engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/nmap/patch/CLEAN.md
russell@unturf.com 7491349edc game-engines: allegro5/bullet3/box2d/dry CWE-407 scan 
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
2026-03-29 19:50:49 -04:00

1.5 KiB
Raw Blame History

CLEAN — Nmap Network Scanner

Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).

Scope

  • service_scan.cc — service/version detection probe selection
  • osscan2.cc — OS fingerprinting
  • traceroute.cc — traceroute probe tracking
  • scan_engine.cc — core scan engine
  • TargetGroup.cc — target specification and dedup

Findings

  • ServiceProbe::portIsProbable — std::find on probableports / probablesslports. These vectors hold port numbers declared in the nmap-service-probes file per probe — typically 1–50 ports. Outer probe loop is over ~200 probes but inner find is O(constant). Not scalable O(N²). CLEAN.
  • ServiceProbe::serviceIsPossible — linear scan of detectedServices with strcmp. List is small (services a probe can detect, typically 1–10). CLEAN.
  • end_svcprobe — std::find on services_in_progress and services_remaining lists. Called once per completed probe to remove it; not a membership test in an accumulation loop. CLEAN.
  • traceroute.cc — std::find on unanswered_probes to locate a probe upon reply receipt. List bounded by max TTL (≤30). CLEAN.
  • Target dedup — TargetGroup uses netblock iteration; no linear dedup over large address sets.

Result: No actionable CWE-407 defects. Nmap's scan data structures use small bounded lists for probe metadata; all scalable target/service tracking uses sorted or hash-based containers.