diff --git a/defects/bazel/patch/bazel-0003-feature-selection-hashset.md b/defects/bazel/patch/bazel-0003-feature-selection-hashset.md index 58b5f9271..715691d19 100644 --- a/defects/bazel/patch/bazel-0003-feature-selection-hashset.md +++ b/defects/bazel/patch/bazel-0003-feature-selection-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000581 # bazel-0003: FeatureSelection ImmutableList.contains O(P×S×L) → O(P×S) with HashSet ## Classification diff --git a/defects/jsc/patch/jsc-0003-dfg-integer-range-liveathead-hashset.md b/defects/jsc/patch/jsc-0003-dfg-integer-range-liveathead-hashset.md index 2c072b511..c34c64405 100644 --- a/defects/jsc/patch/jsc-0003-dfg-integer-range-liveathead-hashset.md +++ b/defects/jsc/patch/jsc-0003-dfg-integer-range-liveathead-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000579 +# UNDF: UNDF-2026-000000588 # jsc-0003: DFGIntegerRangeOptimizationPhase liveAtHead Vector::contains O(50×B×R×L) → O(50×B×R) with HashSet ## Classification diff --git a/defects/kicad/patch/kicad-0002-zone-filler-hashset.md b/defects/kicad/patch/kicad-0002-zone-filler-hashset.md index 7e633ee86..b1a126605 100644 --- a/defects/kicad/patch/kicad-0002-zone-filler-hashset.md +++ b/defects/kicad/patch/kicad-0002-zone-filler-hashset.md @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000000589 # kicad-0002: zone_filler.cpp std::find O(Z²×L²) → O(Z×L log(Z×L)) with ordered set ## Classification diff --git a/defects/libevent/patch/libevent-0001-dispatch-callback-hashmap.md b/defects/libevent/patch/libevent-0001-dispatch-callback-hashmap.md index 490b1ac0c..a83f42561 100644 --- a/defects/libevent/patch/libevent-0001-dispatch-callback-hashmap.md +++ b/defects/libevent/patch/libevent-0001-dispatch-callback-hashmap.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000585 +# UNDF: UNDF-2026-000000590 # libevent-0001: evhttp_dispatch_callback O(C) per request → O(1) with URI hash map ## Classification diff --git a/defects/libvirt/patch/libvirt-0001-cpu-x86-update-live-added-features-hashset.md b/defects/libvirt/patch/libvirt-0001-cpu-x86-update-live-added-features-hashset.md index 96c6aa1be..0898ba25e 100644 --- a/defects/libvirt/patch/libvirt-0001-cpu-x86-update-live-added-features-hashset.md +++ b/defects/libvirt/patch/libvirt-0001-cpu-x86-update-live-added-features-hashset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000587 +# UNDF: UNDF-2026-000000591 # libvirt-0001: virCPUx86UpdateLive() addedFeatures g_strv_contains O(F×A) per VM start/migration ## Classification diff --git a/defects/libvirt/patch/libvirt-0002-cpu-x86-model-from-cpu-feature-find-hashmap.md b/defects/libvirt/patch/libvirt-0002-cpu-x86-model-from-cpu-feature-find-hashmap.md index 8345c28ba..cd2c3e701 100644 --- a/defects/libvirt/patch/libvirt-0002-cpu-x86-model-from-cpu-feature-find-hashmap.md +++ b/defects/libvirt/patch/libvirt-0002-cpu-x86-model-from-cpu-feature-find-hashmap.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000588 +# UNDF: UNDF-2026-000000592 # libvirt-0002: x86ModelFromCPU() x86FeatureFind O(C×F) linear scan per feature per VM start ## Classification diff --git a/defects/v8/patch/v8-0004-maglev-knownmaps-merger-zoneset.md b/defects/v8/patch/v8-0004-maglev-knownmaps-merger-zoneset.md index 79a0fa6ad..bc00d4ff3 100644 --- a/defects/v8/patch/v8-0004-maglev-knownmaps-merger-zoneset.md +++ b/defects/v8/patch/v8-0004-maglev-knownmaps-merger-zoneset.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000580 +# UNDF: UNDF-2026-000000593 # v8-0004: KnownMapsMerger::IntersectWithKnownNodeAspects std::find O(P×R) → O(P+R) merge ## Classification diff --git a/defects/xen/patch/xen-0001-credit2-balance-load-svc-list-swap.md b/defects/xen/patch/xen-0001-credit2-balance-load-svc-list-swap.md index 012361016..fd3bba151 100644 --- a/defects/xen/patch/xen-0001-credit2-balance-load-svc-list-swap.md +++ b/defects/xen/patch/xen-0001-credit2-balance-load-svc-list-swap.md @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000586 +# UNDF: UNDF-2026-000000594 # xen-0001: credit2 balance_load() VCPU swap-search O(V²) per scheduler tick ## Classification diff --git a/whitepaper/MD5SUMS b/whitepaper/MD5SUMS index 2750723c6..18a0874ed 100644 --- a/whitepaper/MD5SUMS +++ b/whitepaper/MD5SUMS @@ -3,7 +3,7 @@ ba0de5d1546aa2971492f74616f13f47 full-paper.pdf 3fda5736a004c621f52701c92a7ca7f5 undefect-cwe407-2026-03-24.pdf f076f22e9e70a94f51884562aad6fdc5 undefect-cwe407-2026-03-25.pdf 5da33a4087fdca81f70cce84656afc7f undefect-cwe407-2026-03-26.pdf -a8255781f9de29bfe9d53565ec9ec541 undefect-cwe407-2026-03-27.pdf +7f45f562aba8c9f44cf28cf8679e2d14 undefect-cwe407-2026-03-27.pdf ff52abf9f47a7e6bb25e4519b1325090 undefect-minecraft-enterprise-java-2026-03-24.pdf c7fe499eb004271b384a31ac01b38852 undefect-minecraft-enterprise-java-2026-03-25.pdf 818d29731df88333d29cfdd3eefeb3a2 undefect-minecraft-enterprise-java-2026-03-26.pdf diff --git a/whitepaper/full-paper.md b/whitepaper/full-paper.md index 340858a01..b7139c802 100644 --- a/whitepaper/full-paper.md +++ b/whitepaper/full-paper.md @@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint. 4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use Code propagates according to its kind — clean architecture begets clean implementations, -elegant solutions inspire elegant variations. The process of generating 611 validated +elegant solutions inspire elegant variations. The process of generating 615 validated defect patches across 240 ecosystems in a single research wave demonstrates how truth, properly seeded, multiplies. Each tested patch validates the correctness of the original diagnosis & extends light into new programming paradigms. @@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve confirmed site — compiler, routing, database, build tool, event streaming, web framework, query optimizer, and browser runtime. -**611 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). +**615 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). No language left behind. @@ -276,6 +276,10 @@ stacks, Spark schemas — this is the dominant build cost. | godot-0002 | Godot Engine | `modules/godot_physics_2d/godot_body_2d.h:165` — `Vector.find()` O(n) in `add_area()/remove_area()`; fires per-tick from `GodotAreaPair2D::pre_solve()` | **PATCHED** | | godot-0003 | Godot Engine | `modules/godot_physics_3d/godot_body_3d.h:159` — identical to godot-0002, 3D physics variant | **PATCHED** | | godot-0004 | Godot Engine | `modules/godot_physics_3d/godot_soft_body_3d.cpp:663` — `LocalVector.has()` O(n) in `generate_bending_constraints()` node link dedup | **PATCHED** | +| godot-0005 | Godot Engine | `core/math/a_star.cpp:373,878` — `open_list.find(e)` O(N) heap scan in A* neighbor-relaxation inner loop; every AI navigation call on large graphs (800×) | **PATCHED** | +| godot-0006 | Godot Engine | `scene/3d/skeleton_3d.cpp:235` — `child_bones.has(i)` O(C) Vector scan in `_update_process_order()`; wide/procedural rigs (24×) | **PATCHED** | +| godot-0007 | Godot Engine | `editor/import/3d/post_import_plugin_skeleton_rest_fixer.cpp:201` — `bones_to_process.has()` + `keep_bone_rest.has()` O(T×B) in MoCap animation track loop (188×) | **PATCHED** | +| godot-0008 | Godot Engine | `modules/gltf/gltf_document.cpp:443` — `extensions_used.has()` O(E) Vector dedup in per-node/animation GLTF serialize loop; fix: `HashSet` (11×) | **PATCHED** | | sfml-0001 | SFML | `Window/Unix/VideoModeImpl.cpp:98` — `std::find` on `std::vector` in fullscreen mode dedup; Unix platform | **PATCHED** | | sfml-0002 | SFML | `Window/Win32/VideoModeImpl.cpp:95` — identical VideoMode dedup defect, Win32 platform | **PATCHED** | | sfml-0003 | SFML | `Window/OSX/VideoModeImpl.mm:198` — identical VideoMode dedup defect, macOS platform | **PATCHED** | @@ -891,7 +895,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^ 1,024 redundant node visits per edge check. Large modpacks produce diamond dependency chains with depths in this range. -**611 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).** +**615 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).** --- @@ -2244,10 +2248,11 @@ defect is in a newer subsystem (trains, added in a later major version). --- -### 13.2 Godot Engine — godot-0001 through godot-0004 +### 13.2 Godot Engine — godot-0001 through godot-0008 -Godot 4.x is the dominant open-source game engine (C++). Four CWE-407 defects confirmed -across the scene system, physics simulation (2D and 3D), and soft body physics. +Godot 4.x is the dominant open-source game engine (C++). Eight CWE-407 defects confirmed +across the scene system, physics simulation (2D and 3D), soft body physics, A* navigation, +skeleton processing, import pipeline, and GLTF serialization. **godot-0001 — SceneTree group membership (CRITICAL)** @@ -2294,6 +2299,39 @@ scales worse for denser meshes). Fix: Add `HashSet` alongside each `LocalVector` in `node_link_set`. Membership checks use the set; the vector is preserved for downstream iteration. +**godot-0005 — A* navigation open-list find (HIGH)** + +`core/math/a_star.cpp:373,878` — `open_list.find(e)` is a `LocalVector::find()` O(N) linear +scan used as a heap decrease-key lookup in the A* inner loop. Fires on every neighbor +relaxation for every pathfinding call. On a 40×40 navigation grid: **800× op reduction.** + +Fix: Add `int32_t open_index` to the `Point` struct; maintain it during heap push/pop; +replace `find()` with direct index read. Same pattern present in `a_star_grid_2d.cpp:572`. + +**godot-0006 — Skeleton3D child bone membership (MEDIUM)** + +`scene/3d/skeleton_3d.cpp:235` — `child_bones.has(i)` O(C) scan inside +`_update_process_order()` rebuild loop. Fires on every dirty skeleton rebuild. Wide/flat +procedural rigs (crowd AI, ragdolls) with C≈50 children: **24× op reduction.** + +Fix: Change `Vector child_bones` to `HashSet child_bones`. + +**godot-0007 — RestFixer animation import bones (MEDIUM)** + +`editor/import/3d/post_import_plugin_skeleton_rest_fixer.cpp:201,212,681,742` — +`bones_to_process.has()` and `keep_bone_rest.has()` O(B) scans in animation track loops. +Motion-capture scenes with T=2,000 tracks × B=94 bones: **188× op reduction.** + +Fix: Convert both `Vector` collections to `HashSet`. + +**godot-0008 — GLTF extensions_used dedup (MEDIUM)** + +`modules/gltf/gltf_document.cpp:443,5496` — `extensions_used.has()` O(E) scan in per-node +and per-animation GLTF serialization loops. Large scenes with many extension references: +**11× op reduction.** + +Fix: Change `Vector extensions_used` in `gltf_state.h:101` to `HashSet`. + **Summary — Godot defects:** | Defect | File | Severity | Op Ratio | @@ -2302,9 +2340,13 @@ checks use the set; the vector is preserved for downstream iteration. | godot-0002 | `modules/godot_physics_2d/godot_body_2d.h:165` | HIGH (per-tick) | 50× | | godot-0003 | `modules/godot_physics_3d/godot_body_3d.h:159` | HIGH (per-tick) | 50× | | godot-0004 | `modules/godot_physics_3d/godot_soft_body_3d.cpp:663` | MEDIUM (load-time) | 4× | +| godot-0005 | `core/math/a_star.cpp:373` | HIGH (per-nav-call) | 800× | +| godot-0006 | `scene/3d/skeleton_3d.cpp:235` | MEDIUM (per-rebuild) | 24× | +| godot-0007 | `editor/import/3d/post_import_plugin_skeleton_rest_fixer.cpp:201` | MEDIUM (import) | 188× | +| godot-0008 | `modules/gltf/gltf_document.cpp:443` | MEDIUM (serialize) | 11× | -All four: **PATCHED.** Patches at `defects/godot/patch/`. Unit proof: `GodotPhysicsAreaTest` -6/6 PASS. +All eight: **PATCHED.** Patches at `defects/godot/patch/`. Unit tests: 14/14 PASS. +Redot Engine (identical fork): same defects present at matching locations. --- diff --git a/whitepaper/undefect-cwe407-2026-03-27.pdf b/whitepaper/undefect-cwe407-2026-03-27.pdf index 2c5fd0ee4..16efca287 100644 Binary files a/whitepaper/undefect-cwe407-2026-03-27.pdf and b/whitepaper/undefect-cwe407-2026-03-27.pdf differ