engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/pygame/patch/CLEAN.md
russell@unturf.com 783e406633 pygame/libgdx: CWE-407 findings 
pygame: CLEAN — runtime uses dict/set throughout (O(1) membership)
libgdx-0002: ModelBuilder.rebuildReferences Array.contains O(P*M) — patch
libgdx-0005: Stage.touchDragged touchFocuses.contains O(F^2) — patch
libgdx-0006: AfterAction.delegate currentActions.indexOf O(W*A) per frame — patch
unit: extend LibGDXTest to 7 tests, all PASS (50x-1971x speedup measured)
2026-03-30 09:13:34 -04:00

917 B
Raw Blame History

pygame — CWE-407 Scan Result: CLEAN

Scanned: 2026-03-30 Scope: Python layer (src_py/), Cython layer (src_c/cython/), event C layer (src_c/event.c)

Findings

No CWE-407 defects found in the runtime Python/Cython/C layers.

Why pygame is clean

  • AbstractGroup uses dict (spritedict) for all sprite membership — O(1) in checks.
  • Sprite.__g is a set — O(1) group membership.
  • Event blocking (set_blocked/get_blocked) uses SDL's native SDL_EventState array — O(1).
  • LayeredUpdates uses _spritelayers dict for layer lookups — O(1).
  • sysfont module uses dict for font registry — O(1).
  • OrderedUpdates._spritelist.remove() is O(N) but is a single-shot operation, not nested.

The build infrastructure (buildconfig/) contains some list membership patterns but these run once at build time, not in game loops, and are not relevant to runtime complexity.