java-topology/defects/curaengine-0001/SCAN-NOTES.md

curaengine-0001 — PathOrderMonotonic std::find on vector O(SN + SL)

Target

Ultimaker CuraEngine (C++, 3D printing slicer engine) https://github.com/Ultimaker/CuraEngine

File

src/PathOrderMonotonic.cpp lines 301-320

Defect

Inside makeOrderedPath(), when processing polyline strings:

for (size_t i = 0; i < polystring.size() - 1; ++i)  // O(S) outer
{
    // O(N): std::find on std::vector<Path*> polylines to get iterator
    const std::vector<Path*> overlapping_lines
        = getOverlappingLines(std::find(polylines.begin(), polylines.end(), polystring[i]),
                              perpendicular, polylines, max_adjacent_distance);

    for (Path* overlapping_line : overlapping_lines)  // O(L) per polystring element
    {
        // O(S): std::find on std::deque<Path*> polystring
        if (std::find(polystring.begin(), polystring.end(), overlapping_line)
            == polystring.end())
        { ... }
    }
}

Two std::find calls inside nested loops:

1. std::find(polylines.begin(), polylines.end(), polystring[i]) — O(N) per iteration, N = total polylines
2. std::find(polystring.begin(), polystring.end(), overlapping_line) — O(S) per overlapping line

Total cost: O(SN + SLS) = O(SN + S²L) per polystring processed. For a complex layer with N=1000 polylines, S=50 in a string, L=5 overlapping: 501000 + 50²5 = 62500 ops. With a flat set the inner find becomes O(1): 501 + 5051 = 300 ops, ~200x fewer.

MOAD

0001 — CWE-407 Algorithmic Complexity, linear container scan inside loop

Severity

MEDIUM-HIGH. Triggered on every layer's monotonic path ordering pass (called once per printed layer per infill/wall segment). A complex print with many infill lines per layer multiplies this cost across all layers.

Fix

1. Pre-build unordered_map<Path*, iterator> polyline_index once before the outer loop for O(1) iterator lookup.
2. Build unordered_set<Path*> polystring_set once per polystring for O(1) membership check.

Speedup

O(SN + S²L) → O(N + S*L). At S=50, N=1000, L=5: 62500 → 1300, ~48x fewer comparisons.

MOADs 0002-0005

• 0002 Intertangle: CuraEngine uses a clean Application singleton with well-scoped processor stages. No god-object Intertangle.
• 0003 Leaked Context: No thread_local usage found in src/. CLEAN.
• 0004 Logged Secret: CuraEngine has no credential or auth handling. CLEAN.
• 0005 Thundering Herd: Single-threaded slicing pipeline, no concurrent cache races. CLEAN.