russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.9 KiB

Raw Blame History

Tiled — CWE-407 Disclosure Brief (tiled-0003)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Tiled's polygon editing tool. selection.contains() performs linear scans during handle update operations when many objects are selected. Patched.

The Defects

tiled-0003 (PATCHED — MEDIUM): src/tiled/editpolygontool.cpp

// In updateHandles() — fires during polygon handle updates:
while (i.hasNext()) {
    i.next();
    if (!selection.contains(i.key())) {  // O(S) per handle
        for (PointHandle *handle : std::as_const(i.value()))
            deleteHandle(handle);
        i.remove();
    }
}
if (mHoveredSegment && !selection.contains(mHoveredSegment.object))  // O(S)
if (mClickedSegment && !selection.contains(mClickedSegment.object))  // O(S)

selection is a QList<MapObject*>. contains() performs O(S) linear scan per handle check. With H handles and S selected objects, total cost is O(H × S).

Complexity Proof

tiled-0003: At H=200 polygon handles, S=100 selected objects:

Defective: 200 × 100 = 20,000 comparisons
Fixed: 200 × 1 = 200 hash lookups
~100× op reduction.

The Fix

tiled-0003: Build a QSet<MapObject*> from the selection list:

const QSet<MapObject*> selectionSet(selection.begin(), selection.end());
if (!selectionSet.contains(i.key())) { ... }

Patch

Fix available: defects/tiled-0003/patch/tiled-0003.patch

Single-file patch in src/tiled/editpolygontool.cpp.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (mapeditor/tiled).
Assess severity — fires during polygon handle updates with multiple selections.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Tiled team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.9 KiB Raw Blame History Unescape Escape