russell@unturf.com
9934133dcf
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
82 lines
3.5 KiB
Java
82 lines
3.5 KiB
Java
package unit;
|
|
|
|
import java.util.*;
|
|
|
|
/**
|
|
* Perl5Test -- CWE-407 benchmark for perl5-0001
|
|
*
|
|
* Models S_pad_findlex() O(M*N) linear pad-name scan per lexical lookup
|
|
* vs. O(M) HashMap-based offset index.
|
|
*
|
|
* Real code (pad.c ~1168):
|
|
* for (offset = PadnamelistMAXNAMED(names); offset > 0; offset--) // O(N)
|
|
* if (PadnameLEN(name)==namelen && memEQ(PadnamePV(name), namepv, namelen))
|
|
* ...
|
|
*
|
|
* Fix: hash map (padname_string -> pad_offset) in PADNAMELIST, O(1) lookup.
|
|
*/
|
|
public class Perl5Test {
|
|
|
|
static void bench(String label, Runnable slow, Runnable fast, long sOps, long fOps) {
|
|
slow.run(); fast.run();
|
|
long t0 = System.nanoTime(); slow.run(); long sMs = (System.nanoTime() - t0) / 1_000_000;
|
|
long t1 = System.nanoTime(); fast.run(); long fMs = (System.nanoTime() - t1) / 1_000_000;
|
|
double speedup = fMs > 0 ? (double) sMs / fMs : 0;
|
|
System.out.printf(" %-54s slow:%4dms (%,d ops) fast:%4dms (%,d ops) speedup:%.0fx%n",
|
|
label, sMs, sOps, fMs, fOps, speedup);
|
|
}
|
|
|
|
static long slowPadFindLex(int N, int M) {
|
|
String[] padNames = new String[N];
|
|
for (int i = 0; i < N; i++) padNames[i] = "$var_" + i;
|
|
String target = padNames[N / 2]; // middle of pad
|
|
long ops = 0;
|
|
for (int ref = 0; ref < M; ref++) {
|
|
// reverse scan from MAXNAMED down to 0
|
|
for (int offset = N - 1; offset >= 0; offset--) {
|
|
ops++;
|
|
if (padNames[offset].equals(target)) break;
|
|
}
|
|
}
|
|
return ops;
|
|
}
|
|
|
|
static long fastPadFindLex(int N, int M) {
|
|
Map<String, Integer> padIndex = new HashMap<>(N * 2);
|
|
for (int i = 0; i < N; i++) padIndex.put("$var_" + i, i);
|
|
String target = "$var_" + (N / 2);
|
|
long ops = 0;
|
|
for (int ref = 0; ref < M; ref++) {
|
|
ops++; // O(1) map lookup
|
|
padIndex.get(target);
|
|
}
|
|
return ops;
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
System.out.println("Perl5Test -- perl5-0001: S_pad_findlex() linear scan -> HashMap index");
|
|
System.out.println();
|
|
System.out.println(" [pad.c ~1168 S_pad_findlex() -- O(N) per lexical variable lookup]");
|
|
int[][] cases = {{100, 1000, 50000}, {300, 2000, 20000}, {500, 5000, 5000}};
|
|
for (int[] c : cases) {
|
|
int N = c[0], M = c[1], R = c[2];
|
|
bench(
|
|
String.format("N=%d pad vars, M=%d refs/unit, %,d compile units", N, M, R),
|
|
() -> { for (int i = 0; i < R; i++) slowPadFindLex(N, M); },
|
|
() -> { for (int i = 0; i < R; i++) fastPadFindLex(N, M); },
|
|
(long) N * M * R,
|
|
(long) M * R
|
|
);
|
|
}
|
|
System.out.println();
|
|
System.out.println("Defect : pad.c ~1168 -- S_pad_findlex() O(N) reverse scan per lexical reference");
|
|
System.out.println("Fix : PADNAMELIST hash map (padname_string -> offset) -- O(1) lookup");
|
|
System.out.println("Ticket : perl5-0001-pad-findlex-linear-scan-per-lexical-lookup.md");
|
|
System.out.println();
|
|
int pass = 0;
|
|
long s0 = slowPadFindLex(500, 5000), f0 = fastPadFindLex(500, 5000);
|
|
assert s0 > f0 * 50 : "perl5-0001 expected >50x; slow=" + s0 + " fast=" + f0; pass++;
|
|
System.out.printf("%d/1 PASS -- perl5-0001: CWE-407 in Perl5 S_pad_findlex() lexical lookup%n", pass);
|
|
System.out.printf("Hotpath: every variable reference at compile time in ORM/template-heavy code%n");
|
|
}
|
|
}
|