russell@unturf.com
7491349edc
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup per broadphase step — even carries "too slow" self-admission comment (HIGH) bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per frame on m_collisionDisabledObjects plain array (MEDIUM) allegro5: CLEAN (vector_contains only on non-hot setup paths) box2d: CLEAN (v3 rewrite uses b2HashSet throughout) dry: CLEAN (HashSet/HashMap on all hot dedup paths)
16 lines
1.2 KiB
Markdown
16 lines
1.2 KiB
Markdown
# CLEAN — Dragonfly (Redis-compatible, C++)
|
|
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
|
|
|
|
## Scope
|
|
- `src/server/` — key eviction, cluster family, stream family, replication
|
|
- `src/core/search/` — HNSW vector search, range tree
|
|
- `src/server/search/` — document index, aggregator, search family
|
|
|
|
## Findings
|
|
- **HNSW vector search** (`src/core/search/hnsw_alg.h`) — uses `VisitedListPool` with a flat array indexed by element ID (`visited_array[id] == tag`). O(1) per visited check. CLEAN.
|
|
- **Aggregator dedup** (`src/server/search/aggregator.cc`) — uses `absl::flat_hash_set<Value>` for DISTINCT counting. CLEAN.
|
|
- **`search_family.cc` kIgnoredOptions** — `std::find` on `kIgnoredOptions` / `kIgnoredOptionsWithArg` which are compile-time constant arrays of ~5 strings. O(1) in practice. CLEAN.
|
|
- **`doc_index.cc` free_ids_** — DCHECK-only assertion, not a production hot path. CLEAN.
|
|
- **Cluster / replication** — no vector-based membership checks found in hot paths; uses hash maps throughout.
|
|
|
|
**Result: No actionable CWE-407 defects. Dragonfly consistently uses `absl::flat_hash_set`, `flat_hash_map`, and array-indexed visited tracking.**
|