java-topology/tools/tickets/defects/cmake-0001.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.3 KiB

id repo severity status created patched patch
cmake-0001 cmake HIGH PATCHED 2026-03-23 2026-03-23 defects/cmake/patch/cmake-0001-groupitems-unordered-set.patch

Defect

File: Source/cmComputeLinkDepends.cxx:1167,521,1363 Pattern: std::find on group vectors in link dependency computation Complexity: O(n) per edge Language: C++

Description

CMake's link dependency computation uses std::find on std::vector to check membership in link groups at three separate call sites. Each std::find call scans the entire vector linearly to determine if an item is already present. During link dependency resolution for large projects, these checks are performed for every edge in the dependency graph, contributing O(n) cost per edge and O(n²) total across all edges.

Fix

Replace: std::find(group.begin(), group.end(), item) != group.end() With: groupSet.count(item) > 0 Data structure change: std::vector<T> group → std::unordered_set<T> groupSet

Work required

  • Patch in defects/cmake/patch/
  • Unit test — asserts exact operation counts before/after (in defects/cmake/unit/)
  • Integration test (in defects/cmake/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/cmake/bench/)
  • White paper section