wave9b: 455/204 — graphhopper-0001/0002 + valhalla-0001 + OSRM CLEAN

defects/osrm/patch/osrm-CLEAN.md

@@ -0,0 +1,30 @@
+# OSRM — CWE-407 Scan Result: CLEAN
+
+## Scan Date
+2026-03-27
+
+## Files Scanned
+- `src/engine/routing_algorithms/alternative_path_ch.cpp`
+- `src/engine/routing_algorithms/alternative_path_mld.cpp`
+- `src/engine/routing_algorithms/routing_base_ch.cpp`
+- `src/engine/routing_algorithms/routing_base_mld.cpp`
+- `src/engine/routing_algorithms/shortest_path.cpp`
+- `src/contractor/` (full directory)
+- `src/extractor/` (full directory)
+
+## Findings
+
+**No CWE-407 defects found in routing hot paths.**
+
+OSRM explicitly uses appropriate O(1) data structures:
+
+- `alternative_path_ch.cpp` line 638: `std::unordered_set<NodeID> nodes_in_path` — correct O(1) node membership for path sharing calculation
+- `alternative_path_mld.cpp` line 292: `std::unordered_set<CellID> cells` — correct O(1) cell membership for path deduplication
+- `std::find` uses found: all on small bounded vectors (trip waypoints, class names, via lists) — not in O(N) traversal loops
+
+## Notes
+
+OSRM's CH alternative path solver (`alternative_path_ch.cpp`) demonstrates the correct pattern
+that GraphHopper's `AlternativeRouteCH.java` should follow: the shortest path node set is built
+as `std::unordered_set<NodeID>` before iterating the search space, giving O(1) membership
+tests during the O(E) sweep.