25 lines
1 KiB
Markdown
25 lines
1 KiB
Markdown
# UNDF: UNDF-2026-000000451
|
||
# lighttpd — CWE-407 scan result: CLEAN
|
||
|
||
## Scan date: 2026-03-27
|
||
|
||
## Files scanned
|
||
|
||
| File | Finding |
|
||
|------|---------|
|
||
| `src/connections.c` | CLEAN — chunk-type scan in `connection_write_chunkqueue` is a single-pass linear traversal, not a nested membership test |
|
||
| `src/plugin.c` | CLEAN (startup-only) — `plugins_load` nested loop is O(M×F) at startup only, where F is a compile-time fixed-size static table; not per-request |
|
||
|
||
## Notes
|
||
|
||
`plugins_load` contains an outer loop over configured modules and an inner
|
||
`strcmp` scan over a static `load_functions[]` array. This is startup-only
|
||
(runs once at server init) and F is bounded by the number of compiled-in
|
||
modules (fixed at build time, typically < 100). This does not meet the CWE-407
|
||
threshold for a ticketed defect.
|
||
|
||
`connection_write_chunkqueue` scans from `cq->first` forward to find the
|
||
first non-MEM_CHUNK element for TCP_CORK optimisation. This is a single
|
||
linear pass per write call, not a nested O(N²) membership test.
|
||
|
||
**Verdict: CLEAN**
|