java-topology/defects/octave/patch/octave-deeper-CLEAN.md

Octave — CWE-407 Deeper Scan: CLEAN (beyond octave-0001/octave-0002)

Scan Date

2026-03-29

Areas Scanned

1. libinterp/corefcn/load-path.cc — m_dir_list

• Line 1661: std::find(m_dir_list.begin(), m_dir_list.end(), dir_name) in package_info::move()
• m_dir_list is std::list<std::string> — O(D) linear scan.
• Severity assessment: LOW — move() is called only during manual path reordering (e.g. movepath/addpath), not during function lookup. Not in a nested loop.
• Result: CLEAN (below CWE-407 threshold for hot-path requirement).

2. libinterp/corefcn/load-path.cc — path string scan

• Lines 163–171: path_list.find(path) — this is std::string::find() on a colon-separated path string, not a container membership scan.
• Result: CLEAN (string substring search, not container dedup).

3. libinterp/parse-tree/pt-classdef.cc — classdef MRO

• No visited/seen arrays in classdef hierarchy traversal.
• Result: CLEAN.

4. libinterp/corefcn/fcn-info.cc — function lookup

• Uses std::map-based lookups throughout — O(log N) or O(1) via unordered_map.
• Result: CLEAN.

5. liboctave/ — numerical libraries

• No visited/seen arrays found.
• Result: CLEAN.

Conclusion

No additional CWE-407 defects found beyond octave-0001 (vecdim std::find) and octave-0002 (load_path::add directory presence scan). The only remaining std::find on a list is in package_info::move() which is a rarely-called path-reordering utility and does not qualify as a hot-path nested scan.