wave6a/6b: elasticsearch/opensearch/solr/llvm-0004-5/linux-0005-6/gcc-0002/tokio/actix-web + love2d/raylib new defects

defects/love2d/patch/love2d-0002-window-fullscreen-sizes-set-dedup.md

@@ -0,0 +1,70 @@
+# love2d-0002: Window::getFullscreenSizes O(n²) dedup — CWE-407
+
+**Severity:** LOW
+**File:** `src/modules/window/sdl/Window.cpp`
+**Function:** `Window::getFullscreenSizes()`
+**Line:** 935
+
+## Description
+
+`getFullscreenSizes()` iterates over all display modes returned by SDL and
+deduplicates them by size (multiple entries exist for the same WxH with
+different bit depths). The deduplication uses `std::find` on the growing
+`sizes` vector — O(n) per iteration:
+
+```cpp
+for (int i = 0; i < count; i++)
+{
+    WindowSize w = {modes[i]->w, modes[i]->h};
+    if (std::find(sizes.begin(), sizes.end(), w) == sizes.end())  // O(n) — CWE-407
+        sizes.push_back(w);
+}
+```
+
+Typical desktop display mode count is 50–200 entries, making this
+O(n²) = 2 500–40 000 comparisons on each call to `love.window.getFullscreenModes()`.
+
+## Fix
+
+Use `std::set<WindowSize>` for O(log n) dedup:
+
+```cpp
+// FIX love2d-0002: set for O(log n) dedup — CWE-407
+// Requires operator< on WindowSize (w first, then h).
+std::set<WindowSize> seen;
+for (int i = 0; i < count; i++)
+{
+    WindowSize w = {modes[i]->w, modes[i]->h};
+    if (seen.insert(w).second)
+        sizes.push_back(w);
+}
+```
+
+Or an `unordered_set` with a hash for O(1).
+
+## Patch
+
+```diff
+--- a/src/modules/window/sdl/Window.cpp
++++ b/src/modules/window/sdl/Window.cpp
+@@ -922,13 +922,18 @@ std::vector<Window::WindowSize> Window::getFullscreenSizes(int displayindex) con
+ {
+ 	std::vector<WindowSize> sizes;
++	// FIX love2d-0002: O(log n) set replaces O(n) std::find — CWE-407
++	auto wsLess = [](const WindowSize &a, const WindowSize &b) {
++		return a.width != b.width ? a.width < b.width : a.height < b.height;
++	};
++	std::set<WindowSize, decltype(wsLess)> seen(wsLess);
+
+ 	int count = 0;
+ 	SDL_DisplayMode **modes = SDL_GetFullscreenDisplayModes(GetSDLDisplayIDForIndex(displayindex), &count);
+
+ 	for (int i = 0; i < count; i++)
+ 	{
+ 		WindowSize w = {modes[i]->w, modes[i]->h};
+-		if (std::find(sizes.begin(), sizes.end(), w) == sizes.end())
+-			sizes.push_back(w);
++		if (seen.insert(w).second)   // O(log n)
++			sizes.push_back(w);
+ 	}
+```

defects/love2d/patch/love2d-0003-filesystem-allowed-mount-unordered-set.md

@@ -0,0 +1,77 @@
+# love2d-0003: Filesystem::allowMountingForPath O(n) dedup each call — CWE-407
+
+**Severity:** LOW
+**File:** `src/modules/filesystem/physfs/Filesystem.cpp`
+**Function:** `Filesystem::allowMountingForPath()`
+**Line:** 972
+
+## Description
+
+`allowMountingForPath()` deduplicates an allowlist of mount paths using
+`std::find` on a `std::vector<std::string>` before every insert:
+
+```cpp
+void Filesystem::allowMountingForPath(const std::string &path)
+{
+    if (std::find(allowedMountPaths.begin(), allowedMountPaths.end(), path) == allowedMountPaths.end())
+        allowedMountPaths.push_back(path);   // O(n) scan every call — CWE-407
+}
+```
+
+Each call is O(n) where n is the size of `allowedMountPaths`. The same path
+is also re-scanned twice in `mount()` (line 387) and `unmount()` (line 513),
+once each. With N paths allowed, N mount operations costs O(N²) total.
+
+## Fix
+
+Replace `allowedMountPaths` vector with `std::unordered_set<std::string>`:
+
+```cpp
+// FIX love2d-0003: unordered_set replaces O(n) vector scan — CWE-407
+// In Filesystem.h, change:
+//   std::vector<std::string> allowedMountPaths;
+// to:
+//   std::unordered_set<std::string> allowedMountPaths;
+
+void Filesystem::allowMountingForPath(const std::string &path)
+{
+    allowedMountPaths.insert(path);  // O(1) amortized
+}
+
+// In mount():
+auto it = allowedMountPaths.find(archive);   // O(1) was O(n)
+
+// In unmount():
+auto it = allowedMountPaths.find(archive);   // O(1) was O(n)
+if (it != allowedMountPaths.end())
+    return unmountFullPath(archive);
+```
+
+## Patch
+
+```diff
+--- a/src/modules/filesystem/physfs/Filesystem.h
++++ b/src/modules/filesystem/physfs/Filesystem.h
+@@ -34,6 +34,7 @@
++#include <unordered_set>
+ #include <vector>
+ #include <string>
+
+-	std::vector<std::string> allowedMountPaths;
++	std::unordered_set<std::string> allowedMountPaths;   // FIX love2d-0003: O(1) lookup — CWE-407
+
+--- a/src/modules/filesystem/physfs/Filesystem.cpp
++++ b/src/modules/filesystem/physfs/Filesystem.cpp
+@@ -387,7 +387,7 @@ bool Filesystem::mount(const char *archive, const char *mountpoint, bool append
+-	auto it = std::find(allowedMountPaths.begin(), allowedMountPaths.end(), archive);
++	auto it = allowedMountPaths.find(archive);    // O(1) was O(n)
+
+@@ -513,7 +513,7 @@ bool Filesystem::unmount(const char *archive)
+-	auto it = std::find(allowedMountPaths.begin(), allowedMountPaths.end(), archive);
++	auto it = allowedMountPaths.find(archive);    // O(1) was O(n)
+
+@@ -970,7 +970,6 @@ void Filesystem::allowMountingForPath(const std::string &path)
+-	if (std::find(allowedMountPaths.begin(), allowedMountPaths.end(), path) == allowedMountPaths.end())
+-		allowedMountPaths.push_back(path);
++	allowedMountPaths.insert(path);               // O(1) amortized, set semantics
+```