russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.8 KiB

Raw Permalink Blame History

Simutrans — CWE-407 Disclosure Brief (simutrans-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(C×H²) defect in haltestelle_t::rebuild_linked_connections() at src/simutrans/simhalt.cc:1374. The function uses append_unique() (linear scan) to collect unique connected halts, iterating over all categories × connections with O(H) dedup per insertion where H = total connected halts.

The Defect

simutrans-0001 (PATCHED — MEDIUM): src/simutrans/simhalt.cc:1374

vector_tpl<halthandle_t> all;
for(uint8 i=0; i<goods_manager_t::get_max_catg_index(); i++){
    for(connection_t &c : connections) {
        all.append_unique( c.halt );  // O(H) linear scan per insertion
    }
}

Complexity Proof

At C=16 categories, H=200 connected halts:

Defective: 16 × 200 × 200/2 = 320,000 comparisons
Fixed: 16 × 200 × O(1) = 3,200 hash lookups
100× op reduction

Impact

Simutrans simulates transportation networks. rebuild_linked_connections() fires when station connections change, affecting gameplay smoothness on large maps with complex transit networks. Major hub stations connecting many lines across many goods categories trigger the worst case.

The Fix

Use inthashtable_tpl<uint16, bool> for O(1) membership checks before appending:

inthashtable_tpl<uint16, bool> seen;
if(!seen.get(halt_id)) {
    seen.put(halt_id, true);
    all.append(c.halt);
}

Patch

Fix available: defects/simutrans-0001/patch/simutrans-0001.patch

100× op reduction at C=16, H=200.

What We Ask

Confirm receipt and assign a GitHub issue reference (simutrans/simutrans).
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Simutrans team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.8 KiB Raw Permalink Blame History Unescape Escape