UNDF: UNDF-2026-000000578

Zig CWE-407 Scan — CLEAN

Date

2026-03-27

Scope

src/Sema.zig — semantic analysis, type inference, comptime evaluation
src/InternPool.zig — type/value interning
src/Zcu.zig, src/Zcu/PerThread.zig — compilation unit management
src/Air/Liveness.zig — liveness analysis
src/link/Elf.zig, src/link/Elf/ — ELF linker
src/link/MachO.zig, src/link/Elf/synthetic_sections.zig
src/codegen/x86_64/CodeGen.zig, src/codegen/llvm.zig

Findings

No CWE-407 defects found. Zig's compiler is well-designed with O(1) data structures throughout all hot paths:

Error set membership: InternPool.ErrorSetType.nameIndex uses a hash map (names_map) — O(1) lookup.
Error set merge: errorSetMerge builds via InferredErrorSet.NameMap (hash map) — O(N).
Liveness analysis: live_set is AutoHashMapUnmanaged — O(1) operations.
Switch dedup: seen_errors is AutoHashMap — O(1) operations.
GOT/PLT entries: Indexed via symbol.flags.has_got / symbol.addExtra — O(1).
Rpath dedup: rpath_table is a hash map — O(1).
Analysis tracking: outdated, failed_analysis, analysis_in_progress are all AutoHashMapUnmanaged or AutoArrayHashMap — O(1) contains checks.

The one instance of std.mem.indexOfScalar found (src/InternPool.zig:1890) is a null-check for underscore characters in strings — not a membership test in a hot loop.

Conclusion

Zig CLEAN for CWE-407. The language team has consistently chosen hash-based data structures for all compiler-internal membership tracking.

1.6 KiB Raw Blame History