russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Blame History

OpenSCAD — CWE-407 Disclosure Brief (openscad-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

O(N²) color deduplication in PolySetBuilder where std::find scans a vector<Color4f> for every polygon color assignment and every appendPolySet merge operation.

The Defect

openscad-0002 (PATCHED — MEDIUM): src/geometry/PolySetBuilder.cc:161

// endPolygon — fires per polygon:
auto it = std::find(colors_.begin(), colors_.end(), color);
if (it == colors_.end()) {
    color_indices_.push_back(colors_.size());
    colors_.push_back(color);
} else {
    color_indices_.push_back(it - colors_.begin());
}

Same pattern in appendPolySet() at line 185. Each color lookup scans the growing color list. With C unique colors and P polygons, total cost is O(P×C).

Complexity Proof

At P=5,000 polygons and C=500 unique colors:

Defective: 5,000 × 500 = 2,500,000 comparisons
Fixed: 5,000 hash lookups
~500× op reduction.

Impact

OpenSCAD builds colored polysets during CSG evaluation. Complex multi-color models from color() operations with many distinct values hit this path during every preview and render.

The Fix

Add an unordered_map<Color4f, size_t> color_index_ alongside the color vector:

auto it = color_index_.find(color);
if (it == color_index_.end()) {
    size_t idx = colors_.size();
    color_index_[color] = idx;
    color_indices_.push_back(idx);
    colors_.push_back(color);
} else {
    color_indices_.push_back(it->second);
}

Patch

Fix available: defects/openscad-0002/patch/openscad-0002-polysetbuilder-color-dedup.patch

Two-file patch across PolySetBuilder.h and PolySetBuilder.cc.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (openscad/openscad).
Assess severity — fires during every CSG evaluation with colored geometry.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the OpenSCAD team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Blame History Unescape Escape