russell@unturf.com
80b26e82b6
vllm-0001: punica_wrapper/utils.py convert_mapping() calls lora_index_to_id.index(x) per token in batch — O(B*L) where B=batch_size, L=loaded_loras. Code has "TODO index can be slow" comment. Fix: pre-build dict for O(1) lookup. 7x at B=2000/L=64. Ollama: all slices.Contains on bounded slices (1-8 items). LangChain: orchestration code, all membership bounded by k param.
1.1 KiB
1.1 KiB
Ollama — CWE-407 Scan Result: CLEAN
Date: 2026-03-30 Target: https://github.com/ollama/ollama (Go) Scanner: Agent Blackops CWE-407 sweep Focus: model registry dedup, runner/scheduler membership, layer dedup, kvcache sequences
Findings
No CWE-407 defects found. All slices.Contains calls operate on bounded slices:
- kvcache/causal.go:
slices.Contains(cell.sequences, seq)— sequences per cell is 1-4 (parallel inference slots), effectively O(1) - server/images.go: Capabilities checks on slices of 3-7 items (model capabilities enum)
- server/sched.go: Capability/family string checks against small constant lists
- ml/backend/ggml/ggml.go: Device/buffer type checks bounded by hardware count (1-8 GPUs)
- server/images.go PullModel/PruneLayers: Uses
map[string]struct{}for layer dedup — correct O(1) lookup - convert/: Tensor name matching on split strings — bounded by name segments
The codebase uses maps for all data-proportional dedup (blob digests, layer tracking) and reserves slices.Contains for small enum-like checks. Well-engineered.