39 lines
1.6 KiB
Diff
39 lines
1.6 KiB
Diff
# UNDF: UNDF-2026-000000046
|
|
diff --git a/distlib/util.py b/distlib/util.py
|
|
index 0d5bd7a..f5f3c83 100644
|
|
--- a/distlib/util.py
|
|
+++ b/distlib/util.py
|
|
@@ -1154,6 +1154,8 @@ class Sequencer(object):
|
|
# http://en.wikipedia.org/wiki/Tarjan%27s_strongly_connected_components_algorithm
|
|
index_counter = [0]
|
|
stack = []
|
|
+ # CWE-407 fix: set for O(1) stack membership test (list `in` is O(n))
|
|
+ stack_set = set()
|
|
lowlinks = {}
|
|
index = {}
|
|
result = []
|
|
@@ -1166,6 +1168,7 @@ class Sequencer(object):
|
|
lowlinks[node] = index_counter[0]
|
|
index_counter[0] += 1
|
|
stack.append(node)
|
|
+ stack_set.add(node)
|
|
|
|
# Consider successors
|
|
try:
|
|
@@ -1177,7 +1180,7 @@ class Sequencer(object):
|
|
# Successor has not yet been visited
|
|
strongconnect(successor)
|
|
lowlinks[node] = min(lowlinks[node], lowlinks[successor])
|
|
- elif successor in stack:
|
|
+ elif successor in stack_set:
|
|
# the successor is in the stack and hence in the current
|
|
# strongly connected component (SCC)
|
|
lowlinks[node] = min(lowlinks[node], index[successor])
|
|
@@ -1188,6 +1191,7 @@ class Sequencer(object):
|
|
|
|
while True:
|
|
successor = stack.pop()
|
|
+ stack_set.discard(successor)
|
|
connected_component.append(successor)
|
|
if successor == node:
|
|
break
|