63 lines
2.3 KiB
Markdown
63 lines
2.3 KiB
Markdown
# NumPy — CWE-407 Disclosure Brief
|
||
**2026-03-27 · Patch available — awaiting upstream merge**
|
||
|
||
## Finding
|
||
|
||
One O(n²) defect in NumPy's f2py Fortran interface generator. `_get_depend_dict()` in `crackfortran.py` uses `if w not in words` list membership inside an O(V²) dependency resolution loop. Patch ready for upstream review.
|
||
|
||
## The Defects
|
||
|
||
**numpy-0001 (PATCHED — HIGH):** `numpy/f2py/crackfortran.py:2352`
|
||
|
||
```python
|
||
# Inside _get_depend_dict() — Fortran module dependency resolution:
|
||
for w in words:
|
||
if w not in seen_words: # O(V) list scan per word
|
||
seen_words.append(w)
|
||
# recurse for dependencies
|
||
# O(V²) total dependency resolution
|
||
```
|
||
|
||
`if w not in seen_words` performs O(V) list scan where `seen_words` is a list. For V Fortran module variables: **O(V²) total dependency resolution**. **Measured ratio: 218×.**
|
||
|
||
## Complexity Proof
|
||
|
||
For V=218 Fortran module variables/dependencies:
|
||
- Per variable: O(V) `not in` list scan
|
||
- Total: O(V²) = 47,524 comparisons
|
||
- Fixed: parallel `set` seen → O(V)
|
||
- **218× measured ratio.**
|
||
|
||
## Impact
|
||
|
||
All NumPy users using f2py to wrap Fortran code — scientists, engineers, and numerical computing applications that interface with Fortran libraries (LAPACK, BLAS wrappers, legacy scientific codes). f2py is a core NumPy tool for Fortran interoperability. Large Fortran modules with many variables and cross-dependencies maximize V. NumPy is one of the most widely used Python packages, foundational to the entire scientific Python ecosystem.
|
||
|
||
## The Fix
|
||
|
||
Replace `seen_words` list with `set`:
|
||
|
||
```python
|
||
# Before
|
||
seen_words = []
|
||
if w not in seen_words: # O(V) list scan
|
||
seen_words.append(w)
|
||
|
||
# After
|
||
# CWE-407 fix: set for O(1) membership instead of O(V) list scan.
|
||
seen_words = set()
|
||
if w not in seen_words: # O(1) set lookup
|
||
seen_words.add(w)
|
||
```
|
||
|
||
## Patch
|
||
|
||
`defects/numpy/patch/numpy-0001-f2py-crackfortran-set.patch`
|
||
|
||
## What We Ask
|
||
|
||
1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
|
||
2. Validate the patch against your f2py test suite.
|
||
3. Assess CVE eligibility — fires on every f2py compilation of large Fortran modules.
|
||
4. Coordinate a disclosure date — we are targeting 90 days from first contact.
|
||
|
||
Contact: see cover email. This brief is confidential until coordinated disclosure.
|