java-topology/defects/neovim/patch/neovim-CLEAN.md

UNDF: UNDF-2026-000000468

neovim — CLEAN

Scan Date

2026-03-27

Files Scanned

• src/nvim/runtime.c (runtimepath loading, package autoload)

Findings

No CWE-407 defects found.

ga_loaded in script_autoload()

The ga_loaded garray is scanned linearly O(P) to check if a package was already loaded. However, script_autoload() is called once per function resolution, not inside an inner loop. The call site does not create a cross-product. This is O(P) per-call, not O(N×P).

Verdict

CLEAN — no algorithmic complexity defects in scanned code paths.