russell@unturf.com
9934133dcf
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
82 lines
3.2 KiB
Java
82 lines
3.2 KiB
Java
package unit;
|
|
import java.util.*;
|
|
|
|
/**
|
|
* CockroachDB CWE-407 unit tests — standalone, no JUnit.
|
|
*
|
|
* cockroachdb-0001 IndexesUsed.add() slices.Contains on growing slice
|
|
* pkg/sql/opt/exec/execbuilder/builder.go:211
|
|
*/
|
|
public class CockroachDBTest {
|
|
|
|
// -----------------------------------------------------------------------
|
|
// cockroachdb-0001: IndexesUsed.add — slice contains vs map lookup
|
|
//
|
|
// Models adding N (tableID, indexID) pairs with deduplication.
|
|
// In a complex query the same index may be referenced multiple times;
|
|
// add() must skip duplicates.
|
|
// Slow: scan the existing slice for each add — O(N) per add, O(N²) total.
|
|
// Fast: maintain a HashSet of pairs alongside the list — O(1) per add.
|
|
// -----------------------------------------------------------------------
|
|
|
|
/** Slow: list-based dedup (models slices.Contains). Returns total comparison ops. */
|
|
static long indexesUsedSlowOps(int numAdds, int numUnique) {
|
|
// Each "index" is encoded as a long: tableID << 32 | indexID
|
|
List<Long> indexes = new ArrayList<>();
|
|
long ops = 0;
|
|
Random rng = new Random(42);
|
|
for (int i = 0; i < numAdds; i++) {
|
|
long key = (long)(rng.nextInt(numUnique / 10 + 1)) << 32
|
|
| (rng.nextInt(numUnique + 1));
|
|
// Linear scan of existing list (models slices.Contains)
|
|
boolean found = false;
|
|
for (int j = 0; j < indexes.size(); j++) {
|
|
ops++;
|
|
if (indexes.get(j).equals(key)) { found = true; break; }
|
|
}
|
|
if (!found) indexes.add(key);
|
|
}
|
|
return ops;
|
|
}
|
|
|
|
/** Fast: HashSet-based dedup. Returns total comparison ops (1 per add). */
|
|
static long indexesUsedFastOps(int numAdds, int numUnique) {
|
|
List<Long> indexes = new ArrayList<>();
|
|
Set<Long> seen = new HashSet<>();
|
|
long ops = 0;
|
|
Random rng = new Random(42);
|
|
for (int i = 0; i < numAdds; i++) {
|
|
long key = (long)(rng.nextInt(numUnique / 10 + 1)) << 32
|
|
| (rng.nextInt(numUnique + 1));
|
|
ops++; // O(1) set lookup
|
|
if (seen.add(key)) {
|
|
indexes.add(key);
|
|
}
|
|
}
|
|
return ops;
|
|
}
|
|
|
|
// -----------------------------------------------------------------------
|
|
// Test runner
|
|
// -----------------------------------------------------------------------
|
|
|
|
public static void main(String[] args) {
|
|
int passed = 0;
|
|
int failed = 0;
|
|
|
|
// N = number of add() calls (index references per query build)
|
|
int[] sizes = {50, 100, 200, 500};
|
|
for (int n : sizes) {
|
|
long slow = indexesUsedSlowOps(n, n);
|
|
long fast = indexesUsedFastOps(n, n);
|
|
// At N=50+, slow grows quadratically, fast is linear
|
|
boolean pass = slow > fast * 5;
|
|
System.out.printf("cockroachdb-0001 N=%-4d slow=%6d fast=%4d ratio=%5.1fx %s%n",
|
|
n, slow, fast, (double) slow / fast, pass ? "PASS" : "FAIL");
|
|
if (pass) passed++; else failed++;
|
|
}
|
|
|
|
System.out.printf("%nTotal: %d/%d PASS%n", passed, passed + failed);
|
|
if (failed > 0) System.exit(1);
|
|
}
|
|
}
|