1.2 KiB
1.2 KiB
UNDF: UNDF-2026-000000555
tokio — CWE-407 Scan Result: CLEAN
Date: 2026-03-27
Source: https://github.com/tokio-rs/tokio (depth=1)
Scanned: tokio/src/ (excluding test modules)
Summary
No CWE-407 defects found in tokio's production code paths.
Candidates Evaluated
| Location | Pattern | Verdict |
|---|---|---|
runtime/scheduler/multi_thread/idle.rs:150 |
sleepers.contains(&worker_id) |
DISQUALIFIED — sleepers is bounded by num_workers (configured at runtime creation, typically 4–32). Single O(N) call, no outer loop. |
runtime/scheduler/multi_thread/idle.rs:133-141 |
linear scan in unpark_worker_by_id |
DISQUALIFIED — same bounded sleepers vec; exits on first match via swap_remove. |
io/ready.rs |
bitflag .contains() |
DISQUALIFIED — bitmask arithmetic, not a Vec linear scan. |
signal/unix.rs:271 |
FORBIDDEN.contains(&signal) |
DISQUALIFIED — FORBIDDEN is a static bounded slice of forbidden signal numbers. |
Conclusion
Tokio uses LinkedList, atomic state, and bounded Vec for scheduler internals. The sleeper list is bounded by worker count (set at startup). No unbounded linear membership tests in hot paths.