java-topology/defects/zsh/patch/zsh-CLEAN.md

UNDF: UNDF-2026-000000579

zsh — CLEAN

Scan Date

2026-03-27

Files Scanned

• Src/params.c (parameter lookup)
• Src/jobs.c (job table)
• Src/exec.c (command resolution, findcmd)

Findings

No CWE-407 defects found.

Parameter lookup (paramtab)

paramtab is a hash table (HashTable); lookups use paramtab->getnode() which is O(1). No linear scans in parameter access paths.

Job table (jobtab)

jobtab is an array indexed by job number; lookup is O(1) by index. The findproc() function scans jobs linearly, but it is called from signal handlers on PID receipt — not in a per-event inner loop.

Command resolution (findcmd, cmdnamtab)

cmdnamtab->getnode() is a hash table lookup O(1). findcmd() does walk path[] linearly but this is bounded by PATH entries (typically < 20), not by the number of commands. Not CWE-407.

Verdict

CLEAN — no algorithmic complexity defects in scanned code paths.