russell@unturf.com
7491349edc
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup per broadphase step — even carries "too slow" self-admission comment (HIGH) bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per frame on m_collisionDisabledObjects plain array (MEDIUM) allegro5: CLEAN (vector_contains only on non-hot setup paths) box2d: CLEAN (v3 rewrite uses b2HashSet throughout) dry: CLEAN (HashSet/HashMap on all hot dedup paths)
18 lines
1.4 KiB
Markdown
18 lines
1.4 KiB
Markdown
# CLEAN — Transmission (BitTorrent client)
|
|
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).
|
|
|
|
## Scope
|
|
- `libtransmission/peer-mgr.cc` — peer list management
|
|
- `libtransmission/announcer-udp.cc` — tracker announcement
|
|
- `libtransmission/quark.cc` — string interning
|
|
- `libtransmission/torrent-files.cc` — torrent file set operations
|
|
- `libtransmission/peer-mgr-wishlist.cc` — piece request tracking
|
|
|
|
## Findings
|
|
- **Peer manager** — no `std::find` in hot peer-processing loops; peer lookup uses sorted or set-based structures. CLEAN.
|
|
- **`quark.cc` string interning** — predefined quarks (TR_N_KEYS=753) use sorted binary search (`std::lower_bound`). Runtime quarks use `std::find` on `my_runtime` vector, but that list only grows for unknown dynamic keys (peer client names, RPC method names, labels) — bounded and small in practice. Not a scalable O(N²). CLEAN.
|
|
- **`torrent-files.cc`** — `std::ranges::find` on `ReservedNames` (compile-time constant ~30-entry list). CLEAN.
|
|
- **Piece tracking** — uses bitfields (`tr_bitfield`) for have/want — O(1) per-piece test. CLEAN.
|
|
- **Announcer** — `find_if` over active connection list bounded by open tracker count (small constant). CLEAN.
|
|
|
|
**Result: No actionable CWE-407 defects. Transmission uses bitfields for piece tracking, sorted binary search for its large static string table, and std::set for runtime deduplication.**
|