russell@unturf.com
7491349edc
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup per broadphase step — even carries "too slow" self-admission comment (HIGH) bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per frame on m_collisionDisabledObjects plain array (MEDIUM) allegro5: CLEAN (vector_contains only on non-hot setup paths) box2d: CLEAN (v3 rewrite uses b2HashSet throughout) dry: CLEAN (HashSet/HashMap on all hot dedup paths)
18 lines
1.5 KiB
Markdown
18 lines
1.5 KiB
Markdown
# CLEAN — Nmap Network Scanner
|
||
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
|
||
|
||
## Scope
|
||
- `service_scan.cc` — service/version detection probe selection
|
||
- `osscan2.cc` — OS fingerprinting
|
||
- `traceroute.cc` — traceroute probe tracking
|
||
- `scan_engine.cc` — core scan engine
|
||
- `TargetGroup.cc` — target specification and dedup
|
||
|
||
## Findings
|
||
- **`ServiceProbe::portIsProbable`** — `std::find` on `probableports` / `probablesslports`. These vectors hold port numbers declared in the nmap-service-probes file per probe — typically 1–50 ports. Outer probe loop is over ~200 probes but inner find is O(constant). Not scalable O(N²). CLEAN.
|
||
- **`ServiceProbe::serviceIsPossible`** — linear scan of `detectedServices` with `strcmp`. List is small (services a probe can detect, typically 1–10). CLEAN.
|
||
- **`end_svcprobe`** — `std::find` on `services_in_progress` and `services_remaining` lists. Called once per completed probe to remove it; not a membership test in an accumulation loop. CLEAN.
|
||
- **`traceroute.cc`** — `std::find` on `unanswered_probes` to locate a probe upon reply receipt. List bounded by max TTL (≤30). CLEAN.
|
||
- **Target dedup** — `TargetGroup` uses netblock iteration; no linear dedup over large address sets.
|
||
|
||
**Result: No actionable CWE-407 defects. Nmap's scan data structures use small bounded lists for probe metadata; all scalable target/service tracking uses sorted or hash-based containers.**
|