Valgrind — 5-MOAD Scan

Source: https://gitlab.com/fbrausse/valgrind (depth=1 snapshot 2026-03-31) Scan date: 2026-03-31

MOAD-0001 (CWE-407) — CLEAN

Our scan examined the core Valgrind infrastructure:

coregrind/m_debuginfo/readelf.c — Symbol dedup uses VG_(OSetGen_Lookup) (AVL tree, O(log N) per lookup). Symbol processing loop at lines 828 and 964 does not contain inner linear membership scans.
coregrind/m_debuginfo/storage.c — Symbol finalization (ML_(canonicaliseTables)) sorts symbols first, then merges adjacent duplicates in a single O(N) pass. No O(N^2).
coregrind/m_debuginfo/debuginfo.c — find_or_create_DebugInfo_for() does a linear scan of debugInfo_list (a linked list of loaded shared objects). Called O(S) times during program startup, giving O(S^2) string comparisons. With S typically < 200 shared objects, this is < 20,000 string comparisons — startup noise only. Severity: NEGLIGIBLE.
coregrind/m_debuginfo/tytypes.c — Type deduplication uses simple iteration over bounded arrays (small field counts). No unbounded O(N^2) pattern.
coregrind/m_errormgr.c — VG_(maybe_record_error) walks the errors linked list to find duplicate error contexts. This is O(E) per new error event, giving O(E^2) overall. However, Valgrind caps distinct errors at M_COLLECT_NO_ERRORS_AFTER_SHOWN=1000, bounding the list to at most 1000 entries. This cap is itself a workaround for the quadratic behavior. Severity: LOW (bounded by design).
coregrind/m_mallocfree.c — Freelist scan has an explicit bound of 100 iterations per freelist level (nsearches_this_level >= 100 guard). The code itself documents this and proposes a shortcut array as a fix. The guard prevents worst-case behavior.
helgrind/hg_main.c — LAOG (Lock Acquisition Order Graph) DFS uses VG_(newFM) (AVL tree) for visited set, making path-finding O(V log V). Lock sets use sorted WordSet arrays.
memcheck/mc_leakcheck.c — find_chunk_for() uses binary search on sorted chunks array.
memcheck/mc_main.c — AuxMap uses a 2-level structure (L1 self-organizing array + L2 AVL tree).

Verdict: CLEAN. Core data structures use AVL trees (OSet/FM family), binary search, and bounded arrays. No actionable high-severity O(N^2) defects found.

MOAD-0002 (Intertangle) — CLEAN

Valgrind's debugInfo_list, suppressions, and errors are global state by architectural necessity — Valgrind is a tool framework that instruments a single target process. This is intentional coupling, not accidental Intertangle. No unintended cross-tool state sharing found.

MOAD-0003 (Leaked Context) — CLEAN

Valgrind does not use POSIX threads for its own analysis. Thread identity for the analyzed program is carried explicitly via ThreadId tid parameters throughout. No pthread_getspecific or equivalent thread-local carrier used for request-scoped identity.

MOAD-0004 (CWE-312 Logged Credentials) — CLEAN

The --vgdb protocol does not implement authentication. VG_(debugLog) output is diagnostic only. No HTTP headers, auth tokens, API keys, or credentials flow through Valgrind's logging path. Scan of all .c files for password, passwd, credential, secret found only test files and syscall wrappers (for inspecting keyctl() and similar syscalls as data, not as log subjects).

MOAD-0005 (Thundering Herd) — CLEAN / NOT APPLICABLE

Valgrind runs in a single-threaded coregrind loop that serializes all analysis. All tool callbacks (tool_eq_Error, tool_update_extra, etc.) are called from one execution context. No concurrent cache access patterns possible. MOAD-0005 does not apply.

3.6 KiB Raw Blame History