ompi: CWE-407 scan result — CLEAN

Scan Date

2026-03-27

Scope

ompi/mca/ — MCA component registration and lookup
opal/class/ — data structure implementations
ompi/communicator/ — communicator management
opal/mca/base/ — component find, repository, alias, var systems

Findings

Linear patterns found

Multiple OPAL_LIST_FOREACH + strcmp patterns exist in component selection (btl_base_select.c, mca_base_component_find.c, mca_base_component_repository.c, etc.), but none meet the CWE-407 threshold:

Component selection at startup (btl_base_select.c:71-96): outer loop over M registered components (M ≤ ~20), inner while over N requested names (N ≤ user CLI argc). Called once at MPI_Init. O(M × N) ≈ O(400). Not a performance defect.
component_find_check (mca_base_component_find.c:336-373): outer loop over N requested names, inner OPAL_LIST_FOREACH over M components. Same analysis: both bounds are tiny and the function runs once at startup.
mca_base_component_repository_open (mca_base_component_repository.c:388): single O(M) scan to check for duplicate component load. Called once per component at startup. Not a hot path.

Hash tables already present

The MCA base layer uses opal_hash_table for variable/group/pvar/alias lookups (mca_base_var.c, mca_base_alias.c, mca_base_component_repository.c). The component repository is hash-indexed by framework name. Only the per-framework framework_components linked list uses linear scan, and that list is always small (< 20 entries).

Verdict

CLEAN — no CWE-407 defect. All linear membership tests occur in one-time startup paths over bounded-small sets.

1.7 KiB Raw Blame History Unescape Escape