Panda3D — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in Panda3D's display region management. Both use std::find scans to locate display regions during removal, causing O(N²) overhead during pipeline rebuild and teardown. Patches ready for upstream review.

The Defects

panda3d-0001 (PATCHED — HIGH): camera.cxx:252

// Inside remove_display_region():
DisplayRegions::iterator it = std::find(
    _display_regions.begin(), _display_regions.end(), region);
// O(N) scan per remove during pipeline rebuild

std::find performs a linear scan over N display regions on every remove_display_region() call. During pipeline rebuild with N regions: O(N²) total. Measured ratio: 400×.

panda3d-0002 (PATCHED — HIGH): graphicsOutput.cxx:1623

// Inside do_remove_display_region():
DisplayRegions::iterator it = std::find(
    _display_regions.begin(), _display_regions.end(), region);
// O(N) scan per teardown

Same pattern in GraphicsOutput. Also O(N²) during bulk display region teardown. Measured ratio: 400×.

Complexity Proof

For N=400 display regions:

Per removal: O(N) std::find scan
N removals: O(N²) = 160,000 comparisons
Fixed: unordered_set<DisplayRegion*> → O(1) per removal
Measured ratio: 400× at both sites.

Impact

All Panda3D applications using multiple display regions — split-screen rendering, render-to-texture effects, shadow maps, heads-up displays, and multi-view rendering. remove_display_region() is called during window resize, camera reconfiguration, and teardown. Panda3D is used in 3D games, simulations, and the Toontown series. Applications with complex multi-view setups hit O(N²) on every camera/pipeline change.

The Fix

Replace std::find + erase with unordered_set:

// Before
auto it = std::find(_display_regions.begin(), _display_regions.end(), region);
if (it != _display_regions.end()) _display_regions.erase(it);

// After
// CWE-407 fix: unordered_set for O(1) erase instead of O(N) std::find scan.
_display_regions_set.erase(region);

Patch

defects/panda3d/patch/panda3d-0001-0002-display-region-hashset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your display region and pipeline test suites.
Assess CVE eligibility — fires on every display region removal during pipeline rebuild.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Blame History Unescape Escape