java-topology/whitepaper/outreach/openfoam-0002.md

OpenFOAM — CWE-407 Disclosure Brief (openfoam-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(F²) defect in OpenFOAM's CFCFaceToCellStencil construction. Patched. calcCellStencil() uses findIndex() on a DynamicList<label> for dedup when building global face indices per cell, producing quadratic behavior.

The Defect

openfoam-0002 (PATCHED — MEDIUM): src/finiteVolume/fvMesh/extendedStencil/faceToCell/globalIndexStencils/CFCFaceToCellStencil.C:128

// In calcCellStencil() — fires per cell per neighbor face:
DynamicList<label> allGlobalFaces(100);
// ...
// Check if already there. Note:should use hashset?
if (findIndex(allGlobalFaces, nbrGlobalI) == -1)  // O(F) per face
{
    allGlobalFaces.append(nbrGlobalI);
}

The code even contains a comment acknowledging the need for a hash set. findIndex() is O(F) where F = faces already collected. Called for every neighbor face of every cell. With C cells and F faces per cell, total cost: O(C × F²).

Complexity Proof

At F=50 faces per cell stencil, C=100,000 cells:

• Defective: 100,000 × 50 × 25 avg = 125,000,000 comparisons
• Fixed: 100,000 × 50 × O(1) = 5,000,000 hash lookups
• 25× op reduction at 50 faces per stencil.

Impact

OpenFOAM is the most widely used open-source CFD framework. The face-to-cell stencil constructs during mesh setup for extended stencil finite volume methods. Large meshes with complex cell connectivity (polyhedral meshes, AMR) trigger quadratic dedup during stencil construction.

The Fix

Add a parallel labelHashSet for O(1) dedup:

// Before
if (findIndex(allGlobalFaces, nbrGlobalI) == -1)  // O(F)

// After
labelHashSet seen(100);
if (seen.insert(nbrGlobalI))                       // O(1)
{
    allGlobalFaces.append(nbrGlobalI);
}

Patch

Fix available: defects/openfoam-0002/patch/openfoam-0002-cfcfacetocelstencil-hashset.patch

Touches CFCFaceToCellStencil.C. 25× speedup at 50 faces per stencil.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign an issue reference (OpenFOAM/OpenFOAM-dev).
2. Assess severity — fires during mesh stencil construction.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the OpenFOAM team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.