java-topology/whitepaper/outreach/synfig-0001.md

Synfig Studio — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Synfig Studio's layer duplication logic. Membership checks for paste-canvas layers use std::find on a std::vector, producing O(L × D × P) complexity during batch layer operations. Patched.

The Defects

synfig-0001 (PATCHED — MEDIUM): synfig-studio/src/synfigapp/actions/layerduplicate.cpp

// In remove_layers_inside_included_pastelayers() — fires on layer duplicate:
if (std::find(layerpastecanvas_list.begin(), layerpastecanvas_list.end(),
              parent_paste_canvas) != layerpastecanvas_list.end()) {
    // O(P) linear scan per ancestor walk step
}

layerpastecanvas_list is a std::vector<Layer::Handle>. std::find performs O(P) linear scan per ancestor walk step, producing O(L × D × P) total where L = layers, D = nesting depth, P = paste-canvas count.

Complexity Proof

synfig-0001: At L=100 layers, D=5 nesting depth, P=20 paste-canvas layers:

• Defective: 100 × 5 × 20 = 10,000 comparisons
• Fixed: 100 × 5 × 1 = 500 hash lookups (O(1) each)
• ~20× op reduction. Fires on every batch layer duplication.

Impact

Synfig Studio is an open-source 2D animation application used by animators and artists worldwide. Complex animation projects with deeply nested layer hierarchies trigger this defect during layer duplication operations. Artists working with large compositions containing many paste-canvas (group) layers experience unnecessary delays during common editing operations.

The Fix

synfig-0001: Replace std::vector + std::find with std::unordered_set for O(1) membership test:

// Before — O(P) per ancestor check
std::vector<Layer::Handle> layerpastecanvas_list;
std::find(layerpastecanvas_list.begin(), layerpastecanvas_list.end(), parent_paste_canvas)

// After — O(1) per ancestor check
std::unordered_set<Layer*> layerpastecanvas_set;
layerpastecanvas_set.count(parent_paste_canvas.get())

Patch

Fix available: defects/synfig-0001/patch/synfig-0001.patch

Single-file patch in synfig-studio/src/synfigapp/actions/layerduplicate.cpp.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (synfig/synfig).
2. Assess severity — fires during batch layer duplication in complex compositions.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Synfig team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.