russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.2 KiB

Raw Blame History

Squid — CWE-407 Disclosure Brief (squid-0004)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(P²) linear scan in whichPeer() at src/neighbors.cc. For each ICP/HTCP response, whichPeer() iterates all configured cache peers and all addresses per peer to find the sender, performing O(P×A) per lookup where P = peers and A = addresses per peer. This fires on every ICP/HTCP response in a mesh.

The Defect

squid-0004 (PATCHED — MEDIUM): src/neighbors.cc

static CachePeer *
whichPeer(const Ip::Address &from)
{
    for (const auto &p: CurrentCachePeers()) {
        for (j = 0; j < p->n_addresses; ++j) {
            if (from == p->addresses[j] && from.port() == p->icp.port) {
                return p.get();  // O(P*A) per lookup
            }
        }
    }
    return nullptr;
}

Complexity Proof

At P=100 peers, A=3 addresses per peer:

Defective: 100 × 3 = 300 comparisons per ICP response
Fixed: O(log(P×A)) = ~8 comparisons via std::map
37× op reduction per ICP response

Impact

Squid operates in caching meshes with many peer proxies. ICP (Internet Cache Protocol) queries fire for every cacheable request, and each response must identify the sending peer. Large meshes with 50-100+ peers and multiple addresses per peer accumulate this cost on every cache query.

The Fix

Build a std::map<std::pair<Ip::Address, unsigned short>, CachePeer*> (WhichPeerMap) at DNS configuration time. Update the map on peer DNS changes and removal. whichPeer() becomes O(log N) via map lookup:

const auto it = WhichPeerMap.find({from, from.port()});
return (it != WhichPeerMap.end()) ? it->second : nullptr;

Patch

Fix available: defects/squid-0004/patch/squid-0004.patch

Multi-file patch: neighbors.cc, CachePeers.cc.

37× op reduction at P=100, A=3.

What We Ask

Confirm receipt and assign a Bugzilla reference (bugs.squid-cache.org).
Assess severity — fires on every ICP/HTCP response in cache meshes.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Squid team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.2 KiB Raw Blame History Unescape Escape