java-topology/whitepaper/outreach/tiled-0001.md

Tiled — CWE-407 Disclosure Brief (tiled-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Four O(n²) defects in Tiled map editor's layer and object sorting, duplication, and movement operations. QList::contains() performs linear scans inside iteration loops. Patched.

The Defects

tiled-0001 (PATCHED — MEDIUM): src/tiled/mapdocument.cpp

Four sites use layers.contains(layer) or objects.contains(mapObject) inside loops:

1. sortLayers() — O(L × S) where L = map layers, S = selected layers
2. sortObjects() — O(O × S) where O = map objects, S = selected objects
3. duplicateLayers() — O(L × S) during layer duplication
4. moveLayersUp/Down() — O(L × S) during layer reordering

// sortLayers — fires on every layer sort operation:
while (Layer *layer = iterator.next()) {
    if (layers.contains(layer))    // O(S) per iteration
        sorted.append(layer);
}

Complexity Proof

tiled-0001: At L=500 map layers, S=100 selected:

• Defective: 500 × 100 = 50,000 comparisons per operation
• Fixed: 500 × 1 = 500 hash lookups
• ~100× op reduction per layer operation.

Impact

Tiled is the most popular open-source tile map editor, used by thousands of game developers. Maps with hundreds of layers (common in complex game levels with parallax, collision, event, and decoration layers) trigger quadratic behavior during sorting, duplication, and movement operations.

The Fix

tiled-0001: Convert selection lists to QSet before iteration:

// Before — O(L × S)
if (layers.contains(layer))

// After — O(L)
const QSet<Layer *> layerSet(layers.begin(), layers.end());
if (layerSet.contains(layer))

Patch

Fix available: defects/tiled-0001/patch/tiled-0001.patch

Single-file patch in src/tiled/mapdocument.cpp across four functions.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (mapeditor/tiled).
2. Assess severity — fires during common layer editing operations.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Tiled team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.