russell@unturf.com
783e406633
pygame: CLEAN — runtime uses dict/set throughout (O(1) membership) libgdx-0002: ModelBuilder.rebuildReferences Array.contains O(P*M) — patch libgdx-0005: Stage.touchDragged touchFocuses.contains O(F^2) — patch libgdx-0006: AfterAction.delegate currentActions.indexOf O(W*A) per frame — patch unit: extend LibGDXTest to 7 tests, all PASS (50x-1971x speedup measured)
20 lines
917 B
Markdown
20 lines
917 B
Markdown
# pygame — CWE-407 Scan Result: CLEAN
|
|
|
|
**Scanned:** 2026-03-30
|
|
**Scope:** Python layer (`src_py/`), Cython layer (`src_c/cython/`), event C layer (`src_c/event.c`)
|
|
|
|
## Findings
|
|
|
|
No CWE-407 defects found in the runtime Python/Cython/C layers.
|
|
|
|
### Why pygame is clean
|
|
|
|
- `AbstractGroup` uses `dict` (`spritedict`) for all sprite membership — O(1) `in` checks.
|
|
- `Sprite.__g` is a `set` — O(1) group membership.
|
|
- Event blocking (`set_blocked`/`get_blocked`) uses SDL's native `SDL_EventState` array — O(1).
|
|
- `LayeredUpdates` uses `_spritelayers` dict for layer lookups — O(1).
|
|
- `sysfont` module uses `dict` for font registry — O(1).
|
|
- `OrderedUpdates._spritelist.remove()` is O(N) but is a single-shot operation, not nested.
|
|
|
|
The build infrastructure (`buildconfig/`) contains some list membership patterns but these
|
|
run once at build time, not in game loops, and are not relevant to runtime complexity.
|