java-topology/whitepaper/outreach/bzflag-0003.md

BZFlag — CWE-407 Disclosure Brief (bzflag-0003)

2026-04-14 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in BZFlag's permission parser. The parsePermissionString() function uses std::find on a std::vector<std::string> to deduplicate custom permissions. When parsing permission strings with many custom permissions, the dedup cost grows quadratically.

The Defect

bzflag-0003 (PATCHED — MEDIUM): src/bzfs/Permissions.cxx:649

// In parsePermissionString() — fires per custom permission token:
std::vector<std::string>& c = info.customPerms;

// Only store the custom permission if it doesn't exist
if (std::find(c.begin(), c.end(), word) == c.end())  // O(P) linear scan
{
    c.push_back(word);
}

Every unrecognized permission token triggers a linear scan of the growing custom permissions vector. Permission strings can contain many custom permissions defined by plugins, and parsePermissionString() fires during group database parsing for every group definition.

Complexity Proof

At P=100 custom permissions:

• Defective: 100 insertions × average 50 comparisons = ~5,000 string comparisons
• Fixed: 100 insertions × O(1) set lookup = 100 lookups
• ~50× op reduction. Fires during server startup for every group in the group database.

Impact

BZFlag servers with many plugins define custom permissions in their group databases. Servers with complex permission configurations parse many custom permission tokens during startup. The quadratic dedup cost adds to server initialization time.

The Fix

Add a std::set<std::string> shadow for O(1) duplicate detection:

// Before
if (std::find(c.begin(), c.end(), word) == c.end())
    c.push_back(word);

// After
// CWE-407 fix: std::set for O(log P) dedup instead of O(P) vector scan.
std::set<std::string> customPermsSeen;
if (customPermsSeen.find(word) == customPermsSeen.end()) {
    customPermsSeen.insert(word);
    c.push_back(word);
}

Patch

Fix available: defects/bzflag-0003/patch/bzflag-0003.patch

Single-file patch on Permissions.cxx. Adds a local std::set<std::string> for dedup alongside the existing vector. Lazily populated on first custom permission encounter.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (BZFlag-Dev/bzflag).
2. Assess severity — fires during server startup permission parsing.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the BZFlag team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.