34 lines
2.4 KiB
Markdown
34 lines
2.4 KiB
Markdown
# UNDF: UNDF-2026-000000554
|
||
# TiKV CWE-407 Scan — CLEAN
|
||
|
||
**Date:** 2026-03-27
|
||
**Repo:** https://github.com/tikv/tikv
|
||
**Scan scope:** `components/raftstore/src/`, `src/storage/`
|
||
|
||
## Findings
|
||
|
||
No confirmed CWE-407 defects in production code paths.
|
||
|
||
### Candidates examined
|
||
|
||
| File | Line | Pattern | Verdict |
|
||
|------|------|---------|---------|
|
||
| `components/raftstore/src/store/peer.rs` | 1624 | `down_peer_ids.contains(id)` (Vec<u64>) inside loop over raft progress — cluster size bounded ≤ ~100; `down_peer_ids` typically 0–3 entries | CLEAN (bounded constant) |
|
||
| `components/raftstore/src/store/peer.rs` | 5411 | `down_peer_ids.contains(&peer_id)` inside loop over `region.get_peers()` — same bounded size | CLEAN (bounded constant) |
|
||
| `components/raftstore/src/store/peer.rs` | 5540 | `down_peer_ids.contains(&x.get_id())` inside iterator chain — same | CLEAN (bounded constant) |
|
||
| `components/raftstore/src/store/peer.rs` | 1585 | `hibernate_vote_peer_ids.contains(id)` — `&[u64]` slice, loop over progress; both bounded | CLEAN (bounded constant) |
|
||
| `components/raftstore/src/store/peer.rs` | 2306 | `wait_data_peers.contains(&peer_id)` — single-key check after loop exit, not inside outer loop | CLEAN |
|
||
| `components/raftstore/src/store/snap.rs` | 232 | `SNAPSHOT_CFS.contains(&cf_file.cf)` — `SNAPSHOT_CFS` is 3 elements constant | CLEAN (constant) |
|
||
| `components/raftstore/src/store/snap.rs` | 1839 | `e.get().contains(&entry)` on `Vec<SnapEntry>` in `register()` — called once per snapshot registration, not inside a per-request loop | CLEAN |
|
||
| `components/raftstore/src/store/fsm/apply.rs` | 2762 | `replace_regions.contains(region_id)` — `replace_regions` is `HashSet`, O(1) | CLEAN |
|
||
| `components/raftstore/src/store/unsafe_recovery.rs` | 447 | `failed_voter_ids.contains(&peer.get_id())` — `failed_voter_ids` is `HashSet`, O(1) | CLEAN |
|
||
| `components/txn_types/src/timestamp.rs` | 189–195 | `TsSet::contains` — uses `Vec` only when len ≤ 8 (constant), else `HashSet` | CLEAN (hybrid) |
|
||
| `src/storage/txn/latch.rs` | 525 | `preempted_cids.contains(x)` — test code | CLEAN (test-only) |
|
||
|
||
## Summary
|
||
|
||
TiKV consistently uses `HashSet` for unbounded membership sets. The few `Vec`
|
||
membership scans that remain are either over cluster-topology data (bounded by
|
||
small constant: 3–7 voters for typical Raft groups), static constant slices,
|
||
or guarded by the `TS_SET_USE_VEC_LIMIT = 8` threshold in `TsSet`.
|
||
No production CWE-407 confirmed.
|