java-topology/defects/minetest-0004/patch/minetest-0004.patch
russell@unturf.com a86a765544 minetest (Luanti): 5 CWE-407 defects, all 5 MOADs scanned
minetest-0001: mg_ore.cpp c_wherein vector CONTAINS in voxel inner loop O(V*W) HIGH 3.3x
minetest-0002: mg_decoration.cpp c_place_on/c_spawnby vector CONTAINS O(S*P) MEDIUM 1.8x
minetest-0003: l_env.cpp find_node_near/find_nodes_in_area filter CONTAINS O(V*F) MEDIUM 1.6x
minetest-0004: nodedef.cpp nodeboxConnects sorted vector linear scan O(N) MEDIUM 2.1x
minetest-0005: blockmodifier.cpp ABM neighbor check sorted vector O(N) LOW-MEDIUM 1.5x

MOAD-0002: g_settings global singleton (architectural, not patchable)
MOAD-0003: thread_local log streams (properly scoped, not leaked context)
MOAD-0004: CLEAN (no credential logging found)
MOAD-0005: CLEAN (no unsynchronized cache patterns found)
2026-03-31 10:10:03 -04:00

22 lines
917 B
Diff

# UNDF: UNDF-2026-000000946
--- a/src/nodedef.cpp
+++ b/src/nodedef.cpp
@@ -1285,10 +1285,12 @@ bool NodeDefManager::nodeboxConnects(MapNode from, MapNode to,
if ((f1.drawtype != NDT_NODEBOX) || (f1.node_box.type != NODEBOX_CONNECTED))
return false;
- // lookup target in connected set
- if (!CONTAINS(f1.connects_to_ids, to.param0))
+ // lookup target in connected set (vector is SORT_AND_UNIQUE'd,
+ // use binary_search O(log N) instead of linear std::find O(N))
+ if (!std::binary_search(f1.connects_to_ids.begin(),
+ f1.connects_to_ids.end(), to.param0))
return false;
const ContentFeatures &f2 = get(to);
if ((f2.drawtype == NDT_NODEBOX) && (f2.node_box.type == NODEBOX_CONNECTED))
- // ignores actually looking if back connection exists
- return CONTAINS(f2.connects_to_ids, from.param0);
+ return std::binary_search(f2.connects_to_ids.begin(),
+ f2.connects_to_ids.end(), from.param0);