russell@unturf.com
a629bd0bbf
New defects (all PASS): - exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20 - minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24 - minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N) - minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N) - minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N) - mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000 - ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x - pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup, prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools, linux-kernel (pointer to linux/)
40 lines
1.6 KiB
Markdown
40 lines
1.6 KiB
Markdown
# wireguard-tools CWE-407 Scan — CLEAN
|
||
|
||
**Scan date:** 2026-03-29
|
||
**Target:** WireGuard/wireguard-tools
|
||
**Source root:** `src/`
|
||
**Hot paths scanned:** config.c, wg.c, set.c, setconf.c, show.c, ipc.c
|
||
|
||
## Summary
|
||
|
||
No CWE-407 defects found. The codebase is a CLI tool (not a server). Peer lists are small
|
||
by design (WireGuard limits to ~10,000 peers per interface), and all multi-peer operations
|
||
use sort-then-merge rather than nested linear scans.
|
||
|
||
## Findings
|
||
|
||
### config.c — parse_allowedips / process_line / config_read_cmd
|
||
No membership checks inside loops. AllowedIPs parsing builds a singly-linked list
|
||
(`new_allowedip->next_allowedip = ...`) in O(N) with no deduplication scan.
|
||
|
||
### setconf.c — sync_conf
|
||
The only multi-peer algorithm: merges file-peers and runtime-peers to compute the delta.
|
||
Uses `qsort(peers, peer_count, sizeof(*peers), peer_cmp)` then a single O(N) sorted merge.
|
||
Total: O(N log N). Correct algorithm, no O(N²) pattern.
|
||
|
||
### show.c — pretty_print / dump_print / ugly_print
|
||
Nested `for_each_wgpeer { for_each_wgallowedip }` loops are pure rendering (printf).
|
||
No membership test inside the inner loop. No deduplication. O(P×A) for output only.
|
||
|
||
### wg.c — main dispatch
|
||
Static subcommand array of 9 entries, linear scanned once per invocation.
|
||
Constant time in practice (N=9 always).
|
||
|
||
### ipc.c — ipc_list_devices
|
||
Builds a null-delimited string buffer. No membership checks.
|
||
|
||
## Conclusion
|
||
|
||
wireguard-tools is clean for CWE-407. The tool is a thin CLI wrapper over the kernel
|
||
WireGuard interface. All multi-peer operations are O(N log N) or pure output loops.
|
||
No O(N²) membership checks found.
|