russell@unturf.com
e074f18ac7
cpython-0001: unittest.mock.reset_mock visited=[] O(N²) diamond traversal mastodon-0001: OStatus Creation processed_account_ids Array#include? O(N²) mastodon-0002: ActivityPub process_hashtag status.tags.include? O(N²) AR queries CLEAN: dask, bottle, pyramid, alembic, dgl, synapse, dendrite, zulip
28 lines
1.2 KiB
Markdown
28 lines
1.2 KiB
Markdown
# dry (Urho3D fork) — CWE-407 Scan Result: CLEAN
|
|
|
|
**Scanned:** 2026-03-29
|
|
**Repo:** https://github.com/nikibobi/dry (Urho3D fork)
|
|
|
|
## Findings
|
|
|
|
All hot-path dedup structures in dry use `HashSet<T>` or `HashMap<K,V>`:
|
|
|
|
| Hot Path | Container | O() |
|
|
|----------|-----------|-----|
|
|
| `Renderer::DrawDebugGeometry` processedGeometries/processedLights | `HashSet<Drawable*>` / `HashSet<Light*>` | O(1) |
|
|
| `AnimationController::Update` processedAnimations | `HashSet<StringHash>` | O(1) |
|
|
| `PhysicsWorld` currentCollisions / previousCollisions | `HashMap<Pair<...>, ManifoldPair>` | O(1) |
|
|
| `Scene` node/component registries | `HashMap<unsigned, Node*>` | O(1) |
|
|
|
|
`PODVector<RigidBody*>::Contains` in `PhysicsQueryCallback::addSingleResult`
|
|
is O(R) per contact point, but R is bounded by the number of bodies in the
|
|
query volume (typically < 10 in practice) and the method is not called
|
|
per-frame unless the game explicitly issues repeated overlap queries.
|
|
|
|
Node tag lookup `HasTag()` uses `StringVector::Contains` (O(T)), but T (tags
|
|
per node) is typically 1-3. Scene-level `GetNodesWithTag()` is backed by
|
|
`HashMap<StringHash, PODVector<Node*>>` — O(1) tag lookup.
|
|
|
|
No qualifying O(N²) defects found in any hot path.
|
|
|
|
**Verdict: CLEAN**
|