# rustc — CWE-407 Scan Result: CLEAN

## Scan Date
2026-03-30

## Target
Rust compiler (rustc) — https://github.com/rust-lang/rust

## Scope
- `compiler/rustc_borrowck/src/` — borrow checker, NLL region inference
- `compiler/rustc_trait_selection/src/` — trait selection, obligation processing
- `compiler/rustc_monomorphize/src/` — mono-item collection, partitioning
- `compiler/rustc_codegen_ssa/src/` — codegen, symbol export, linker
- `compiler/rustc_infer/src/` — type inference, region constraints
- `compiler/rustc_expand/src/` — macro expansion
- `compiler/rustc_mir_transform/src/` — MIR optimization passes
- `compiler/rustc_resolve/src/` — name resolution
- `compiler/rustc_passes/src/` — dead code, reachability
- `compiler/rustc_hir_typeck/src/` — HIR type checking
- `compiler/rustc_next_trait_solver/src/` — next-gen trait solver
- `compiler/rustc_middle/src/` — core types, MIR traversal

## Keywords Scanned
`Vec::contains`, `.iter().any(`, `.iter().find(`, `.position(` inside loops

## Findings
No CWE-407 defects found.

The Rust compiler team has done an exemplary job of using appropriate data structures
throughout the compiler:

- **Region inference**: `SparseBitMatrix`, `IntervalSet`, `SparseIntervalMatrix` for region membership
- **Trait selection**: `FxIndexSet`, `FxHashSet` for auto-trait dedup
- **Monomorphize collector**: `UnordSet` (hash-based) for visited tracking
- **Borrow checker**: `BitSet`-based containers throughout
- **Inline history**: bounded by `HISTORY_DEPTH_LIMIT = 20`
- **Dead code analysis**: `LocalDefIdSet` (hash-based) for live symbols
- **Fudge inference**: `Range<T>::contains` (O(1) range check, not linear scan)
- **Defining opaque types**: `ty::List` with O(N) contains, but N is always small (opaque types in a function body)

Every hot-path membership test uses a hash-based, bit-set, or interval-set data structure.