freecad-0001: ifc_generator.py done-list O(N^2) dedup MEDIUM-HIGH 499x
freecad-0002: importDXF.py processededges list O(E^2) MEDIUM 469x
retroarch-0001: playlist_entry_exists O(R*P) linear scan in content scanner HIGH 749x
mpv: CLEAN (all data structures naturally bounded)
3/3 unit tests PASS.
clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) +
files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with
HashMap + HashSet. HIGH severity, 250x at N=1000.
clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/
SendUrls loops — fix with integer counter + QSet for requested_ids.
MEDIUM severity, 500x at N=1000.
MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout.
Rhythmbox: CLEAN — uses g_hash_table for all membership checks.
4/4 unit tests PASS.
amarok-0001: TrackNavigator::queueIds QQueue.contains in loop MEDIUM 1000x
amarok-0002: QtGroupingProxy::mapFromSource QList.contains/indexOf in nested iteration MEDIUM 2426x
strawberry-0001: CollectionWatcher::ScanSubdirectory QStringList files_on_disk contains+removeAll HIGH 2525x
strawberry-0002: ScrobblerCache::Flush QList.contains/removeAll in loop MEDIUM 334x
tomcat-0001: WebSocket getNegotiatedSubprotocol List.contains O(R×S) MEDIUM 52x
hibernate-orm-0001: FK ordering buildRecursiveOrderedFkSecondPasses List.contains O(N²) HIGH 2.8x
netty-0001: ALPN select/selected List.contains O(S×P) MEDIUM 26x
netty-0002: DnsResolveContext dedup ArrayList.contains O(R²) MEDIUM 30x
All 4/4 unit tests PASS.
Beam: exhaustive scan of sdks/java/core + runners — all membership tests already
use proper Set types (HashSet, LinkedHashSet, ImmutableSet, TreeSet). CLEAN.
Hive hive-0001: SharedWorkOptimizer.mergeSchema() uses List.contains() in loops
for neededColumnIDs/neededColumns/virtualCols dedup. O(D*R) per list. MEDIUM, 3-4x.
Hive hive-0002: HiveRelMdSize.averageColumnSizes() uses ImmutableList.contains(i)
in column loop during Calcite metadata queries. O(C*L). MEDIUM, 3-5x.
Both patched with HashSet wrappers. 2/2 unit tests PASS.
kdenlive-0001: ThumbnailCache m_storedOnDisk vector<int> std::find dedup O(C*P*V) MEDIUM
kdenlive-0002: TimelineModel clipIds vector std::find in mix loop O(N^2) MEDIUM
kdenlive-0003: TimelineController sorted_clips vector std::find in moveGroup O(N^2) MEDIUM
kdenlive-0004: TimelineModel all_items list std::find in resize O(N^2) MEDIUM
shotcut-0001: PlaylistProxyModel m_hashes vector std::find in filterAcceptsRow O(N^2) MEDIUM
5/5 unit tests PASS
libtorrent-0001: file_storage::get_or_add_path std::find on m_paths vector O(F*P) MEDIUM 250x
qBittorrent: CLEAN (QSet/QHash throughout for membership tests)
CWE-407: is_contained(BlockList, Succ) inside nested for loops in
computeOutliningColdRegionsInfo. Fix: SmallPtrSet for O(1) membership.
GCC deep scan: CLEAN (bitmaps/hash_sets throughout).
rustc: Exemplary use of FxHashSet/BitSet/IntervalSet throughout;
no linear membership tests on hot paths.
swift-0001: LoadableByAddress.cpp StructLoweringState uses SmallVector
with std::find for largeLoadableArgs/applies membership — O(I×A)
per function, 322x overhead at A=500. Fix: SmallPtrSet shadow.
minio-0001: healingTracker.isHealed() slices.Contains O(B×H) MEDIUM 25x
minio-0002: isBucketDecommissioned() slices.Contains O(P×D) MEDIUM 24x
minio-0003: isGroupDescEqual/isUserInfoEqual slices.Contains O(M²) MEDIUM 13x
etcd: maps + interval trees throughout; no CWE-407 defects found
