1.7 KiB
1.7 KiB
Krita — CWE-407 Scan Result: CLEAN
Date: 2026-03-30 Scanner: agent blackops Scope: libs/ (image, flake, ui, resources, global, pigment, command, widgetutils), plugins/
Summary
Krita is clean of CWE-407 algorithmic complexity defects. The codebase consistently uses QHash/QMap/QSet for membership tests and lookup operations. Where QList/QVector linear scans appear, they operate on inherently small collections (selected shapes, layer counts, composite op IDs) and are not data-proportional.
Key observations
KisNodeDummiesGraph.m_dummiesMap: QHash<KisNodeSP, KisNodeDummy*> for node lookupsKisResourceLocator: QHash-based caches for resources and tagsKisMemoryLeakTracker: QHash for reference trackingSharedCache.*DeletedDuringPrewarm: HashSet for prewarm dedupKoSelection::isSelected(): std::find on selectedShapes list, but called per-click, not in loopsKisWatershedWorker.groups[].levels: QMap for level lookup — O(log N)
Minor findings (no defect):
KisNodeDummy::nextSibling/prevSibling: indexOf on parent->m_children QList, O(C) per call, but C is the number of sibling layers (typically <100) and not called in inner loopsKisSavedMacroCommand::mergeWith: QVector::contains for skipWhenOverride, but skip list is tiny and called once per undo mergekis_layer_utils::scanForLastLayer: KisNodeList::contains inside sibling walk, but N is the number of layers selected for delete (typically <20)kis_layer_utils::CleanUpNodes::findPerfectParent: KisNodeList::contains inside parent walk, O(D*N) where D is tree depth (~10) and N is nodes to delete (~20), runs once per merge
No data-proportional linear scans inside loops found.