41 lines
1.9 KiB
Markdown
41 lines
1.9 KiB
Markdown
# rustc — CWE-407 Scan Result: CLEAN
|
|
|
|
## Scan Date
|
|
2026-03-30
|
|
|
|
## Target
|
|
Rust compiler (rustc) — https://github.com/rust-lang/rust
|
|
|
|
## Scope
|
|
- `compiler/rustc_borrowck/src/` — borrow checker, NLL region inference
|
|
- `compiler/rustc_trait_selection/src/` — trait selection, obligation processing
|
|
- `compiler/rustc_monomorphize/src/` — mono-item collection, partitioning
|
|
- `compiler/rustc_codegen_ssa/src/` — codegen, symbol export, linker
|
|
- `compiler/rustc_infer/src/` — type inference, region constraints
|
|
- `compiler/rustc_expand/src/` — macro expansion
|
|
- `compiler/rustc_mir_transform/src/` — MIR optimization passes
|
|
- `compiler/rustc_resolve/src/` — name resolution
|
|
- `compiler/rustc_passes/src/` — dead code, reachability
|
|
- `compiler/rustc_hir_typeck/src/` — HIR type checking
|
|
- `compiler/rustc_next_trait_solver/src/` — next-gen trait solver
|
|
- `compiler/rustc_middle/src/` — core types, MIR traversal
|
|
|
|
## Keywords Scanned
|
|
`Vec::contains`, `.iter().any(`, `.iter().find(`, `.position(` inside loops
|
|
|
|
## Findings
|
|
No CWE-407 defects found.
|
|
|
|
The Rust compiler team has done an exemplary job of using appropriate data structures
|
|
throughout the compiler:
|
|
|
|
- **Region inference**: `SparseBitMatrix`, `IntervalSet`, `SparseIntervalMatrix` for region membership
|
|
- **Trait selection**: `FxIndexSet`, `FxHashSet` for auto-trait dedup
|
|
- **Monomorphize collector**: `UnordSet` (hash-based) for visited tracking
|
|
- **Borrow checker**: `BitSet`-based containers throughout
|
|
- **Inline history**: bounded by `HISTORY_DEPTH_LIMIT = 20`
|
|
- **Dead code analysis**: `LocalDefIdSet` (hash-based) for live symbols
|
|
- **Fudge inference**: `Range<T>::contains` (O(1) range check, not linear scan)
|
|
- **Defining opaque types**: `ty::List` with O(N) contains, but N is always small (opaque types in a function body)
|
|
|
|
Every hot-path membership test uses a hash-based, bit-set, or interval-set data structure.
|