# UNDF: UNDF-2026-000000455
# love2d-0002: Window::getFullscreenSizes O(n²) dedup — CWE-407

**Severity:** LOW
**File:** `src/modules/window/sdl/Window.cpp`
**Function:** `Window::getFullscreenSizes()`
**Line:** 935

## Description

`getFullscreenSizes()` iterates over all display modes returned by SDL and
deduplicates them by size (multiple entries exist for the same WxH with
different bit depths). The deduplication uses `std::find` on the growing
`sizes` vector — O(n) per iteration:

```cpp
for (int i = 0; i < count; i++)
{
    WindowSize w = {modes[i]->w, modes[i]->h};
    if (std::find(sizes.begin(), sizes.end(), w) == sizes.end())  // O(n) — CWE-407
        sizes.push_back(w);
}
```

Typical desktop display mode count is 50–200 entries, making this
O(n²) = 2 500–40 000 comparisons on each call to `love.window.getFullscreenModes()`.

## Fix

Use `std::set<WindowSize>` for O(log n) dedup:

```cpp
// FIX love2d-0002: set for O(log n) dedup — CWE-407
// Requires operator< on WindowSize (w first, then h).
std::set<WindowSize> seen;
for (int i = 0; i < count; i++)
{
    WindowSize w = {modes[i]->w, modes[i]->h};
    if (seen.insert(w).second)
        sizes.push_back(w);
}
```

Or an `unordered_set` with a hash for O(1).

## Patch

```diff
--- a/src/modules/window/sdl/Window.cpp
+++ b/src/modules/window/sdl/Window.cpp
@@ -922,13 +922,18 @@ std::vector<Window::WindowSize> Window::getFullscreenSizes(int displayindex) con
 {
 	std::vector<WindowSize> sizes;
+	// FIX love2d-0002: O(log n) set replaces O(n) std::find — CWE-407
+	auto wsLess = [](const WindowSize &a, const WindowSize &b) {
+		return a.width != b.width ? a.width < b.width : a.height < b.height;
+	};
+	std::set<WindowSize, decltype(wsLess)> seen(wsLess);

 	int count = 0;
 	SDL_DisplayMode **modes = SDL_GetFullscreenDisplayModes(GetSDLDisplayIDForIndex(displayindex), &count);

 	for (int i = 0; i < count; i++)
 	{
 		WindowSize w = {modes[i]->w, modes[i]->h};
-		if (std::find(sizes.begin(), sizes.end(), w) == sizes.end())
-			sizes.push_back(w);
+		if (seen.insert(w).second)   // O(log n)
+			sizes.push_back(w);
 	}
```
