24 lines
831 B
Markdown
24 lines
831 B
Markdown
# UNDF: UNDF-2026-000000484
|
|
# OpenBGPD CWE-407 Scan — CLEAN
|
|
|
|
**Scan date:** 2026-03-28
|
|
**Source:** `usr.sbin/bgpd/` in openbsd-src
|
|
|
|
## Findings
|
|
|
|
`rde_community.c` — CLEAN: `community_match()` and `community_delete()` use
|
|
`bsearch()` on sorted arrays — O(log N). Wildcard/masked match is a single O(N)
|
|
linear scan, not nested.
|
|
|
|
`rde_filter.c` — CLEAN: `MAX_COMM_MATCH` loop bounded at compile-time constant (3).
|
|
|
|
`rde_attr.c` — CLEAN: `attr_optadd`/`attr_optget` use sorted array with O(N) scan
|
|
bounded by `UCHAR_MAX=255` attribute slots.
|
|
|
|
Prefix sets use `rde_trie.c` — O(prefix length). AS sets use sorted arrays with
|
|
binary search. No O(N²) community/prefix operations found.
|
|
|
|
## Conclusion
|
|
|
|
OpenBGPD's community infrastructure is deliberately designed around sorted arrays +
|
|
`bsearch` — no CWE-407 defects found.
|