UNDF: UNDF-2026-000000341

wireshark — CWE-407 scan result: CLEAN (beyond wireshark-0001)

Scan date: 2026-03-27 Files scanned:

epan/proto.c (protocol registration and field lookup)
epan/packet.c (dissector table lookup, heuristic dissector dispatch)
epan/dissectors/packet-tcp.c (TCP stream reassembly, MPTCP)

Candidates Investigated

proto_cleanup_base() — proto.c

g_list_remove() inside while (protocols) loop. Appears quadratic but is actually O(N): each iteration takes protocol = protocols->data (the list head) and then calls g_list_remove(protocols, protocol). GLib's g_list_remove scans from head and finds the element immediately (it IS the head). O(1) per iteration, O(N) total. Not a defect.

heur_dissector_add() — packet.c

Linear duplicate-check loop over sub_dissectors->dissectors before each heuristic registration. Runs only at startup; 96 TCP heuristics → ~4,656 ops total. Startup-only, not a per-packet hot path. Not a qualifying CWE-407.

dissector_try_heuristic() — packet.c

Iterates all H heuristic dissectors per unmatched packet. This is O(H) per packet, not O(H²). The outer "loop" is the packet stream, but each packet is independent — there is no inner membership-test-inside-a-loop structure. Has bubble-to-front optimization and breaks on first match. Not CWE-407.

mptcp_attach_subflow() — packet-tcp.c

wmem_list_find(mptcpd->subflows, tcpd) called once per MPTCP subflow attach event. MPTCP subflow counts are bounded by the protocol specification (typically 2–8 per connection). Not a scalable O(N²) pattern.

wmem_list_count() — wsutil/wmem/wmem_list.c

Confirmed O(1): the wmem_list_t struct caches a count field.

Verdict: CLEAN beyond wireshark-0001

No new CWE-407 defects found in the scanned files.

1.8 KiB Raw Blame History Unescape Escape