# allegro5 — CWE-407 Scan Result: CLEAN

**Scanned:** 2026-03-29
**Repo:** https://github.com/liballeg/allegro5

## Findings

All `_al_vector_contains` / `_al_list_contains` usages in allegro5 are on
non-hot paths:

| Site | Path | Hot? |
|------|------|------|
| `al_register_event_source` | `src/events.c:168` | No — called once at setup |
| `al_is_event_source_registered` | `src/events.c:153` | No — query, not per-event |
| `al_destroy_shader` (bitmap dedup) | `src/shader.c:242` | No — called at teardown |
| `wwindow.c resizing_displays` | `src/win/wwindow.c:975` | No — OS resize callback |

Font fallback chain (`addons/ttf/ttf.c`, `addons/font/font.c`) uses a singly-linked
pointer chain (`f->fallback`), not a list membership scan.

No O(N²) or O(N×M) inner-loop membership checks found in any hot path
(per-frame, per-event, per-pixel).

**Verdict: CLEAN**