russell@unturf.com
7491349edc
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup per broadphase step — even carries "too slow" self-admission comment (HIGH) bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per frame on m_collisionDisabledObjects plain array (MEDIUM) allegro5: CLEAN (vector_contains only on non-hot setup paths) box2d: CLEAN (v3 rewrite uses b2HashSet throughout) dry: CLEAN (HashSet/HashMap on all hot dedup paths)
18 lines
756 B
Markdown
18 lines
756 B
Markdown
# dgl — CWE-407 Scan: CLEAN
|
|
|
|
Scanned: 2026-03-29
|
|
|
|
## Scope
|
|
|
|
- `python/dgl/traversal.py` — BFS/DFS: delegates to C++ backend, no Python-level visited list
|
|
- `python/dgl/nn/pytorch/explain/subgraphx.py` — MCTS node selection: no visited list
|
|
- `python/dgl/graphbolt/impl/ondisk_dataset.py` — dataset loading: no graph traversal
|
|
- `python/dgl/graphbolt/internal/utils.py` — utility functions: no membership checks
|
|
- `python/dgl/nn/pytorch/network_emb.py` — random walk sampling: delegates to C++
|
|
|
|
## Verdict
|
|
|
|
No CWE-407 (algorithmic complexity / quadratic membership check) defects found.
|
|
Core graph traversal (BFS, DFS, topological sort) is implemented in the C++
|
|
backend. Python-level code uses no list-based visited/seen patterns in hot
|
|
paths.
|