russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.2 KiB

Raw Blame History

FreeOrion — CWE-407 Disclosure Brief (freeorion-0003)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Two O(S*N) defects in FreeOrion's gift/scrap handling during turn processing. Both involve linear scans of span-based ID lists. Patched. Patch ready for upstream review.

The Defects

freeorion-0003 (PATCHED — MEDIUM): server/ServerApp.cpp:3216,3340

// In HandleGifting() — fires during turn processing:
auto not_invading_not_colonizing_ship = [invading_ship_ids, colonizing_ship_ids](const Ship& s)
{ return !range_contains(invading_ship_ids, s.ID()) && !range_contains(colonizing_ship_ids, s.ID()); };

// In HandleScrapping() — fires during turn processing:
return s && s->OrderedScrapped() && !range_contains(gifted_ids, s->ID()) &&
    !range_contains(invading_ship_ids, s->ID()) && !range_contains(colonizing_ship_ids, s->ID());

range_contains on std::span<const int> performs O(N) linear scan. Each ship/building predicate calls it 2-3 times per object. With S ships and N IDs per span, total cost reaches O(S * N) per predicate.

Complexity Proof

At S=500 ships, N=200 IDs across spans:

Defective: 500 x 3 x 200 = 300,000 comparisons
Fixed: 500 x 3 x 1 = 1,500 lookups (unordered_set)
200x op reduction.

Impact

FreeOrion processes gifts and scrapping every game turn. Large games with many ships, invasions, and colonizations accumulate long ID lists, making turn processing increasingly slow.

The Fix

Convert spans to std::unordered_set<int> before the filtering lambdas:

// Before
range_contains(invading_ship_ids, s.ID())

// After
invading_set.count(s.ID())

Patch

Fix available: defects/freeorion-0003/patch/freeorion-0003.patch

Single-file patch on server/ServerApp.cpp. 200x speedup at S=500, N=200.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (freeorion/freeorion).
Assess severity — fires every game turn during gift/scrap processing.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the FreeOrion team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.2 KiB Raw Blame History