russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.3 KiB

Raw Blame History

ROOT (CERN) — CWE-407 Disclosure Brief (root-cern-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(V²) linear scan in TTreeCache::CollectBaskets() at TTreeCache.cxx:1378. potentialVetoes uses std::vector<Int_t> with std::find() for membership checks, producing O(V) per lookup where V = number of vetoed baskets. Called inside a loop over all branches per cluster, total cost compounds to O(B×V) per cluster read.

The Defect

root-cern-0001 (PATCHED — MEDIUM): tree/tree/src/TTreeCache.cxx:1378

std::vector<Int_t> potentialVetoes;
// ...
b->fCacheInfo.GetUnused(potentialVetoes);
// ...
if (std::find(std::begin(potentialVetoes), std::end(potentialVetoes), j)
    != std::end(potentialVetoes)) {
    // O(V) linear scan per basket check

Complexity Proof

At B=500 branches, V=200 vetoed baskets per cluster:

Defective: 500 × 200 = 100,000 comparisons per cluster
Fixed: 500 × O(1) hash lookups = 500 probes
200× op reduction per cluster

Impact

ROOT serves the global high-energy physics community (CERN, Fermilab, SLAC, KEK, DESY). TTreeCache controls I/O prefetching for multi-terabyte analysis datasets. CollectBaskets runs on every cluster boundary during TTree reading. Physics analyses iterating billions of events across thousands of branches accumulate this cost at every cluster read.

The Fix

Replace std::vector<Int_t> potentialVetoes with std::unordered_set<Int_t>. Adapter bridges the existing GetUnused() API returning a vector:

std::unordered_set<Int_t> potentialVetoes;
// ...
{ std::vector<Int_t> tmp; b->fCacheInfo.GetUnused(tmp);
  for (auto v : tmp) potentialVetoes.insert(v); }
// ...
if (potentialVetoes.count(j)) {  // O(1)

Patch

Fix available: defects/root-cern-0001/patch/root-cern-0001-treecache-potentialvetoes.patch

200× op reduction at B=500, V=200.

What We Ask

Confirm receipt and assign a JIRA reference (sft.its.cern.ch/jira) or GitHub issue (root-project/root).
Assess severity — fires on every cluster boundary during TTree I/O.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the ROOT team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Blame History Unescape Escape