russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.8 KiB

Raw Blame History

Simutrans — CWE-407 Disclosure Brief (simutrans-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Two O(L×R) and O(C×R) linear scans in halt registration at src/simutrans/simhalt.cc:3295. registered_lines.is_contained() performs O(R) per line check, and registered_convoys.is_contained() performs O(R) per convoy check, where R = registered items. With L total lines and C total convoys in the world, this creates O(L×R) + O(C×R) total cost.

The Defect

simutrans-0002 (PATCHED — MEDIUM): src/simutrans/simhalt.cc:3295

// Line registration:
if(!registered_lines.is_contained(j) && j->count_convoys() > 0) {
    // O(R) per line check
}
// Convoy registration:
if(!registered_convoys.is_contained(cnv)) {
    // O(R) per convoy check
}

Complexity Proof

At L=500 lines, R=200 registered lines, C=1,000 convoys:

Defective: 500 × 200 + 1,000 × 200 = 300,000 comparisons
Fixed: 500 + 1,000 hash lookups = 1,500 probes
200× op reduction

Impact

Simutrans simulates complex transportation networks. Halt registration fires whenever stop assignments update. Large maps with hundreds of lines and thousands of convoys trigger the worst case, causing gameplay stutter during network recalculation.

The Fix

Build inthashtable_tpl<uint16, bool> hash sets from registered lines and convoys for O(1) membership checks.

Patch

Fix available: defects/simutrans-0002/patch/simutrans-0002.patch

200× op reduction at L=500, C=1,000.

What We Ask

Confirm receipt and assign a GitHub issue reference (simutrans/simutrans).
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Simutrans team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.8 KiB Raw Blame History Unescape Escape