russell@unturf.com
9934133dcf
Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
1.7 KiB
1.7 KiB
cpython-0001 — pkgutil extend_path: O(n²) list membership inside portion loop
| Field | Value |
|---|---|
| ID | cpython-0001 |
| Target | CPython |
| File | Lib/pkgutil.py |
| Lines | 332–336 |
| CWE | CWE-407 (Algorithmic Complexity) |
| Severity | MEDIUM |
| Status | PATCHED |
Description
pkgutil.extend_path() accumulates namespace package path portions while
deduplicating against a growing list. For each portion yielded by every
finder on the meta-path, the guard:
for portion in portions:
if portion not in path: # O(n) list scan
path.append(portion) # n grows with each append
path is a plain list; Python's list.__contains__ is O(n). As n
portions accumulate the total cost is O(n²). In environments with many
namespace packages (scientific stacks, monorepos, editable installs) the
meta-path can expose hundreds of portions, making startup/import time
super-linear.
Reproduction
import sys, pkgutil
# Synthetic: 500 distinct portions
portions = [f"/opt/pkg{i}/ns" for i in range(500)]
path = []
for p in portions:
if p not in path: # O(i) each iteration
path.append(p)
# 500 iterations × average 250 comparisons = 125,000 string comparisons
# vs set: 500 × O(1) = 500 hash probes
Fix
Replace the list with a parallel set for O(1) membership testing while
preserving insertion order in the list.
seen = set(path)
for portion in portions:
if portion not in seen:
path.append(portion)
seen.add(portion)
Complexity
| Metric | Before | After |
|---|---|---|
| Per-extend | O(n²) | O(n) |
| 500 portions | ~125 000 comparisons | ~500 hash probes |
| Speedup (500) | 1× | ~250× |