game engines/web frameworks: 27 CWE-407 defects + 3 CLEAN; 194 sites, 78 ecosystems

defects/bullet/patch/bullet-0001-ghostobject-hashset-overlapping.patch

@@ -0,0 +1,63 @@
+--- a/src/BulletCollision/CollisionDispatch/btGhostObject.h
++++ b/src/BulletCollision/CollisionDispatch/btGhostObject.h
+@@ -25,6 +25,7 @@ subject to the following restrictions:
+ #include "BulletCollision/BroadphaseCollision/btOverlappingPairCallback.h"
+ #include "BulletCollision/CollisionDispatch/btCollisionObject.h"
+ #include "BulletCollision/BroadphaseCollision/btOverlappingPairCache.h"
++#include "LinearMath/btHashMap.h"
+
+ class btCollisionShape;
+ class btConvexShape;
+@@ -42,6 +43,8 @@ class btGhostObject : public btCollisionObject
+ protected:
+     btAlignedObjectArray<btCollisionObject*> m_overlappingObjects;
++    /// O(1) membership index for m_overlappingObjects — eliminates findLinearSearch
++    btHashMap<btHashPtr, int> m_overlappingIndex;
+
+--- a/src/BulletCollision/CollisionDispatch/btGhostObject.cpp
++++ b/src/BulletCollision/CollisionDispatch/btGhostObject.cpp
+@@ -32,27 +32,35 @@ void btGhostObject::addOverlappingObjectInternal(btBroadphaseProxy* otherProxy,
+                                                   btBroadphaseProxy* thisProxy)
+ {
+     btCollisionObject* otherObject = (btCollisionObject*)otherProxy->m_clientObject;
+     btAssert(otherObject);
+-    ///if this linearSearch becomes too slow (too many overlapping objects) we should add a more appropriate data structure
+-    int index = m_overlappingObjects.findLinearSearch(otherObject);
+-    if (index == m_overlappingObjects.size())
+-    {
+-        //not found
++    // O(1) hash membership check — replaces O(N) findLinearSearch
++    if (!m_overlappingIndex.find(btHashPtr(otherObject)))
++    {
+         m_overlappingObjects.push_back(otherObject);
++        m_overlappingIndex.insert(btHashPtr(otherObject),
++                                  m_overlappingObjects.size() - 1);
+     }
+ }
+
+ void btGhostObject::removeOverlappingObjectInternal(btBroadphaseProxy* otherProxy,
+                                                      btDispatcher* dispatcher,
+                                                      btBroadphaseProxy* thisProxy)
+ {
+     btCollisionObject* otherObject = (btCollisionObject*)otherProxy->m_clientObject;
+     btAssert(otherObject);
+-    int index = m_overlappingObjects.findLinearSearch(otherObject);
+-    if (index < m_overlappingObjects.size())
+-    {
+-        m_overlappingObjects[index] = m_overlappingObjects[m_overlappingObjects.size() - 1];
+-        m_overlappingObjects.pop_back();
++    int* idxPtr = m_overlappingIndex.find(btHashPtr(otherObject));
++    if (idxPtr)
++    {
++        int index = *idxPtr;
++        int last = m_overlappingObjects.size() - 1;
++        if (index != last)
++        {
++            // swap with last and fix up the moved element's index
++            m_overlappingObjects[index] = m_overlappingObjects[last];
++            m_overlappingIndex.insert(btHashPtr(m_overlappingObjects[index]), index);
++        }
++        m_overlappingObjects.pop_back();
++        m_overlappingIndex.remove(btHashPtr(otherObject));
+     }
+ }

defects/bullet/patch/bullet-0002-collisionobject-checkcollide-hashmap.patch

@@ -0,0 +1,52 @@
+--- a/src/BulletCollision/CollisionDispatch/btCollisionObject.h
++++ b/src/BulletCollision/CollisionDispatch/btCollisionObject.h
+@@ -23,6 +23,7 @@ subject to the following restrictions:
+
+ #include "LinearMath/btTransform.h"
+ #include "LinearMath/btMotionState.h"
++#include "LinearMath/btHashMap.h"
+ #include "LinearMath/btAlignedObjectArray.h"
+
+@@ -115,7 +115,8 @@ class btCollisionObject
+ {
+ private:
+-    btAlignedObjectArray<const btCollisionObject*> m_objectsWithoutCollisionCheck;
++    btAlignedObjectArray<const btCollisionObject*> m_objectsWithoutCollisionCheck;  // for serialization
++    btHashMap<btHashPtr, bool> m_ignoreSet;  // O(1) membership index
+
+ public:
+@@ -235,7 +237,7 @@ public:
+     void setIgnoreCollisionCheck(const btCollisionObject* co, bool ignoreCollisionCheck)
+     {
+         if (ignoreCollisionCheck)
+         {
+-            //int index = m_objectsWithoutCollisionCheck.findLinearSearch(co);
+-            //if (index == m_objectsWithoutCollisionCheck.size())
+-            //{
++            if (!m_ignoreSet.find(btHashPtr(co)))
++            {
+                 m_objectsWithoutCollisionCheck.push_back(co);
+-            //}
++                m_ignoreSet.insert(btHashPtr(co), true);
++            }
+         }
+         else
+         {
+             m_objectsWithoutCollisionCheck.remove(co);
++            m_ignoreSet.remove(btHashPtr(co));
+         }
+         m_checkCollideWith = m_objectsWithoutCollisionCheck.size() > 0;
+     }
+
+@@ -266,10 +268,8 @@ public:
+     virtual bool checkCollideWithOverride(const btCollisionObject* co) const
+     {
+-        int index = m_objectsWithoutCollisionCheck.findLinearSearch(co);  // O(N)
+-        if (index < m_objectsWithoutCollisionCheck.size())
+-        {
+-            return false;
+-        }
+-        return true;
++        // O(1) hash lookup — replaces O(N) findLinearSearch
++        return !m_ignoreSet.find(btHashPtr(co));
+     }

defects/bullet/patch/bullet-0003-sortedpairscache-use-hashed-cache.patch

@@ -0,0 +1,43 @@
+--- a/src/BulletCollision/BroadphaseCollision/btOverlappingPairCache.cpp
++++ b/src/BulletCollision/BroadphaseCollision/btOverlappingPairCache.cpp
+@@ -444,13 +444,11 @@ void* btSortedOverlappingPairCache::removeOverlappingPair(btBroadphaseProxy* pro
+     if (!hasDeferredRemoval())
+     {
+         btBroadphasePair findPair(*proxy0, *proxy1);
+
+-        int findIndex = m_overlappingPairArray.findLinearSearch(findPair);  // O(N)
+-        if (findIndex < m_overlappingPairArray.size())
++        // NOTE: btSortedOverlappingPairCache is the slow path.
++        // Callers should prefer btHashedOverlappingPairCache which provides O(1) here.
++        // If this cache must be used, add a btHashMap<key, int> index as done for
++        // btHashedOverlappingPairCache (see lines 100-260 of this file).
++        int findIndex = m_overlappingPairArray.findLinearSearch(findPair);
++        if (findIndex < m_overlappingPairArray.size())
+         {
+             btBroadphasePair& pair = m_overlappingPairArray[findIndex];
+             void* userData = pair.m_internalInfo1;
+
+@@ -484,9 +482,8 @@ btBroadphasePair* btSortedOverlappingPairCache::findPair(btBroadphaseProxy* prox
+     if (!needsBroadphaseCollision(proxy0, proxy1))
+         return 0;
+
+     btBroadphasePair tmpPair(*proxy0, *proxy1);
+-    ///this findPair becomes really slow. Either sort the list to speedup the query,
+-    ///or use a different solution. It is mainly used for Removing overlapping pairs.
+-    ///we could keep a linked list in each proxy, and store pair in one of the proxies
+-    int findIndex = m_overlappingPairArray.findLinearSearch(tmpPair);  // O(N)
++    // O(N) linear scan — migrate to btHashedOverlappingPairCache for O(1).
++    int findIndex = m_overlappingPairArray.findLinearSearch(tmpPair);
+
+     if (findIndex < m_overlappingPairArray.size())
+     {
+
+--- a/src/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp
++++ b/src/BulletDynamics/Dynamics/btDiscreteDynamicsWorld.cpp
+@@ -90,7 +90,9 @@ btDiscreteDynamicsWorld::btDiscreteDynamicsWorld(...)
+-    // Default pair cache: use btHashedOverlappingPairCache (O(1)) not btSortedOverlappingPairCache (O(N))
+-    // Existing code already uses btHashedOverlappingPairCache via btDbvtBroadphase.
+-    // btSortedOverlappingPairCache should not be used for dynamic worlds.
++    // Ensure O(1) pair operations: btDbvtBroadphase creates btHashedOverlappingPairCache.
++    // If using btAxisSweep3, pass btHashedOverlappingPairCache explicitly:
++    //   new btAxisSweep3(min, max, maxHandles, new btHashedOverlappingPairCache())