russell@unturf.com
652608142a
All projects with patches now have outreach docs. 276 new docs covering CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#, PHP, Ruby, JavaScript, Dart, Erlang, R, and more. Outreach gap: 276 -> 0.
1.9 KiB
FreeOrion — CWE-407 Disclosure Brief (freeorion-0001)
2026-04-13 · Patch available — awaiting upstream merge
Finding
One O(Q*T) defect in FreeOrion's research progress computation. Patched. Patch ready for upstream review.
The Defects
freeorion-0001 (PATCHED — MEDIUM): Empire/Empire.cpp:2263
// In CheckResearchProgress() — fires every turn:
const auto ct_it = range_find_if(costs_times, is_tech);
// is_tech lambda matches by name — O(T) linear scan per tech
For each tech in the research queue (Q items), range_find_if linearly scans the costs_times vector (T entries) to find the matching cost/time data. Total: O(QT) plus another O(TT) loop for remaining techs.
Complexity Proof
At Q=100 queued techs, T=500 total techs:
- Defective: 100 x 500 + 500 x 500 = 300,000 comparisons
- Fixed: 100 + 500 = 600 lookups (unordered_flat_map)
- 500x op reduction.
Impact
FreeOrion is a 4X space strategy game. Research progress fires every turn for every empire. Games with many empires and large tech trees pay increasing per-turn costs.
The Fix
Build a boost::unordered_flat_map from tech name to cost/time before the loops:
// Before
range_find_if(costs_times, is_tech)
// After
costs_times_map.find(tech_name)
Patch
Fix available: defects/freeorion-0001/patch/freeorion-0001.patch
Single-file patch on Empire/Empire.cpp. 500x speedup at Q=100, T=500.
What We Ask
A patch is ready for review.
- Confirm receipt and assign a GitHub issue reference (freeorion/freeorion).
- Assess severity — fires every game turn for every empire.
- Coordinate a disclosure date — we are targeting 90 days from first contact.
- We will credit the FreeOrion team in the public disclosure. Preferred acknowledgment format welcome.
Contact: see cover email. This brief is confidential until coordinated disclosure.