russell@unturf.com
25c2bafdee
New UNDF assignments (693→720): elixir-0002 → UNDF-2026-000000698 (typespec used_type_pairs O(T²)) r-source-0002 → UNDF-2026-000000711 (.walkClassGraph match dedup O(S²)) ruby-0003 → UNDF-2026-000000712 (RubyGems dependent_gems O(N²×D)) victoria-metrics-0002 → UNDF-2026-000000717 (MetricName tag-filter O(T×I)) Total: 720 UNDF assigned
55 lines
2 KiB
Diff
55 lines
2 KiB
Diff
# UNDF: UNDF-2026-000000705
|
|
--- a/lparser.h
|
|
+++ b/lparser.h
|
|
@@ -60,6 +60,10 @@ typedef struct FuncState {
|
|
struct FuncState *prev; /* enclosing function */
|
|
struct LexState *ls; /* lexical state */
|
|
BlockCnt *bl; /* chain of current blocks */
|
|
+ /* CWE-407 fix: hash map for O(1) upvalue name lookup.
|
|
+ * upval_ht[name->hash & (UPVAL_HT_SIZE-1)] = upvalue index + 1, 0 = empty.
|
|
+ * Collisions fall back to the linear scan in searchupvalue_slow(). */
|
|
+ int upval_ht[256];
|
|
} FuncState;
|
|
|
|
--- a/lparser.c
|
|
+++ b/lparser.c
|
|
@@ -357,11 +357,37 @@ static int searchupvalue (FuncState *fs, TString *name) {
|
|
** Search the upvalues of the function 'fs' for one
|
|
** with the given 'name'.
|
|
*/
|
|
+/* CWE-407: full O(n) fallback — only used on hash collision */
|
|
+static int searchupvalue_slow (FuncState *fs, TString *name) {
|
|
+ int i;
|
|
+ Upvaldesc *up = fs->f->upvalues;
|
|
+ for (i = 0; i < fs->nups; i++) {
|
|
+ if (eqstr(up[i].name, name)) return i;
|
|
+ }
|
|
+ return -1;
|
|
+}
|
|
+
|
|
static int searchupvalue (FuncState *fs, TString *name) {
|
|
int i;
|
|
- Upvaldesc *up = fs->f->upvalues;
|
|
- for (i = 0; i < fs->nups; i++) {
|
|
- if (eqstr(up[i].name, name)) return i;
|
|
+ int slot = (int)(name->hash & 255u);
|
|
+ /* probe up to 8 slots before falling back to linear scan */
|
|
+ for (i = 0; i < 8; i++, slot = (slot + 1) & 255) {
|
|
+ int entry = fs->upval_ht[slot];
|
|
+ if (entry == 0) return -1; /* empty slot — not present */
|
|
+ if (eqstr(fs->f->upvalues[entry - 1].name, name))
|
|
+ return entry - 1;
|
|
}
|
|
- return -1; /* not found */
|
|
+ return searchupvalue_slow(fs, name); /* collision fallback */
|
|
}
|
|
|
|
@@ -382,6 +408,10 @@ static int newupvalue (FuncState *fs, TString *name, expdesc *v) {
|
|
Upvaldesc *up = allocupvalue(fs);
|
|
FuncState *prev = fs->prev;
|
|
+ /* CWE-407 fix: register new upvalue in hash table */
|
|
+ int slot = (int)(name->hash & 255u);
|
|
+ while (fs->upval_ht[slot]) slot = (slot + 1) & 255;
|
|
+ fs->upval_ht[slot] = fs->nups; /* store index+1 (0 = empty sentinel) */
|
|
+
|
|
if (v->k == VLOCAL) {
|