engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

game-engines: allegro5/bullet3/box2d/dry CWE-407 scan

Browse source 
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
This commit is contained in:
russell@unturf.com 2026-03-29 19:50:49 -04:00
parent 72e37e6142
commit 7491349edc
15 changed files with 477 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

18
defects/nmap/patch/CLEAN.md Normal file
View file

@ -0,0 +1,18 @@
# CLEAN — Nmap Network Scanner
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
## Scope
- `service_scan.cc` — service/version detection probe selection
- `osscan2.cc` — OS fingerprinting
- `traceroute.cc` — traceroute probe tracking
- `scan_engine.cc` — core scan engine
- `TargetGroup.cc` — target specification and dedup
## Findings
- **`ServiceProbe::portIsProbable`** — `std::find` on `probableports` / `probablesslports`. These vectors hold port numbers declared in the nmap-service-probes file per probe — typically 1–50 ports. Outer probe loop is over ~200 probes but inner find is O(constant). Not scalable O(N²). CLEAN.
- **`ServiceProbe::serviceIsPossible`** — linear scan of `detectedServices` with `strcmp`. List is small (services a probe can detect, typically 1–10). CLEAN.
- **`end_svcprobe`** — `std::find` on `services_in_progress` and `services_remaining` lists. Called once per completed probe to remove it; not a membership test in an accumulation loop. CLEAN.
- **`traceroute.cc`** — `std::find` on `unanswered_probes` to locate a probe upon reply receipt. List bounded by max TTL (≤30). CLEAN.
- **Target dedup** — `TargetGroup` uses netblock iteration; no linear dedup over large address sets.
**Result: No actionable CWE-407 defects. Nmap's scan data structures use small bounded lists for probe metadata; all scalable target/service tracking uses sorted or hash-based containers.**