russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Permalink Blame History

RawTherapee — CWE-407 Disclosure Brief (rawtherapee-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

O(I×S) selection membership test in IPTCPanel::delKeyWord() and delSuppCategory() where std::find scans the selection vector for every item in the list, checking which items to keep.

The Defect

rawtherapee-0002 (PATCHED — LOW): rtgui/iptcpanel.cc:561

// delKeyWord — fires per keyword:
for (unsigned int i = 0; i < keywords->size(); i++)
    if (std::find(selection.begin(), selection.end(), i) == selection.end()) {
        keep.push_back(keywords->get_text(i));
    }

Same pattern in delSuppCategory() at line 613. With I items and S selected items, cost per deletion is O(I×S).

Complexity Proof

At I=200 keywords and S=50 selected:

Defective: 200 × 50 = 10,000 comparisons
Fixed: 50 hash insertions + 200 O(1) lookups = 250 operations
~40× op reduction.

Impact

RawTherapee manages IPTC metadata (keywords, supplemental categories) for photographs. Batch keyword deletion from large keyword lists triggers this path. While the absolute numbers are modest, the fix is trivial and eliminates the quadratic pattern.

The Fix

Convert the selection vector to an unordered_set<int> before the loop:

std::unordered_set<int> selectionSet(selection.begin(), selection.end());
for (unsigned int i = 0; i < keywords->size(); i++)
    if (selectionSet.count(i) == 0)
        keep.push_back(keywords->get_text(i));

Patch

Fix available: defects/rawtherapee-0002/patch/rawtherapee-0002-iptcpanel-selection-linear-scan.patch

Single-file patch in iptcpanel.cc.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (Beep6581/RawTherapee).
Assess severity — low (bounded keyword counts), but straightforward fix.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the RawTherapee team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Permalink Blame History Unescape Escape