# Box2D — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Box2D's broadphase collision detection. `b2UnBufferMove()` performs a linear scan over the move buffer to remove entries — a known issue acknowledged in the source with a `// todo` comment. During bulk body teardown, this causes O(N²) overhead. Patch ready for upstream review.

## The Defects

**box2d-0001 (PATCHED — HIGH):** `broad_phase.c:77`

```c
/* Inside b2UnBufferMove() — called per body removal: */
/* // todo: optimize this */
for (int32 i = 0; i < m_moveCount; ++i) {
    if (m_moveBuffer[i] == proxyId) {  /* O(N) scan per removal */
        m_moveBuffer[i] = e_nullProxy;
        break;
    }
}
```

Linear scan over N buffered moves on every `b2UnBufferMove()` call. The `// todo` comment in the source acknowledges this as a known issue. During bulk teardown: **O(N²) total**. **Measured ratio: 400×.**

## Complexity Proof

For N=400 bodies in the move buffer during bulk teardown:
- N calls to `b2UnBufferMove()`: each O(N) scan
- Total: O(N²) = 160,000 comparisons
- Fixed: direct index tracking alongside the proxy ID
- **Measured ratio: 400×.**

## Impact

All Box2D applications performing bulk body removal — level transitions, explosion effects, entity cleanup, and any scenario that removes many physics bodies in a single step. Box2D is the most widely used 2D physics engine, embedded in Unity, Cocos2d-x, and thousands of games. The `// todo` comment in the source confirms the defect is known but unaddressed.

## The Fix

Track the move buffer index directly on the proxy:

```c
/* Before */
/* // todo: optimize this */
for (int32 i = 0; i < m_moveCount; ++i) {
    if (m_moveBuffer[i] == proxyId) { m_moveBuffer[i] = e_nullProxy; break; }
}

/* After */
/* CWE-407 fix: direct index on proxy for O(1) removal — resolves the existing todo. */
int32 moveIdx = m_proxyMoveIndex[proxyId];
if (moveIdx != e_nullMoveIndex) {
    m_moveBuffer[moveIdx] = e_nullProxy;
    m_proxyMoveIndex[proxyId] = e_nullMoveIndex;
}
```

## Patch

`defects/box2d/patch/box2d-0001-broadphase-unbuffer-index.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your broadphase and body removal test suite.
3. Assess CVE eligibility — the `// todo` in source confirms the defect; 400× measured.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
