libreoffice-0001: SavePivotTableXml member-to-cache O(M*C) std::find
sc/source/filter/excel/xepivotxml.cxx SavePivotTableXml()
for (member : aMembers) std::find(aCacheFieldItems) -> O(M*C)
Fix: unordered_map<OUString,size_t> index built once -> O(M+C)
Measured: 7.1x speedup at M=C=2000
calligra-0001: KoShapeManager addShape QList::contains O(N^2) dedup
libs/flake/KoShapeManager.cpp addShape() called from setShapes() loop
QList<KoShape*>::contains is O(N); N calls = O(N^2) total
Fix: change d->shapes to QSet<KoShape*> for O(1) membership
Measured: 12.6x speedup at N=5000
MOADs 0002-0005: CLEAN for both targets (see README.md per defect)
Both unit tests: PASS
suitecrm-0004: SugarBean.php subpanel union field dedup in_array($field, $all_fields)
inside nested foreach over subpanel queries — O(S*F^2), 4.3x at S=40 F=60.
Fix: parallel hash set for O(1) isset() check.
dolibarr-0004: emailcollector_card.php line 575 — IMAP password logged verbatim
unconditionally in dol_syslog(). CWE-312 HIGH. Fix: replace with literal ***.
dolibarr-0005: functions_ldap.php line 98 — LDAP admin searchPassword first 3 chars
leaked via dol_trunc() in dol_syslog() and browser print when $ldapdebug=true.
CWE-312 MEDIUM. Fix: replace dol_trunc(...) with literal *** in both sinks.
All 4 SuiteCRM tests PASS. All 5 Dolibarr tests PASS.
MOADs 0002/0003/0005 CLEAN for both targets (PHP single-threaded, architectural globals).
taiga-0001: taiga/events/middleware.py stores request X-Session-ID in threading.local,
leaking it across thread-pool requests when process_response is skipped.
Fix: replace with contextvars.ContextVar for proper per-request isolation.
redmine-0004: Role#add_permission! in app/models/role.rb calls permissions.include?(p)
(Array O(P)) inside a perms.each loop — O(P^2) total. At P=1000 permissions,
68.6x overhead measured. Fix: build a Set once before the loop, use Set#add?.
jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
Fix: HashSet for O(1) membership; pre-built index map for indexOf
Unit test: 4/4 PASS, 19-35x op-count reduction at N=200
woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
two nested loops over items and deps: O(N*D*N) = O(N^2)
Fix: pre-build name-set map for O(1) lookup, O(N) total
Unit test: 3/3 PASS, 20x op-count reduction at N=100
woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
Exposes full Bearer JWT token in application logs
Fix: log only that header was found, not its value
Unit test: 3/3 PASS
ollama-0001: kvcache/causal.go buildMask() Except []int linear scan O(B*E).
For Gemma3 multi-image prompts, slices.Contains(opts.Except, i) is called
per batch token. With N images x 256 tokens/image, B and |except| both scale
as N*256 giving quadratic prefill cost. Fix: convert Except to map[int]struct{}
before the outer loop. 3.4x speedup at N=10 images. Unit test PASS.
dosbox-staging scanned for all 5 MOADs; all CLEAN. Linear scans operate on
fixed small palettes (16 CGA colors), hardcoded 3-item lists, or single-call
config paths. Mixer mutex consistent. No credential logging.
Updated defects/ollama/CLEAN.md to note the missed defect from prior scan.
langchain-0001: MultiVectorRetriever._get_relevant_documents() dedup
IDs from vectorstore sub_docs uses list.contains() inside loop, O(k^2).
k is unbounded in production RAG pipelines (configurable via search_kwargs).
Fix: track seen IDs in a set, keep list for order. 499.5x at k=1000.
forgejo-0002: LoadRepoConfig() license sort O(P*L) where L=776 licenses.
Two SliceContainsString calls in back-to-back loops iterate full license
list for each preferred license and vice versa. Fix: build lookup sets
before loops. 19.5x at P=20 preferred licenses.
forgejo-0003: synchronizePublicKeys() three O(N*M) scans per LDAP sync.
Dedup of providedKeys is O(K^2), plus two O(P*G) set-difference loops.
Runs per user per sync cycle. Fix: use maps for O(1) membership. 178.6x
at K=G=500.
forgejo-0001 (search.go RepoIDs) already patched in prior scan.
MOADs 0002-0005 CLEAN for both targets.
MOAD-0004 CWE-312: EveHttpLogJSONHeaders() in output-json-http.c logs HTTP
credential headers (Authorization, Proxy-Authorization, Cookie, Set-Cookie)
verbatim when dump-all-headers or custom field logging is enabled. Patch adds
a credential denylist that emits "[REDACTED]" instead of the raw value.
Default suricata.yaml.in shows Authorization as a custom field example with
no warning. Unit test 5/5 PASS.
MOADs 0001/0002/0003/0005 CLEAN: bitarray+hash+radix+RB-tree hot paths,
per-tenant DetectEngineCtx, thread-scoped thread_local, HRLOCK-guarded THash.
snort3-0002: chp_add_candidate_to_tally() in http_url_patterns.cc calls std::find_if
over CHPMatchTally vector for each Aho-Corasick HTTP key-pattern match callback,
O(M*T) per packet. Fix: add unordered_map index to ChpMatchDescriptor for O(1) lookup.
48x op-count reduction at T=100/M=20. 3/3 PASS.
pgbouncer-0001: scram_client_first() logs user->passwd (SCRAM verifier or plaintext
password) at slog_debug level, CWE-312. Fix: remove the log line. 5/5 PASS.
pgbouncer MOAD-0002/0003/0005 CLEAN (single-threaded libevent loop).
snort3 MOAD-0002/0003/0004/0005 CLEAN.
MOAD-0001: citra-0001 RasterizerCache page_table surfaces vector O(P*S^2)
UnregisterSurface calls std::find(surfaces.begin(), surfaces.end(), surface_id)
for each of P pages a surface spans. With S overlapping surfaces per page,
total unregister cost is O(P*S) per surface, O(P*S^2) overall.
Fix: change std::vector<SurfaceId> to std::unordered_set<SurfaceId>
(std::hash<Common::SlotId> already defined). 3.4x measured at S=500, P=64.
Hot path: InvalidateRegion called per CPU write to GPU texture memory.
MOAD-0002: CLEAN. System singleton is intentional single-emulator architecture;
subsystems injected via System& reference, no intertangle coupling found.
MOAD-0003: CLEAN. thread_local only used for JNIEnv* JVM attachment in Android
JNI (standard pattern, not request-scoped identity).
MOAD-0004: CLEAN. No credential values logged verbatim; JWT token size only.
MOAD-0005: CLEAN. GetPublicKey static cache is room-server single-threaded;
JitEngine shader cache is GPU-thread single-threaded; all others use mutex.
Source: azahar-emu/azahar (Citra continuation), depth=1.
gearboy-0001: Processor::CheckBreakpoints() and CheckMemoryBreakpoints() scan
m_breakpoints std::vector O(B) on every opcode dispatch and every memory
Read/Write. At ~4 MHz with B=64 breakpoints: ~256M comparisons/second.
Fix: std::unordered_set<u16> index for O(1) point-breakpoint lookup.
8.4x speedup measured in Java model.
gearsystem-0001: Same defect in GearSystem (SMS/GG emulator). Compounded by
Video.cpp calling CheckMemoryBreakpoints() on every VDP VRAM/CRAM access
(5 additional call sites beyond CPU). >5M O(B) scans/second at 3.58 MHz.
7.1x speedup measured in Java model.
minivmac: All 5 MOADs CLEAN. LocalFindATTel() bounded to 16-20 ATT entries
by design (constant, not O(N^2)). Single-threaded, no credentials, no TLS.
MOAD-0001 squid-0002: HttpHeader::removeConnectionHeaderEntries() O(H*C) per response hop.
strListIsMember() scans all C Connection tokens for each of H header entries. Fix: pre-build
unordered_set from Connection tokens once, probe O(1) per entry. 4.84x measured speedup at
H=200 headers / C=50 Connection tokens. Called per hop in removeHopByHopEntries().
MOAD-0004 squid-0003: CWE-312 credentials logged verbatim in debug output.
FtpGateway.cc loginParser() logs user:password at debug 9; basic/Config.cc decodeCleartext()
logs decoded cleartext at debug 9 AND logs full Authorization header at DBG_IMPORTANT (level 1,
always on); basic/UserRequest.cc startHelperLookup() logs user:password at debug 9.
Fix: replace credential values with redacted markers / length-only diagnostic info.
MOAD-0002: SquidConfig 571-line god object in 209 files, 1408 call sites — structural,
documented in defects/squid/scan/MOAD-RESULTS.md.
MOAD-0003: CLEAN (event-loop single-threaded, no thread_local for request context).
MOAD-0005: CLEAN (event-loop single-threaded, no concurrent cache race).
play-0001: CIopBios::FindIntrHandler() O(H) linear scan per IOP interrupt.
Called from HandleInterrupt() thousands of times per second. Fix: direct
index array m_intrHandlerIndex[LINES_MAX] keyed by interrupt line -> O(1).
Algorithmic ratio 32x (H=MAX_INTRHANDLER=32), timing 5.6x. 5/5 PASS.
Basilisk II: all 5 MOADs CLEAN. Video/newcpu lookuptab searches are cold
paths only; no god object, thread_local identity, credential logging, or
unsynchronized cache patterns found.
xenia-0001: ObjectTable::GetAllObjects() in
src/xenia/kernel/util/object_table.cc uses std::find on a growing results
vector to deduplicate XObject pointers while iterating all 16,384+ table
slots. Each slot incurs an O(results.size()) linear scan, giving O(S*R)
total where S = slot count and R = unique object count. Fix: unordered_set
seen-pointer set reduces membership test to O(1). Measured 4.3x speedup.
MOAD-0002 Intertangle: CLEAN
MOAD-0003 Leaked Context: CLEAN (TLS vars are thread-scoped, not request-scoped)
MOAD-0004 CWE-312: CLEAN (no credentials or key bytes logged)
MOAD-0005 Thundering Herd: CLEAN (all caches use global_critical_region_ lock)
aranym-0001: hardware.cpp getModule() O(D) linear scan over 17 devices
on every 68k I/O read/write. Replaced with O(log D) binary search over
a sorted HWRange table built at HWInit(). 2.73x speedup measured.
ppsspp-0004: sceKernelLockMutex/CB and sceKernelLockLwMutex/CB (4 sites)
scan mutex->waitingThreads vector with std::find before push_back --
O(W) per lock attempt. Fix: parallel unordered_set for O(1) dedup.
Unit test extended to cover ppsspp-0004; all 8/8 PASS (ratios 5-27x).
retroarch-0002: core_info_database_supports_content_path O(C*(E+D)) per file
in ROM scanner, 193x speedup at C=100 cores; fix: ext->database hash map
built at core list init, O(1) lookups replace full core-list scan.
openemu-0001: SetupAssistant knownCores Array.contains O(N^2) core dedup,
17x op-count at N=35 cores; fix: Set<CoreDownload> for O(1) .contains.
MOADs 0002-0005 for both targets: RetroArch runloop is single-threaded by
design (no leaked context); no credential logging found (CHEEVOS_LOG_PASSWORD
guarded and undef'd by default); no unguarded cache thundering herd.
OpenEmu: no ThreadLocal patterns; no credential logging; NSCache is
thread-safe and duplicate fetch work is bounded.
openmsx-0001: MSXCPUInterface::checkBreakPoints() O(B) linear scan
over all breakpoints per Z80 instruction when any breakpoint is active.
Fix: unordered_map<uint16_t, vector<id>> index gives O(k) lookup where
k = breakpoints at current PC (typically 0). 500x improvement at B=500.
desmume-0001: armInnerLoop scans breakPoints std::vector<u32> linearly
O(B) on every ARM9 and ARM7 instruction (~66+33 MHz); replace with
std::unordered_set<u32> for O(1) lookup. 3.5x speedup at B=32. MOAD 0002-0005 CLEAN.
melonds-0001: GPU3D_Soft RenderScanline iterates all P polygons per
scanline O(P*S) per frame; active-list sweep gives O(P log P + A_total).
9x speedup at P=2048 with typical short-lived polygons. MOAD 0002-0005 CLEAN.
genesis-plus-gx-0001: retro_cheat_set duplicate cheat detection uses
O(N) linear scan over cheatlist[0..maxcheats-1] for every code added,
producing O(N^2) total cost when loading a full cheat file (MAX_CHEATS=150).
Fix: open-addressing hash table keyed by (address, data), O(1) per insert.
9x speedup measured at N=150.
dolphin-0001: BreakPoints::GetRegularBreakpoint O(N) std::ranges::find
over m_breakpoints vector, called per CPU instruction when breakpoints
are active. Fix: unordered_map<u32, size_t> index rebuilt on mutation,
O(1) lookup. 2.5x speedup at N=64, scales further with breakpoint count.
vice-0001: monitor breakpoint list O(N) scan per opcode — search_checkpoint_list
traverses sorted checkpoint linked list without early exit. Code comment promises
"we can drop out early" but never implements it. Fix: break when entry.start_addr
exceeds target address. 200x fewer comparisons for addresses below first breakpoint.
11/11 PASS.
DOSBox-X: dosbox-x-0001/0002 previously committed (2026-03-31). MOAD 0002-0005 CLEAN.
fbneo-0001: BurnDrvGetIndex O(N) linear scan over 24493 drivers -> O(1) unordered_map,
91x speedup at N=5000. Fix: hash index built at BurnLibInit, cleared at BurnLibExit.
mame: confirmed CLEAN on all 5 MOADs (binary search for driver lookup, single-threaded).
