# MPD (Music Player Daemon) - CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30
Source: https://github.com/MusicPlayerDaemon/MPD (depth=1)

## Scan Summary

MPD is well-engineered with respect to data structure choices:

- **Tag type lookups**: Uses bitmask arrays (`TagMask`) for O(1) membership testing
- **Protocol list**: Uses `std::set` for dedup
- **Property model**: Uses `g_hash_table` (via libmpd) for O(1) lookups
- **Keyword tracking**: Uses `g_hash_table` for entry-keyword mapping
- **Playlist dedup**: Uses hash-based `location_in_map` via `g_hash_table`
- **Input cache**: Uses `std::map` (`items_by_uri`) for URI lookups
- **Event polling**: Uses `std::map` for fd-to-pollfd mapping

The few `std::find` calls found operate on bounded-size collections
(tag_types, ~30 entries max) and are not inside scaling loops.

No CWE-407 defects found.
