engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

game-engines: allegro5/bullet3/box2d/dry CWE-407 scan

Browse source 
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
This commit is contained in:
russell@unturf.com 2026-03-29 19:50:49 -04:00
parent 72e37e6142
commit 7491349edc
15 changed files with 477 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

28
defects/transmission/patch/CLEAN.md
View file

@ -1,18 +1,18 @@
# CLEAN — Transmission (BitTorrent client)
Scanned 2026-03-29 for CWE-407 (algorithmic complexity / linear scan membership).
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
## Areas Checked
## Scope
- `libtransmission/peer-mgr.cc` — peer list management
- `libtransmission/announcer-udp.cc` — tracker announcement
- `libtransmission/quark.cc` — string interning
- `libtransmission/torrent-files.cc` — torrent file set operations
- `libtransmission/peer-mgr-wishlist.cc` — piece request tracking
- `libtransmission/peer-mgr.cc` — peer management: no O(N²) peer dedup found.
Peer lookups use `std::ranges::find_if` on short request queues (capped by protocol
limits), not unbounded lists.
- `libtransmission/piece-picker` — piece selection: uses bitfields (`tr_bitfield`)
for have/want tracking — O(1) per-piece test.
- `libtransmission/announcer-udp.cc` — tracker UDP responses: `find_if` over active
connections, bounded by open tracker count (small constant).
- `libtransmission/web.cc` — HTTP connection pooling: `find` over `easy_pool_` keyed
by hostname string — map-like lookup by string key.
- `libtransmission/watchdir.cc` — `handled_` is an `std::set<std::string>` — O(log N).
## Findings
- **Peer manager** — no `std::find` in hot peer-processing loops; peer lookup uses sorted or set-based structures. CLEAN.
- **`quark.cc` string interning** — predefined quarks (TR_N_KEYS=753) use sorted binary search (`std::lower_bound`). Runtime quarks use `std::find` on `my_runtime` vector, but that list only grows for unknown dynamic keys (peer client names, RPC method names, labels) — bounded and small in practice. Not a scalable O(N²). CLEAN.
- **`torrent-files.cc`** — `std::ranges::find` on `ReservedNames` (compile-time constant ~30-entry list). CLEAN.
- **Piece tracking** — uses bitfields (`tr_bitfield`) for have/want — O(1) per-piece test. CLEAN.
- **Announcer** — `find_if` over active connection list bounded by open tracker count (small constant). CLEAN.
**Result: No actionable CWE-407 defects found. Transmission uses bitfields for
piece tracking and std::set for deduplication where needed.**
**Result: No actionable CWE-407 defects. Transmission uses bitfields for piece tracking, sorted binary search for its large static string table, and std::set for runtime deduplication.**