russell@unturf.com
a629bd0bbf
New defects (all PASS): - exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20 - minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24 - minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N) - minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N) - minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N) - mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000 - ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x - pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup, prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools, linux-kernel (pointer to linux/)
39 lines
1.7 KiB
Markdown
39 lines
1.7 KiB
Markdown
# Dask — CWE-407 Scan: CLEAN
|
|
|
|
**Date:** 2026-03-29 (re-scanned; original 2026-03-27)
|
|
**Target:** dask/dask (Version 2026.3.0)
|
|
**Files scanned:**
|
|
- `dask/order.py` — task ordering algorithm
|
|
- `dask/optimization.py` — graph fusion, visited nodes
|
|
- `dask/base.py` — tokenization, key deduplication
|
|
- `dask/_task_spec.py` — task specification graph traversal
|
|
- `dask/local.py` — local scheduler
|
|
- `dask/blockwise.py` — blockwise layer fusion
|
|
- `dask/graph_manipulation.py` — graph cloning / rebinding
|
|
|
|
## Verdict: CLEAN
|
|
|
|
All `not in` membership tests in hot graph traversal paths are against
|
|
`set`, `dict`, or `frozenset` containers providing O(1) average membership:
|
|
|
|
- `order.py:237` — `item in result` — dict
|
|
- `order.py:325` — `key in runnable_hull or key in result` — set, dict
|
|
- `order.py:374` — `path[-2] not in result` — dict
|
|
- `order.py:581` — `item in result` — dict
|
|
- `optimization.py:62` — `d not in seen` — set
|
|
- `optimization.py:156` — `child not in unfusible` — set
|
|
- `optimization.py:215` — `key not in fused` — set
|
|
- `optimization.py:349` — `key not in output` — set/dict
|
|
- `optimization.py:577` — `v not in rdeps` — dict
|
|
- `local.py:182` — `key in seen` — set
|
|
- `local.py:309` — `dep not in results` — dict
|
|
- `blockwise.py:1123` — `layer in seen` — set
|
|
- `blockwise.py:1389` — `x in seen` — dict
|
|
- `graph_manipulation.py:299` — `layer in omit_layers` — set comprehension
|
|
- `base.py:490` — `tok not in repack_dsk` — dict
|
|
|
|
The only `if x in [...]` patterns found are against constant-size literal
|
|
lists (e.g. `mode in ["edge", "linear_ramp"]`, `kind in [p.POSITIONAL_OR_KEYWORD, ...]`)
|
|
— these are not hot-path O(N) issues.
|
|
|
|
No CWE-407 defects found.
|