russell@unturf.com
669ed13408
clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) + files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with HashMap + HashSet. HIGH severity, 250x at N=1000. clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/ SendUrls loops — fix with integer counter + QSet for requested_ids. MEDIUM severity, 500x at N=1000. MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout. Rhythmbox: CLEAN — uses g_hash_table for all membership checks. 4/4 unit tests PASS.
24 lines
967 B
Markdown
24 lines
967 B
Markdown
# Rhythmbox - CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-30
|
|
Source: https://github.com/GNOME/rhythmbox (depth=1)
|
|
|
|
## Scan Summary
|
|
|
|
Rhythmbox uses GLib hash tables throughout for membership testing:
|
|
|
|
- **Database entries**: `g_hash_table` for entry storage and lookup
|
|
- **Property model**: `g_hash_table` (reverse_map) + `g_sequence` (balanced tree) for properties
|
|
- **Keyword tracking**: `g_hash_table` for keyword-to-entry mapping
|
|
- **Playlist membership**: `g_hash_table` via `rb_playlist_source_location_in_map`
|
|
- **Changed entries**: `g_hash_table` for tracking changes
|
|
- **Import dedup**: `g_hash_table` for added/deleted entry tracking
|
|
|
|
The `rb_string_list_contains` calls (linear GList scan) are used only for
|
|
mount-point lists which are bounded to a handful of entries (typically 2-5
|
|
filesystem mount points).
|
|
|
|
The `g_list_find` calls in display-page-model operate on DnD target atom
|
|
lists (bounded by GTK target types, ~10 max).
|
|
|
|
No CWE-407 defects found.
|