russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Blame History

Evolution — CWE-407 Disclosure Brief (evolution-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N^2) defect in Evolution's date-time list deduplication (exception dates in calendar events). Patched. Patch ready for upstream review.

The Defects

evolution-0001 (PATCHED — MEDIUM): src/calendar/gui/e-date-time-list.c:580

// In e_date_time_list_append() — fires when adding exception dates:
if (g_list_find_custom(date_time_list->priv->list, itt,
                       (GCompareFunc) compare_datetime) == NULL) {
    date_time_list->priv->list = g_list_append(...);
}

g_list_find_custom performs O(N) linear scan of the GList for each new date insertion. With N exception dates, total dedup cost reaches O(N^2).

Complexity Proof

At N=200 exception dates:

Defective: 200 x 200 / 2 = 20,000 comparisons
Fixed: 200 x 1 = 200 lookups (GHashTable)
100x op reduction.

Impact

Evolution is the default email and calendar client on GNOME. Recurring events with many exception dates (e.g., a daily meeting over 2 years with 200+ cancellations) trigger quadratic dedup when editing the event.

The Fix

Add a GHashTable keyed on ISO date strings alongside the GList:

// Before
g_list_find_custom(list, itt, compare_datetime)

// After
GHashTable *date_set = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, NULL);
g_hash_table_contains(date_set, key)

Patch

Fix available: defects/evolution-0001/patch/evolution-0001-exdate-dedup-hashset.patch

Single-file patch on src/calendar/gui/e-date-time-list.c. 100x speedup at N=200 exception dates.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GNOME GitLab issue reference (GNOME/evolution).
Assess severity — fires when editing recurring events with many exceptions.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Evolution team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Blame History