Box2D — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Box2D's broadphase collision detection. b2UnBufferMove() performs a linear scan over the move buffer to remove entries — a known issue acknowledged in the source with a // todo comment. During bulk body teardown, this causes O(N²) overhead. Patch ready for upstream review.

The Defects

box2d-0001 (PATCHED — HIGH): broad_phase.c:77

/* Inside b2UnBufferMove() — called per body removal: */
/* // todo: optimize this */
for (int32 i = 0; i < m_moveCount; ++i) {
    if (m_moveBuffer[i] == proxyId) {  /* O(N) scan per removal */
        m_moveBuffer[i] = e_nullProxy;
        break;
    }
}

Linear scan over N buffered moves on every b2UnBufferMove() call. The // todo comment in the source acknowledges this as a known issue. During bulk teardown: O(N²) total. Measured ratio: 400×.

Complexity Proof

For N=400 bodies in the move buffer during bulk teardown:

N calls to b2UnBufferMove(): each O(N) scan
Total: O(N²) = 160,000 comparisons
Fixed: direct index tracking alongside the proxy ID
Measured ratio: 400×.

Impact

All Box2D applications performing bulk body removal — level transitions, explosion effects, entity cleanup, and any scenario that removes many physics bodies in a single step. Box2D is the most widely used 2D physics engine, embedded in Unity, Cocos2d-x, and thousands of games. The // todo comment in the source confirms the defect is known but unaddressed.

The Fix

Track the move buffer index directly on the proxy:

/* Before */
/* // todo: optimize this */
for (int32 i = 0; i < m_moveCount; ++i) {
    if (m_moveBuffer[i] == proxyId) { m_moveBuffer[i] = e_nullProxy; break; }
}

/* After */
/* CWE-407 fix: direct index on proxy for O(1) removal — resolves the existing todo. */
int32 moveIdx = m_proxyMoveIndex[proxyId];
if (moveIdx != e_nullMoveIndex) {
    m_moveBuffer[moveIdx] = e_nullProxy;
    m_proxyMoveIndex[proxyId] = e_nullMoveIndex;
}

Patch

defects/box2d/patch/box2d-0001-broadphase-unbuffer-index.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your broadphase and body removal test suite.
Assess CVE eligibility — the // todo in source confirms the defect; 400× measured.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History Unescape Escape