russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
46 lines
2 KiB
ReStructuredText
46 lines
2 KiB
ReStructuredText
GNU Octave — CWE-407 Analysis
|
|
==============================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
GNU Octave is a scientific computing environment with MATLAB-compatible syntax. Its
|
|
``scripts/graph/`` package implements graph algorithms including spanning trees, shortest
|
|
paths, topological sort, and SCC analysis.
|
|
|
|
Status: **CLEAN** (scanned 2026-03-23)
|
|
---------------------------------------
|
|
|
|
Scan returned 8 candidates from ``.m`` scripts. All triaged as false positives.
|
|
|
|
Triage Summary
|
|
--------------
|
|
|
|
- ``__ghostscript__.m`` — ``ismember(opts.level, [1, 2, 3])`` — 3-element constant array, O(1) effectively
|
|
- ``__print_parse_opts__.m`` — ``any(arg(end) == "124")`` — character comparison against 3-char string
|
|
- ``spline.m`` — ``any(szy == n)`` — vectorized comparison over a size vector (scalar output expected)
|
|
- ``treeplot.m`` — ``find(skelet == 0)`` — vectorized element search; necessarily O(n) but not inside a traversal loop
|
|
- ``hgload.m`` — ``ismember(fn_old, fn_new{j})`` — filename comparison in plot file loading utility
|
|
|
|
No CWE-407 pattern: none of these are O(n) membership tests inside a graph traversal loop.
|
|
The ``treeplot`` function draws a pre-computed tree structure; the ``find`` call locates
|
|
unconnected skeleton nodes in a linear pass — O(n) but not quadratic.
|
|
|
|
Octave's graph algorithms in ``scripts/graph/`` (``graphpred2path``, ``dmperm``,
|
|
``graph_chol``) use Octave's native sparse matrix operations for adjacency representation.
|
|
SCC computation delegates to compiled FORTRAN/C routines.
|
|
|
|
Note on MATLAB
|
|
--------------
|
|
|
|
MATLAB's ``ismember`` for array inputs is O(n log n) (sort-based). For large adjacency
|
|
lists used as visited sets in iterative graph algorithms, this is suboptimal compared to
|
|
O(1) hash membership. This is not a defect in the CWE-407 sense (no list inside a traversal
|
|
loop) but is a known performance consideration for MATLAB graph algorithm implementations.
|
|
|
|
References
|
|
----------
|
|
|
|
* Scan result: ``tools/scan-results/gnu-octave.txt``
|