## Diamond Recursion Scan — CLEAN

**Scan date:** 2026-03-29
**Pattern:** Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

### Files examined

- `Source/cmGeneratorExpressionDAGChecker.cxx` / `.h` — generator expression DAG traversal
- `Source/cmComputeTargetDepends.cxx` — inter-target dependency graph computation
- `Source/cmComputeComponentGraph.cxx` — Tarjan SCC implementation
- `Source/cmComputeLinkDepends.cxx` — link dependency ordering (`VisitComponent`, `VisitEntry`)
- `Source/cmOrderDirectories.cxx` — directory ordering DFS (`VisitDirectory`)
- `Source/cmGlobalGhsMultiGenerator.cxx` — GHS target topological sort (`VisitTarget`)
- `Source/cmCMakePresetsGraph.cxx` — preset inheritance cycle detection (`VisitPreset`)
- `Source/cmFindPackageCommand.cxx` — `FindPackageDependencies`, transitive CPS package deps

### Findings

**cmGeneratorExpressionDAGChecker:** Uses a parent-chain walk via linked `Parent` pointers to detect cycles. Each `cmGeneratorExpressionDAGChecker` instance carries a pointer to its parent, and `CheckGraph()` walks the chain linearly. This is O(depth) for cycle detection, not recursive — CLEAN. The `Seen` map on `Top` prevents duplicate transitive property evaluation.

**cmComputeTargetDepends:** Uses Tarjan's SCC algorithm (`cmComputeComponentGraph`) for dependency analysis — proper O(V+E) algorithm, no naive recursive reachability. `CollectSideEffectsForTarget` uses `std::set<size_t> visited` passed by reference. CLEAN.

**cmComputeLinkDepends:** `VisitComponent` uses `ComponentVisited[]` array (indexed by component ID) as visited guard; checks before recursing. `VisitEntry` tracks component state. CLEAN.

**cmOrderDirectories:** `VisitDirectory` uses `DirectoryVisited[]` array indexed by node ID; checks and marks before recursing into neighbors. CLEAN.

**cmGlobalGhsMultiGenerator::VisitTarget:** Uses `temp` (in-progress) and `perm` (completed) `std::set` pairs for proper topological sort. CLEAN.

**cmCMakePresetsGraph VisitPreset:** Uses `std::map<std::string, CycleStatus>` with three states (Unvisited/InProgress/Verified) — standard DFS coloring. CLEAN.

**cmFindPackageCommand::FindPackageDependencies:** Processes CPS-format transitive dependencies by creating new `cmFindPackageCommand` instances for each dep. Uses global Makefile state (`Foo_FOUND`, `Foo_DIR` cache entries) to detect already-processed packages. The `_DIR` cache variable acts as a memoization key that causes `HandlePackageMode` to use the cached directory instead of re-searching. Re-reading the config file can occur but is idempotent in practice. Diamond traversal is bounded by CMake's internal `include-guard` mechanism in config files. CLEAN.

### Verdict: CLEAN — no diamond recursion CWE-407 found