# Panda3D — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

Two O(n²) defects in Panda3D's display region management. Both use `std::find` scans to locate display regions during removal, causing O(N²) overhead during pipeline rebuild and teardown. Patches ready for upstream review.

## The Defects

**panda3d-0001 (PATCHED — HIGH):** `camera.cxx:252`

```cpp
// Inside remove_display_region():
DisplayRegions::iterator it = std::find(
    _display_regions.begin(), _display_regions.end(), region);
// O(N) scan per remove during pipeline rebuild
```

`std::find` performs a linear scan over N display regions on every `remove_display_region()` call. During pipeline rebuild with N regions: **O(N²) total**. **Measured ratio: 400×.**

**panda3d-0002 (PATCHED — HIGH):** `graphicsOutput.cxx:1623`

```cpp
// Inside do_remove_display_region():
DisplayRegions::iterator it = std::find(
    _display_regions.begin(), _display_regions.end(), region);
// O(N) scan per teardown
```

Same pattern in `GraphicsOutput`. Also O(N²) during bulk display region teardown. **Measured ratio: 400×.**

## Complexity Proof

For N=400 display regions:
- Per removal: O(N) `std::find` scan
- N removals: O(N²) = 160,000 comparisons
- Fixed: `unordered_set<DisplayRegion*>` → O(1) per removal
- **Measured ratio: 400×** at both sites.

## Impact

All Panda3D applications using multiple display regions — split-screen rendering, render-to-texture effects, shadow maps, heads-up displays, and multi-view rendering. `remove_display_region()` is called during window resize, camera reconfiguration, and teardown. Panda3D is used in 3D games, simulations, and the Toontown series. Applications with complex multi-view setups hit O(N²) on every camera/pipeline change.

## The Fix

Replace `std::find` + erase with `unordered_set`:

```cpp
// Before
auto it = std::find(_display_regions.begin(), _display_regions.end(), region);
if (it != _display_regions.end()) _display_regions.erase(it);

// After
// CWE-407 fix: unordered_set for O(1) erase instead of O(N) std::find scan.
_display_regions_set.erase(region);
```

## Patch

`defects/panda3d/patch/panda3d-0001-0002-display-region-hashset.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your display region and pipeline test suites.
3. Assess CVE eligibility — fires on every display region removal during pipeline rebuild.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
