GNU Octave — CWE-407 Analysis
==============================

.. contents:: :local:

Overview
--------

GNU Octave is a scientific computing environment with MATLAB-compatible syntax. Its
``scripts/graph/`` package implements graph algorithms including spanning trees, shortest
paths, topological sort, and SCC analysis.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

Scan returned 8 candidates from ``.m`` scripts. All triaged as false positives.

Triage Summary
--------------

- ``__ghostscript__.m`` — ``ismember(opts.level, [1, 2, 3])`` — 3-element constant array, O(1) effectively
- ``__print_parse_opts__.m`` — ``any(arg(end) == "124")`` — character comparison against 3-char string
- ``spline.m`` — ``any(szy == n)`` — vectorized comparison over a size vector (scalar output expected)
- ``treeplot.m`` — ``find(skelet == 0)`` — vectorized element search; necessarily O(n) but not inside a traversal loop
- ``hgload.m`` — ``ismember(fn_old, fn_new{j})`` — filename comparison in plot file loading utility

No CWE-407 pattern: none of these are O(n) membership tests inside a graph traversal loop.
The ``treeplot`` function draws a pre-computed tree structure; the ``find`` call locates
unconnected skeleton nodes in a linear pass — O(n) but not quadratic.

Octave's graph algorithms in ``scripts/graph/`` (``graphpred2path``, ``dmperm``,
``graph_chol``) use Octave's native sparse matrix operations for adjacency representation.
SCC computation delegates to compiled FORTRAN/C routines.

Note on MATLAB
--------------

MATLAB's ``ismember`` for array inputs is O(n log n) (sort-based). For large adjacency
lists used as visited sets in iterative graph algorithms, this is suboptimal compared to
O(1) hash membership. This is not a defect in the CWE-407 sense (no list inside a traversal
loop) but is a known performance consideration for MATLAB graph algorithm implementations.

References
----------

* Scan result: ``tools/scan-results/gnu-octave.txt``
