russell@unturf.com
669ed13408
clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) + files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with HashMap + HashSet. HIGH severity, 250x at N=1000. clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/ SendUrls loops — fix with integer counter + QSet for requested_ids. MEDIUM severity, 500x at N=1000. MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout. Rhythmbox: CLEAN — uses g_hash_table for all membership checks. 4/4 unit tests PASS.
856 B
856 B
MPD (Music Player Daemon) - CWE-407 Scan Result: CLEAN
Scanned: 2026-03-30 Source: https://github.com/MusicPlayerDaemon/MPD (depth=1)
Scan Summary
MPD is well-engineered with respect to data structure choices:
- Tag type lookups: Uses bitmask arrays (
TagMask) for O(1) membership testing - Protocol list: Uses
std::setfor dedup - Property model: Uses
g_hash_table(via libmpd) for O(1) lookups - Keyword tracking: Uses
g_hash_tablefor entry-keyword mapping - Playlist dedup: Uses hash-based
location_in_mapviag_hash_table - Input cache: Uses
std::map(items_by_uri) for URI lookups - Event polling: Uses
std::mapfor fd-to-pollfd mapping
The few std::find calls found operate on bounded-size collections
(tag_types, ~30 entries max) and are not inside scaling loops.
No CWE-407 defects found.