russell@unturf.com
a7b08c7e05
solang-0001: add_external_functions emits_events Vec::contains O(F×E²) MEDIUM src/sema/external_functions.rs:93-103 — dedup accumulator Vec uses linear scan for each event per function; fix: IndexSet (already a dependency) for O(1) dedup tor/bitcoin/transmission/libtorrent/solc: CLEAN markers added after full scan Tor: nodes_have_common_family_id F=1-3 IDs, O(N×F²) ≈ O(9N), not scalable issue Bitcoin: TxGraph/sets throughout, no linear scan in hot paths Transmission: bitfields for piece tracking, sorted binary search for string table libtorrent: sorted vectors with lower_bound, DHT uses binary search on results solc: unordered_set/set throughout OverrideChecker, SMTEncoder, FunctionCallGraph
21 lines
2 KiB
Markdown
21 lines
2 KiB
Markdown
# CLEAN — Tor Anonymity Network
|
||
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
|
||
|
||
## Scope
|
||
- `src/feature/client/entrynodes.c` — guard node selection, sampled/confirmed guard lists
|
||
- `src/feature/client/circpathbias.c` — circuit path bias tracking
|
||
- `src/feature/nodelist/node_select.c` — node selection with exclusion lists
|
||
- `src/feature/nodelist/nodelist.c` — family membership, `nodes_have_common_family_id`
|
||
- `src/feature/nodelist/routerlist.c` — router descriptor ingestion
|
||
- `src/feature/hs/hs_service.c` — hidden service hsdir tracking
|
||
- `src/feature/relay/dns.c` — DNS wildcard detection
|
||
|
||
## Findings
|
||
- **`nodelist_subtract`** (`node_select.c:890`) — explicitly noted in comments as "delivers linear performance when smartlist_subtract would be quadratic." Uses `bitarray_t` indexed by `node->nodelist_idx`. O(N+M). CLEAN.
|
||
- **`nodes_have_common_family_id`** (`nodelist.c:2190`) — O(|ids_a| × |ids_b|) nested loop over family certificate IDs. Both lists are tiny (typically 1–3 IDs per relay). Outer loop in `nodelist_add_node_and_family` iterates all ~7000 relays but inner product is O(F²) where F≪1. Not a scalable O(N²). CLEAN.
|
||
- **`entrynodes.c` guard lists** — `smartlist_contains` on `primary_entry_guards` and `confirmed_entry_guards`: bounded by `MAX_SAMPLE_THRESHOLD` (dozens), called in setup/error paths (BUG assertions), not hot per-circuit. CLEAN.
|
||
- **`hs_service.c` `previous_hsdirs`** — `smartlist_contains_string` on a list bounded by `REND_NUMBER_OF_CONSECUTIVE_REPLICAS` (6). CLEAN.
|
||
- **`dns.c` `dns_wildcard_list`** — linear scan on a list of hijacked IPs. In practice contains 0–10 entries; called once per DNS response. CLEAN.
|
||
- **Router descriptor ingestion** — `requested_fingerprints` shrinks as each router is processed (O(N) total). CLEAN.
|
||
|
||
**Result: No actionable CWE-407 defects. Tor's hot node-selection paths use bitarray-indexed O(N) exclusion; all family/guard list scans operate on constant-bounded collections.**
|