java-topology/whitepaper/outreach/prusaslicer-0002.md

PrusaSlicer — CWE-407 Disclosure Brief (prusaslicer-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

O(N²) membership test in SLA support island distance propagation where std::find scans a process vector for each candidate node, checking if it already exists in the processing queue.

The Defect

prusaslicer-0002 (PATCHED — MEDIUM): src/libslic3r/SLA/SupportIslands/UniformSupportIsland.cpp:2049

// Inside neighbor processing loop:
if (std::find(process.begin(), process.end(), item_index) != process.end())
    continue;  // already in process

With N island nodes, process grows to O(N) entries. Each neighbor check scans the full process vector, giving O(N²) total for distance propagation.

Complexity Proof

At N=5,000 island nodes:

• Defective: ~12,500,000 comparisons (triangle sum)
• Fixed: 5,000 hash insertions + 5,000 hash lookups
• ~2,500× op reduction.

Impact

PrusaSlicer generates SLA support structures for resin printing. Support island analysis with shortest-distance propagation fires during slice preparation. Complex models with dense support requirements create thousands of island nodes, and the quadratic propagation dominates slice preparation time.

The Fix

Add a parallel unordered_set<size_t> process_set maintained alongside the process vector:

std::unordered_set<size_t> process_set;
// ...
if (process_set.count(item_index))
    continue;  // O(1) membership check
// ...
process.push_back(next_distance_index);
process_set.insert(next_distance_index);

Patch

Fix available: defects/prusaslicer-0002/patch/prusaslicer-0002.patch

Single-file patch in UniformSupportIsland.cpp.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (prusa3d/PrusaSlicer).
2. Assess severity — fires during SLA support island analysis, compounds with model complexity.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the PrusaSlicer team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.