35 lines
1.6 KiB
Markdown
35 lines
1.6 KiB
Markdown
# UNDF: UNDF-2026-000000578
|
|
# Zig CWE-407 Scan — CLEAN
|
|
|
|
## Date
|
|
2026-03-27
|
|
|
|
## Scope
|
|
- `src/Sema.zig` — semantic analysis, type inference, comptime evaluation
|
|
- `src/InternPool.zig` — type/value interning
|
|
- `src/Zcu.zig`, `src/Zcu/PerThread.zig` — compilation unit management
|
|
- `src/Air/Liveness.zig` — liveness analysis
|
|
- `src/link/Elf.zig`, `src/link/Elf/` — ELF linker
|
|
- `src/link/MachO.zig`, `src/link/Elf/synthetic_sections.zig`
|
|
- `src/codegen/x86_64/CodeGen.zig`, `src/codegen/llvm.zig`
|
|
|
|
## Findings
|
|
No CWE-407 defects found. Zig's compiler is well-designed with O(1) data structures
|
|
throughout all hot paths:
|
|
|
|
- **Error set membership**: `InternPool.ErrorSetType.nameIndex` uses a hash map (`names_map`)
|
|
— O(1) lookup.
|
|
- **Error set merge**: `errorSetMerge` builds via `InferredErrorSet.NameMap` (hash map) — O(N).
|
|
- **Liveness analysis**: `live_set` is `AutoHashMapUnmanaged` — O(1) operations.
|
|
- **Switch dedup**: `seen_errors` is `AutoHashMap` — O(1) operations.
|
|
- **GOT/PLT entries**: Indexed via `symbol.flags.has_got` / `symbol.addExtra` — O(1).
|
|
- **Rpath dedup**: `rpath_table` is a hash map — O(1).
|
|
- **Analysis tracking**: `outdated`, `failed_analysis`, `analysis_in_progress` are all
|
|
`AutoHashMapUnmanaged` or `AutoArrayHashMap` — O(1) contains checks.
|
|
|
|
The one instance of `std.mem.indexOfScalar` found (`src/InternPool.zig:1890`) is a
|
|
null-check for underscore characters in strings — not a membership test in a hot loop.
|
|
|
|
## Conclusion
|
|
Zig CLEAN for CWE-407. The language team has consistently chosen hash-based data
|
|
structures for all compiler-internal membership tracking.
|