java-topology/whitepaper/outreach/root-cern-0003.md

ROOT (CERN) — CWE-407 Disclosure Brief (root-cern-0003)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(B²) defect in TTree::InitializeBranchLists() at TTree.cxx:5862. Two loops call std::find() on fSeqBranches (a std::vector<TBranch*>), each performing O(S) per branch where S = sequential branches count. With B total branches and up to B leaf-count branches, both loops are O(B×S) = O(B²).

The Defect

root-cern-0003 (PATCHED — MEDIUM): tree/tree/src/TTree.cxx:5862

// First loop: checking leaf-count branches
if (std::find(fSeqBranches.begin(), fSeqBranches.end(), countBranch)
    == fSeqBranches.end()) {  // O(S) per branch
    fSeqBranches.push_back(countBranch);
}
// Second loop: building sorted branches
if (std::find(fSeqBranches.begin(), fSeqBranches.end(), branch)
    == fSeqBranches.end()) {  // O(S) per branch

Complexity Proof

At B=1,000 branches, S=200 sequential branches:

• Defective: 2 × 1,000 × 200 = 400,000 comparisons
• Fixed: 2 × 1,000 × O(1) = 2,000 probes
• 200× op reduction

Impact

ROOT processes petabytes of physics data at CERN and partner labs worldwide. InitializeBranchLists runs during TTree setup for every analysis job. Trees with thousands of branches (common in CMS/ATLAS NanoAOD formats) pay this cost on every file open.

The Fix

Mirror fSeqBranches in an std::unordered_set<TBranch*> for O(1) membership checks. The set stays synchronized with the vector on every insertion.

Patch

Fix available: defects/root-cern-0003/patch/root-cern-0003-ttree-seqbranches-find.patch

200× op reduction at B=1,000, S=200.

What We Ask

1. Confirm receipt and assign a JIRA or GitHub issue reference (root-project/root).
2. Assess severity — fires on every TTree initialization with many branches.
3. Coordinate a disclosure date — targeting 90 days from first contact.
4. We will credit the ROOT team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.