engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/transmission/patch/CLEAN.md
russell@unturf.com 7491349edc game-engines: allegro5/bullet3/box2d/dry CWE-407 scan 
bullet3-0001: btGhostObject::addOverlappingObjectInternal O(N²) linear dedup
  per broadphase step — even carries "too slow" self-admission comment (HIGH)
bullet3-0002: btSoftRigidCollisionAlgorithm::processCollision O(C×D) per
  frame on m_collisionDisabledObjects plain array (MEDIUM)
allegro5: CLEAN (vector_contains only on non-hot setup paths)
box2d: CLEAN (v3 rewrite uses b2HashSet throughout)
dry: CLEAN (HashSet/HashMap on all hot dedup paths)
2026-03-29 19:50:49 -04:00

1.4 KiB
Raw Blame History

CLEAN — Transmission (BitTorrent client)

Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).

Scope

  • libtransmission/peer-mgr.cc — peer list management
  • libtransmission/announcer-udp.cc — tracker announcement
  • libtransmission/quark.cc — string interning
  • libtransmission/torrent-files.cc — torrent file set operations
  • libtransmission/peer-mgr-wishlist.cc — piece request tracking

Findings

  • Peer manager — no std::find in hot peer-processing loops; peer lookup uses sorted or set-based structures. CLEAN.
  • quark.cc string interning — predefined quarks (TR_N_KEYS=753) use sorted binary search (std::lower_bound). Runtime quarks use std::find on my_runtime vector, but that list only grows for unknown dynamic keys (peer client names, RPC method names, labels) — bounded and small in practice. Not a scalable O(N²). CLEAN.
  • torrent-files.cc — std::ranges::find on ReservedNames (compile-time constant ~30-entry list). CLEAN.
  • Piece tracking — uses bitfields (tr_bitfield) for have/want — O(1) per-piece test. CLEAN.
  • Announcer — find_if over active connection list bounded by open tracker count (small constant). CLEAN.

Result: No actionable CWE-407 defects. Transmission uses bitfields for piece tracking, sorted binary search for its large static string table, and std::set for runtime deduplication.