russell@unturf.com
669ed13408
clementine-0001: LibraryWatcher ScanSubdirectory FindSongByPath O(F*S) + files_on_disk.contains O(S*F) — linear scan with TODO comment, fix with HashMap + HashSet. HIGH severity, 250x at N=1000. clementine-0002: SongSender indexOf(s) O(N^2) in SendAlbum/SendPlaylist/ SendUrls loops — fix with integer counter + QSet for requested_ids. MEDIUM severity, 500x at N=1000. MPD: CLEAN — uses std::set, bitmask arrays, std::map throughout. Rhythmbox: CLEAN — uses g_hash_table for all membership checks. 4/4 unit tests PASS.
21 lines
856 B
Markdown
21 lines
856 B
Markdown
# MPD (Music Player Daemon) - CWE-407 Scan Result: CLEAN
|
|
|
|
Scanned: 2026-03-30
|
|
Source: https://github.com/MusicPlayerDaemon/MPD (depth=1)
|
|
|
|
## Scan Summary
|
|
|
|
MPD is well-engineered with respect to data structure choices:
|
|
|
|
- **Tag type lookups**: Uses bitmask arrays (`TagMask`) for O(1) membership testing
|
|
- **Protocol list**: Uses `std::set` for dedup
|
|
- **Property model**: Uses `g_hash_table` (via libmpd) for O(1) lookups
|
|
- **Keyword tracking**: Uses `g_hash_table` for entry-keyword mapping
|
|
- **Playlist dedup**: Uses hash-based `location_in_map` via `g_hash_table`
|
|
- **Input cache**: Uses `std::map` (`items_by_uri`) for URI lookups
|
|
- **Event polling**: Uses `std::map` for fd-to-pollfd mapping
|
|
|
|
The few `std::find` calls found operate on bounded-size collections
|
|
(tag_types, ~30 entries max) and are not inside scaling loops.
|
|
|
|
No CWE-407 defects found.
|