russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.3 KiB

Raw Permalink Blame History

Okular — CWE-407 Disclosure Brief (okular-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(F²) defect in Okular's font deduplication during PDF font extraction. Patched. fontReadingGotFont() uses QList::indexOf() for duplicate detection, producing quadratic behavior when extracting fonts from large PDF documents.

The Defect

okular-0001 (PATCHED — MEDIUM): core/document.cpp:1562

// In fontReadingGotFont() — fires per font discovered in PDF:
if (m_fontsCache.indexOf(font) == -1) {
    m_fontsCache.append(font);
    Q_EMIT m_parent->gotFont(font);
}

m_fontsCache is FontInfo::List (a QList). indexOf() is O(F) per call, using FontInfo::operator== for comparison. With F fonts in a document, total cost: O(F²).

Complexity Proof

At F=500 fonts (large typeset document):

Defective: 500 × 250 avg = 125,000 font comparisons
Fixed: 500 × O(1) QSet lookups = 500 operations
250× op reduction at 500 fonts.

Impact

Okular is KDE's universal document viewer, widely used on Linux desktops. Font extraction runs when viewing font information for PDFs. Large academic papers, typeset books, and multi-language documents can embed hundreds of fonts. The font extraction dialog becomes unresponsive with quadratic dedup.

The Fix

Add a parallel QSet<QString> with composite keys for O(1) dedup:

// Before
if (m_fontsCache.indexOf(font) == -1)  // O(F) per font

// After
QSet<QString> m_fontsCacheKeys;
const QString key = font.name() + "|" + font.substituteName() + "|" + ...;
if (!m_fontsCacheKeys.contains(key)) {  // O(1) per font
    m_fontsCacheKeys.insert(key);
    m_fontsCache.append(font);
}

Patch

Fix available: defects/okular-0001/patch/okular-0001.patch

Touches core/document_p.h and core/document.cpp. 250× speedup at 500 fonts.

What We Ask

A patch is ready for review.

Confirm receipt and assign a KDE Bugzilla issue reference (okular).
Assess severity — fires during font extraction on large PDFs.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Okular team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Permalink Blame History Unescape Escape