russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2 KiB

Raw Permalink Blame History

Evolution — CWE-407 Disclosure Brief (evolution-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N^2) defect in Evolution's calendar search hit cache deduplication. Patched. Patch ready for upstream review.

The Defects

evolution-0002 (PATCHED — MEDIUM): src/modules/calendar/e-cal-shell-view-private.c:878

// In cal_searching_got_instance_cb() — fires for each search result:
if (!g_slist_find_custom(priv->search_hit_cache, value,
                         cal_time_t_ptr_compare))
    priv->search_hit_cache = g_slist_append(..., value);

g_slist_find_custom performs O(N) linear scan of the search hit cache for each new result. With N matching events, total dedup cost reaches O(N^2).

Complexity Proof

At N=500 search results:

Defective: 500 x 500 / 2 = 125,000 comparisons
Fixed: 500 x 1 = 500 lookups (GHashTable)
250x op reduction.

Impact

Evolution uses this cache during calendar search operations. Users searching across long date ranges in busy calendars accumulate many hits, making each search progressively slower.

The Fix

Add a GHashTable alongside the GSList for O(1) dedup:

// Before
g_slist_find_custom(priv->search_hit_cache, value, compare)

// After
g_hash_table_contains(priv->search_hit_cache_set, GINT_TO_POINTER(start))

Patch

Fix available: defects/evolution-0002/patch/evolution-0002.patch

Two-file patch across e-cal-shell-view-private.h and e-cal-shell-view-private.c. 250x speedup at N=500 search results.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GNOME GitLab issue reference (GNOME/evolution).
Assess severity — fires during calendar search; scales with result count.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Evolution team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2 KiB Raw Permalink Blame History