and
|
||
RemoveEdge(). Rewrite EdgesTo to iterate upEdgesNoCopy(v) instead:
|
||
one hash lookup to get the source set, then one BasicEdge construction
|
||
per source. Cost is O(in-degree(v)) per call — O(sum of in-degrees) =
|
||
O(E) total across all vertices, vs O(V×E) before.
|
||
|
||
The returned []Edge slice has identical semantics; callers are unaffected.
|
||
|
||
Defect-Id: TF-002
|
||
Severity: MEDIUM
|
||
CWE: CWE-407 (Inefficient Algorithmic Complexity)
|
||
---
|
||
internal/dag/graph.go | 12 ++++--------
|
||
1 file changed, 4 insertions(+), 8 deletions(-)
|
||
|
||
diff --git a/internal/dag/graph.go b/internal/dag/graph.go
|
||
index xxxxxxx..yyyyyyy 100644
|
||
--- a/internal/dag/graph.go
|
||
+++ b/internal/dag/graph.go
|
||
@@ -79,13 +79,9 @@ func (g *Graph) EdgesFrom(v Vertex) []Edge {
|
||
// EdgesTo returns the list of edges to the given target.
|
||
func (g *Graph) EdgesTo(v Vertex) []Edge {
|
||
- var result []Edge
|
||
- search := hashcode(v)
|
||
- for _, e := range g.Edges() {
|
||
- if hashcode(e.Target()) == search {
|
||
- result = append(result, e)
|
||
- }
|
||
+ // CWE-407 fix: use upEdgesNoCopy index instead of scanning all edges O(E).
|
||
+ // upEdges[hashcode(v)] holds exactly the set of sources pointing at v;
|
||
+ // one map lookup + O(in-degree(v)) edge constructions replaces O(E) scan.
|
||
+ sources := g.upEdgesNoCopy(v)
|
||
+ result := make([]Edge, 0, sources.Len())
|
||
+ for _, src := range sources {
|
||
+ result = append(result, BasicEdge(src.(Vertex), v)) // CWE-407 fix: O(in-degree)
|
||
}
|
||
return result
|
||
}
|