russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1,003 B

Raw Permalink Blame History

Speed Dreams — CWE-407 Disclosure Brief (speed-dreams-0004)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(D×S) linear scan in human player selection at src/modules/userinterface/legacymenu/racescreens/humanselect.cpp:224. For each human driver, std::find() scans the staging list to check availability, performing O(S) per driver where S = staged drivers.

The Defect

speed-dreams-0004 (PATCHED — LOW): humanselect.cpp:224

if (std::find(staging.cbegin(), staging.cend(), name) == staging.end())
    // O(S) per driver

The Fix

Build an std::unordered_set<std::string> from the staging list for O(1) lookups.

Patch

Fix available: defects/speed-dreams-0004/patch/speed-dreams-0004.patch

What We Ask

Confirm receipt and assign a SourceForge tracker reference.
Coordinate a disclosure date — targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1,003 B Raw Permalink Blame History Unescape Escape