check fgets return val

correct pid querying and missed #ifdef changes

.gitattributes

@@ -1,2 +0,0 @@
-# Try to tell GitHub how to handle .asc files
-*.asc linguist-language=Tcl

.github/actions/prepare-bext/action.yml

@@ -1,260 +0,0 @@
-name: Prepare bext dependencies
-description: Restore a compatible bext production artifact or build the pinned revision.
-
-inputs:
-  platform-channel:
-    description: Published bext platform channel.
-    required: true
-  source-dir:
-    description: Absolute path to the BRL-CAD source tree.
-    required: true
-  output-dir:
-    description: Absolute path where the bext dependency tree will be prepared.
-    required: true
-  build-type:
-    description: BRL-CAD build configuration that will consume the dependency tree.
-    required: false
-    default: Release
-  artifact-token:
-    description: Token with Actions read access to BRL-CAD/bext.
-    required: false
-
-outputs:
-  bext-sha:
-    description: The bext revision in the prepared dependency tree.
-    value: ${{ steps.result.outputs.bext-sha }}
-  source:
-    description: Whether preparation used a production artifact, cache, or local build.
-    value: ${{ steps.result.outputs.source }}
-
-runs:
-  using: composite
-  steps:
-    - name: Resolve bext production artifact
-      id: resolve
-      shell: bash
-      env:
-        BEXT_BUILD_TYPE: ${{ inputs.build-type }}
-        BEXT_CHANNEL: ${{ inputs.platform-channel }}
-        BRLCAD_SOURCE_DIR: ${{ inputs.source-dir }}
-        GH_TOKEN: ${{ inputs.artifact-token }}
-      run: |
-        set -uo pipefail
-        source_dir="$BRLCAD_SOURCE_DIR"
-        if command -v cygpath >/dev/null 2>&1; then
-          source_dir="$(cygpath -u "$source_dir")"
-        fi
-        required_sha="$(awk -F'[()]' '/^[[:space:]]*brlcad_bext_init\([0-9a-fA-F]{40}\)/ { print tolower($2) }' "$source_dir/CMakeLists.txt")"
-        if [[ ! "$required_sha" =~ ^[0-9a-f]{40}$ ]]; then
-          echo "Expected exactly one brlcad_bext_init(<sha>) call in $source_dir/CMakeLists.txt" >&2
-          exit 1
-        fi
-
-        repository='BRL-CAD/bext'
-        marker_name="bext-production-$required_sha"
-        marker_info="$(gh api "repos/$repository/actions/artifacts?name=$marker_name&per_page=100" \
-          --jq '[.artifacts[] | select(.expired == false and .name == "'"$marker_name"'")] | sort_by(.created_at) | last | select(. != null) | [.name, .workflow_run.id] | @tsv' 2>/dev/null)" || marker_info=''
-
-        selected_sha=''
-        run_id=''
-        if [[ -n "$marker_info" ]]; then
-          selected_sha="$required_sha"
-          IFS=$'\t' read -r _ run_id <<< "$marker_info"
-          echo "Found complete bext production artifacts for pinned revision $required_sha."
-        else
-          marker_info="$(gh api "repos/$repository/actions/artifacts?per_page=100" \
-            --jq '[.artifacts[] | select(.expired == false and (.name | test("^bext-production-[0-9a-f]{40}$")))] | sort_by(.created_at) | last | select(. != null) | [.name, .workflow_run.id] | @tsv' 2>/dev/null)" || marker_info=''
-          if [[ -n "$marker_info" ]]; then
-            IFS=$'\t' read -r latest_marker run_id <<< "$marker_info"
-            selected_sha="${latest_marker#bext-production-}"
-            comparison="$(gh api "repos/$repository/compare/$required_sha...$selected_sha" --jq '.status' 2>/dev/null)" || comparison=''
-            if [[ "$comparison" == 'ahead' || "$comparison" == 'identical' ]]; then
-              echo "::warning::Using newer successful bext revision $selected_sha instead of BRL-CAD's pinned revision $required_sha."
-            else
-              selected_sha=''
-              run_id=''
-            fi
-          fi
-        fi
-
-        artifact_ready=false
-        artifact_name=''
-        if [[ "$RUNNER_OS" == 'Windows' && "$BEXT_BUILD_TYPE" == 'Debug' ]]; then
-          echo 'Windows Debug requires a Debug bext build; skipping Release production artifacts.'
-          selected_sha=''
-          run_id=''
-        elif [[ -n "$selected_sha" ]]; then
-          artifact_name="bext-$BEXT_CHANNEL-$selected_sha"
-          artifact_count="$(gh api "repos/$repository/actions/runs/$run_id/artifacts?name=$artifact_name&per_page=100" \
-            --jq '[.artifacts[] | select(.expired == false and .name == "'"$artifact_name"'")] | length' 2>/dev/null)" || artifact_count=0
-          if [[ "$artifact_count" == '1' ]]; then
-            artifact_ready=true
-          else
-            selected_sha=''
-            run_id=''
-            artifact_name=''
-          fi
-        fi
-
-        cache_schema=1
-        image_version="${ImageVersion:-unknown}"
-        runner_arch="${RUNNER_ARCH:-unknown}"
-        fallback_cache_key="bext-$cache_schema-$BEXT_CHANNEL-$BEXT_BUILD_TYPE-$required_sha-$image_version-$runner_arch"
-        production_cache_key="bext-$cache_schema-$BEXT_CHANNEL-Release-$selected_sha"
-        if [[ "$artifact_ready" != 'true' ]]; then
-          echo "No compatible production artifact is available; using the cache/build fallback for $required_sha."
-        fi
-
-        echo "required-sha=$required_sha" >> "$GITHUB_OUTPUT"
-        echo "selected-sha=$selected_sha" >> "$GITHUB_OUTPUT"
-        echo "run-id=$run_id" >> "$GITHUB_OUTPUT"
-        echo "artifact-name=$artifact_name" >> "$GITHUB_OUTPUT"
-        echo "artifact-ready=$artifact_ready" >> "$GITHUB_OUTPUT"
-        echo "production-cache-key=$production_cache_key" >> "$GITHUB_OUTPUT"
-        echo "fallback-cache-key=$fallback_cache_key" >> "$GITHUB_OUTPUT"
-
-    - name: Restore production artifact cache
-      if: steps.resolve.outputs.artifact-ready == 'true'
-      id: production-cache
-      uses: actions/cache/restore@v6
-      with:
-        path: ${{ inputs.output-dir }}
-        key: ${{ steps.resolve.outputs.production-cache-key }}
-
-    - name: Download bext production artifact
-      if: steps.resolve.outputs.artifact-ready == 'true' && steps.production-cache.outputs.cache-hit != 'true'
-      id: download
-      shell: bash
-      env:
-        ARTIFACT_NAME: ${{ steps.resolve.outputs.artifact-name }}
-        BEXT_CHANNEL: ${{ inputs.platform-channel }}
-        BEXT_OUTPUT_DIR: ${{ inputs.output-dir }}
-        BEXT_RUN_ID: ${{ steps.resolve.outputs.run-id }}
-        GH_TOKEN: ${{ inputs.artifact-token }}
-      run: |
-        set -uo pipefail
-        output_dir="$BEXT_OUTPUT_DIR"
-        if command -v cygpath >/dev/null 2>&1; then
-          output_dir="$(cygpath -u "$output_dir")"
-        fi
-        download_dir="$RUNNER_TEMP/bext-download-$BEXT_RUN_ID-$BEXT_CHANNEL"
-        cmake -E rm -rf "$download_dir" "$output_dir"
-        cmake -E make_directory "$download_dir" "$output_dir"
-
-        ready=false
-        if gh run download "$BEXT_RUN_ID" --repo BRL-CAD/bext --name "$ARTIFACT_NAME" --dir "$download_dir"; then
-          archive="$download_dir/bext-$BEXT_CHANNEL.tar.gz"
-          if (cd "$output_dir" && cmake -E tar xzf "$archive") && \
-             [[ -d "$output_dir/install" && -d "$output_dir/noinstall" && -f "$output_dir/bext-install-manifest.json" ]]; then
-            ready=true
-          fi
-        fi
-        cmake -E rm -rf "$download_dir"
-        if [[ "$ready" != 'true' ]]; then
-          cmake -E rm -rf "$output_dir"
-          echo '::warning::Unable to download or validate the bext production artifact; using the pinned cache/build fallback.'
-        fi
-        echo "ready=$ready" >> "$GITHUB_OUTPUT"
-
-    - name: Restore fallback bext cache
-      if: steps.production-cache.outputs.cache-hit != 'true' && steps.download.outputs.ready != 'true'
-      id: fallback-cache
-      uses: actions/cache/restore@v6
-      with:
-        path: ${{ inputs.output-dir }}
-        key: ${{ steps.resolve.outputs.fallback-cache-key }}
-
-    - name: Build pinned bext revision
-      if: steps.production-cache.outputs.cache-hit != 'true' && steps.download.outputs.ready != 'true' && steps.fallback-cache.outputs.cache-hit != 'true'
-      shell: bash
-      env:
-        BEXT_BUILD_TYPE: ${{ inputs.build-type }}
-        BEXT_OUTPUT_DIR: ${{ inputs.output-dir }}
-        BEXT_SHA: ${{ steps.resolve.outputs.required-sha }}
-      run: |
-        set -euo pipefail
-        output_dir="$BEXT_OUTPUT_DIR"
-        if command -v cygpath >/dev/null 2>&1; then
-          output_dir="$(cygpath -u "$output_dir")"
-        fi
-        source_dir="$RUNNER_TEMP/bext-src"
-        build_dir="$RUNNER_TEMP/bext-build"
-        cleanup() {
-          cmake -E rm -rf "$source_dir" "$build_dir"
-        }
-        trap cleanup EXIT
-        cleanup
-        cmake -E rm -rf "$output_dir"
-
-        git clone --filter=blob:none https://github.com/BRL-CAD/bext.git "$source_dir"
-        git -C "$source_dir" -c advice.detachedHead=false checkout "$BEXT_SHA"
-        configure_args=(-S "$source_dir" -B "$build_dir" -G Ninja -DENABLE_ALL=ON -DGIT_SHALLOW_CLONE=ON "-DCMAKE_BUILD_TYPE=$BEXT_BUILD_TYPE" "-DCMAKE_INSTALL_PREFIX=$output_dir")
-        if [[ "$RUNNER_OS" == 'Windows' ]]; then
-          configure_args+=(-DCMAKE_C_COMPILER=cl.exe -DCMAKE_CXX_COMPILER=cl.exe)
-        elif [[ "$RUNNER_OS" == 'macOS' ]]; then
-          export CC=clang
-          export CXX=clang++
-        fi
-        cmake "${configure_args[@]}"
-        cmake --build "$build_dir" --config "$BEXT_BUILD_TYPE" --parallel 2
-
-    - name: Validate bext dependency tree
-      shell: bash
-      env:
-        BEXT_OUTPUT_DIR: ${{ inputs.output-dir }}
-      run: |
-        set -euo pipefail
-        output_dir="$BEXT_OUTPUT_DIR"
-        if command -v cygpath >/dev/null 2>&1; then
-          output_dir="$(cygpath -u "$output_dir")"
-        fi
-        [[ -d "$output_dir/install" && -d "$output_dir/noinstall" && -f "$output_dir/bext-install-manifest.json" ]]
-        tool="$output_dir/noinstall/bin/strclear"
-        if [[ "$RUNNER_OS" == 'Windows' ]]; then
-          [[ -f "$tool.exe" ]]
-        else
-          [[ -x "$tool" ]]
-        fi
-
-    - name: Save production artifact cache
-      if: steps.download.outputs.ready == 'true'
-      uses: actions/cache/save@v6
-      with:
-        path: ${{ inputs.output-dir }}
-        key: ${{ steps.resolve.outputs.production-cache-key }}
-
-    - name: Save fallback bext cache
-      if: steps.production-cache.outputs.cache-hit != 'true' && steps.download.outputs.ready != 'true' && steps.fallback-cache.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v6
-      with:
-        path: ${{ inputs.output-dir }}
-        key: ${{ steps.resolve.outputs.fallback-cache-key }}
-
-    - name: Report bext source
-      id: result
-      shell: bash
-      env:
-        ARTIFACT_READY: ${{ steps.resolve.outputs.artifact-ready }}
-        ARTIFACT_SHA: ${{ steps.resolve.outputs.selected-sha }}
-        DOWNLOAD_READY: ${{ steps.download.outputs.ready }}
-        FALLBACK_CACHE_HIT: ${{ steps.fallback-cache.outputs.cache-hit }}
-        PRODUCTION_CACHE_HIT: ${{ steps.production-cache.outputs.cache-hit }}
-        REQUIRED_SHA: ${{ steps.resolve.outputs.required-sha }}
-      run: |
-        if [[ "$PRODUCTION_CACHE_HIT" == 'true' ]]; then
-          source=production-cache
-        elif [[ "$DOWNLOAD_READY" == 'true' ]]; then
-          source=production-artifact
-        elif [[ "$FALLBACK_CACHE_HIT" == 'true' ]]; then
-          source=fallback-cache
-        else
-          source=local-build
-        fi
-        if [[ "$ARTIFACT_READY" == 'true' && ( "$PRODUCTION_CACHE_HIT" == 'true' || "$DOWNLOAD_READY" == 'true' ) ]]; then
-          sha="$ARTIFACT_SHA"
-        else
-          sha="$REQUIRED_SHA"
-        fi
-        echo "source=$source" >> "$GITHUB_OUTPUT"
-        echo "bext-sha=$sha" >> "$GITHUB_OUTPUT"
-        echo "Prepared bext $sha from $source."

.github/workflows/analysis.yml

@@ -0,0 +1,102 @@
+name: BRL-CAD Analysis
+
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+
+  linux_static:
+    name: Clang Static Analyser
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+    steps:
+      - name: Setup - CMake
+        uses: lukka/get-cmake@latest
+
+        # Setup hint from https://github.com/darktable-org/rawspeed/blob/develop/.github/workflows/ci-static-analysis.yml
+      - name: Clang Static Analyzer Setup
+        env:
+          DEBIAN_FRONTEND: noninteractive
+        run: |
+          sudo apt-get update
+          sudo apt-get install clang-tools-14
+          # We want as many deps pre-installed as we can for this - the analyzer setup slows their compilation
+          sudo apt-get install libproj-dev libgdal-dev tcl-dev tk-dev itcl3-dev itk3-dev libpng-dev zlib1g-dev libxml2-dev libxslt1-dev xsltproc libxml2-utils astyle xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev
+          sudo apt-get clean
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Analyzer
+        run: |
+          pwd
+          export PATH=$ENV{GITHUB_WORKSPACE}:/usr/share/clang/scan-build-14/bin:/usr/share/clang/scan-build-14/libexec:$PATH
+          mkdir build && cd build && cp ../misc/clang-static-analyzer-run.sh .
+          ./clang-static-analyzer-run.sh
+
+      - name: Summary
+        if: success() || failure()
+        run: |
+          sudo apt-get install html2text
+          html2text build/scan-reports-all/*/index.html
+
+
+  linux_cov:
+    # See https://app.codecov.io/gh/BRL-CAD/brlcad for analysis results
+    name: LCOV Coverage testing
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+    steps:
+      - name: Setup - CMake
+        uses: lukka/get-cmake@latest
+
+      - name: Setup
+        env:
+          DEBIAN_FRONTEND: noninteractive
+        run: |
+          sudo apt-get update
+          # Get the lcov tool and its dependencies
+          sudo apt-get install lcov
+          # We want as many deps pre-installed as we can for this - the analyzer setup slows their compilation
+          sudo apt-get install libproj-dev libgdal-dev tcl-dev tk-dev itcl3-dev itk3-dev libpng-dev zlib1g-dev libxml2-dev libxslt1-dev xsltproc libxml2-utils astyle xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev
+          sudo apt-get clean
+
+#     - name: Setup - Qt
+#       uses: jurplel/install-qt-action@v3
+#       with:
+#         cache: 'true'
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cmake -S . -B build -DBRLCAD_ENABLE_COVERAGE=ON
+
+      - name: Build
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cd build && make && cd ..
+
+      - name: Run Coverage Test
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cd build
+          find . -name '*.gcda' -exec rm {} \;
+          make check
+          lcov --capture --directory . --output-file coverage.info
+          lcov -r coverage.info \*\/other\/\* > coverage-2.info
+          lcov -r coverage-2.info \/usr\/\* > coverage_cad.info
+          rm coverage-*.info
+          #genhtml coverage_cad.info --output-directory lcov-output
+          mv coverage_cad.info ..
+
+      - name: Upload
+        uses: codecov/codecov-action@v3
+        with:
+          files: ./coverage_cad.info
+

.github/workflows/check.yml

@@ -0,0 +1,232 @@
+# This file defines Continuous Integration (CI) tests for BRL-CAD using the
+# Github Actions framework.  Currently it defines configurations for Windows,
+# Linux and OSX.
+#
+# Initially we used examples to try and define one common configuration for all
+# platforms, but that turned out to be more complex than it was worth.  The
+# different platforms manifest different issues, and it is easier to keep the
+# individual steps simple and address what needs addressing per-platform.
+#
+# For more information about available platforms for testing, see:
+#
+# https://docs.github.com/en/free-pro-team@latest/actions/reference/specifications-for-github-hosted-runners
+#
+# The general rule when building in CI is to go more verbose in output settings
+# rather than less, since iterative debugging isn't practical.  We also want to
+# avoid parallel building - while that will sometimes catch dependency issues,
+# it also makes the outputs far harder to interpret when there is a problem.
+# Better to do parallel build debugging in an environment were more interactive
+# and iterative debugging is available while preserving the readability of the
+# CI outputs for other issues.
+#
+# Note that there is another reason not to do parallel runs; we have had some
+# trouble with issues that appear to be related to files not being fully
+# written out to disk. To try and help mitigate this, we don't want to stress
+# the I/O subsystem any more than necessary:
+#
+# https://github.com/actions/runner/issues/718
+#
+
+name: BRL-CAD
+
+on: [push]
+
+jobs:
+  windows:
+    name: Windows Latest MSVC - Ninja
+    runs-on: windows-latest
+    strategy:
+      fail-fast: true
+    steps:
+      - name: Setup - CMake
+        uses: lukka/get-cmake@latest
+
+      - name: Setup - Qt
+        uses: jurplel/install-qt-action@v3
+        with:
+          cache: 'true'
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Add github workspace to path
+        # https://github.community/t/deprecated-add-path/136621
+        run: echo "$ENV{GITHUB_WORKSPACE}" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+
+      - name: Add msbuild to PATH
+        uses: microsoft/setup-msbuild@v1.1.3
+
+      - name: Add cl.exe to PATH
+        uses: ilammy/msvc-dev-cmd@v1
+
+      - name: Configure
+        run: |
+          cmake -S . -B build -G Ninja -D CMAKE_C_COMPILER="cl.exe" -D CMAKE_CXX_COMPILER="cl.exe" -D ENABLE_ALL=ON -D CMAKE_BUILD_TYPE=Release -DBRLCAD_ENABLE_QT=ON
+          # We do the following in order to help ensure files are "flushed"
+          # to disk before compilation is attempted
+          # https://superuser.com/a/1553374/1286142
+          powershell Write-VolumeCache C
+          powershell Write-VolumeCache D
+
+      - name: Build
+        run: cd build && ninja -j1 -v && ninja check -v && ninja package
+
+        # Various other Windows build lines used for various types of testing.
+        # Preserved for reference, as the iterative time to figure out how to
+        # perform them was significant...
+        #run: cmake --build build --config Release --target package
+        #run: cd build && ninja -j1 -v STEPCODE_BLD && cd src/other/ext/STEPCODE_BLD-prefix/src/STEPCODE_BLD-build && ninja clean && ninja -j1 -v
+        #run: cmake --build build --config Release --target STEPCODE_BLD && cd build/src/other/ext/STEPCODE_BLD-prefix/src/STEPCODE_BLD-build && msbuild ALL_BUILD.vcxproj -t:clean && msbuild ALL_BUILD.vcxproj -v:diag
+
+        # For the moment the space demands are too extreme to enable this
+        # output for every compile test, but leave the enabling logic present
+        # in commented out form so it can be enabled as needed.
+#     - name: Upload Package
+#       uses: actions/upload-artifact@v2
+#       with:
+#         name: BRLCAD_Windows
+#         path: ${{ github.workspace }}/build/BRL-CAD*exe
+
+  windows_std_tools:
+    name: Windows Latest MSVC - Standard Tools
+    runs-on: windows-latest
+    strategy:
+      fail-fast: true
+    steps:
+      - name: Setup - CMake
+        uses: lukka/get-cmake@latest
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Add github workspace to path
+        # https://github.community/t/deprecated-add-path/136621
+        run: echo "$ENV{GITHUB_WORKSPACE}" | Out-File -Append -FilePath $env:GITHUB_PATH -Encoding utf8
+
+      - name: Configure
+        run: |
+          cmake -S . -B build -D ENABLE_ALL=ON
+          # We do the following in order to help ensure files are "flushed"
+          # to disk before compilation is attempted
+          # https://superuser.com/a/1553374/1286142
+          powershell Write-VolumeCache C
+          powershell Write-VolumeCache D
+
+          # At least for the moment, the main idea for this particular test is to try and
+          # verify multi-config building is working as expected - to shorten build times
+          # but still have a test of the key components, just build MGED
+      - name: Build
+        run: |
+          cmake --build build --config Debug   --target mged
+          cmake --build build --config Release --target mged
+
+  linux:
+    name: Ubuntu Latest GCC
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+    steps:
+      - name: Setup - CMake
+        uses: lukka/get-cmake@latest
+
+      - name: Setup - System
+        env:
+          DEBIAN_FRONTEND: noninteractive
+        run: |
+          sudo apt-get update
+          # Install X/OpenGL dev pkgs
+          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev
+          sudo apt-get clean
+
+      - name: Setup - Qt
+        uses: jurplel/install-qt-action@v3
+        with:
+          cache: 'true'
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cmake -S . -G Ninja -B build -D ENABLE_ALL=ON -D CMAKE_BUILD_TYPE=Release -DBRLCAD_ENABLE_QT=ON
+
+      - name: Build
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cmake --build build --config Release --target check
+          cmake --build build --config Release --target package
+
+        # For the moment the space demands are too extreme to enable this
+        # output for every compile test, but leave the enabling logic present
+        # in commented out form so it can be enabled as needed.
+#     - name: Upload Package
+#       uses: actions/upload-artifact@v2
+#       with:
+#         name: BRLCAD_Linux
+#         path: ${{ github.workspace }}/build/BRL-CAD*gz
+
+  osx:
+    name: macOS Latest Clang
+    runs-on: macos-latest
+    strategy:
+      fail-fast: true
+    steps:
+      - name: Setup - CMake
+        uses: lukka/get-cmake@latest
+
+      - name: Setup - Qt
+        uses: jurplel/install-qt-action@v3
+        with:
+          cache: 'true'
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          export CC=clang
+          export CXX=clang++
+          cmake -S . -G Ninja -B build -D ENABLE_ALL=ON -D CMAKE_BUILD_TYPE=Release -DBRLCAD_ENABLE_QT=ON -D BRLCAD_ENABLE_X11=OFF
+
+      - name: Build
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cd build && ninja -j1 && ninja -j1 package
+          #cmake --build build --config Release --target check
+          #cmake --build build --config Release --target package
+
+        # For the moment the space demands are too extreme to enable this
+        # output for every compile test, but leave the enabling logic present
+        # in commented out form so it can be enabled as needed.
+#     - name: Upload Package
+#       uses: actions/upload-artifact@v2
+#       with:
+#         name: BRLCAD_OSX
+#         path: ${{ github.workspace }}/build/BRL-CAD*gz
+
+  # A full distcheck is too expensive for the runners, but we can run the
+  # repository integrity check and make sure we can build source archives.
+  archives:
+    name: Source Archives
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+    steps:
+      - name: Setup - CMake
+        uses: lukka/get-cmake@latest
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cmake -S . -B build_archives -D ENABLE_ALL=ON
+
+      - name: Build
+        run: |
+          export PATH=$ENV{GITHUB_WORKSPACE}:$PATH
+          cmake --build build_archives --config Debug --target distcheck-source_archives
+

.github/workflows/distcheck.yml

@@ -1,637 +0,0 @@
-# BRL-CAD's primary distcheck target runs too long and does too much work to
-# be suitable as a CI target, even occasionally.  To achieve essentially the
-# same result, we define individual jobs for each distcheck sub-target and
-# distribute them across five serial queues.  To avoid the target list going
-# stale, this header is followed by jobs generated from the CMake logic.
-
-name: Distcheck
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '30 3 * * 5'
-
-jobs:
-  bext:
-    name: Prepare bext
-    runs-on: ubuntu-24.04
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxcb-xinput-dev libxcb-xrm-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-  distcheck-default_build_type:
-    name: distcheck-default_build_type
-    runs-on: ubuntu-24.04
-    needs: [bext]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-default_build_type
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-default_build_type -G Ninja -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-default_build_type --target distcheck-default_build_type
-      - name: Log
-        if: always()
-        run: cat build_distcheck-default_build_type/distcheck-default_build_type.log
-
-  distcheck-debug:
-    name: distcheck-debug
-    runs-on: ubuntu-24.04
-    needs: [bext]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-debug
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-debug -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-debug --config Debug --target distcheck-debug
-      - name: Log
-        if: always()
-        run: cat build_distcheck-debug/distcheck-debug.log
-
-  distcheck-release:
-    name: distcheck-release
-    runs-on: ubuntu-24.04
-    needs: [bext]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-release
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-release -G Ninja -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-release --config Release --target distcheck-release
-      - name: Log
-        if: always()
-        run: cat build_distcheck-release/distcheck-release.log
-
-  distcheck-no_unity_debug:
-    name: distcheck-no_unity_debug
-    runs-on: ubuntu-24.04
-    needs: [bext]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-no_unity_debug
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-no_unity_debug -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_UNITY_BUILD=OFF
-      - name: Build
-        run: cmake --build build_distcheck-no_unity_debug --config Debug --target distcheck-no_unity_debug
-      - name: Log
-        if: always()
-        run: cat build_distcheck-no_unity_debug/distcheck-no_unity_debug.log
-
-  distcheck-no_unity_release:
-    name: distcheck-no_unity_release
-    runs-on: ubuntu-24.04
-    needs: [bext]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-no_unity_release
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-no_unity_release -G Ninja -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_UNITY_BUILD=OFF
-      - name: Build
-        run: cmake --build build_distcheck-no_unity_release --config Release --target distcheck-no_unity_release
-      - name: Log
-        if: always()
-        run: cat build_distcheck-no_unity_release/distcheck-no_unity_release.log
-
-  distcheck-enableall_debug:
-    name: distcheck-enableall_debug
-    runs-on: ubuntu-24.04
-    needs: [distcheck-default_build_type]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-enableall_debug
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-enableall_debug -G Ninja -DCMAKE_BUILD_TYPE=Debug -DENABLE_ALL=ON -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-enableall_debug --config Debug --target distcheck-enableall_debug
-      - name: Log
-        if: always()
-        run: cat build_distcheck-enableall_debug/distcheck-enableall_debug.log
-
-  distcheck-enableall_release:
-    name: distcheck-enableall_release
-    runs-on: ubuntu-24.04
-    needs: [distcheck-debug]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-enableall_release
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-enableall_release -G Ninja -DCMAKE_BUILD_TYPE=Release -DENABLE_ALL=ON -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-enableall_release --config Release --target distcheck-enableall_release
-      - name: Log
-        if: always()
-        run: cat build_distcheck-enableall_release/distcheck-enableall_release.log
-
-  distcheck-prepared_debug:
-    name: distcheck-prepared_debug
-    runs-on: ubuntu-24.04
-    needs: [distcheck-release]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-prepared_debug
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-prepared_debug -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-prepared_debug --config Debug --target distcheck-prepared_debug
-      - name: Log
-        if: always()
-        run: cat build_distcheck-prepared_debug/distcheck-prepared_debug.log
-
-  distcheck-prepared_release:
-    name: distcheck-prepared_release
-    runs-on: ubuntu-24.04
-    needs: [distcheck-no_unity_debug]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-prepared_release
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-prepared_release -G Ninja -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-prepared_release --config Release --target distcheck-prepared_release
-      - name: Log
-        if: always()
-        run: cat build_distcheck-prepared_release/distcheck-prepared_release.log
-
-  distcheck-no_tcl:
-    name: distcheck-no_tcl
-    runs-on: ubuntu-24.04
-    needs: [distcheck-no_unity_release]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-no_tcl
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-no_tcl -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_TCL=OFF
-      - name: Build
-        run: cmake --build build_distcheck-no_tcl --config Debug --target distcheck-no_tcl
-      - name: Log
-        if: always()
-        run: cat build_distcheck-no_tcl/distcheck-no_tcl.log
-
-  distcheck-no_tk:
-    name: distcheck-no_tk
-    runs-on: ubuntu-24.04
-    needs: [distcheck-enableall_debug]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-no_tk
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-no_tk -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_TK=OFF
-      - name: Build
-        run: cmake --build build_distcheck-no_tk --config Debug --target distcheck-no_tk
-      - name: Log
-        if: always()
-        run: cat build_distcheck-no_tk/distcheck-no_tk.log
-
-  distcheck-no_strict:
-    name: distcheck-no_strict
-    runs-on: ubuntu-24.04
-    needs: [distcheck-enableall_release]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-no_strict
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-no_strict -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_STRICT=OFF
-      - name: Build
-        run: cmake --build build_distcheck-no_strict --config Debug --target distcheck-no_strict
-      - name: Log
-        if: always()
-        run: cat build_distcheck-no_strict/distcheck-no_strict.log
-
-  distcheck-no_object:
-    name: distcheck-no_object
-    runs-on: ubuntu-24.04
-    needs: [distcheck-prepared_debug]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-no_object
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-no_object -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DUSE_OBJECT_LIBS=OFF
-      - name: Build
-        run: cmake --build build_distcheck-no_object --config Debug --target distcheck-no_object
-      - name: Log
-        if: always()
-        run: cat build_distcheck-no_object/distcheck-no_object.log
-
-  distcheck-odd_pathnames:
-    name: distcheck-odd_pathnames
-    runs-on: ubuntu-24.04
-    needs: [distcheck-prepared_release]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-odd_pathnames
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-odd_pathnames -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-odd_pathnames --config Debug --target distcheck-odd_pathnames
-      - name: Log
-        if: always()
-        run: cat build_distcheck-odd_pathnames/distcheck-odd_pathnames.log
-
-  distcheck-in_src_dir:
-    name: distcheck-in_src_dir
-    runs-on: ubuntu-24.04
-    needs: [distcheck-no_tcl]
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          sudo apt-get install astyle re2c
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev libgl-dev libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-      - name: Directory setup
-        run: cmake -E make_directory build_distcheck-in_src_dir
-      - name: Configure
-        run: cmake -S brlcad -B build_distcheck-in_src_dir -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-      - name: Build
-        run: cmake --build build_distcheck-in_src_dir --config Debug --target distcheck-in_src_dir
-      - name: Log
-        if: always()
-        run: cat build_distcheck-in_src_dir/distcheck-in_src_dir.log

.github/workflows/linux_interactive.yml

@@ -1,85 +0,0 @@
-# The purpose of this particular test definition is to support on-demand
-# interactive command shells.  We sometimes see problems that occur only in the
-# Github Runner environments, and in order to explore what is happening we need
-# an interactive prompt (the alternative is hours-per-cycle submit and test
-# loops, which doesn't scale at all.)
-#
-# Unlike the other BRL-CAD tests, this one is started manually from the Github
-# website.  For more information see https://mxschmitt.github.io/action-tmate/
-#
-# The "recommended" way to use this action is for the dev to make a fork of
-# the repository, alter the configure and/or build logic below for their
-# particular use case (the example below is a libged-only build used to zero
-# in on a specific libged behavior) before running.
-
-name: BRL-CAD Linux Interactive Debugging
-
-on:
-  workflow_dispatch:
-    inputs:
-      debug_enabled:
-        type: boolean
-        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
-        required: false
-        default: false
-
-jobs:
-
-  linux:
-    name: Ubuntu Latest GCC
-    runs-on: ubuntu-latest
-    steps:
-
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Setup - System
-        env:
-          DEBIAN_FRONTEND: noninteractive
-        run: |
-          sudo apt-get update
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c xsltproc libxml2-utils liblief-dev
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Cleanup (we want to avoid wasting disk space)
-          sudo apt-get clean
-
-      - name: Setup - System Qt Build Requirements
-        env:
-          DEBIAN_FRONTEND: noninteractive
-        run: |
-          sudo apt-get update
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev
-          sudo apt-get clean
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Build Directory setup
-        run: |
-          cmake -E make_directory ./build_linux
-
-      - name: Configure
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake -S . -G Ninja -B build_linux -DBRLCAD_EXT_PARALLEL=1 -DBRLCAD_COMPONENTS=libged -DBRLCAD_EXTRADOCS=OFF
-
-      - name: Build
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake --build build_linux --config Release --target check
-
-      - name: Debugging - tmate session
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
-        uses: mxschmitt/action-tmate@v3
-        with:
-          limit-access-to-actor: true
-

.github/workflows/push.yml

@@ -1,449 +0,0 @@
-# This file defines Continuous Integration (CI) tests for BRL-CAD using the
-# Github Actions framework that are executed each time a commit is pushed.
-# Currently it defines configurations for Windows, Linux and OSX.
-#
-# For more information about available platforms for testing, see:
-#
-# https://docs.github.com/en/free-pro-team@latest/actions/reference/specifications-for-github-hosted-runners
-#
-# The general rule when building in CI is to go more verbose in output settings
-# rather than less, since iterative debugging isn't practical.  We also want to
-# avoid parallel building - while that will sometimes catch dependency issues,
-# it also makes the outputs far harder to interpret when there is a problem.
-# Better to do parallel build debugging in an environment were more interactive
-# and iterative debugging is available while preserving the readability of the
-# CI outputs for other issues.
-
-name: Per-push
-
-on:
-  push:
-
-jobs:
-
-  linux:
-    name: Ubuntu GCC
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: true
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: github.event_name == 'push'
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      # Install system dependencies
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c xsltproc libxml2-utils
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxcb-xinput-dev libxcb-xrm-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-      - name: Directory setup
-        run: |
-          cmake -E make_directory ./build_linux
-          cmake -E make_directory $HOME/.cache
-          cmake -E make_directory $HOME/.cache/BRL-CAD
-
-      - name: Configure
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake -S brlcad -B build_linux -G Ninja -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build
-        id: build_parallel
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake --build build_linux --config Release --target check -j2
-          cmake --build build_linux --config Release --target package -j2
-        continue-on-error: true
-
-      - name: Build (serial for diagnostics)
-        if: steps.build_parallel.outcome == 'failure'
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake --build build_linux --config Release --target check
-          cmake --build build_linux --config Release --target package
-
-  # A full distcheck is too expensive for the runners, but we can run the
-  # repository integrity check and make sure we can build source archives.
-  archives:
-    name: Source Archives
-    runs-on: ubuntu-24.04
-    needs: [linux]
-    strategy:
-      fail-fast: true
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: github.event_name == 'push'
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      # Install system dependencies - we do the full setup here, even though
-      # source archives isn't intended to build the main BRL-CAD, in case
-      # this check is the one where the bext dependency cache check gets a miss.
-      # In that case, this check will have to build bext to proceed - and it will
-      # need the bext environment set up to do so.
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c xsltproc libxml2-utils
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxcb-xinput-dev libxcb-xrm-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-      - name: Build
-        run: |
-          cmake -E make_directory build_archives
-          cmake -S brlcad -B build_archives -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_PARALLEL=1 -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output
-          cmake --build build_archives --config Release --target distcheck-source_archives
-
-  # A full bext build every time we push is too much, but we can exercise the
-  # basic bext mechanisms and also the BRLCAD_COMPONENTS subbuild at the same
-  # time if we do a local bext build of *just* the libbg subset of BRL-CAD.  If
-  # the COMPONENTS mechanism works as it should it won't trigger a full bext
-  # build, and we'll only be compiling what libbg needs.
-  componentbext:
-    name: BRLCAD_COMPONENTS
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: true
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: github.event_name == 'push'
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      # Install system dependencies - we do the full setup here, even though
-      # source archives isn't intended to build the main BRL-CAD, in case
-      # this check is the one where the bext dependency cache check gets a miss.
-      # In that case, this check will have to build bext to proceed - and it will
-      # need the bext environment set up to do so.
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c xsltproc libxml2-utils
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxcb-xinput-dev libxcb-xrm-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Directory setup
-        run: |
-          cmake -E make_directory build_components
-          cmake -E make_directory $HOME/.cache
-          cmake -E make_directory $HOME/.cache/BRL-CAD
-
-      - name: Build
-        run: |
-          cmake -S brlcad -B build_components -DCMAKE_BUILD_TYPE=Release -DBRLCAD_COMPONENTS=libbg
-          cmake --build build_components --config Release
-
-  windows:
-    name: MSVC - Ninja
-    runs-on: windows-2025
-    strategy:
-      fail-fast: true
-    if: github.event_name == 'push'
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v3
-
-      - name: Add cl.exe to PATH
-        uses: ilammy/msvc-dev-cmd@v1
-
-      - name: Add github workspace to path
-        shell: pwsh
-        run: Add-Content -Path $env:GITHUB_PATH -Value $env:GITHUB_WORKSPACE
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: windows-2025-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-      - name: Build Directory setup
-        run: cmake -E make_directory ./build_winninja
-
-      - name: Configure
-        shell: powershell
-        run: |
-          cmake -S brlcad -B build_winninja -G Ninja -DCMAKE_C_COMPILER="cl.exe" -DCMAKE_CXX_COMPILER="cl.exe" -DBRLCAD_EXT_DIR=${{ runner.temp }}\bext_output -DCMAKE_BUILD_TYPE=Release -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build
-        id: build_parallel
-        shell: powershell
-        run: |
-          ninja
-        working-directory: ${{ github.workspace }}/build_winninja
-        continue-on-error: true
-
-      - name: Build (serial for diagnostics)
-        if: steps.build_parallel.outcome == 'failure'
-        shell: powershell
-        run: |
-          ninja -j1 -v
-        working-directory: ${{ github.workspace }}/build_winninja
-
-      - name: Check
-        shell: powershell
-        run: |
-          ninja check -v
-        working-directory: ${{ github.workspace }}/build_winninja
-
-      - name: Package
-        shell: powershell
-        run: |
-          ninja package
-        working-directory: ${{ github.workspace }}/build_winninja
-
-  windows_std_tools:
-    name: MSVC - Standard Tools
-    needs: [windows]
-    runs-on: windows-2025
-    strategy:
-      fail-fast: true
-    if: github.event_name == 'push'
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v3
-
-      - name: Add cl.exe to PATH
-        uses: ilammy/msvc-dev-cmd@v1
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: windows-2025-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-      - name: Build Directory setup
-        run: |
-          cmake -E make_directory ./build_winstd
-
-      - name: MSVC and Ninja diagnostics
-        shell: cmd
-        run: |
-          where cmake
-          where ninja
-          where cl.exe
-          where msbuild
-          cmake --version
-          cl.exe
-          set INCLUDE
-          set LIB
-          set LIBPATH
-
-      - name: Configure
-        shell: cmd
-        run: |
-          cmake -S brlcad -B build_winstd -DBRLCAD_EXT_PARALLEL=1 -DBRLCAD_BUNDLED_LIBS=Bundled -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_DIR=%RUNNER_TEMP%\bext_output -DBRLCAD_ENABLE_QT=ON -DBRLCAD_CONFIG_PROBE_DIAGNOSTICS=ON -DBRLCAD_PROBE_SNAPSHOT_FILE=%GITHUB_WORKSPACE%\build_winstd\parallel-probes.txt
-
-      - name: Configure probe diagnostics
-        if: always()
-        shell: pwsh
-        run: |
-          $build = Join-Path $env:GITHUB_WORKSPACE 'build_winstd'
-          $diagnosticDir = Join-Path $build 'CMakeTmp/probe_diagnostics'
-          if (Test-Path $diagnosticDir) {
-            Get-ChildItem -Path $diagnosticDir -File | Sort-Object Name | ForEach-Object {
-              Write-Host "`n===== $($_.FullName) ====="
-              Get-Content -Path $_.FullName
-            }
-          } else {
-            Write-Host "No parallel-probe diagnostic directory was created."
-          }
-          $cmakeError = Join-Path $build 'CMakeFiles/CMakeError.log'
-          if (Test-Path $cmakeError) {
-            Write-Host "`n===== $cmakeError ====="
-            Get-Content -Path $cmakeError
-          }
-          $cache = Join-Path $build 'CMakeCache.txt'
-          if (Test-Path $cache) {
-            Write-Host "`n===== selected cache entries ====="
-            Select-String -Path $cache -Pattern '^(HAVE_CONIO_H|BRLCAD_PROBE_USE_NINJA|BRLCAD_PROBE_NINJA_EXE|BRLCAD_PROBE_VCVARS|BRLCAD_PROBE_VCVARS_ARCH):' | ForEach-Object { $_.Line }
-          }
-
-      - name: Rebuild conio probe verbosely
-        if: always()
-        shell: cmd
-        continue-on-error: true
-        run: |
-          if not exist build_winstd\CMakeTmp\INCLUDE_PROBE_build (
-            echo INCLUDE_PROBE mini-project was not configured.
-            exit /b 0
-          )
-          cmake --build build_winstd\CMakeTmp\INCLUDE_PROBE_build --config Release --target HAVE_CONIO_H --verbose
-
-      - name: Build
-        id: build_parallel
-        shell: cmd
-        run: |
-          cmake --build build_winstd --config Release -j2
-        continue-on-error: true
-
-      - name: Build (serial for diagnostics)
-        if: steps.build_parallel.outcome == 'failure'
-        shell: cmd
-        run: |
-          cmake --build build_winstd --config Release --target mged
-
-      - name: Check
-        shell: cmd
-        run: |
-          cmake --build build_winstd --config Release --target check -j2
-
-      - name: Package
-        shell: cmd
-        run: |
-          cmake --build build_winstd --config Release --target package -j2
-
-  osx:
-    name: macOS Clang
-    needs: [linux]
-    runs-on: macos-15
-    strategy:
-      fail-fast: true
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Install Xquartz
-        run: |
-          brew install xquartz --cask
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: macos-15-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-      - name: Build Directory setup
-        run: |
-          cmake -E make_directory build_osx
-          cmake -E make_directory $HOME/.cache
-          cmake -E make_directory $HOME/.cache/BRL-CAD
-
-      - name: Configure
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          export CC=clang
-          export CXX=clang++
-          cmake -S brlcad -B build_osx -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build
-        id: build_parallel
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          make -j2
-        working-directory: ${{ github.workspace }}/build_osx
-        continue-on-error: true
-
-      - name: Build (serial for diagnostics)
-        if: steps.build_parallel.outcome == 'failure'
-        run: |
-          make
-        working-directory: ${{ github.workspace }}/build_osx
-
-      - name: Check
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          make check
-        working-directory: ${{ github.workspace }}/build_osx
-
-      - name: Package
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          make package
-        working-directory: ${{ github.workspace }}/build_osx

.github/workflows/scheduled.yml

@@ -1,400 +0,0 @@
-# This file defines Continuous Integration (CI) tests for BRL-CAD using the
-# Github Actions framework.  Currently it defines configurations for Windows,
-# Linux and OSX.  These tests are run on a fixed schedule, rather than per
-# push, and will typically take longer to run.
-#
-# Tests here are intended to test more expensive integrations and longer
-# builds than the ones targeted at per-commit feedback.  The tradeoff is
-# that a failure in these tests might be cause by any commit within a
-# 24 hour block of time, so the developer will need to track down the
-# specifics themselves.
-
-name: Scheduled
-
-on:
-  schedule:
-    - cron: '0 3 * * *' # daily at 03:00 UTC
-  workflow_dispatch:
-
-jobs:
-
-  linux_bext:
-    name: Linux - BRL-CAD bext build
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: true
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      # Install system dependencies
-      - name: Install apt dependencies
-        run: |
-          sudo apt-get update
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c xsltproc libxml2-utils
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxcb-xinput-dev libxcb-xrm-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Directory setup
-        run: |
-          cmake -E make_directory build_linux
-          cmake -E make_directory $HOME/.cache
-          cmake -E make_directory $HOME/.cache/BRL-CAD
-
-      - name: Configure
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake -S brlcad -B build_linux -G Ninja -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_PARALLEL=1 -DBRLCAD_BEXT_CLEANUP=ON -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build + Check + Package
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake --build build_linux --config Release --target check
-          cmake --build build_linux --config Release --target package
-
-  windows_bext:
-    name: MSVC - Ninja - BRL-CAD bext build
-    needs: [linux_bext]
-    runs-on: windows-latest
-    strategy:
-      fail-fast: true
-    if: ${{ !cancelled() }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v3
-
-      - name: Add cl.exe to PATH
-        uses: ilammy/msvc-dev-cmd@v1
-
-      - name: Add github workspace to path
-        shell: powershell
-        run: Add-Content -Path $env:GITHUB_PATH -Value $env:GITHUB_WORKSPACE
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Build Directory setup
-        run: cmake -E make_directory ./build_winninja
-
-      - name: Configure
-        shell: powershell
-        run: |
-          cmake -S brlcad -B build_winninja -G Ninja -DCMAKE_C_COMPILER="cl.exe" -DCMAKE_CXX_COMPILER="cl.exe" -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_PARALLEL=1 -DBRLCAD_BEXT_CLEANUP=ON -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build
-        shell: powershell
-        run: |
-          ninja -j1 -v
-        working-directory: ${{ github.workspace }}/build_winninja
-
-      - name: Check
-        shell: powershell
-        run: |
-          ninja check -v
-        working-directory: ${{ github.workspace }}/build_winninja
-
-      - name: Package
-        shell: powershell
-        run: |
-          ninja package
-        working-directory: ${{ github.workspace }}/build_winninja
-
-  windows_std_tools_bext:
-    name: MSVC - Standard Tools - BRL-CAD bext build
-    needs: [windows_bext]
-    runs-on: windows-latest
-    strategy:
-      fail-fast: true
-    if: ${{ !cancelled() }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v3
-
-      - name: Add cl.exe to PATH
-        uses: ilammy/msvc-dev-cmd@v1
-
-      - name: Add github workspace to path
-        shell: cmd
-        run: echo %GITHUB_WORKSPACE%>>"%GITHUB_PATH%"
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Build Directory setup
-        run: |
-          cmake -E make_directory ./build_winstd
-
-      - name: Configure
-        shell: cmd
-        run: |
-          where cmake
-          where ninja
-          where cl.exe
-          where msbuild
-          cmake -S brlcad -B build_winstd -DBRLCAD_EXT_PARALLEL=1 -DBRLCAD_BUNDLED_LIBS=Bundled -DCMAKE_BUILD_TYPE=Release -DBRLCAD_BEXT_CLEANUP=ON -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build
-        shell: cmd
-        run: |
-          cmake --build build_winstd --config Release --target mged
-
-      - name: Check
-        shell: cmd
-        run: |
-          cmake --build build_winstd --config Release --target check
-
-      - name: Package
-        shell: cmd
-        run: |
-          cmake --build build_winstd --config Release --target package
-
-  osx_bext:
-    name: macOS - BRL-CAD bext build
-    needs: [linux_bext]
-    runs-on: macos-15
-    strategy:
-      fail-fast: true
-    if: ${{ !cancelled() }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Install Xquartz
-        run: |
-          brew install xquartz --cask
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Build Directory setup
-        run: |
-          cmake -E make_directory build_osx
-          cmake -E make_directory $HOME/.cache
-          cmake -E make_directory $HOME/.cache/BRL-CAD
-
-      - name: Configure
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          export CC=clang
-          export CXX=clang++
-          cmake -S brlcad -B build_osx -DCMAKE_BUILD_TYPE=Release -DBRLCAD_EXT_PARALLEL=1 -DBRLCAD_BEXT_CLEANUP=ON -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build
-        run: |
-          make
-        working-directory: ${{ github.workspace }}/build_osx
-
-      - name: Check
-        run: |
-          make check
-        working-directory: ${{ github.workspace }}/build_osx
-
-      - name: Package
-        run: |
-          make package
-        working-directory: ${{ github.workspace }}/build_osx
-
-  linux_static:
-    name: Clang Static Analyser
-    needs: [linux_bext]
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: true
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-     # Setup hint from https://github.com/darktable-org/rawspeed/blob/develop/.github/workflows/ci-static-analysis.yml
-      - name: Clang Static Analyzer Setup
-        run: |
-          sudo apt-get update
-          sudo apt-get install clang-18 clang-tools-18
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c xsltproc libxml2-utils
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxcb-xinput-dev libxcb-xrm-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev          # Cleanup
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-      - name: Directory setup
-        run: |
-          cmake -E make_directory build_clangstatic
-          cmake -E make_directory $HOME/.cache
-          cmake -E make_directory $HOME/.cache/BRL-CAD
-        working-directory: ${{ github.workspace }}/brlcad
-
-      - name: Run Analyzer
-        env:
-          BRLCAD_EXT_DIR: ${{ runner.temp }}/bext_output
-        run: |
-          export PATH=$GITHUB_WORKSPACE:/usr/share/clang/scan-build-18/bin:/usr/share/clang/scan-build-18/libexec:$PATH
-          cp $GITHUB_WORKSPACE/brlcad/misc/clang-static-analyzer-run.sh .
-          ./clang-static-analyzer-run.sh
-        working-directory: ${{ github.workspace }}/brlcad/build_clangstatic
-
-      - name: Summary
-        if: success() || failure()
-        run: |
-          sudo apt-get install html2text
-          html2text scan-reports-all/*/index.html
-        working-directory: ${{ github.workspace }}/brlcad/build_clangstatic
-
-
-  # See https://app.codecov.io/gh/BRL-CAD/brlcad for analysis results
-  linux_cov:
-    name: LCOV Coverage testing
-    needs: [linux_bext]
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: true
-    env:
-      DEBIAN_FRONTEND: noninteractive
-    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    steps:
-      - name: Setup - CMake
-        uses: lukka/get-cmake@latest
-
-      - name: Setup - System
-        run: |
-          sudo apt-get update
-          # Get the lcov tool and its dependencies
-          sudo apt-get install lcov gdb
-          # Install X/OpenGL dev pkgs
-          sudo apt-get install xserver-xorg-dev libx11-dev libxi-dev libxext-dev libglu1-mesa-dev libfontconfig-dev
-          # Install tools
-          sudo apt-get install astyle re2c xsltproc libxml2-utils
-          # Install dependency dev pkgs
-          sudo apt-get install zlib1g-dev libpng-dev libjpeg-dev libtiff-dev libeigen3-dev libgdal-dev libassimp-dev libopencv-dev tcl-dev tk-dev
-          # Install XCB/OpenGL dev pkgs for Qt - see:
-          # https://wiki.qt.io/Building_Qt_6_from_Git
-          # https://doc.qt.io/qt-6/linux-requirements.html
-          sudo apt-get install libfontconfig1-dev libfreetype6-dev libx11-dev libx11-xcb-dev libxext-dev libxfixes-dev libxi-dev libxrender-dev libxcb1-dev libxcb-cursor-dev libxcb-glx0-dev libxcb-keysyms1-dev libxcb-image0-dev libxcb-shm0-dev libxcb-icccm4-dev libxcb-sync-dev libxcb-xfixes0-dev libxcb-shape0-dev libxcb-randr0-dev libxcb-render-util0-dev libxcb-util-dev libxcb-xinerama0-dev libxcb-xkb-dev libxcb-xinput-dev libxcb-xrm-dev libxkbcommon-dev libxkbcommon-x11-dev
-          sudo apt-get install libgl-dev
-          sudo apt-get install libinput-dev
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          path: brlcad
-
-      - name: Prepare bext dependencies
-        uses: ./brlcad/.github/actions/prepare-bext
-        with:
-          platform-channel: ubuntu-24.04-${{ runner.arch }}-release
-          source-dir: ${{ github.workspace }}/brlcad
-          output-dir: ${{ runner.temp }}/bext_output
-          build-type: Release
-          artifact-token: ${{ secrets.BEXT_ARTIFACT_TOKEN }}
-
-      - name: Directory setup
-        run: |
-          cmake -E make_directory build_lcov
-          cmake -E make_directory $HOME/.cache
-          cmake -E make_directory $HOME/.cache/BRL-CAD
-
-      - name: Configure
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake -S brlcad -B build_lcov -DBRLCAD_ENABLE_COVERAGE=ON -DCMAKE_BUILD_TYPE=Debug -DBRLCAD_EXT_DIR=${{ runner.temp }}/bext_output -DBRLCAD_ENABLE_QT=ON
-
-      - name: Build
-        id: build_parallel
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake --build build_lcov -j2
-        continue-on-error: true
-
-      - name: Build (serial for diagnostics)
-        if: steps.build_parallel.outcome == 'failure'
-        run: |
-          export PATH=$GITHUB_WORKSPACE:$PATH
-          cmake --build build_lcov -j1
-
-      - name: Run Tests
-        id: coverage_tests
-        run: |
-          find . -name '*.gcda' -exec rm {} \;
-          cmake --build . --target check
-        working-directory: ${{ github.workspace }}/build_lcov
-
-      - name: Diagnose failed annotation test
-        if: failure() && steps.coverage_tests.outcome == 'failure'
-        continue-on-error: true
-        run: |
-          set +e
-          ctest -R '^rt_datum_annot_semantics$' -VV
-          cat Testing/Temporary/LastTest.log
-          if command -v gdb >/dev/null 2>&1; then
-            gdb --quiet --batch \
-              -ex 'set pagination off' \
-              -ex run \
-              -ex 'thread apply all bt full' \
-              --args ./src/librt/tests/rt_datum_annot_semantics
-          fi
-        working-directory: ${{ github.workspace }}/build_lcov
-
-      - name: Capture Coverage
-        run: |
-          lcov --capture --directory . --output-file coverage.info
-          lcov -r coverage.info \*\/bext_output\/\* > coverage-2.info
-          lcov -r coverage-2.info \/usr\/\* > coverage_cad.info
-          rm coverage-*.info
-          mv coverage_cad.info ..
-        working-directory: ${{ github.workspace }}/build_lcov
-
-      - name: Upload
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./coverage_cad.info
-

.gitignore

@@ -1,8 +1,8 @@
 # Common build directories used in the source tree
-/build*
-/.build*
-/*_build*
-/*-build*
+/build
+/.build
+/*_build
+/*-build
 /out
 
 # Temporary files
@@ -18,24 +18,8 @@
 .DS_Store
 .DS_Store?
 
-# CMake supports some configuration files to allow users a convenient way to pre-define
-# sets of configuration options:
-# https://cmake.org/cmake/help/latest/manual/cmake-presets.7.html
-/CMakeUserPresets.json
-
-# Visual Studio (note that CMakePresets.json is recommended instead of
-# CMakeSettings.json for Visual Studio going forward)
-# https://learn.microsoft.com/en-us/cpp/build/cmake-presets-vs
-# https://learn.microsoft.com/en-us/cpp/build/customize-cmake-settings
-/.vs
 .vscode
-/CMakeSettings.json
-
-#Qt Creator
-CMakeLists.txt.user
-
-# Misc
 .clang-format
-*__pycache__*
-
-
+CMakeLists.txt.user
+/.vs
+/CMakeSettings.json

AGENTS.md

@@ -1,32 +0,0 @@
-# Code Quality Standards
-
-Write code as a senior engineer would for long-term maintenance. These are non-negotiable defaults, not suggestions to apply when asked.
-
-## Principles
-
-- **DRY.** Extract duplicate logic. Refactor. Once and only once.
-- **Minimize surprises.** Preserve existing style and conventions. Test when you can.
-- **No magic values.** Use named constants, enums, or configuration. Every literal needs justification.
-- **Minimize scope.** Prefer tightest scope that works - local variables, parameters, encapsulation. Broader scope needs justification.
-- **No dead code.** Delete commented-out code, unused variables, unreachable branches. Version control remembers.
-- **Comments explain why.** Document intent, constraints, and non-obvious decisions. Use "what" summaries only for complex or non-obvious algorithms. If routine code needs a comment to explain it, the code should be clearer.
-- **Clean up what you touch.** Improve code you are changing: rename unclear variables, extract functions, simplify conditionals. Do not mix unrelated cleanup with logic changes - separate concerns, separate commits.
-- **Handle errors deliberately.** Whether failing loudly or quietly, make it an intentional choice. No accidental swallowing.
-- **YAGNI.** Do not add speculative abstractions, unused parameters, or unplanned extension points. Build what is needed now. Refactor when requirements actually change.
-- **Perfection is when there is nothing left to take away.** Prefer reduction over addition, simpler is better. Too clever to debug easily is too clever.
-
-## Before Finishing
-
-Review your changes for code smells, duplicated logic, hardcoded values, overly broad scope, unclear names, missing error handling, unnecessary complexity, etc. Fix issues in the same pass - do not defer cleanup.
-
-## Git
-
-Never commit without permission (ask every time).  Never push to remote.  Never use `codex`, `chatgpt`, `openai`, `gemini`, `antigravity`, `copilot`, `claude`, `llm`, `ai`, or similar terms in branch names, tag names, commits, PRs, comments, and other metadata.  Do not add generated-by notices or otherwise indicate authorship unless user explicitly requests.  Do not include specific machine information - full file system paths, machine names, IP addresses, or other identifiable information in commit messages, code, comments or documentation.
-
-## Repository Coding Conventions
-
-The HACKING file in the root of the source tree defines coding conventions specific to BRL-CAD, including versions of common functions that are used in our code base instead of raw standard functions.  Review this file before writing code so your changes and additions adhere to BRL-CAD standards.
-
-BRL-CAD code should typically use our ZERO and EQUAL macros rather than raw floating-point equality comparisons to avoid Werror=float-equal compilation failures on expressions such as a == 0.0 (should be ZERO(a)) or b != c (should be !EQUAL(b, c)).
-
-When completing a code change (not for intermediate iterations, but when preparing to hand back a finalized change) use our regress-repository and regress-licenses build targets to check that the result satisfies our internal checkers.

AUTHORS

@@ -366,10 +366,6 @@ McDonald, Rob
 2013 November
 Open Source
 
-Roberts, Mitchell
-2014 July
-U.S. Army Research Laboratory
-
 Tannous, Marc
 2014 December
 Open Source (GCI)
@@ -393,11 +389,6 @@ Sieu, Jeff
 2017 December
 Open Source (GCI)
 
-Baker, Josh
-nicknames joshbaker22
-2023 August
-U.S. Army Research Laboratory
-
 
 CODE CONTRIBUTIONS
 ------------------
@@ -608,11 +599,6 @@ nicknames Alexandrus
 2010 July
 Open Source
 
-Pal, Csanyi
-nicknames csanyi_pal
-2010 July
-Open Source
-
 Hinesley, Brandon
 nicknames bhinesley
 2011 March
@@ -908,7 +894,7 @@ nicknames chetanshinde911
 Open Source (GSoC)
 
 Haydar, Ali
-nicknames lois221 lgoogl696 LouisGoogl
+nicknames lois221
 2019 May
 Open Source (GSoC)
 
@@ -1045,60 +1031,6 @@ Tao, Michael
 2023 February
 Texas A&M University
 
-Dhawan, Rohan
-2023 October
-Texas A&M University
-
-Feng, Feng
-2023 October
-Texas A&M University
-
-Hollenbeck, Sam
-nicknames samhollenbeck
-2023 October
-Texas A&M University
-
-Pham, Timothy
-nicknames YUMGUY
-2023 October
-Texas A&M University
-
-Zou, Yida
-nicknames YidaZou
-2023 October
-Texas A&M University
-
-Reynolds, Timothy
-nicknames TheZouave007
-2024 February
-Texas A&M University
-
-Delbarre, Gaultier
-nicknames CoralRocker
-2024 March
-Texas A&M University
-
-Beckett, Ian
-2024 March
-Texas A&M University
-
-McLean, Connor
-2024 March
-Texas A&M University
-
-Reel, Samuel (Sammy)
-2024 March
-Texas A&M University
-
-Rupesh
-nicknames rupes, rupeshca007
-2026 March
-Open Source
-
-nicknames laithaldaeef
-2026 March
-Open Source
-
 
 SPECIAL THANKS
 --------------
@@ -1421,10 +1353,6 @@ nicknames r-ricci
 2022 January
 Open Source
 
-nicknames Meghna45-code
-2026 July
-Open Source
-
 
 CORPORATE AND ORGANIZATION SUPPORT
 ----------------------------------

BUGS

@@ -15,19 +15,6 @@ on-going issues.
 Recent Bugs
 -----------
 
-* fbserv as well as -F option handling (e.g., -F0 or -F/dev/wgls) that
-  is supported across myriad other tools appears to be broken on
-  Windows in a git bash shell (problem is not seen in Command Prompt.)
-  Something is concatenating EXEPATH and/or fbserv silently fails with
-  return codes (e.g., when not specifying -F, only giving the port.)
-
-* recursive bu_parallel() failure, tbd whether cpp11 or pthread impl,
-  likely because IDs are exceeding MAX_PSW, causing mayhem and chaos.
-
-* rtcheck_handler_cleanup() throws 'invalid handle specified' on Windows
-  in closing of STDOUT (see FIXME comment). Does not affect normal running,
-  but a debug build complains.
-
 * very peculiar non-linear memory issue in rt when allocating a large
   flat hierarchy of objects.  I have three combs, each with 10k
   members unioned. Each member is an rcc.  Rendering with just one
@@ -38,13 +25,6 @@ Recent Bugs
   at allocation stack, rt_ct_get() appears to be allocating 10MB
   chunks.
 
-  [HARD] Superlinear growth (3 combs -> 18GB) points at an
-  integer/overflow interaction deep in the space-partitioning cut
-  allocator (rt_ct_get 10MB chunks), intertwined with bu memory.
-  Painful to isolate and validate at scale.
-  [FAN-OUT: poor -- one focused investigator with an allocator/profiler
-  trace; not parallelizable.]
-
 * rt from mged is not outputting overlap log messages or rt summary.
   Stops printing after opendb line. (Observed on Mac)
 
@@ -52,12 +32,20 @@ Recent Bugs
   Backtrace indicates write buffer is full, likely because no output
   is going to terminal. (Observed on Mac)
 
+* gcv on a glTF file (at least a binary .glb) crashes hard with a NULL
+  pointer bomb (workaround: gltf-g succeeds albeit incomplete
+  conversion).  Takes out the entire Terminal app on Mac for some
+  reason (consistently).
+
 * Running"mged -c test.g" exits automatically on default prompt:
   ...
   Create new database (y|n)[n]? 
   Warning: no database is currently open!
   morrison@Miniagua .build %
 
+* TGC tess fails when we have a near-zero c axis and a larger d
+  axis, or vice versa.
+
 * MGED crashes trying to open the repository file
   doc/docbook/resources/other/standard/xsl/images/important.tif
   It is mis-identified as a v4 .g file due to the file header's
@@ -70,6 +58,10 @@ Recent Bugs
 * running pkgIndex and/or mkIndex during build appears to be randomly
   crashing on Mac using bundled libs
 
+* garbage_collect -c wipes out custom attributes on _GLOBAL
+  > attr set _GLOBAL foo bar
+  > garbage_collect -c
+
 * Visual error when drawing using -S -m1 of a region with the same solid
   subtracted and then unioned.
 
@@ -78,6 +70,20 @@ Recent Bugs
   > e -S -m1 boxes.r
   box1 is not drawn
 
+* When run inside mged, invalid syntax reported on "gqa -p prefix"
+  despite it being documented as the correct form (and working outside
+  mged).  specifying gqa -pprefix appears to be workaround, though
+  unintuitive.  specifying gqa -p"" annoyingly outputs ""exp_air.plot3
+  with quotes embedded in the name.
+
+* rtweight reports nan,nan,nan centroid when density is 0
+
+* rtweight/gqa volumes seem wrong with simple sphere test case, with
+  values consistently and quickly converging less than the actual
+  volume regardless of the grid size.
+
+* gqa manpage has the wrong indentation on the options write-up.
+
 * raytracing a revolved sketch seems to work fine, but rtarea and gqa
   seem to be crashing on that same revolve.  curiously, the brep
   revolve from the csgbrep proc-db has the same failure as well as the
@@ -88,12 +94,20 @@ Recent Bugs
 * running archer "" at least on windows results in a file type dialog
   and errors with "can't read "_conv_log": no such variable
 
+* opening a database in archer with the same name as a command doesn't
+  work.
+
 * in mged, running the 'attach' command (confirmed issues with X and
   ogl), closing the window, and then issuing a 'draw' results in mged
   crashing.
 
 * killtree / crashes
 
+* killtree reports spurious db_lookup failures saying object does not
+  exist as it previously deleted it.  should keep track of what it
+  deletes to not output spuriously, or (better) delete transactionally
+  so it only attempts to lookup and delete once per object.
+
 * object names with a / or \ in them make ls or underlying directory
   parsing logic display them incorrectly.
 
@@ -109,9 +123,18 @@ Recent Bugs
 * fbclear -c appears to hang indefinitely inside pkg_bwaitfor,
   possible protocol mismatch or capability removed/changed in fbserv.
 
+* dbupgrade -r produces an invalid rhc with the default v5 rhc produced
+  by MGED with  "make rhc rhc"
+
 * apparently all four BRL-CAD Tutorial Series volumes are missing from
   our bibliography...
 
+* Tessellating an ETO with a normal tolerance results in stack
+  smashing due to bad logic in recursive algorithm: set norm 2;
+  facetize my.eto my.bot;. Observed infinite recursion in both
+  make_ellipse4() in eto.c and (after adding max recursion test) in
+  paint_face() in manif.c:190
+
 * mater -d information stored in the .g file doesn't survive a
   garbage collection operation.
 
@@ -127,10 +150,36 @@ Recent Bugs
   still being displayed.  this causes 'rt' to fly into an infinite
   loop, presumably trying to increment rays from the eye position.
 
+* icv dpix support is not cross-platform (it writes out native, reads
+  in assuming same encoding).  regression tests fail on big endian.
+
 * creating an object with a slashes in the name (e.g., cp foo foo/R)
   results in an object that cannot be deleted/renamed.  bad behavior
   presumably extends to any name with path separators.
 
+* mirror command rejects brep solids and turns faces inside-out when
+  mirroring a comb with brep solids below it.
+
+* rtsil command works if do what usage says and redirect output to
+  file, but mentions .pix when data is actually .bw; and using the -o
+  option results in a black image.  it is also inconsistent, writing a
+  black silhouette on a white background, instead of black on white
+  and missing background color options.
+
+* make sph sph
+  clone -i 1 -t 1000 0 0 -n 100 sph
+  kill sph
+  g line sph*
+  clone -i 1 -t 0 1000 0 -n 100 line
+  kill line
+  g square line*
+  clone -i 1 -t 0 0 1000 -n 100 square
+  ... never returns ...
+
+  This should be merely 1M spheres, but something chokes.  Could be
+  somewhere in the Tk layer.  Maybe somewhere in the db layer.  Maybe
+  something is corrupted by clone when it
+
 * If we draw any form, then trace it using rt, then change of database
   (by clicking file>open and selecting another database), badness
   ensues.  One report has quitting the rt window causing a segfault.
@@ -144,12 +193,31 @@ Recent Bugs
   in ann3.s annot 0 0 0 1 10 10 3 1
   # using numbers for a label results in no label
 
+* make eto eto
+  tol norm 1
+  facetize eto.bot eto
+  [crashes due to excessive recursion]
+
+* crash in rt_bot_xform() due to a bot being marked as having face
+  normals, but didn't.  bot probably written wrong via conversion
+  to/from obj or asc.  found importing teapot.
+
 * rtedge with perspective is wrong.  it fills in nearly entire faces,
   vertically in particular.  it's worse on small sized renders, and
   gets better the larger the render size (indicating there's some
   neighbor distance coming into play that is not affected by
   max_dist).  eoes not happen in non-perspective ray-traces.
 
+* a character is (still) sometimes captured by the cursor box.  steps
+  to reproduce:
+    1) write a word on the mged command prompt ("e.g. hello")
+    2) select the word to end of line with mouse
+    3) paste the word (e.g., middle mouse) and press enter
+    4) type "hello" again and press enter
+
+  you should now see an "o" in the yellow cursor box.  sometimes
+  you'll see the "o" after step 3.  running "clear" resets the cursor.
+
 * get_regions tcl command doesn't respond well to situations where
   child object names in combs have dashes (the "-" character) in
   names.  It tries to interpret the dash as an argument delimiter.
@@ -171,6 +239,13 @@ Recent Bugs
 * Recursive submodel predictably goes infinite, need stack-based
   db_walk_tree(): mged> in submodel submodel submodel grid test.g
 
+* running rt -s20 -F file.pix ... does not result in an 20x20 image
+  being written out.  it ends up being 512x512.
+
+* running rt -C255/0/0 -o file.pix ... does not result in the
+  background color getting used.  It does work with -F file.pix, going
+  through libfb instead of libicv.
+
 * ogl display manager and framebuffer are creating windows with
   transparent backgrounds (the glClear color is not being drawn) on
   Linux.  Presumably a driver-related issue, alpha channel, or expose
@@ -179,6 +254,9 @@ Recent Bugs
   private memory -- looks like private memory is not initialized
   (observed on Mac 10.6, Windows, and Ubuntu Linux using 7.26).
 
+* pixdiff on Windows is reporting no differences with a pair of files
+  that pixcmp can see differences in.
+
 * fblabel seems quite busted, at least talking to a /dev/X fbserv, in
   that it only draws the first character and eventually displays
   rem_read() failures when run in -d debug mode.
@@ -187,6 +265,12 @@ Recent Bugs
   after doing an overlay render.  it does draw, though, as confirmed
   by a forced fb-fb refresh.
 
+* pixborder doesn't account for an edge case where the right edge of
+  an image is expected to be colored (except for one pixel on the top
+  edge).  Example:
+
+  pixborder -b "255 0 0" -t "255 255 255" < pix/moss.pix | pix-fb
+
 * typing 'comb -f -r assembly_name' shuts down mged with the error:
   ERROR: bad pointer 0000000000B4CA50: s/b bu_external(x768dbbd0), was bu_vls(x89333bbb), file ..\..\..\brlcad_src\src\libbu\parse.c, line 2443"
   And on the mged command line:
@@ -200,6 +284,11 @@ Recent Bugs
 * wgl framebuffer is not lingering on windows (regardless of using
   wgll or default) when it should
 
+* calling "attr set obj key value" should always result in key getting
+  set to value, no matter what, as it is the lowest-level attribute
+  management interface and what the command (correctly) documents.
+  example demonstrated to not work was: attr set obj rgb 123/123/123
+
 * report of LIBBU not working when accessed by a multithreaded
   application on Windows.  reportedly due to some problem with the
   debug memory queue.
@@ -237,16 +326,18 @@ Recent Bugs
 
   rm -f terra.pix && valgrind bin/rt -o terra.pix -P1 -H3 -s1024 share/brlcad/7.21.0/db/terra.g all.g
 
-  [HARD] valgrind-confirmed 8-byte corruption after a build_spec_table()
-  realloc in find_spec_wgt(), where "bookkeeping seems okay" -- i.e.,
-  root cause is non-obvious.  Classic hard-to-pin data race.
-  [FAN-OUT: poor -- a single heisenbug needing one careful
-  investigator, not parallel coverage.]
-
 * mged 'joint' hold command isn't working. looks like the fp_names
   book-keeping is fuxored or the db_lookup is returning NULL (or isn't
   yet performed).
 
+* src/librt/primitives/bot/g_bot_include.c:rt_bot_bbox() routine isn't
+  calculating the bbox correctly
+
+* 'exists' command documentation claims more than has been implemented
+
+* rtxray crashes if you specify a -o *.bw output file due to
+  assumptions in the rt front-end that all output files are .pix
+
 * encountered a crash during rtarea on a (default) facetized version
   of the hyp from the proc-db csgbrep tool.
 
@@ -261,6 +352,9 @@ Recent Bugs
 * torus with a near zero inner diameter results in zero-length edges
   during tessellation.
 
+* bu_log() with a width specifier does not align like printf().
+  Example: bu_log("%24s", str);
+
 * report that "keep" sometimes results in a .g file with unknown units;
   dbconcat also is reported to set the units to unknown if concatting
   a file with unknown units.
@@ -288,6 +382,10 @@ Recent Bugs
 
 * rt -i -s4096 -H16 -F/dev/null boolean-ops.g all
 
+* asc2g of a .asc file containing the first line as a "#" comment
+  results in a bu_malloc(0) bomb.  comment lines should be valid in
+  .asc files.
+
 * compilation reportedly fails when building Tcl if the path to the
   source directory includes a space.
 
@@ -341,6 +439,9 @@ Recent Bugs
   tclscripts/mged/tclIndex for examples:
   https://sourceforge.net/tracker/?func=detail&atid=640802&aid=2923199&group_id=105292
 
+* vdeck truncates the region names in the 'regions' file, probably
+  wrong bu_strlcpy() length.
+
 * hyp tessellation routine creates bot that does not raytrace
 
 * hyp used in a boolean with other objects (even unions) does not
@@ -412,6 +513,11 @@ Recent Bugs
 * running 'keep' on too many objects (hundreds is causing a usage
   statement (and not doing the keep)
 
+* rtwizard won't display a line overlay if you line object is obscured
+  by another.  Example being to display a vehicle as ghost, crew as
+  solid, and crew as line.  confirmed even when using the other line
+  occlusion settings.
+
 * fbserv is receiving image data very slowly if the framebuffer is a
   remote X24 interface.  could reproduce on mac with the following:
 
@@ -471,6 +577,9 @@ Recent Bugs
   ubuntu linux.  key events go to the command window even with the
   graphics window has focus.
 
+* MGED File->Preferences->Fonts results in error "named font "button
+  _font" doesn't exist on Linux.
+
 * mged tab-completion doesn't work if the object names have spaces
 
 * Open dialog in MGED seems rather busted for scrolling and selection
@@ -508,6 +617,16 @@ Recent Bugs
 * dsp primitive is going into what seems to be an unbounded memory
   allocation loop during prep, inside dsp_layers().
 
+* crashes during photonmap raytrace of m35 where right node is invalid
+  rt -o test.pix -V 1.0 -P4 -J0 -l7 -A0 ~/Desktop/m35.g all.g box.r sph.r
+
+* libfb cannot utilize standard output/error "device" files without
+  path trickery.  it recognizes the /dev/ prefix and presumes it's a
+  libfb device instead of a filesystem device.
+
+   OK: rt -F/./dev/stdout
+  BAD: rt -F/dev/stdout
+
 * libfb cannot open a file descriptor when piping/redirecting output.
 
    OK: rt -F/./dev/stdout moss.g all.g
@@ -530,6 +649,8 @@ Recent Bugs
 * triangulation of some pipe in toyjeep.g fails (rather reliably) on
   some given bend.  fails in nmg_triangulate model().
 
+* fbhelp sends some of the output to stdout and some to stderr...
+
 * debugbu 2 immediately reports a bu_vls_free() error.. apparently
   been a problem since 4.5 days.  this occurs because
   bu_memdebug_add() is not called unless memory checking is enabled
@@ -546,6 +667,9 @@ Recent Bugs
 
 * Create menu.. create "part" boo hiss..
 
+* wavelet isn't working correctly on a simple image decomposition &
+  reconstruction.
+
 * fbed is looking for /usr/lib/vfont/nonie.r.12
 
 * mged doesn't check if html_dir does not exist when searching for
@@ -565,6 +689,11 @@ Recent Bugs
 
 * concave arbs give correct wireframe but do not raytrace correctly.
 
+* rtwizard/rtedge creates incorrect "fuzzy" edge overlay when creating
+  a "Ghost Image with Insert and Lines" that includes a light source
+  and object close to surface (e.g. moss.g; select plane, light, and
+  cone for ghost; select cone for insert and lines.)
+
 * mged's solid illuminate doesn't work when Lighting is turned on
 
 * raytrace of zoomed images (e.g., -s64) doesn't work for if_X24
@@ -590,6 +719,8 @@ Recent Bugs
 * mged primitive editor doesn't accept/apply values to disk for
   certain primitives (e.g. sph)
 
+* photon map cache file doesn't work (seems to crash rt on use)
+
 * enabling perspective mode horks shaded mode, also Z clipping
   shouldn't be required to get the shading.
 
@@ -606,9 +737,35 @@ Recent Bugs
 * sketches extruded with non-square AB vectors results in inner sketch
   components not getting scaled properly.
 
+* rtcheck is ignoring fastgen tagged geometry since no multioverlap
+  handler is set.
+
 * bot-bldxf fails in db_walk_tree(), interface may have changed
 
 
+Older Bugs
+----------
+
+* several manpages are missing or out of date for various tools
+
+* X11 framebuffer often fails to display on certain middle bit depth
+  displays. (e.g. 15 or 16 bit depth)
+
+* mk_lcomb fails on large combinations due to mk_tree_pure() building
+  a left-heavy tree and wdb_put_internal() then recursively performing
+  lookup and put calls.
+
+
+Annoyances
+----------
+
+* matrix edits on objects in mged require you to select a primitive
+  for a coordinate system reference.  this can be counterintuitive and
+  confusing.
+
+* there are frequently modality errors when entering edit mode as
+  control and middle mouse rebind to model edit instead of view edit.
+
 ---
 Bugs should be reported to the bug tracker on the project website at
 http://sourceforge.net/tracker/?atid=640802&group_id=105292

CHANGES.adoc

@@ -1,87 +0,0 @@
-= BRL-CAD Interface Change Policy
-:toc: macro
-
-toc::[]
-
-== Scope
-
-This policy defines how BRL-CAD public interfaces may change. Public
-interfaces include developer APIs, command-line interfaces, graphical
-interfaces, documented commands, installed headers, public macros,
-public types, and other behavior users reasonably rely on.
-
-Renaming an application is not minimally impacting: an application
-name is the primary way users find and run the tool.
-
-Every public interface change must be either minimally impacting or
-formally deprecated.
-
-== Minimally Impacting
-
-A minimally impacting change may be made at any time. A change is
-minimally impacting only when it can be represented by the documented
-rule language in
-link:doc/changes/minimally-impacting.rules[doc/changes/minimally-impacting.rules]
-and emitted by the generated update script.
-
-If the rule language cannot express a change, either extend the rule
-language so the generated script can perform the update, or treat the
-change as formally deprecated.
-
-Minimally impacting path includes:
-
-* recently introduced interfaces that have not yet appeared unchanged
-  in two releases;
-* appreciably broken interfaces that have been unusable for at least
-  two releases and have no secondary utility;
-* elementary mechanical changes such as renames, parameter reordering,
-  parameter removal, defaulted parameter insertion, equivalent
-  interface substitutions, and header moves.
-
-For function argument rewrites, BRL-CAD assumes callers are not
-relying on preprocessor-generated call syntax and are not passing
-nested function calls as arguments to the changed function. That
-assumption keeps generated substitutions deterministic and reviewable.
-
-Rule syntax and generated update-script workflow are documented in
-link:doc/changes/README.adoc[doc/changes/README.adoc]. The generated
-build-tree rendering of minimally impacting changes is
-`doc/changes/minimally-impacting.adoc`.
-
-== Formally Deprecated
-
-Any public interface change that is not minimally impacting must
-follow the formal deprecation process.
-
-During a major release, such as 7.x to 8.x, any public interface may
-change without advance notice. Major version changes imply interface
-incompatibility.
-
-During a minor release, such as 7.44.x to 7.46.x, a public interface
-must be deprecated beforehand with advance notice in at least two
-minor releases and at least 90 days elapsed since the initial release
-announcement.
-
-Public interfaces scheduled for change should be listed in
-link:doc/changes/deprecated.adoc[doc/changes/deprecated.adoc] and
-visibly marked in the source code. Appropriate markings include
-`DEPRECATED` declarations, preprocessor warnings, `@DEPRECATED`
-comments, runtime warnings when they do not disrupt valid usage, and
-documentation updates.
-
-After a deprecation window has completed, removed or significantly
-changed interfaces are listed in
-link:doc/changes/obsoleted.adoc[doc/changes/obsoleted.adoc].
-
-== Examples
-
-Removing `rt_shootray()` after it has been published and documented in
-multiple releases is not minimally impacting unless a generated rule
-can update callers to an equivalent interface. Otherwise, it must be
-listed as deprecated, marked in the headers, announced in releases,
-and only later obsoleted.
-
-Renaming `bu_log()` or adding a defaulted first argument can be
-minimally impacting if the change is listed in
-`minimally-impacting.rules` and the generated update script rewrites
-existing callers.

COPYING

@@ -80,7 +80,10 @@ When referring to BRL-CAD, its source code, documentation, and
 libraries, the reference is not meant to include or imply 3rd party
 source code, libraries, and/or applications unless specifically stated
 otherwise.  No endorsement or claim of authorship is implied to any
-3rd party asset that is included with BRL-CAD.
+3rd party asset that is included with BRL-CAD.  The majority of the
+3rd party source code, libraries, and applications included with
+BRL-CAD are located in the src/other/ directory of the source code
+distribution.
 
 Copyright
 ---------
@@ -98,7 +101,7 @@ arranged.  This includes an implicit assignment of copyright for any
 and all contributions being made.  The following notice should be
 prominent in the BRL-CAD sources:
 
-  Copyright (c) 1984-2026 United States Government as represented by
+  Copyright (c) 1984-2024 United States Government as represented by
   the U.S. Army Research Laboratory.
 
 Contact

HACKING

@@ -376,6 +376,8 @@ details on subdirectories and authorship not covered here.
 	Write database library
   src/mged/
 	Multi-device geometry editor
+  src/other/
+	External frameworks (Tcl/Tk, libpng, zlib, etc.)
   src/proc-db/
 	Procedural geometry tools, create models programmatically
   src/remrt/
@@ -397,17 +399,14 @@ should be POSIX-compliant Bourne Shell Script.  The build system uses
 the CMake build tool.  An initial implementation of a BRL-CAD Geometry
 Server is written in PHP.
 
-With release 7.38, BRL-CAD intends to conform strictly with the
-following ANSI/ISO standards for C and C++ language compilation:
-
-C  : ISO/IEC  9899:2011, i.e. C11
-C++: ISO/IEC 14882:2017, i.e. C++17
-
+With release 7.28, BRL-CAD intends to conform strictly with the 2011
+ANSI/ISO standards for C and C++ language compilation
+(ISO/IEC 9899:2011, i.e. C11 and ISO/IEC 14882:2011, i.e. C++11).
 Support for use of necessary non-standard system facilities is
 handled by build system declarations and preprocessor defines driven
 by build configuration tests.  The working feature set for normal
-development should be widely supported C++17 features and the subset
-of C11 that is also valid (and widely supported) C++17.
+development should be widely supported C++11 features and the subset
+of C11 that is also valid (and widely supported) C++11.
 
 C++ is used as an implementation language within libraries, but there
 are no public C++ APIs in use outside of OpenNURBS.  For new work,
@@ -616,7 +615,7 @@ the end of the file:
  * indent-tabs-mode: t
  * c-file-style: "stroustrup"
  * End:
- * ex: shiftwidth=4 tabstop=8 cino=N-s
+ * ex: shiftwidth=4 tabstop=8
  */
 
 In emacs, the 'indent-region' command (bound to C-M-\ by default)
@@ -868,7 +867,7 @@ respective library being tested (e.g., src/libbu/tests):
 
 Note that changes to publicly documented tools and library APIs must
 adhere to BRL-CAD's change policy.  This means changes to any tests
-may require thoughtful deployment.  See CHANGES.adoc for details.
+may require thoughtful deployment.  See the CHANGES file for details.
 
 These tests are run nightly on BRL-CAD's server to catch problems
 quickly - developers should be aware of the status of BRL-CAD's tests
@@ -918,9 +917,9 @@ PATCH SUBMISSION GUIDELINES
 ---------------------------
 
 To contribute to BRL-CAD, begin by submitting pull requests to the
-GitHub project at https://github.com/BRL-CAD/brlcad.
+Github project at https://github.com/BRL-CAD/brlcad.
 
-For an introduction to the standard GitHub workflow for forking and
+For an introduction to the standard Github workflow for forking and
 submitting pull requests, see:
 
 https://git-scm.com/book/en/v2/GitHub-Contributing-to-a-Project
@@ -933,8 +932,8 @@ particularly important when working with BRL-CAD.  Patches need to be
 based on the latest sources and avoid reverting improvements that have
 been added to the upstream sources since your fork was created.
 
-Although the GitHub pull request based workflow is recommended and
-preferred, if for any reason you cannot use GitHub you may also
+Although the Github pull request based workflow is recommended and
+preferred, if for any reason you cannot use Github you may also
 submit "git format-patch" patches through other channels.  See:
 
 https://git-scm.com/docs/git-format-patch
@@ -955,7 +954,7 @@ BUGS & UNEXPECTED BEHAVIOR
 
 When a bug or unexpected behavior is encountered that cannot be
 quickly fixed, it needs to be documented in our BUGS file or more
-formally reported to the GitHub issues tracker at:
+formally reported to the Github issues tracker at:
 
 https://github.com/BRL-CAD/brlcad/issues
 
@@ -987,7 +986,7 @@ access to be granted:
 
 3) Join the brlcad-devel developer mailing list, introduce yourself.
 
-4) Create a GitHub account, submit at least pull requests that
+4) Create a Github account, submit at least pull requests that
 demonstrate competency with our coding style, apply flawlessly, and
 provide some significant improvement.
 
@@ -1035,10 +1034,10 @@ developers to address issues as they are encountered regardless of who
 introduces the problem.
 
 To assist developers in these efforts,  BRL-CAD utilizes Continuous
-Integration (CI) testing via the GitHub Actions infrastructure to
+Integration (CI) testing via the Github Actions infrastructure to
 monitor code health:  https://github.com/BRL-CAD/brlcad/actions
 Under normal conditions, all developers should strive to keep all
-GitHub Actions tests passing.
+Github Actions tests passing.
 
 3) Contributors making commits to the repository are required to
 uphold the legal conventions and requirements summarized in the
@@ -1258,32 +1257,15 @@ Release steps are as follows:
 #####################################################################
 # 00: Notify developer mailing list of intention to release.
 
-    echo "Release preparations are under way.  Trunk sources merged to the RELEASE branch will be reviewed for sync to STABLE and release tagging.  Please help test by compiling distcheck and running benchmark, mged, and archer." | mail -s "Release preparations commencing" brlcad-devel@lists.sourceforge.net -r "your@subscribed.address"
+    echo "Release preparations are under way.  Trunk sources merged to the RELEASE branch will be reviewed for sync to STABLE and release tagging.  Please help test by compiling distcheck-full and running benchmark, mged, and archer." | mail -s "Release preparations commencing" brlcad-devel@lists.sourceforge.net -r "your@subscribed.address"
 
 #####################################################################
 # 01: Sync main to RELEASE branch.
 
-TODO - we probably need to do a re-look at the RELEASE and STABLE setup.
-With Git and modern workflows, I'm leaning more towards a temporary
-working branch where we shake down for release, then tagging from that
-working branch and merging that back into main once complete.  For
-minor releases we should create a X-XX branch from the X-XX-0 tag, and
-any patch releases on that minor series will be handled in and tagged
-from the branch.  With AI driven change rates, it's unrealistic to
-try and put main back into a state where we can call a tag off of it
-a patch on an older minor.  Needs more thought - should try to hash out
-before the next minor release and update the workflow.
-
     git clone git@github.com:BRL-CAD/brlcad.git
     cd brlcad
     git checkout RELEASE
-
-    # NOTE - it is not strictly necessary to use the strategy-option,
-    # but barring some specific reason not to the goal will be to
-    # have RELEASE match the contents of main.  The "theirs"
-    # strategy option helps simplify that process.
-
-    git merge --strategy-option theirs main
+    git merge main
 
     # NON-AUTO:  The merge may succeed without conflicts.  If
     # not, you will see the message:
@@ -1329,8 +1311,12 @@ before the next minor release and update the workflow.
 #####################################################################
 # 02: Test the merge.
 
+    # NON-AUTO: Confirm versioning in include/conf/.
+    # BRLCAD_VERSION_AMEND may be defined during CMake for an
+    # amendment build.
+
     mkdir -p .build && cd .build
-    cmake .. -DENABLE_ALL=ON -DCMAKE_BUILD_TYPE=Release && make
+    cmake .. -DBRLCAD_BUNDLED_LIBS=ON -DCMAKE_BUILD_TYPE=Release && make
 
     # NON-AUTO: Manually check rt, mged, and archer.
     bin/rt        # should report usage with correct library versions
@@ -1342,17 +1328,17 @@ before the next minor release and update the workflow.
     cd .. && rm -rf .build
 
 #####################################################################
-# 03: Commit the merge (if necessary).
-
-    # Note - we don't push the merge at this stage, since we
-    # will be using the upstream RELEASE branch when we generate a
-    # ChangeLog file.
+# 03: Commit the merge (if necessary) and push.
 
     # If merge conflict resolution was needed, make a merge commit:
     MSHA1=$(git log -1 main --pretty=format:"%h")
     echo $MSHA1
     git commit -m "merge of main $MSHA1 to RELEASE branch"
 
+    # Whether or not their was a conflict, let upstream know what
+    # has changed
+    git push
+
 #####################################################################
 # 04: Reprioritize or address remaining TODO items.
 
@@ -1362,21 +1348,12 @@ before the next minor release and update the workflow.
 # 05: Review all commits.
 
     # NON-AUTO: Verify all user-visible changes are in NEWS.
-    # NON-AUTO: Verify all interface changes are in CHANGES.adoc or doc/changes/.
+    # NON-AUTO: Verify all interface changes are in CHANGES.
     # NON-AUTO: Verify usage/options are documented in doc/.
 
-    # A useful trick for this step is to use gitk to display all
-    # commits made since the last time the RELEASE branch was
-    # updated:
-
-    gitk --no-merges origin/RELEASE..RELEASE
-
 #####################################################################
 # 06: Update the version numbers.
 
-    # NOTE - BRLCAD_VERSION_AMEND may also be defined during CMake
-    # for an amendment build.
-
     # NON-AUTO: NEWS
     # NON-AUTO: README
     # NON-AUTO: include/conf/PATCH
@@ -1386,60 +1363,24 @@ before the next minor release and update the workflow.
     # NON-AUTO: misc/macosx/Resources/Welcome.rtfd/TXT.rtf
 
 #####################################################################
-# 07: Create branch for release in bext repository.
+# 07: Update ChangeLog.  Use the YYYY-MM-DD of previous NEWS entry.
 
-    MAJOR=`awk '{print $1}' include/conf/MAJOR`
-    MINOR=`awk '{print $1}' include/conf/MINOR`
-    PATCH=`awk '{print $1}' include/conf/PATCH`
-    cd ..
-    git clone git@github.com:BRL-CAD/bext.git
-    cd bext
-    git checkout RELEASE
-    git branch rel-$MAJOR-$MINOR-$PATCH
-    git checkout rel-$MAJOR-$MINOR-$PATCH
-    git push --set-upstream origin rel-$MAJOR-$MINOR-$PATCH
-    cd ../brlcad
+    TODO - if we want GNU style changelogs, more work will be needed
+    as there's not an out of the box solution...
 
-#####################################################################
-# 08: Update the bext submodule in BRL-CAD's main repository.
-
-    # NON-AUTO: Update BEXT_SHA1 hash in CMakeLists.txt (argument
-    # to brlcad_bext_init function).  If already pointing to the
-    # sha1 being used for the bext rel-$MAJOR-$MINOR-$PATCH branch
-    # this is a no-op - otherwise, commit the update.
-
-    git add CMakeLists.txt
-    git commit -m "Update bext submodule to SHA1 <hashval>"
-
-#####################################################################
-# 09: Update ChangeLog.
-
-    # We have held off pushing to upstream RELEASE branch until now,
-    # so we can use that as an anchor point from which to start the
-    # ChangeLog logging.  If for some reason that won't work, replace
-    # origin/RELEASE with the sha1 of the previous release's final
-    # commit in the RELEASE branch.
-
-    # We do this instead of date based logging to capture commits that
-    # may have been originally made before the last release (i.e. older
-    # commits made in a fork and incorporated into the history via PR)
-
-    git log origin/RELEASE..RELEASE > ChangeLog
+    LAST=`grep -E "\--- [0-9]{4}-[0-9X]{2}-[0-9X]{2}" NEWS | head -n 2 | tail -n 1 | awk '{print $2}'`
+    echo "LAST=$LAST"
+    git log --since=$LAST > ChangeLog
     git add ChangeLog
-    git commit -m "Update log with commits being incorporated into rel-$MAJOR-$MINOR-$PATCH"
-
-    # Now that we have updated the ChangeLog, push the changes to
-    # upstream RELEASE branch.
-
-    git push
+    git commit -m "Update log with commits since $LAST"
 
 #####################################################################
-# 10: Run distcheck on at least two platforms.
+# 08: Run distcheck-full on at least two platforms.
 
-    mkdir -p .build && cd .build && cmake .. && make distcheck
+    mkdir -p .build && cd .build && cmake .. && make distcheck-full
 
 #####################################################################
-# 11: Sync RELEASE to STABLE branch:
+# 09: Sync RELEASE to STABLE branch:
 
     # NON-AUTO: Update the NEWS release date for the current release to today's date
     git add NEWS
@@ -1458,32 +1399,27 @@ before the next minor release and update the workflow.
     # the resolution will be to make STABLE match the state of RELEASE
 
 #####################################################################
-# 12: If there are any differences between RELEASE and STABLE trees,
+# 10: If there are any differences between RELEASE and STABLE trees,
       test the merge.  In normal usage STABLE should match RELEASE,
-      so this is only necessary in unusual circumstances.  To check
-      if there are any differences, use git diff:
-
-    git diff RELEASE STABLE
-
-    # NON-AUTO:  If differences were observed, either correct them
-    # or (if expected) test:
+      so this is only necessary in special circumstances.
 
     mkdir .merge && cd .merge
-    cmake .. -DBRLCAD_BUNDLED_LIBS=ON -DCMAKE_BUILD_TYPE=Release && make distcheck && cd .. && rm -rf .merge
+    cmake .. -DBRLCAD_BUNDLED_LIBS=ON -DCMAKE_BUILD_TYPE=Release && make distcheck-full && cd .. && rm -rf .merge
 
 #####################################################################
-# 13: Let upstream know about the new state of STABLE.
+# 11: Let upstream know about the new state of STABLE.
 
     # If merge conflict resolution was needed, make a merge commit:
     RSHA1=$(git log -1 RELEASE --pretty=format:"%h")a
     echo $RSHA1
     git commit -m "merge of RELEASE $RSHA1 to STABLE branch"
 
-    # Let upstream know what has changed
+    # Whether or not their was a conflict, let upstream know what
+    # has changed
     git push
 
 #####################################################################
-# 14: Tag the release using "rel-MAJOR-MINOR-PATCH" format:
+# 12: Tag the release using "rel-MAJOR-MINOR-PATCH" format:
 
     MAJOR=`awk '{print $1}' include/conf/MAJOR`
     MINOR=`awk '{print $1}' include/conf/MINOR`
@@ -1494,7 +1430,7 @@ before the next minor release and update the workflow.
     git push origin rel-$MAJOR-$MINOR-$PATCH
 
 #####################################################################
-# 15: Increment and commit the next BRL-CAD release numbers.
+# 13: Increment and commit the next BRL-CAD release numbers.
 
     # Update the include/conf/(MAJOR|MINOR|PATCH) version files
     # immediately to odd-numbered minor version or new patch developer
@@ -1514,7 +1450,7 @@ before the next minor release and update the workflow.
     git push
 
 #####################################################################
-# 16: Sync RELEASE changes back to main.
+# 14: Sync RELEASE changes back to main.
 
     git checkout main
     git merge RELEASE
@@ -1529,40 +1465,22 @@ before the next minor release and update the workflow.
     git push
 
 #####################################################################
-# 17: Obtain a tagged version of the sources from the repository, make
+# 15: Obtain a tagged version of the sources from the repository, make
 # final distribution tarballs:
 
     git checkout rel-$MAJOR-$MINOR-$PATCH
     mkdir .build && cd .build
-    cmake .. -DBRLCAD_BUNDLED_LIBS=ON -DCMAKE_BUILD_TYPE=Release && make distcheck
+    cmake .. -DBRLCAD_BUNDLED_LIBS=ON -DCMAKE_BUILD_TYPE=Release && make distcheck-full
 
 #####################################################################
-# 18: Upload the source distributions and release notes.  Use source
+# 16: Upload the source distributions and release notes.  Use source
 # tarballs to create binaries.
 
-    # NON-AUTO:  Select the new tag at https://github.com/BRL-CAD/brlcad/releases/new
-    #
-    # Upload the NEWS entries and description for the web page's
-    # release notes.  Attach the tar.gz, tar.bz2 and .zip files as
-    # the initial archives.  Releases may be edited to add new files,
-    # so go ahead and publish the release to have our default webpage
-    # correctly reflect the most recent release.
+------------- TODO - need new procedures for Github... ------------
 
 
-TODO - It would be nice to have some curated scripts for binary creation.
-For Linux I usually set up a fresh Rocky Linux image with a clean environment
-and install just what is needed to try and get a "this will probably run
-anywhere" binary, but as a manual process that's a pain - maybe there's a way
-to script qemu to do the job for us...
-
-Windows is still completely manual.  The .msi installer depends on an older
-version of WiX, and I don't know of another good solution there - we probably need
-to investigate whether we could produce MSIX packages instead.
-
-Mac - TODO.
-
 #####################################################################
-# 19: Notify binary platform maintainers:
+# 17: Notify binary platform maintainers:
 
     T2 package maintainer
 	http://t2-project.org/packages/brlcad.html
@@ -1589,7 +1507,7 @@ Mac - TODO.
  	https://fedoraproject.org/wiki/User:Germano#Contact
 
 #####################################################################
-# 20: Announce the new release.
+# 18: Announce the new release.
 
 The NEWS file should generally be used as a basis for making release
 announcements though the announcements almost always require
@@ -1668,7 +1586,7 @@ Multiple platform major release and announcements:
 	copyboy@cadcam-insider.com
 
 #####################################################################
-# 21: Sit back and enjoy a beverage for a job well done.
+# 19: Sit back and enjoy a beverage for a job well done.
 
 
 

INSTALL

@@ -1,21 +1,23 @@
 The Installation Guide to BRL-CAD
 =================================
 
-This document covers the installing BRL-CAD from either a source or binary
-distribution.  Please see REPORTING PROBLEMS to troubleshoot.
+This document covers the installing BRL-CAD from either a source or
+binary distribution.  Please see REPORTING PROBLEMS to troubleshoot.
 
-Some platforms have additional platform-specific documentation provided in the
-doc/ directory with additional information. This presently includes the
-following:
+Some platforms have additional platform-specific documentation
+provided in the doc/ directory with additional information. This
+presently includes the following:
 
+  doc/README.AIX        -- IBM's Advanced Interactive eXecutive OS
   doc/README.BSD        -- FreeBSD, NetBSD, OpenBSD, etc.
-  doc/README.Linux	-- Various Linux distributions
-  doc/README.MacOSX	-- Apple Mac OS X
+  doc/README.IRIX	      -- SGI IRIX and IRIX64
+  doc/README.Linux	    -- Various Linux distributions
+  doc/README.MacOSX	    -- Apple Mac OS X
   doc/README.Solaris    -- Oracle Solaris, OpenIndiana (Illumos), etc.
+  doc/README.Windows    -- Microsoft Windows
   doc/README.VAX        -- Virtual Address eXtension architecture from DEC.
                            One of the original BRL-CAD platforms. These
                            days, re-created using the simh simulator.
-  doc/README.Windows    -- Microsoft Windows
 
 
 TABLE OF CONTENTS
@@ -34,32 +36,32 @@ TABLE OF CONTENTS
 QUICK SOURCE INSTALL
 --------------------
 
-See https://brlcad.org/wiki/Compiling for a platform-specific walk-through
-including instructions for building on Windows.
+See https://brlcad.org/wiki/Compiling for a platform-specific
+walk-through including instructions for building on Windows.
 
 Required tools:
   - Git must be 2.17 or later
-  - CMake must be 3.26 or later
-  - Compiler must be C++17-compliant
-    - If using Visual Studio, version 2019 (16.8+) or later
-    - If using GCC/G++, version 7 or later
-    - If using LLVM/Clang 5 or later
-    - If using Intel, version 19.0.1 or later
+  - CMake must be 3.12 or later
+  - Compiler must be C++11-compliant
+    - If using Visual Studio, version 2015 (14.0+) or later
+    - If using GCC/G++, version 4.8.1 or later
+    - If using LLVM/Clang 3.3 or later
+    - If using Intel, version 2015 (15.0+) or later
 
-Steps to compile, test, and install an optimized BRL-CAD on non-Windows
-platforms:
+Steps to compile, test, and install an optimized BRL-CAD on
+non-Windows platforms:
 
   git clone https://github.com/BRL-CAD/brlcad.git
   mkdir brlcad/build
   cd brlcad/build
-  cmake .. -DENABLE_ALL=ON -DCMAKE_BUILD_TYPE=Release
+  cmake .. -DBRLCAD_BUNDLED_LIBS=ON -DCMAKE_BUILD_TYPE=Release
   make -j4
   make check
   sudo make install
 
-Once installed, run bin/mged or bin/archer to launch BRL-CAD's GUI apps.  See
-POST-INSTALLATION for instruction adding bin/ folder to your system PATH to
-more easily run geometry converters.
+Once installed, run bin/mged or bin/archer to launch BRL-CAD's GUI
+apps.  See POST-INSTALLATION for instruction adding bin/ folder to
+your system PATH to more easily run geometry converters.
 
 
 INSTALLING FROM BINARY
@@ -74,54 +76,56 @@ and Windows etc.
 
 Generic Binary Distributions:
 
-For binary distributions that are simply compressed tarballs of the
-installation root, they should contain the entire hierarchy of the
-distribution.  To put that hierarchy in its "installed" location, you just
-create the directory and move the expanded tarball contents:
+For the unspecialized binary distributions that are basically
+compressed tarballs of the installation root, they should contain the
+entire hierarchy of the distribution.  To put that hierarchy in its
+"installed" location, you just create the directory and move the
+expanded tarball contents:
 
-gunzip BRL-CAD_X.Y.Z_Linux_ia64.tar.gz
-tar -xvf BRL-CAD_X.Y.Z_Linux_ia64.tar
-sudo mkdir /usr/brlcad/rel-X.Y.Z
-sudo mv BRL-CAD_X.Y.Z_Linux_ia64/* /usr/brlcad/rel-7.X.Y/
+gunzip BRL-CAD_7.2.4_Linux_ia64.tar.gz
+tar -xvf BRL-CAD_7.2.4_Linux_ia64.tar
+sudo mkdir /usr/brlcad/rel-7.2.4
+sudo mv BRL-CAD_7.2.4_Linux_ia64/* /usr/brlcad/rel-7.2.4/
 
-Of course, there are other compression options possible including zip and
-bzip2.  By default, BRL-CAD expects to be installed into /usr/brlcad/rel-X.Y.Z.
-On some platforms the binary may be relocatable, but this is not guaranteed.
-It's recommended that you start from a source distribution if you would like to
-install into an alternate installation location.  That said, if you do desire
-to install and/or run BRL-CAD from a different location, give it a try...on
-some platforms it will work.
+Of course, there are other compression options possible including zip
+and bzip2.  By default, BRL-CAD expects to be installed into
+/usr/brlcad/rel-7.2.4. On some platforms the binary may be relocatable,
+but this is not guaranteed. It's recommended that you start from a source
+distribution if you would like to install into an alternate installation
+location.  That said, if you do desire to install and/or run BRL-CAD from
+a different location, give it a try...on some platforms it will work.
 
-Something to be aware of, even if a binary distribution IS relocatable: it will
-use its local copies of things like libraries only so long as the "final"
-installed target directory that the build was compiled for does not contain a
-BRL-CAD installation.  Due to the way path logic is set, an installed copy of a
-library in the correct location will always be loaded first, regardless of the
-presence of a "local" copy.
+Something to be aware of, even if a binary distribution IS relocatable:
+it will use its local copies of things like libraries only so long as the
+"final" installed target directory that the build was compiled for
+does not contain a BRL-CAD installation.  Due to the way path logic
+is set, an installed copy of a library in the correct location will
+always be loaded first, regardless of the presence of a "local" copy.
 
 
 Mac OS X Disk Mounting Image:
 
-Mount the .dmg and run the Installer .pkg contained therein.  This will install
-into /usr/brlcad/rel-X.Y.Z and will only require confirming that your
-environment is set up properly (i.e. add /usr/brlcad/rel-X.Y.Z/bin to your
-path) as described in the Quick Installation section.
+Mount the .dmg and run the Installer .pkg contained therein.  This
+will install into /usr/brlcad/rel-X.Y.Z and will only require
+confirming that your environment is set up properly (i.e. add
+/usr/brlcad/rel-X.Y.Z/bin to your path) as described in the Quick
+Installation section.
 
 
 Validating checksums:
 
-The integrity of distributed files can be verified using checksums that are
-published with released files.  Released files and their checksums are
-available from the GitHub releases page (https://github.com/BRL-CAD/brlcad/releases).  If you
-re-distribute BRL-CAD, checksums should be retained with the files so others
-can validate origination.
+The integrity of distributed files can be verified using checksums
+that are published with released files.  Files on SourceForge's file
+release system can be found by clicking the 'i' button at the end of
+each file's name.  If you re-distribute BRL-CAD, checksums should be
+retained with the files so others can validate origination.
 
 
 INSTALLING FROM SOURCE
 ----------------------
 
-There are a couple of ways to obtain the BRL-CAD sources, usually via one of
-the following starting points:
+There are a couple of ways to obtain the BRL-CAD sources, usually via
+one of the following starting points:
 
   1) from a Git checkout, or
   2) from a source distribution tarball
@@ -134,68 +138,31 @@ you need/want will determine which configuration options you should
 use.  See the CONFIGURATION OPTIONS section below for details on how
 to go about selecting which options are appropriate for you.
 
-BRL-CAD's dependencies are managed in a separate repository, located at
-https://github.com/BRL-CAD/bext  By default BRL-CAD's configure process will
-download and manage the necessary dependencies, avoiding the need for user
-awareness of the bext repository, but there are a number of scenarios where it
-is advantageous for developers to adjust how this process works.
-
-The full dependency stack of BRL-CAD, with all optional and experimental
-features enabled, is a VERY large and long compile.  Therefore, the bext build
-outputs can be built as their own separate, external project to allow for reuse
-of the compiled outputs.  Building bext separately means BRL-CAD won't get a
-chance to customize what is and is not built, but the trade-off is that outputs
-can be built once and reused over and over.  Doing so can significantly shorten
-time spent configuring BRL-CAD builds - reusing bext compiled outputs is
-recommended for serious developers.
-
-Various useful configurations for working with bext:
-
-* Get a git clone that has everything which might be needed (large,
-  but useful for offline building)
-
-git clone --recurse-submodules https://github.com/BRL-CAD/brlcad
-
-* Have prebuilt bext outputs to reuse - BRL-CAD will simply copy and prepare
-  the pre-existing files
-
-cmake .. -DBRLCAD_EXT_DIR=/home/user/bext_output
-
-* Already have an existing bext clone but want BRL-CAD to build bext outputs
-
-cmake .. -DBRLCAD_EXT_SOURCE_DIR=/home/user/bext
-
-* Download, build and bundle only what is needed for librt
-
-cmake .. -DBRLCAD_COMPONENTS=librt
-
-* Build and bundle only what is needed, but don't require internet for bext clone
-cmake .. -DBRLCAD_EXT_SOURCE_DIR=/home/user/bext -DBRLCAD_COMPONENTS=librt
-
-
-By default, the build system will prepare a Debug build and install into the
-/usr/brlcad/dev-X.Y.Z directory.   The CMAKE_INSTALL_PREFIX option may be used
-to change that directory, or a Release build type may be specified to install
-to /usr/brlcad/rel-X.Y.Z - more on this below.  The tradition of non-system
-installation paths goes back a couple of decades and is a convenient means to
-isolate the BRL-CAD solid modeling system from your system, resolves conflicts,
-facilitates uninstalls, and simplifies upgrades.  The default configuration is
-performed by running `cmake'.  It is not required to do the build in a
-directory different from your source directory, but it is much cleaner and
-*highly* recommended - this guide will illustrate the build process with the
-assumption that the BRL-CAD source code is in the directory brlcad-X.Y.Z and
-the directory intended to hold the build output is brlcad-build, located in the
-same parent directory as brlcad-X.Y.Z:
+By default, the default configuration will prepare the build system
+to perform a Debug build and install into the /usr/brlcad/dev-X.Y.Z
+directory.   The CMAKE_INSTALL_PREFIX option may be used to change
+that directory, or a Release build type may be specified to install to
+/usr/brlcad/rel-X.Y.Z - more on this below.  The
+tradition of non-system installation paths goes back a couple of decades
+and is a convenient means to isolate the BRL-CAD solid modeling
+system from your system, resolves conflicts, facilitates uninstalls,
+and simplifies upgrades.  The default configuration is performed by
+running `cmake'.  It is not required to do the build in a directory
+different from your source directory, but it is much cleaner and
+*highly* recommended - this guide will illustrate the build process
+with the assumption that the BRL-CAD source code is in the directory
+brlcad-7.2.4 and the directory intended to hold the build output is
+brlcad-build, located in the same parent directory as brlcad-7.2.4:
 
   .
-  ./brlcad-X.Y.Z
+  ./brlcad-7.2.4
   ./brlcad-build
 
 To start the build process, cd into brlcad-build and run CMake,
 pointing it to the source directory:
 
   cd brlcad-build
-  cmake ../brlcad-X.Y.Z
+  cmake ../brlcad-7.2.4
 
 As mentioned earlier, CMake uses two "build types", controlled by
 the CMAKE_BUILD_TYPE variable, that are useful for specific purposes:
@@ -220,23 +187,69 @@ override the ../brlcad-install default.  Build types are a convenient way
 to bundle sets of settings, but they do not prevent overrides if a more
 custom setup is needed.
 
+By default, all components and functionality will be built.
+Note that BRL-CAD does require and include several 3rd party
+components.  If your system does not include a sufficient version of
+those required 3rd party components, they will be automatically
+configured for compilation.
+
 If the autodetection mechanisms fail to produce a working configuration,
 the next simplest approach is typically to enable ALL the third party
 components - this is typically a well tested configuration, but will
 increase both the build time and final install size of BRL-CAD on
 the system.  To set this variable on the command line, use -D to
-define ENABLE_ALL for CMake:
+define BRLCAD_BUNDLED_LIBS for CMake:
 
-  -DENABLE_ALL=ON
+  -DBRLCAD_BUNDLED_LIBS=Bundled
+
+If the graphical interface (cmake-gui) is in use, it will list this
+and other common options by default, allowing the user change them
+graphically.  This is often quicker and more convenient than
+defining options on the command line, but both will work.
+
+You can also force on or off any individual 3rd party library by
+setting the BRL-CAD variable for that feature to either on or off:
+
+  -DBRLCAD_<LIBRARY>=ON
+
+Other variables control BRL-CAD features.  For example, to NOT
+enable functionality using OpenGL, set
+
+  -DBRLCAD_ENABLE_OPENGL=OFF
 
 To obtain an optimized build (for example, for BRL-CAD Benchmark
 performance evaluation), enable BRLCAD_FLAGS_OPTIMIZATION:
 
   -DBRLCAD_FLAGS_OPTIMIZATION=ON
 
+Profile-guided optimization builds are possible via two-pass
+compilation.  Compile with this flag set, run the benchmark suite,
+clean the build, and then compile again with this flag set.  Supported
+compilers will utilize data from the first pass to guide optimization,
+typically resulting in a significant performance increase:
+
+  -DBRLCAD_PGO=ON
+
 See the CONFIGURATION OPTIONS below for more details on all of the
 possible settings.
 
+You can specify options or preferences you want to always use by
+default.  For example, to always enable all local libs the following
+line can be added to your own configuration file:
+
+  set(BRLCAD_BUNDLED_LIBS "Bundled" CACHE STRING "Enable all local libs")
+
+You can define your own configuration file in one of three ways.  The
+build system will search for the file in this order:
+
+  ${BRLCAD_SOURCE_DIR}/../BRL-CAD_CONFIG.GLOBAL
+
+  ${BRLCAD_SOURCE_DIR}/BRL-CAD_CONFIG.GLOBAL
+
+  the file defined in the environment variable "BRLCAD_USER_GLOBAL_CONFIG_FILE"
+
+The build system will use the first file defined that exists.
+
 Once configured, you should be able to successfully build BRL-CAD via
 make:
 
@@ -329,16 +342,19 @@ Please report any bugs, support requests, or feature requests to:
   https://github.com/BRL-CAD/brlcad/issues
 
 
-
 CONFIGURATION OPTIONS
 ---------------------
 
---- ENABLE_ALL ---
+--- BRLCAD_BUNDLED_LIBS ---
 
-If set to ON, and the BRL-CAD configure process is managing the bext
-dependencies, instructs bext to default to building local copies of the
-dependencies it will enable per the BRL-CAD feature settings, rather than
-searching for system versions.
+Enables compilation of all 3rd party sources that are provided within a BRL-CAD
+source distribution.  If used this option sets all other 3rd party library
+build flags to ON by default.  However, that setting can be overridden by
+manually setting individual variables. Default is "AUTO" - 3rd party sources
+are compiled only if they are not detected as being available and functioning
+as expected.
+
+Aliases:  ENABLE_ALL
 
 
 --- BRLCAD_ENABLE_OPENGL ---
@@ -350,41 +366,6 @@ if it is, default is to enable.
 Aliases:  ENABLE_OPENGL
 
 
---- BRLCAD_X11_PROVIDER ---
-
-Selects the X11 implementation used by BRL-CAD, Tk, Qt, and OpenGL.  Accepted
-values are AUTO, SYSTEM, and XMIN.  AUTO is the default and deliberately
-resolves to SYSTEM so installing Xmin cannot change an existing build.
-
-XMIN selects an installed Xmin client SDK for deterministic GUI testing
-without a host X server.  The SDK must provide Xmin::ToolkitX11; OpenGL builds
-also need Xmin::GL.  Set Xmin_ROOT to the SDK installation prefix.  Tk and Qt
-must be built for the same provider because their public X11 APIs conceal
-provider-private state; mixing Xmin and system client libraries is not ABI
-safe and is rejected during configuration.
-
-When BRL-CAD manages bext, it derives the matching bext SDK prefix from the
-selected Xmin package.  Bext then applies its version-matched Tk and Qt patches
-automatically to whichever bundled toolkits are selected.  No external patch
-paths are needed.
-
-A typical Xmin configuration is:
-
-  cmake .. -DBRLCAD_X11_PROVIDER=XMIN \
-    -DXmin_ROOT=/path/to/xmin-prefix
-
-Bext retains advanced TK_EXTRA_PATCHES, TK_CONFIGURE_ARGS, QT_EXTRA_PATCHES,
-and QT_XMIN_ROOT controls for custom profiles.  The standard BRL-CAD Xmin
-configuration does not need them.  Refer to bext's Xmin profile documentation
-before changing the bundled Tk or Qt revision.
-
-
---- BRLCAD_COMPONENTS ---
-
-Semicolon separated list of components to enable for building - see
-src/source_dirs.cmake for a list of the components that may be specified.
-
-
 --- BRLCAD_ENABLE_RUNTIME_DEBUG ---
 
 Enables support for application and library debugging facilities.
@@ -398,26 +379,6 @@ Aliases:  ENABLE_RUNTIME_DEBUG, ENABLE_RUN_TIME_DEBUG, ENABLE_RUNTIME_DEBUGGING
           ENABLE_RUN_TIME_DEBUGGING
 
 
---- BRLCAD_EXT_DIR ---
-
-If specified, BRL-CAD will look in this directory for bext compiled outputs to
-bundle and use during the build.
-
-
---- BRLCAD_EXT_SOURCE_DIR ---
-
-If specified, BRL-CAD will look in this directory for bext source files. Use
-this when you have a pre-existing bext clone and don't want BRL-CAD's configure
-process to pull down another copy, but are still looking to have the BRL-CAD
-configure process manage producing bext build outputs.
-
-
---- BRLCAD_EXT_PARALLEL ---
-
-This number, when specified, describes how many compilation threads to use
-when compiling bext sources.  Default is 8.
-
-
 --- BRLCAD_DEBUGGING ---
 
 Add compiler flags to aid in program debugging.  Defaults to ON.
@@ -426,17 +387,6 @@ Aliases:  ENABLE_DEBUG, ENABLE_FLAGS_DEBUG, ENABLE_DEBUG_FLAGS
           BRLCAD_FLAGS_DEBUG
 
 
---- BRLCAD_PGO ---
-
-Enable profile-guided optimization build flags.  Defaults to OFF.
-
-Profile-guided optimization builds are possible via two-pass
-compilation.  Compile with this flag set, run the benchmark suite,
-clean the build, and then compile again with this flag set.  Supported
-compilers will utilize data from the first pass to guide optimization,
-typically resulting in a significant performance increase:
-
-
 --- BRLCAD_WARNINGS ---
 
 Use extra warning flags when compiling C/C++ code.  Defaults to ON.
@@ -467,10 +417,171 @@ Aliases:  ENABLE_ALL_CXX
 --- BRLCAD_EXTRADOCS ---
 
 The core option that enables and disables building of BRL-CAD's
-AsciiDoc based documentation (includes manuals and man pages for
-commands, among other things).  It is built with BRL-CAD's bundled
-asciiquack processor into HTML and man-page (troff) formats.  Defaults
-to ON for a full build and OFF for reduced target sets.
+DocBook based documentation (includes manuals and man pages for
+commands, among other things).  Defaults to ON, but only HTML and MAN
+formats are enabled by default - PDF must be enabled separately by use
+of this option or one of its aliases.  Note that you may set
+environment variable APACHE_FOP to point to your locally installed fop
+executable file (which on Linux is usually a shell script with 0755
+permissions).
 
-Aliases:  ENABLE_DOCS, ENABLE_EXTRA_DOCS
+Aliases:  ENABLE_DOCS, ENABLE_EXTRA_DOCS, ENABLE_DOCBOOK
 
+
+--- BRLCAD_ASTYLE ---
+
+Option for enabling and disabling compilation of the Artistic Style
+(astyle) utility provided with BRL-CAD's source distribution.  Default is
+AUTO,
+responsive to the toplevel BRLCAD_BUNDLED_LIBS option and testing
+first for a system version if BRLCAD_BUNDLED_LIBS is also AUTO.
+
+Aliases:  ENABLE_ASTYLE
+
+
+--- BRLCAD_XSLTPROC ---
+
+Option for enabling and disabling compilation of the xsltproc XML
+transformation utility provided with BRL-CAD's source distribution.
+Used for DocBook documentation processing.  Default is AUTO,
+responsive to the toplevel BRLCAD_BUNDLED_LIBS option and testing
+first for a system version if BRLCAD_BUNDLED_LIBS is also AUTO.
+Depends on BRLCAD_EXTRADOCS.
+
+Aliases:  ENABLE_XSLTPROC
+
+
+--- BRLCAD_XMLLINT ---
+
+Option for enabling and disabling compilation of the xmllint XML
+validation utility provided with BRL-CAD's source distribution.  Used
+for DocBook documentation validation.  Default is AUTO, responsive to
+the toplevel BRLCAD_BUNDLED_LIBS option and testing first for a system
+version if BRLCAD_BUNDLED_LIBS is also AUTO.
+
+Aliases:  ENABLE_XMLLINT
+
+
+--- BRLCAD_ZLIB ---
+
+Option for enabling and disabling compilation of the zlib library
+provided with BRL-CAD's source distribution.  Default is AUTO,
+responsive to the toplevel BRLCAD_BUNDLED_LIBS option and testing
+first for a system version if BRLCAD_BUNDLED_LIBS is also AUTO.
+
+Aliases:  ENABLE_ZLIB, ENABLE_LIBZ
+
+
+--- BRLCAD_REGEX ---
+
+Option for enabling and disabling compilation of the Regular
+Expression Library provided with BRL-CAD's source distribution.
+Default is AUTO, responsive to the toplevel BRLCAD_BUNDLED_LIBS option
+and testing first for a system version if BRLCAD_BUNDLED_LIBS is also
+AUTO.
+
+Aliases:  ENABLE_REGEX
+
+
+--- BRLCAD_NETPBM ---
+
+Option for enabling and disabling compilation of the netpbm library
+provided with BRL-CAD's source code.  Default is AUTO, responsive to
+the toplevel BRLCAD_BUNDLED_LIBS option and testing first for a system
+version if BRLCAD_BUNDLED_LIBS is also AUTO.
+
+Aliases:  ENABLE_NETPBM
+
+
+--- BRLCAD_PNG ---
+
+Option for enabling and disabling compilation of the Portable Network
+Graphics library provided with BRL-CAD's source distribution.  Default
+is AUTO, responsive to the toplevel BRLCAD_BUNDLED_LIBS option and
+testing first for a system version if BRLCAD_BUNDLED_LIBS is also
+AUTO.
+
+Aliases:  ENABLE_PNG
+
+
+--- BRLCAD_SC ---
+
+Option for enabling and disabling compilation of the NIST Step Class
+Libraries provided with BRL-CAD's source code.  Default is AUTO,
+responsive to the toplevel BRLCAD_BUNDLED_LIBS option and testing
+first for a system version if BRLCAD_BUNDLED_LIBS is also AUTO.
+
+Aliases:  ENABLE_SCL, ENABLE_STEP, ENABLE_STEP_CLASS_LIBRARIES
+
+
+--- BRLCAD_SQLITE3 ---
+
+Option for enabling and disabling compilation of the sqlite3 database command
+and library provided with BRL-CAD's source distribution.  Default is AUTO,
+responsive to the toplevel BRLCAD_BUNDLED_LIBS option and testing first for a
+system version if BRLCAD_BUNDLED_LIBS is also AUTO.
+
+Aliases:  ENABLE_SQLITE3, ENABLE_SQLITE3
+
+
+--- BRLCAD_PROJ ---
+
+Option for enabling and disabling compilation of the PROJ geographic
+projection library provided with BRL-CAD's source code.  Default
+is AUTO, responsive to the toplevel BRLCAD_BUNDLED_LIBS option and
+testing first for a system version if BRLCAD_BUNDLED_LIBS is also
+AUTO.
+
+Aliases:  ENABLE_PROJ
+
+
+--- BRLCAD_GDAL ---
+
+Option for enabling and disabling compilation of the GDAL geographic
+library provided with BRL-CAD's source code.  Default
+is AUTO, responsive to the toplevel BRLCAD_BUNDLED_LIBS option and
+testing first for a system version if BRLCAD_BUNDLED_LIBS is also
+AUTO.
+
+Aliases:  ENABLE_GDAL
+
+
+--- BRLCAD_ASSETIMPORT ---
+
+Option for enabling and disabling compilation of the Open
+Asset Import Library provided with BRL-CAD's source code.  Default
+is AUTO, responsive to the toplevel BRLCAD_BUNDLED_LIBS option and
+testing first for a system version if BRLCAD_BUNDLED_LIBS is also
+AUTO.
+
+Aliases:  ENABLE_ASSETIMPORT
+
+
+--- BRLCAD_OPENMESH ---
+
+Option for enabling and disabling compilation of the OpenMesh 
+Library provided with BRL-CAD's source code.  Default
+is AUTO, responsive to the toplevel BRLCAD_BUNDLED_LIBS option and
+testing first for a system version if BRLCAD_BUNDLED_LIBS is also
+AUTO.
+
+Aliases:  ENABLE_OPENMESH
+
+
+--- BRLCAD_TCL ---
+
+Option for enabling and disabling compilation of the Tcl library
+provided with BRL-CAD's source code.  Default is AUTO, responsive to
+the toplevel BRLCAD_BUNDLED_LIBS option and testing first for a system
+version if BRLCAD_BUNDLED_LIBS is also AUTO.
+
+Aliases:  ENABLE_TCL
+
+
+
+*** Note - Do not add or edit configuration option descriptions and alias
+   lists in this file - those entries are auto-generated from information in
+   the toplevel CMakeLists.txt file and src/other/CMakeLists.txt - any changes
+   should be made in those files.  The CMake configuration process will
+   automatically re-generate INSTALL with the new descriptions and alias
+   information.

NEWS

@@ -10,538 +10,10 @@ descriptive text that emphasizes or further describes significant
 changes made.  See document footer for additional details.
 
 ----------------------------------------------------------------------
---- 2026-10-0X  Release 7.46.0                                     ---
+--- 202X-XX-XX  Release 7.XX.X                                     ---
 ----------------------------------------------------------------------
 
-This release expands geometry conversion and improves modeling
-reliability.  STEP support adds AP203e2, AP214, and AP242
-import/export, native CSG round trips, and AP242 product and
-manufacturing information (PMI) import.  IGES and JT conversion is
-expanded, and new OpenSCAD CSG import/export tools are available.
-
-Facetization is more reliable, NMG solid ray tracing is 10-20 times
-faster, CSG ray tracing is faster, and BoT, DSP, and point-cloud ray
-intersections are corrected.  MGED gains numerous fixes to primitive,
-sketch, and combination editing, drawing, dialogs, and preferences.
-
-New tools support object nesting with arrange, building generation
-with mkbuilding, annotation editing, and primitive repair.  Geometry
-analysis, image utilities, Windows support, documentation, and bundled
-dependencies also receive substantial updates.
-
-* fixed inside BoT rays, DSP surface normals, PNTS bounds - Cliff Yapp
-* improved mged fallback HTML manual viewer - Cliff Yapp
-* fixed gqa undefined densities and exit status - Chris McGregor
-* added ARBN support to the mged inside command - Cliff Yapp
-* improved HYP neck-ratio labels and BoT face selection - Cliff Yapp
-* fixed mged view panning, edit rotation, & ray queries - Cliff Yapp
-* preserved ARB, CLINE, TGC, & extrusion geometry edits - Cliff Yapp
-* restored mged command prompt focus at GUI startup - Cliff Yapp
-* improved pixscale & bwscale scaling and image piping - Sean Morrison
-* restored pixdiff behavior on .pix, added -b for .bw - Sean Morrison
-* improved facetize fallback methods and reliability - Cliff Yapp
-* updated mged and Archer for Tcl 8.6.18 and Itcl/Itk 4 - Cliff Yapp
-* fixed writes to fileless geometry databases - Cliff Yapp
-* fixed nastran-g handling of large property IDs - Rupesh, Cliff Yapp
-* fixed dxf-g invalid polyface idx crash - Meghna45-code, Cliff Yapp
-* fixed TclCAD framebuffer listing and deletion - Cliff Yapp
-* fixed mged Build Pattern progress updates - Cliff Yapp
-* fixed mged search -exec reentry and Ctrl-C crashes - Cliff Yapp
-* fixed mged asynchronous commands and clone progress - Cliff Yapp
-* accelerated large and repeated mged path drawing - Cliff Yapp
-* fixed ARB7 inside solid construction - Cliff Yapp
-* fixed direct ARB face and edge-direction editing - Cliff Yapp
-* fixed rtwizard startup with framebuffer contention - Cliff Yapp
-* fixed Archer annotation line display updates - Cliff Yapp
-* fixed Archer sketch scale drift in non-mm databases - Cliff Yapp
-* fixed toggle arrow callbacks during setup - Cliff Yapp
-* fixed Tcl dialogs with multi-word titles and msgs - Cliff Yapp
-* fixed Archer Tank Wizard gun generation - Cliff Yapp
-* fixed mged and Archer sketch arc tangency editing - Cliff Yapp
-* fixed Archer ARB4 point 3 editing - Cliff Yapp
-* fixed ARB4 storage from make and mk_arb4 - Cliff Yapp
-* fixed ARB4 and ARB6 center point calculations - Cliff Yapp
-* fixed concurrent mged and rtwizard framebuffer use - Cliff Yapp
-* fixed mged ShotVis editing and reload failures - Cliff Yapp
-* fixed Tcl widget geometry and selection defects - Cliff Yapp
-* fixed mged BoT editor property handling - Cliff Yapp
-* fixed mged LOD dialog and adaptive BoT wireframes - Cliff Yapp
-* fixed mged Plot, PostScript, and manual launch tools - Cliff Yapp
-* fixed mged Overlap Tool multi-object result handling - Cliff Yapp
-* eliminated 16-fold redundant gchecker grid analysis - Cliff Yapp
-* fixed submodel transforms & relative database paths - Sean Morrison
-* fixed Archer tree handling for names with spaces - Cliff Yapp
-* fixed RtWizard multi-object edge occlusion handling - Cliff Yapp
-* fixed RtWizard title, About, and preference handling - Cliff Yapp
-* fixed mged startup file false legacy-syntax warnings - Cliff Yapp
-* fixed mged saved-view deletion and collaboration sync - Cliff Yapp
-* fixed mged font preferences apply and persistence - Cliff Yapp
-* fixed Archer combination edits changing Boolean trees - Cliff Yapp
-* fixed Archer command-line help startup crash - Cliff Yapp
-* fixed mged Geometry Browser menu and close behavior - Cliff Yapp
-* fixed mged collaboration view unshare crash - Cliff Yapp
-* added override for Archer's preference file location - Cliff Yapp
-* fixed embedded Archer display and mode menus - Cliff Yapp
-* added Archer -h and --help command-line options - Cliff Yapp
-* fixed Archer Help opening the documentation menu - Sean Morrison
-* added arrange nest command for packing db objects - Sean Morrison
-* added mkbuilding for parametric/OSM/CityJSON models - Sean Morrison
-* cross-platform BINUNIF and DSP byte-order handling - Sean Morrison
-* improved several cv default behaviors (s,32,64,n) - Sean Morrison
-* fixed invalid bot handling bug applying matrices - Sean Morrison
-* improved glTF import robustness via gcv - Sean Morrison
-* fixed bot dump glTF/GLB export; -F is now rejected - Cliff Yapp
-* faster NMG solid ray tracing (10-20x faster) - Sean Morrison
-* preserved prim colors in shaded BoT and B-Rep drawing - Cliff Yapp
-* preserved B-Rep attrs through in-place geometry edits - Cliff Yapp
-* fixed gcv filter arguments w/ one-character values - Cliff Yapp
-* improved iges-g importer robustness - Cliff Yapp
-* expanded g-iges native CSG and B-Rep export support - Cliff Yapp
-* added IGES import and export support to gcv - Cliff Yapp
-* rt -b query option now supports a single value idx - Sean Morrison
-* fixed .dpix file format portability and icv support - Sean Morrison
-* expanded pixscale support for piped image data - Sean Morrison
-* fixed HYP volume and ARBN totals reported by analyze - Cliff Yapp
-* fixed VOL data-file lookup and missing-data errors - Chris McGregor
-* corrected rtarea sampling/exposed-area calculations - Cliff Yapp
-* bot split now groups results and preserves mesh data - Cliff Yapp
-* bot decimate now preserves nrmls, UVs, and plate data - Cliff Yapp
-* added raytracing support for annotation objects - Cliff Yapp
-* fixed Windows subprocess quoting and empty arguments - Cliff Yapp
-* fixed mged X embedded framebuffer display manager crash - Cliff Yapp
-* fixed Windows drive-letter path handling - Cliff Yapp
-* added annotate command for managing annotation objects - Cliff Yapp
-* added repair command for supported invalid primitives - Cliff Yapp
-* changed default new-region material code from 1 to 0 - Keith Bowman
-* added comb support to bb -o oriented bounding boxes - Cliff Yapp
-* added -t tight bounding box option to bb command - Cliff Yapp
-* added az (-a) and el (-e) option implementations to gqa - Cliff Yapp
-* added center command support for centering on an object - Cliff Yapp
-* greatly expanded JT import and added basic JT export - Sean Morrison
-* added csg-g/g-scad OpenSCAD CSG importer/exporter - Erik Greenwald
-* improved art light, color, output, & region handling - Sean Morrison
-* added preliminary OpenSCAD import support - Sean Morrison
-* expanded IGES BREP/NURBS import and export support - Sean Morrison
-* expanded STEP AP203 import support with faceted BREP - Sean Morrison
-* added STEP AP203e2, AP214, and AP242 import/export - Cliff Yapp
-* added STEP CSG round trips and AP242 PMI import - Cliff Yapp
-* improved STEP assembly, topology repair, and reporting - Cliff Yapp
-* new adrt CLI utility with path, spall, and cut modes - Sean Morrison
-* new CLI+GUI prototype BRL-CAD application launcher - Sean Morrison
-* added option validation to image & framebuffer tools - Sean Morrison
-* added contributor, API, command, & raytracing guides - Sean Morrison
-* added and updated command and library manual pages - Sean Morrison
-* added pnts write -f xyz export option - Chris McGregor
-* fixed mged ARB5 point editing - Cliff Yapp
-* fixed mged gqa and rtcheck stale overlap plots - Cliff Yapp
-* fixed procedural tree generator crashes - Sean Morrison, Cliff Yapp
-* added gaia Earth models with day/dusk/night textures - Sean Morrison
-* fixed fbcolor ramps & Windows input - Cliff Yapp, Sean Morrison
-* added parashot gravity trajectory path generator - Sean Morrison
-* added metaball pnt scaling (via metaball_move_pnt) - Sean Morrison
-* all raytracing apps now report object prep failures - Sean Morrison
-* improved fast4-g robustness and error reporting - Cliff Yapp
-* improved robustness of g-vrml plate mode handling - Cliff Yapp
-* added support for tick drawing on mged model axis - Cliff Yapp
-* added naca456 left and paired wing generation - Cliff Yapp
-* added patch-g -j option, specify object thicknesses - Sean Morrison
-* corrected bwstat median and input error handling - Sean Morrison
-* fixed gist -Q quick preview option - Sean Morrison
-* rt preserves eye_pt setting in command scripts - Sean Morrison
-* removed trailing whitespace from nirt output - Sean Morrison
-* rt -l8 heat graphs now measure CPU time - Sean Morrison
-* documented gqa centroid & moments of inertia options - Sean Morrison
-* pixdiff now calculates pixel differences on bw files - Sean Morrison
-* fixed bwcrop single-axis crops & pixembed edge fill - Sean Morrison
-* fixed isize in non-mm databases - Josh Baker
-* fixed metaball adjust clearing points on errors - Sean Morrison
-* fixed benchmark+pixcmp correctness validation bug - Sean Morrison
-* fixed mged gqa option and value parsing - Sean Morrison
-* improved gist hierarchy overflow rendering - Chris McGregor
-* fixed rtxray -o grayscale/BW output - Sean Morrison
-* fbhelp writes help to stdout and rest to stderr - Sean Morrison
-* FB now supports /dev/stdout and /dev/stderr devices - Sean Morrison
-* fixed mged rt -C + -o background color to file bug - Sean Morrison
-* fixed rt -C255/0/0 -o file.pix background color bug - Sean Morrison
-* added rtsil foreground & background -c set options - Sean Morrison
-* added rtsil -o support for bw output - Sean Morrison
-* added cutting plane animation generation to rtwizard - Cliff Yapp
-* fixed pixdiff bug on Windows - Sean Morrison
-* fixed mged startup window placement on Windows - Chris McGregor
-* fixed pixborder utility right-side edge bug - Sean Morrison
-* fixed 'wavelet' image processing tool on Windows - Sean Morrison
-* quieted mged killtree spurious lookup failure output - Sean Morrison
-* fixed ray tracing small images to disk framebuffers - Sean Morrison
-* improved raytracing performance of CSG-heavy regions - Sean Morrison
-* fixed OBJ conversion bug importing unnamed groups - Sean Morrison
-* fixed k-g conversion of BoT vertex normals - laithaldaeef
-* new doc guide, a visual overview of BRL-CAD objects - Sean Morrison
-* improved triangle quality produced by bot remesh - Cliff Yapp
-* updated numerous manpage command references - Josh Baker
-* improved performance making huge combinations - Sean Morrison
-* added PNTS get, adjust, form, & g2asc/asc2g support - Chris McGregor
-* fixed ANNOT get, adjust, & g2asc/asc2g support - Chris McGregor
-* added make -t primitive type listing - Chris McGregor
-* added gcv import conversion support for vrml/wrl 1.0 - Sean Morrison
-* fixed gcv appending to existing geometry databases - Sean Morrison
-* added CSS names, hex, HSL/HSV to libbu color parsing - Sean Morrison
-* improved OpenNURBS B-Rep import and adjustment safety - Cliff Yapp
-* improved Debian application menus/MIME associations - Jordi Sayol
-* updated Tcl/Tk dependency to v8.6.18 using bundled Itcl - Cliff Yapp
-* updated Clipper2 dependency to v1.5.4 - Cliff Yapp
-* updated Eigen dependency to v5.0.1 - Cliff Yapp
-* updated GDAL dependency to v3.13.3 - Cliff Yapp
-* updated GeometricTools dependency to v8.2 - Cliff Yapp
-* updated Itk dependency to v4.2.7 - Cliff Yapp
-* updated LMDB dependency to v1.0.1 - Cliff Yapp
-* updated Manifold dependency to v3.5.3 - Cliff Yapp
-* updated OpenCV dependency to v5.0.0 - Cliff Yapp
-* updated OpenNURBS dependency to v8.34.26223.11001 - Cliff Yapp
-* updated PROJ dependency to v9.8.1 - Cliff Yapp
-* updated PoissonRecon dependency to v18.75 - Cliff Yapp
-* updated libjpeg-turbo dependency to v3.2.0 - Cliff Yapp
-* updated libosmesa dependency to SHA1 bfa90de - Cliff Yapp
-* updated libpng dependency to v1.6.58 - Cliff Yapp
-* updated libtiff dependency to v4.7.2 - Cliff Yapp
-* updated netpbm dependency to v10.86.50 - Cliff Yapp
-* updated oneTBB dependency to v2023.1.0 - Cliff Yapp
-* updated pugixml dependency to v1.16 - Cliff Yapp
-* updated sqlite3 dependency to v3.53.4 - Cliff Yapp
-* updated stepcode dependency to SHA1 ed686ee1d - Cliff Yapp
-* updated tinygltf dependency to v3.0.1 - Cliff Yapp
-* updated zlib dependency to v1.3.2 - Cliff Yapp
-
-
-----------------------------------------------------------------------
---- 2026-07-23  Release 7.44.0                                     ---
-----------------------------------------------------------------------
-
-This release expands geometry processing, conversion, and rendering
-capabilities including a new proximity search 'near' command, ARB
-repair, BoT exterior extraction, Cauchy-Crofton validation in lint,
-and more reliable facetization pipeline.  Ray tracers now auto-select
-a default object or report available top-levels when none is named.
-Rendering advancements include perspective edge rendering, timing heat
-maps, PNTS ray tracing, and faster opaque and lighting-heavy renders.
-
-GCV adds preliminary import support for VTK ASCII, X3D BREP/NURBS, and
-JT import support, while OBJ preserves material colors.  Procedural
-tools now generate shells, gears, lattices, terrain, propellers,
-wings, trees, and parameterized tires with tread presets.
-
-MGED gains full-text doc searching and more robust command I/O; gist
-1-page reports are more informative; and ICV adds richer reporting,
-animation, comparison, and image metadata features.  DocBook
-documentation was converted to AsciiDoc, adding over 220 manual pages
-and extensively improving existing docs.
-
-* fixed search -exec infinite looping with creations - Chris McGregor
-* fixed NOCOS mode plate mode bot creation - Meghna45-code
-* fixed search -exec multithreaded output - Cliff Yapp, Chris McGregor
-* improved as2g importing speed for large inputs - Cliff Yapp
-* gist pages now include file size in header - Sean Morrison
-* added preliminary support for mirroring brep objects - Sean Morrison
-* fixed dbupgrade corruption of RHC entities - Sean Morrison
-* fixed archer bug opening database named same as cmd - Sean Morrison
-* fixed mged bug where pasted text captured by prompt - Sean Morrison
-* added -k/-K manpage full text keyword search options - Sean Morrison
-* rm ged command now behaves like the system rm, kills objects&paths
-	- Cliff Yapp, Sean Morrison
-* fixed gqa exactly symmetric volumetric estimates - Sean Morrison
-* added support to rtedge for perspective renderings - Sean Morrison
-* rt -l8 rendering time heat graphs - Stephen Kennedy, Sean Morrison
-* added 'icv anim' for APNG and MJPEG animation files - Clifford Yapp
-* added BREP/NURBS import support to gcv x3d importer - Sean Morrison
-* added BRL-CAD Taxonomy article on naming conventions - Sean Morrison
-* added new documentation on adrt rendering - Sean Morrison
-* added snail & seashell procedural geometry generator - Sean Morrison
-* additional 3D geometry model examples - Csanyi Pal, Lee Butler
-* fixed fbgamma bug specifying three channel values - Sean Morrison
-* fixed fbgrid -o old grid mode uninitialized data bug - Sean Morrison
-* added gcv import support for VTK's ascii file format - Sean Morrison
-* improved ray tracing performance on opaque objects - Sean Morrison
-* expanded autoview command with support for objects - Sean Morrison
-* added new rt -c "autoview object1 object2" option - Sean Morrison
-* killall no longer outputs kill lookup failures - Sean Morrison
-* added new manual pages for over 30 tools & utilities - Sean Morrison
-* fixed mged/rt/gui apps on Mac w/ ogl device windows - Sean Morrison
-* modified gist long title printing to maximally fit - Sean Morrison
-* fixed gist hierarchy bug with matrix on top subcombs - Sean Morrison
-* modified gist hierarchy summary to include counts - Sean Morrison
-* gist hierarchy no longer displays air as black boxes - Sean Morrison
-* added get/put/adjust/g2asc support for datum objects - Sean Morrison
-* added gcv & g-obj color .mtl material export support - Sean Morrison
-* improved DSP raytrace consistency, robustness, & speed - Cliff Yapp
-* added arb repair command to fix various ARB8 issues - Cliff Yapp
-* fixed convex hull tolerance handling for thin shapes - Cliff Yapp
-* fixed vdeck truncating/overflowing long region names - Sean Morrison
-* fixed rtweight nan centroid for zero-density regions - Sean Morrison
-* fixed rt -l7 photon mapping-based rendering crashes - Sean Morrison
-* fixed mged instability/crash after mged help command - Sean Morrison
-* new mged 'near' command to find proximity objects - Sean Morrison
-* fixed sketch/view polygon coordinate offsets - Cliff Yapp
-* added new manual pages for over 110 GED commands - Sean Morrison
-* improved facetize tolerance and coplanar face handling - Cliff Yapp
-* added support for alternate plane forms to rt -k option - Cliff Yapp
-* improved ~85 manual page synopses, docs, & examples - Sean Morrison
-* fixed bug in gqa material object lookup - Cliff Yapp
-* fixed bug in rtweight material object lookup - Cliff Yapp
-* added support for writing out .jpg files to libicv/rt - Cliff Yapp
-* converted DocBook documentation files to AsciiDoc - Cliff Yapp
-* added MGED Pattern GUI patterns to clone command - Cliff Yapp
-* improved performance of search cmd's -above option - Cliff Yapp
-* added -d depth limit to npush cmd, improved robustness - Cliff Yapp
-* address race condition with bu_nsemaphores in libbu - Cliff Yapp
-* fixed potential DSP corner case rendering crash - Cliff Yapp
-* fixed multithreaded crashing with noise-using shaders - Cliff Yapp
-* corrected the exposed region count report in rtarea - Cliff Yapp
-* fixed icv support for RLE image format - Cliff Yapp
-* added similarity grouping identification mode to gdiff - Cliff Yapp
-* added preliminary JT mesh import support to gcv - Sean Morrison
-* improved gcv asc v5 reader to handle brep input - Cliff Yapp
-* improved DSP primitive's default facetize behavior - Cliff Yapp
-* fixed gcv appending to existing databases - Sean Morrison
-* improved NMG->bot conv speed for all triangle case - Cliff Yapp
-* added SPSR meshing support to the pnts command - Cliff Yapp
-* rt tools auto-select an object when none is given - Sean Morrison
-* added metadata-aware image diff & nirt analysis - Cliff Yapp
-* added basic PNTS point-cloud ray tracing - Sean Morrison
-* improved nirt behavior in Windows bash consoles - Cliff Yapp
-* added g2asc/asc2g support for DSP and EBM - Sean Morrison
-* updated gct mesh decimation dependency to mmesh - Cliff Yapp
-* added procedural wing, propeller & tree generators - Cliff Yapp
-* added ISO tire dimensions & named tread presets - Cliff Yapp
-* added specimen, terrain, & voxelize proc-db tools - Sean Morrison
-* added gear, helicoil, lattice, loftwing proc-db - Sean Morrison
-* added authenticated IPC/TLS to fbserv & remrt/rtsrv - Cliff Yapp
-* improved rtwizard concurrency & remrt on Windows - Cliff Yapp
-* added simplification control options to bot extrude - Cliff Yapp
-* added bot exterior subcommand - Cliff Yapp
-* fixed 'search -type sph' not returning sph's - Chris McGregor
-* fixed gist crashing with bad/unknown units - Chris McGregor
-* add gist '-d' to allow user-specified density file - Chris McGregor
-* added Cauchy-Crofton area/volume & lint validation - Cliff Yapp
-* updated geogram dependency from v1.9.0 to v1.9.6 - Cliff Yapp
-* updated Manifold dependency from v2.5.1 to v3.2.1 - Cliff Yapp
-* updated SPSR dependency from v16.10 to v18.74 - Cliff Yapp
-* updated Embree dependency from v4.3.2 to v4.4.1 - Sean Morrison
-* updated ISPC dependency from v1.24.0 to v1.30.0 - Sean Morrison
-* updated oneTBB dependency from v2021.12.0 to v2023.0.0 - Sean Morrison
-* updated OSPRay dependency from v3.1.0 to v3.2.0 - Sean Morrison
-* updated rkcommon dependency from v1.13.0 to v1.15.2 - Sean Morrison
-* updated LIEF dependency from v0.15.1 to v0.17.6 - Cliff Yapp
-* updated Qt dependency from v6.10.2 to v6.11.1 - Cliff Yapp
-* added Bullet dependency v3.27 - Cliff Yapp
-
-
-----------------------------------------------------------------------
---- 2026-03-13  Release 7.42.2                                     ---
-----------------------------------------------------------------------
-
-Follow-on patch release to 7.42.0 correcting a couple of corner case
-BoT raytracing behaviors, incorporating behaviorial fixes for a number
-of commands, updating dependencies, and various documentation updates.
-
-* fixed BoT crash when invalid data present - Chris McGregor
-* updated stepcode to upstream SHA1 74b6fe4 - Cliff Yapp
-* replaced yedit with brledit as libbu fallback editor - Cliff Yapp
-* updated libtiff dependency to v4.7.1 - Cliff Yapp
-* updated OpenCV dependency to v4.13.0 - Cliff Yapp
-* updated PUGIXML dependency to v1.15 - Cliff Yapp
-* updated LMDB dependency to v0.9.35 - Cliff Yapp
-* updated libjpeg-turbo dependency to v3.1.3 - Cliff Yapp
-* updated sqlite dependency to v3.51.2 - Cliff Yapp
-* updated assimp dependency to v6.0.4 - Cliff Yapp
-* updated GDAL dependency to v3.12.1 - Cliff Yapp
-* updated PROJ dependency to v9.7.1 - Cliff Yapp
-* updated libpng dependency to v1.6.54 - Cliff Yapp
-* improved get/adjust/attr help text - Josh Baker
-* created manpage for 'adjust' command - Josh Baker
-* improved 'B' manpage options and usage - Josh Baker
-* improved 'voxelize' manpage usage and examples - Josh Baker
-* improved 'draw' manpage options and usage - Josh Baker
-* improved 'get' manpage - Josh Baker
-* improved 'view' manpage options, usage, and examples - Josh Baker
-* improved 'gqa' command usage and help text - Josh Baker
-* corrected various manpage typos and spacing - Josh Baker
-* fixed open cmd reporting when database not open - Cliff Yapp
-* updated g2asc to exit if input file == output file - Cliff Yapp
-* updated asc2g to exit if input file == output file - Cliff Yapp
-* fixed default file-create behavior of open command - Cliff Yapp
-* fixed bot -h crash when database not open - Cliff Yapp
-* fixed libged nirt cmd -c backout option support - Cliff Yapp
-* fixed bot subcmd help printing - Cliff Yapp
-* corrected BoT shotline behavior when starting ray pt in mesh
-        - Sean Morrison Chris McGregor Cliff Yapp
-* fixed gist never returning on some models - Chris McGregor
-* improved gist weight gathering speed and accuracy - Chris McGregor
-
-
-----------------------------------------------------------------------
---- 2025-08-11  Release 7.42.0                                     ---
-----------------------------------------------------------------------
-
-Polygonal BoT ray tracing is now dramatically faster.  Integration of
-a new spatial partition acceleration method (HLBVH) into librt's BoT
-ray tracing pipeline yields substantial speedups, better multicore
-scaling, and reduced memory overhead across all BRL-CAD ray tracing of
-scenes with BoTs.  In general, new overall performence is typicaly in
-the 2-25x range depending on the model, scene, and other factors.  The
-culmination of many efforts, the improvement was verified, validated,
-and performance tested against numerous real and test models to
-confirm gains and assert correctness.  As a result, users no longer
-need to tune TIE or ADRT-specific settings as both are fully obsoleted
-and replaced.
-
-This release expands Arbitrary Polyhedron support with 8 vertices
-(i.e., ARB8-only, not ARB7/6/5/4) to include concave definitions.
-Surfaces must (still) be planar and not self-intersect, but polyhedral
-edges creating concavities are now supported for ray tracing.
-
-MGED's nirt command use of .mgedrc qray settings was restored, which
-affects output styling (e.g., showing/hiding attributes).  To restore
-default behavior, delete .mgedrc in your home directory or remove
-existing qray settings manually.
-
-* increased app parallelism ceiling to 4096 threads - Sean Morrison
-* removed obsolete nirt -T BoT spatial partition option - Cliff Yapp
-* added support for concave arb8 primitive definitions - Sean Morrison
-* added example geometry model showcasing all types - Mitchell Roberts
-* fixed mged crash when switching databases after rt - Sean Morrison
-* mitigated multithreading contention on >32 core cpus - Sean Morrison
-* clarified material_name not found warning in rtweight - Cliff Yapp
-* fixed stat command crash with invalid path specifiers - Cliff Yapp
-* improved search std attr table in man page - Cliff Yapp
-* updated MGED nirt man page to reference cmdline version - Cliff Yapp
-* fixed raytracing crash with empty BoT solid in tree - Cliff Yapp
-* cleaned up nirt -L format listing output - Cliff Yapp
-* fixed MGED nirt command's use of .mgedrc qray formats - Cliff Yapp
-* improved MGED nirt cmd handling for large object lists - Cliff Yapp
-* removed requirement to launch nirt with objects listed - Cliff Yapp
-* improved k-g LS-DYNA keyword file geometry importer - Ali Haydar
-* added bot support for plate mode thickness get/set cmds - Cliff Yapp
-* fixed dbconcat treatment of a '/' prefix character - Cliff Yapp
-* fixed bb '-o' oriented bounding box option in MGED - Chris McGregor
-* added manual page for pixcmp, bwish, btclsh - Sean Morrison
-* fixed "ted" text edit and "make_pnts" GED commands - Cliff Yapp
-* renamed MGED x command to solid_report for clarity - Sean Morrison
-* fixed Archer "Center View" button and vslew GED command - Cliff Yapp
-* added support for console text editing on Windows - Cliff Yapp
-* added bb '-m' option for outputting midpoint - Chris McGregor
-* fixed sed crash when editing a brep object in MGED - Cliff Yapp
-* fixed primitive & matrix edit GUIs in MGED ("x -1") - Sean Morrison
-* added (align, dir and print) subcommands to 'view' - Chris McGregor
-* added (autoview, lookat, saveview) to 'view' - Chris McGregor
-* fixed mged 'process' command on read-only databases - Sean Morrison
-* replaced ADRT with HLBVH-acclerated BoT tracing - Timothy Reynolds
-* accelerated BoT ray tracing HLBVH integration across all librt apps
-	- Timothy Reynolds, Connor McLean, Ian Beckett, Samuel Reed,
-	- Gaultier Debarre, Sean Morrison, Chris McGregor, Cliff Yapp
-* various manpage and help text updates - Josh Baker
-* fixed -exec behavior with 'flat' search in mged - Chris McGregor
-* improved logging behavior from multiple threads - Kenneth Davis
-* removed libgdiam dependency - Chris McGregor
-* updated strclear dependency to latest bsd upstream - Cliff Yapp
-* updated Assimp to v5.4.3, with patch for CVE-2025-2151 - Cliff Yapp
-* updated OpenNURBS dependency to v8.10.24228.13001 - Cliff Yapp
-* updated GeometricTools dependency to 7adae93f8 - Cliff Yapp
-* updated GDAL dependency to v3.9.2 - Cliff Yapp
-* updated PROJ dependency to v9.5.0 - Cliff Yapp
-* updated SQLite dependency to v3.46.1 - Cliff Yapp
-* updated lmdb dependency to 9c9d345 - Cliff Yapp
-* updated libtiff dependency to v4.7.0 - Cliff Yapp
-* updated netpbm dependency to v10.86.42 - Cliff Yapp
-* updated LIEF dependency to v0.15.1 - Cliff Yapp
-* updated libpng dependency to v1.6.44 - Cliff Yapp
-
-
-----------------------------------------------------------------------
---- 2024-09-24 Release 7.40.2                                      ---
-----------------------------------------------------------------------
-
-* various manpage and help text updates - Josh Baker
-* improved gist -F default behavior - Chris McGregor
-* fixed gist crashing with halfspaces in component - Chris McGregor
-* fixed lint BoT check testing - Cliff Yapp
-* improved overlap checker dialog behavior - Chris McGregor
-* fixed rtwizard tree visuals in gist - Chris McGregor
-
-
-----------------------------------------------------------------------
---- 2024-08-16  Release 7.40.0                                     ---
-----------------------------------------------------------------------
-
-This major release of BRL-CAD improves the robustness of the facetize
-command.  Building on work begun in 7.38.0, for the first time BRL-CAD
-is able to successfully facetize all of BRL-CAD's example geometries.
-This involves a major change to the processing pipeline of the
-facetize command, allowing handling of individual primitives to be
-fault tolerant and automatically attempting fallback methods.
-Historically BRL-CAD facetize has attempted to produce output meshes
-even when individual operations fail by silently skipping over failing
-inputs, but now this behavior is changed to a stricter policy of
-halting when individual elements of the process do not succeed.
-
-This release also incorporates the tool 'gist' for generating a one
-page graphical overview and summary of the contents of a .g database.
-This tool is the culmination of work by multiple student teams from
-Texas A&M University and incorporates automatic layout features to
-produce geometry-appropriate visual arrangements.
-
-Also new in this release are capabilities for testing and repairing
-triangle meshes.   The lint command will now validate solid BoT
-behavior with the raytracer, and the 'bot repair' command is able to
-perform hole filling operations on some categories of non-manifold
-BoTs.  Another related new feature allows users to generate explicit
-volumetric BoTs using plate mode BoTs as inputs via the 'bot extrude'
-command.
-
-This release introduces a major change in the management of 3rd party
-dependencies.  The src/other directory has been replaced by an
-external repository specifically tasked with the job of managing 3rd
-party libraries.  By default BRL-CAD will download and build necessary
-dependencies as part of its build automatically.  However, note that
-an internet connection is required by default to access this
-repository.  See the INSTALL file for more details and options for
-preparing to build without internet availability.
-
-Developers requiring only a subset of BRL-CAD (for example, if a
-project only needs librt and its dependencies) can now define subsets
-of BRL-CAD to build with the BRLCAD_COMPONENTS variable.  See INSTALL
-for more information.
-
-* added new k-g LS-DYNA .k file to .g importer - Daniel Roßberg
-* improved obj-g import naming - Chris McGregor
-* added importer attr to stl-g and obj-g BoT objects - Cliff Yapp
-* improved object name generation for stl-g importer - Cliff Yapp
-* updated 3dm-g input attribute: converter -> importer - Cliff Yapp
-* fixed mged 'search -or' filter behavior - Cliff Yapp, Chris McGregor
-* major improvements to 'gist' features and usability
-	- Rohan Dhawan, Leo Feng, Sam Hollenbeck, Timothy Pham,
-	- Yida Zou, Chris McGregor
-* updated pinewood.g test model - Josh Baker
-* updated edcodes man page and help text - Josh Baker
-* update mvall man page - Josh Baker
-* updated OpenCV library to version 4.10.0 - Cliff Yapp
-* updated GDAL library to version 3.9.0 - Cliff Yapp
-* improved 3dm-g error message when file does not exist - Cliff Yapp
-* added new BoT raytracing validity checks to lint cmd - Cliff Yapp
-* removed upper limit on MGED pnts cmd point count - Cliff Yapp
-* added a -t option to bot flip to check BoT orientation - Cliff Yapp
-* fixed shaded drawing of CW BoT solids - Cliff Yapp
-* added reair man page - Josh Baker
-* added 'help reair' mged command help text - Josh Baker
-* added experimental 'imgdiff' command-line tool - Cliff Yapp
-* updated OpenNURBS library to version 8.8.24166.15000 - Cliff Yapp
-* improved 'help lc' mged command help text - Josh Baker
-* added 'help lint' mged command help text - Josh Baker
-* added man pages for 'bot check' and 'bot extrude' cmds - Cliff Yapp
-* enhanced bot extrude command to output a BoT mesh - Cliff Yapp
-* added bot check manifold cmd for bot validity testing - Cliff Yapp
-* added bot repair command for filling holes in meshes - Cliff Yapp
-* added Utah RLE image reading and writing to libicv - Cliff Yapp
-* added "standardize" option to GED attr command - Cliff Yapp
-* added -L option to dbconcat for lazy prefix/suffix use - Cliff Yapp
+* updated dbconcat to use prefix/suffix str for conflicts - Cliff Yapp
 
 
 ----------------------------------------------------------------------
@@ -579,7 +51,6 @@ for more information.
 ----------------------------------------------------------------------
 --- 2023-11-06  Release 7.38.0                                     ---
 ----------------------------------------------------------------------
-
 This major release of BRL-CAD introduces significant improvements to
 the robustness of the facetize command by leveraging the Manifold
 library for boolean evaluation of meshes. Facetization is an operation
@@ -618,7 +89,6 @@ processing high level assemblies in BRL-CAD's example geometry files:
 ----------------------------------------------------------------------
 --- 2023-07-26  Release 7.36.0                                     ---
 ----------------------------------------------------------------------
-
 This major release of BRL-CAD introduces significant updates to
 geometry conversion support. The update includes modernization for
 NURBS importing and interaction, BoT manipulation, and incorporates
@@ -676,8 +146,7 @@ Lastly, the "smooth" command will smooth the BoT's topology.
 * fixed nirt -f (fmt) to work within MGED - Chris McGregor
 * fixed nirt of objects with hyphens in name - Chris McGregor
 * correct facetall.sh to automatically restart on failure - Cliff Yapp
-* updated nirt to backout of geometry by default - Chris McGregor
-* added nirt -c flag to use view center, not backout - Chris McGregor
+
 
 ----------------------------------------------------------------------
 --- 2022-11-23  Release 7.34.0                                     ---
@@ -699,7 +168,7 @@ the stage for the aforementioned major feature developments.
 * removed 'nburst' rewrite with burst now deprecated - Cliff Yapp
 * fixed bot_merge with oriented plate mode bots - Sean Morrison
 * bot_dump infers output type from filename extension - Sean Morrison
-* re-added MGED viewring, sweep, collab, & rateknob menus - Cliff Yapp
+* readded MGED viewring, sweep, collab, & rateknob menus - Cliff Yapp
 * fixed a crash when shaded NURBS brep drawing fails - Cliff Yapp
 * added new man pages for brep, process, and ps commands - Cliff Yapp
 * added new man page for 3dm-g Rhino3D importer - Cliff Yapp
@@ -880,7 +349,7 @@ infrastructure with BRL-CAD's imminent migration to Git.
 * improved behavior of MGED overlap checker GUI - Nick Reed
 * fixed startup dimensions of overlap checker window - Nick Reed
 * fixed rtedge line drawing color when using -W flag - Cliff Yapp
-* added -F option to lint cmd to test specific solid types - Cliff Yapp
+* added -F option to lint cmd to test specifc solid types - Cliff Yapp
 * added support to MGED for zooming with mouse wheel - Cliff Yapp
 * fixed solid editing wireframe drawing in MGED - Nick Reed
 * added .r suffixes to region names in 3dm-g conversion - Cliff Yapp
@@ -1217,7 +686,7 @@ performance ray tracing pipeline.
 * improved datum wireframes (yellow) and fixed arrowheads - Cliff Yapp
 * added initial manual page for 'burst' ray dispatch tool - Cliff Yapp
 * improved wireframe display list performance - Keith Bowman
-* added draw -S for simplified wireframes, no subtractions - Cliff Yapp
+* added draw -S for simplied wireframes, no subtractions - Cliff Yapp
 * added draw -L# to draw bounding boxes for large objects - Cliff Yapp
 * added 3dm-g instance reference and definition import - Jon Engbert
 * minor rtwizard graphical user interface reorganization - Cliff Yapp
@@ -1441,7 +910,7 @@ tracing infrastructure including CPU thread affinity locking for
 faster performance, more consistent grazing hit behavior, expanded
 volume and surface area calculations, numerous bug fixes, and more
 robust NURBS evaluation.  Following BRL-CAD's interface deprecation
-policy (see CHANGES.adoc), the Jove text editor is no longer being
+policy (see CHANGES file), the Jove text editor is no longer being
 bundled.  Numerous converters receive robustness improvements
 including the STEP, Patch, and 3DM importers.
 
@@ -2118,7 +1587,7 @@ undo support and graphical editing, are expanded upon.
 * pipe now validates independent of parameter order - Daniel Roßberg
 * added '-r' color randomize option to 3dm-g importer - Cliff Yapp
 * enhanced '-v' verbosity option in 3dm-g importer - Cliff Yapp
-* re-added -A & -o attribute options to 'draw' and 'erase' - Bob Parker
+* readded -A & -o attribute options to 'draw' and 'erase' - Bob Parker
 * fixed bug in 'E' command to show object names - John Anderson
 * initial obj-g geometry importer - Erik Greenwald
 * Pro/E export plugin creates a 'Proe_Name' attribute - Bob Parker
@@ -3790,8 +3259,8 @@ future.  For those situations, developers using the BRL-CAD libraries
 may need to update to new API features in order to link with newer
 versions of BRL-CAD.
 
-See doc/changes/deprecated.adoc and doc/changes/obsoleted.adoc for
-features that are deprecated or have already become obsolete.
+See the CHANGES file for a transcript of features that are deprecated
+or have already become obsolete.
 
 ---
 See doc/history.txt for more historic information on BRL-CAD.  There

README

@@ -1,6 +1,6 @@
-                          BRL-CAD
-                      Release 7.46.0
-                    http://brlcad.org/
+			    BRL-CAD
+			 Release 7.38.2
+		       http://brlcad.org/
 
 BRL-CAD is a powerful cross-platform open source combinatorial
 solid modeling system that includes an interactive 3D solid geometry

audit/AUDIT_LEDGER.md

@@ -1,359 +0,0 @@
-# BRL-CAD RMF/STIG Cat 1 Vulnerability Tracking Ledger
-**Last Synchronized:** 2026-09-28 03:00:00 UTC
-
-| Issue ID | File | Lines | Cat 1 Type | Sev | Verification | Fix Status | 1-Sentence Nature of Issue |
-|:---|:---|:---:|:---|:---:|:---:|:---:|:---|
-| `SEC-0001` | `src/libpkg/pkg.c` | `1876-1923` | Invalid Free / Crasher | 3 | `CONFIRMED` | `FIXED` | pkg_waitfor fails to clear pc->pkc_buf on excess message length, causing subsequent pkg_close to call free on caller stack memory. |
-| `SEC-0002` | `src/libpkg/pkg.c` | `1960-1968` | Uninitialized Memory Access | 2 | `CONFIRMED` | `FIXED` | pkg_bwaitfor returns uninitialized heap buffer instead of NULL when network read fails or disconnects prematurely. |
-| `SEC-0003` | `src/libpkg/example_qt/server.cpp` | `46-59` | NULL Pointer Dereference / Crasher | 1 | `PENDING` | `UNFIXED` | PKGServer destructor unconditionally dereferences NULL client pointer and frees uninitialized pkc_inbuf. |
-| `SEC-0004` | `src/fbserv/server.c` | `432-540` | Heap Out-of-Bounds Read / Crasher | 3 | `CONFIRMED` | `FIXED` | fbserv packet handlers fail to validate packet payload length against pixel count before calling fb_write, causing heap out-of-bounds read. |
-| `SEC-0005` | `src/fbserv/server.c` | `476-580` | Integer Overflow / Heap Buffer Overflow | 3 | `CONFIRMED` | `FIXED` | Integer multiplication overflow in width*height in fb_readrect and fb_bwreadrect leads to heap buffer overflow during pixel read. |
-| `SEC-0006` | `src/remrt/rtsrv.c` | `891-971` | Integer Signedness / Out-of-Bounds Memory Access | 2 | `CONFIRMED` | `FIXED` | ph_lines fails to validate pixel range bounds, causing signed integer underflow in (b-a+1)*3 to wrap to huge size_t in pkg_2send, triggering out-of-bounds heap reads, and leaks buffer. |
-| `SEC-0007` | `src/remrt/remrt.c` | `3803-3806` | Unhandled Input Validation / Denial of Service | 2 | `CONFIRMED` | `FIXED` | ph_pixels parses incoming MSG_PIXELS without checking packet length or magic header, allowing malformed network packets to trigger out-of-bounds reads or terminate remrt via bu_bomb. |
-| `SEC-0008` | `src/libbu/parse.c` | `87-118` | Out-of-Bounds Memory Access / Buffer Underflow | 2 | `CONFIRMED` | `FIXED` | bu_struct_wrap_buf and PARSE_CK_GETPUT do not verify buffer length is at least 8 bytes, causing negative index access and out-of-bounds read on buffers with small or zero length. |
-| `SEC-0009` | `src/libbu/vls_vprintf.c` | `186-226` | Format String / Type Confusion | 2 | `CONFIRMED` | `FIXED` | vls_vprintf uses bitwise XOR (^=) instead of bitwise AND NOT (&= ~) to clear length modifiers, corrupting flags and causing incorrect type extraction from va_list. |
-| `SEC-0010` | `src/libbu/vls.c` | `433-465` | Off-by-One / Buffer Corruption | 2 | `CONFIRMED` | `FIXED` | bu_vls_substr calls bu_vls_putc with NUL, embedding an unwanted NUL byte and off-by-one corrupting vls_len. |
-| `SEC-0011` | `src/libbu/malloc.c` | `84-145,375-388` | Integer Overflow / Heap Overflow | 2 | `CONFIRMED` | `FIXED` | alloc() and bu_pool_alloc() lack integer multiplication overflow checks on cnt*size, which can cause undersized memory allocations and subsequent heap buffer overflows. |
-| `SEC-0012` | `src/libbu/argv.c` | `97,175,268-295` | Buffer Underflow / Out-of-bounds Pointer | 2 | `CONFIRMED` | `FIXED` | bu_argv_from_string computed pointer at strlen(lp)-1 on potentially empty string causing integer underflow and out-of-bounds pointer arithmetic. |
-| `SEC-0013` | `src/libbu/str.c` | `61-75` | Buffer Over-read | 2 | `CONFIRMED` | `FIXED` | bu_strlcatm uses unbounded strlen on dst to detect un-terminated buffers, causing out-of-bounds read. |
-| `SEC-0014` | `src/libbu/b64.c` | `216-284` | Null Pointer Dereference / Integer Overflow | 2 | `CONFIRMED` | `FIXED` | bu_b64 encode and decode functions lacked null pointer checks on input/output and cast lengths to signed 32-bit int. |
-| `SEC-0015` | `src/libbu/sscanf.c` | `312-320,365-375` | Format String / Scanset Parser Bug | 2 | `CONFIRMED` | `FIXED` | bu_vsscanf omitted literal ] and ^] from partFmt when extracting scanset specifiers, causing malformed format strings and scan failure. |
-| `SEC-0016` | `src/libbu/bitv.c` | `95-105,285-295,440-445,625-630` | Null Pointer Dereference / Integer Overflow | 2 | `CONFIRMED` | `FIXED` | bu_hex_to_bitv and bu_binary_to_bitv2 crashed on NULL input, and bu_bitv_shift_vector had integer overflow UB on INT_MIN. |
-| `SEC-0017` | `src/libbu/hash.c` | `125-135,180-190,270-280` | Null Pointer Dereference / Memory Safety | 2 | `CONFIRMED` | `FIXED` | bu_hash_get crashed on NULL key in _nhash_keycmp, and bu_hash_create/bu_hash_set lacked allocation failure handling. |
-| `SEC-0018` | `include/bu/ptbl.h, src/libbu/ptbl.c` | `105,119-120; 63,99,214,240,266,290` | Memory Access Violation / Buffer Overflow / Out-of-bounds Pointer | 3 | `CONFIRMED` | `FIXED` | BU_PTBL_FOR macro and BU_PTBL_LASTADDR cause out-of-bounds pointer calculation and segfault on empty tables with NULL buffers, and table reallocations lack integer multiplication overflow checks. |
-| `SEC-0019` | `src/libbu/affinity.c` | `74,90-104,108` | Out-of-bounds Bit Array Access / Resource Leak / Undefined Behavior | 2 | `CONFIRMED` | `FIXED` | parallel_set_affinity permitted negative cpu indexing into CPU_SET and negative bitshift on Windows, leaked Mach thread port rights, and passed wrong policy type for Mach thread affinity. |
-| `SEC-0020` | `src/libbu/backtrace.c` | `324,596,659-661,742` | NULL Pointer Dereference / Process Signal Safety | 2 | `CONFIRMED` | `FIXED` | bu_backtrace_app called bu_strlcpy on potentially NULL gdb_path, used negative file descriptors in write, and reaped arbitrary child processes via wait(NULL). |
-| `SEC-0021` | `src/libbu/cmd.c` | `50-66` | NULL Pointer Dereference / Buffer Underflow / Crasher | 2 | `CONFIRMED` | `FIXED` | bu_cmd lacked null checks on cmds, argv, and argv[cmd_index], allowed negative cmd_index causing buffer underflow, and executed unverified function pointers. |
-| `SEC-0022` | `src/libbu/damlevlim.cpp` | `68-159` | Integer Multiplication Overflow / Crasher | 2 | `CONFIRMED` | `FIXED` | bu_editdist computed buffer allocation size as (n+1)*(m+1) using signed 32-bit int, causing signed integer multiplication overflow, out-of-bounds access, and std::length_error crash on large strings. |
-| `SEC-0023` | `src/libbu/dirent.c, src/libbu/datetime.cpp` | `36-88; 173-197` | Heap Buffer Overflow / NULL Pointer Dereference / TOCTOU | 2 | `CONFIRMED` | `FIXED` | bu_file_list called opendir(NULL) when path is NULL and suffered from heap buffer overflow if directory entries were added concurrently between passes; bu_utctime crashed on NULL vls_gmtime. |
-| `SEC-0024` | `src/libbu/dir.c` | `69-75, 108, 169, 186, 248, 254, 395-405, 480-535, 656-665, 684-740` | Buffer Overflow / Underflow / NULL Pointer Dereference / Infinite Loop | 2 | `CONFIRMED` | `FIXED` | dir routines passed caller buffer len to fixed stack arrays risking stack buffer overflow, permitted underflow pointer reads in _bu_dir_join_path, crashed on NULL result in vdir, and risked infinite loop or crash in bu_mkdir/bu_dirclear on invalid paths. |
-| `SEC-0025` | `src/libbu/dylib.c` | `38-40, 70-87, 105-120` | Heap Use-After-Free / Double-Free / Thread Safety | 3 | `CONFIRMED` | `FIXED` | bu_dlunload freed the global handles table without resetting handles to NULL or max_handles to 0, leading to dangling pointer use-after-free heap writes on subsequent bu_dlclose calls and double-free on subsequent bu_dlunload calls; routines lacked thread synchronization. |
-| `SEC-0026` | `src/libbu/fchmod.cpp` | `62-75` | Invalid File Descriptor / Parameter Validation | 1 | `CONFIRMED` | `FIXED` | bu_fchmod passed unvalidated negative file descriptors to OS handles routines triggering CRT parameter validation errors or unexpected failures. |
-| `SEC-0027` | `src/libbu/file.cpp` | `79-110, 126-166, 193, 227-240, 360, 603-640` | Memory Leak / Resource Leak / NULL Pointer Dereference / Logic Flaw | 2 | `CONFIRMED` | `FIXED` | bu_file_same leaked allocated realpath strings on match and crashed on NULL paths, file_compare_info had an assignment instead of comparison operator bug, bu_file_exists leaked file descriptors, and stream seek/tell functions crashed on NULL streams. |
-| `SEC-0028` | `src/libbu/fnmatch.c` | `308-311` | NULL Pointer Dereference / Crasher | 2 | `CONFIRMED` | `FIXED` | bu_path_match immediately dereferenced pattern and string without NULL pointer checks, causing immediate SIGSEGV crashes on NULL inputs. |
-| `SEC-0029` | `src/libbu/gethostname.c` | `49, 81-84, 89` | Invalid Pointer Cast / NULL Pointer Dereference / Buffer Overflow | 2 | `CONFIRMED` | `FIXED` | bu_gethostname passed constant (LPDWORD)MAXPATHLEN as pointer to GetComputerName causing invalid pointer crash, left procfs file pointer unchecked causing null stream crash, and lacked entry bounds validation. |
-| `SEC-0030` | `src/libbu/getopt.c` | `34-39, 48-56, 65-72, 84, 98` | NULL Pointer Dereference / Buffer Over-read / Logic Flaw | 2 | `CONFIRMED` | `FIXED` | bu_getopt dereferenced NULL nargv elements and NULL *nargv in tell macro, read out of bounds on '\0' matched in ostr via strchr, and misidentified bare '-' as an option. |
-| `SEC-0031` | `src/libbu/glob.c` | `63, 84, 110, 161, 195, 240, 259, 286` | NULL Pointer Dereference / Crasher | 2 | `CONFIRMED` | `FIXED` | bu_glob internal helpers and callbacks dereferenced NULL pattern, path, directory entry, or stat buffer pointers without checking for NULL. |
-| `SEC-0032` | `src/libbu/heap.c` | `136, 200-216, 255` | Out-of-bounds Array Access / Integer Underflow | 2 | `CONFIRMED` | `FIXED` | bu_heap_get bypassed allocation size range check when DEBUG was not defined causing out-of-bounds heap bin indexing and underflow to SIZE_MAX when sz == 0, and lacked cpu id bounds clamping. |
-| `SEC-0033` | `src/libbu/hist.c` | `52, 82-100, 117-128` | Out-of-bounds Memory Write / NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bu_hist_range permitted negative or out-of-bounds 'a' indexing on NaN inputs causing heap write access violation, and bu_hist_init/bu_hist_pr crashed on NULL inputs. |
-| `SEC-0034` | `src/libbu/interrupt.c` | `78-83, 100-116, 137-163` | Signal Handler Leak / Out-of-bounds Array Access / Logic Flaw | 2 | `CONFIRMED` | `FIXED` | interrupt_restore_signal never restored signal handlers when no signal was received leaving temporary handler active indefinitely, checked wrong handler pointer, and lacked bounds check on signum. |
-| `SEC-0035` | `src/libbu/num.c` | `35-58, 87-90, 106` | Buffer Underflow / Integer Overflow UB / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | bu_num_print read out-of-bounds at tbl_start[-1] due to reversed condition ordering in trailing newline scan and crashed on empty strings; char_length had signed integer overflow UB on INT64_MIN and truncated 64-bit int to long. |
-| `SEC-0036` | `src/libbu/log.c` | `148, 156, 204, 222, 335` | NULL Pointer Dereference / Integer Overflow | 2 | `CONFIRMED` | `FIXED` | bu_flog lacked null pointer and empty string checks on fmt and fp, causing NULL pointer dereference crashes in fwrite, and bu_log helper routines lacked null pointer guards. |
-| `SEC-0037` | `src/libbu/mappedfile.c` | `360, 544-550, 577` | NULL Pointer Dereference / Integer Underflow | 2 | `CONFIRMED` | `FIXED` | bu_open_mapped_file_with_path crashed with SIGSEGV on NULL name or path, bu_free_mapped_files suffered from unsigned integer underflow on index removal, and bu_open_mapped_file allowed invalid file sizes. |
-| `SEC-0038` | `src/libbu/observer.c` | `36, 58, 110, 168, 194, 215` | NULL Pointer Dereference / Memory Safety | 2 | `CONFIRMED` | `FIXED` | bu_observer_cmd and helper routines dereferenced NULL argv or NULL observer lists without validation, and bu_observer_free left dangling pointers in the observer list. |
-| `SEC-0039` | `src/libbu/lex.c` | `42, 131, 155, 257, 268` | Integer Underflow / NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | lex_getone allowed negative *used integer underflow on number fallback, and bu_lex crashed on NULL token, rtstr, or NULL key strings. |
-| `SEC-0040` | `src/libbu/path_normalize.c` | `47, 86-88, 95` | Buffer Underflow / Concurrency Hazard / Integer Bounds | 2 | `CONFIRMED` | `FIXED` | bu_path_normalize used non-thread-safe static buffer, lacked lower-bound check in backward component scan allowing pointer underflow before resolved buffer, and used unchecked signed pointer arithmetic for MAXPATHLEN bounds check. |
-| `SEC-0041` | `src/libbu/printb.c` | `36, 40-52` | NULL Pointer Dereference / Undefined Bitshift / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | bu_vls_printb dereferenced NULL vls and bits strings, shifted signed 1L by negative or out-of-range bit numbers causing undefined behavior, and read out-of-bounds on strings ending after bit numbers. |
-| `SEC-0042` | `src/libbu/path.c` | `177-180, 211-218, 242-258` | NULL Pointer Dereference / Path Truncation Flaw | 2 | `CONFIRMED` | `FIXED` | bu_path_to_argv dereferenced NULL ac pointer causing crash, and bu_path_component corrupted file paths by stripping directories when a dot appeared in directory names under BU_PATH_EXTLESS and BU_PATH_EXT. |
-| `SEC-0043` | `src/libbu/parallel_cpp11thread.cpp` | `28-51` | Crash / Unhandled Exception / NULL Function Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | parallel_cpp11thread crashed on NULL func callback and caused std::terminate() aborts if thread creation threw an exception while previous threads remained joinable. |
-| `SEC-0044` | `src/libbu/progname.c` | `74-79, 140-143, 155-190` | Concurrency Hazard / Unchecked Buffer Overflow | 2 | `CONFIRMED` | `FIXED` | bu_argv0_full_path and bu_getprogname returned static non-thread-safe buffers and accessed bu_progname unsynchronized with concurrent bu_setprogname writes, and bu_argv0_full_path unchecked bu_getcwd return and appended with potential buffer overflow. |
-| `SEC-0045` | `src/libbu/realpath.c` | `38-66` | NULL Pointer Dereference / Crash | 2 | `CONFIRMED` | `FIXED` | bu_file_realpath dereferenced NULL path pointer into realpath, GetFullPathName, and bu_strlcpy fallback causing immediate SIGSEGV crashes. |
-| `SEC-0046` | `src/libbu/scan.c` | `38, 58-60, 68-73, 89-93` | Format String Flaw / Uninitialized Variable Memory Corruption | 2 | `CONFIRMED` | `FIXED` | bu_scan_fastf_t constructed dynamic scanf format strings from user delimiter allowing format string injection, and read uninitialized stack variable 'len' into offset when sscanf failed to reach %n specifier. |
-| `SEC-0047` | `src/libbu/semaphore.c` | `260-286, 298-301, 340-343` | Out-of-bounds Array Access / Concurrency Race Condition | 2 | `CONFIRMED` | `FIXED` | bu_semaphore_acquire and bu_semaphore_release lacked upper bounds checks on semaphore index causing out-of-bounds array access and integer overflow on UINT_MAX, and bu_semaphore_free destroyed mutexes without synchronizing on bu_init_lock. |
-| `SEC-0048` | `src/libbu/sha1.c` | `53, 110, 126, 150` | NULL Pointer Dereference / Memory Safety | 2 | `CONFIRMED` | `FIXED` | SHA1Transform, SHA1Init, SHA1Update, and SHA1Final lacked NULL pointer validation on context, data, digest, state, and buffer pointers causing SIGSEGV crashes. |
-| `SEC-0049` | `src/libbu/snooze.cpp` | `35-42` | Integer Overflow UB / Logic Flaw | 1 | `CONFIRMED` | `FIXED` | bu_snooze lacked upper bound clamping on 64-bit useconds causing integer overflow when converted to nanoseconds internally in std::chrono durations. |
-| `SEC-0050` | `src/libbu/sort.c` | `156-189, 381-402` | Memory Access Flaw / Divide by Zero | 2 | `CONFIRMED` | `FIXED` | bu_sort lacked checks for NULL a, NULL cmp, zero element size es == 0 (causing division by zero in introsort), and min(a, b) macro lacked parameter parentheses. |
-| `SEC-0051` | `src/libbu/tbl.c` | `381-432` | Buffer Underflow / Pointer Overflow | 2 | `CONFIRMED` | `FIXED` | bu_tbl_printf suffered from backward scan buffer underflow dereferencing buf[-1] and unbounded runaway pointer increment last += 2 over-reading memory. |
-| `SEC-0052` | `src/libbu/tc.c` | `33-200, 428-456` | Null Pointer Dereference / Memory Management | 2 | `CONFIRMED` | `FIXED` | bu_thrd_create dereferenced NULL thr pointer and lacked guard on NULL func; mutex and condition variable routines lacked NULL checks; used raw malloc/free. |
-| `SEC-0053` | `src/libbu/tcllist.c` | `538, 554-565` | Buffer Over-read / Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bu_argv_from_tcl_list crashed on NULL arguments; _bu_tcl_copy_collapse passed strlen(src) instead of remaining count to _bu_tcl_parse_backslash, allowing read out of bounds past list element. |
-| `SEC-0054` | `src/libbu/temp.c` | `85-151, 155-175` | Uninitialized Memory / Heap Corruption / Concurrency | 3 | `CONFIRMED` | `FIXED` | temp_add_to_list failed to copy initial_temp_files when reallocating from 8 to 16 elements, reading uninitialized memory and calling close() on garbage file descriptors at exit; global temp list lacked thread synchronization. |
-| `SEC-0055` | `src/libbu/units.c` | `237-244, 256-270, 390-440` | Buffer Underflow / Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | units_name_matches underflowed bu_vls_strlen - 1 to SIZE_MAX on empty strings/whitespace, causing out-of-bounds heap read; bu_units_conversion, bu_mm_value, and bu_mm_cvt crashed on NULL pointers. |
-| `SEC-0056` | `src/libbu/units_dehumanize.c` | `80-92, 131-137` | Null Pointer Dereference / Integer Overflow UB | 1 | `CONFIRMED` | `FIXED` | bu_dehumanize_number crashed on NULL str or size and performed signed multiplication without pre-overflow bounds check. |
-| `SEC-0057` | `src/libbu/units_humanize.c` | `74-82, 128-133` | Null Pointer Dereference / Integer Overflow UB | 2 | `CONFIRMED` | `FIXED` | bu_humanize_number dereferenced buf[0] before validating buf != NULL, causing crash when called with a NULL buffer; negation of INT64_MIN caused signed integer overflow UB. |
-| `SEC-0058` | `src/libbu/uuid.c` | `56, 89, 118-124, 134-161` | Buffer Overflow / Null Pointer Dereference / Logic Flaw | 2 | `CONFIRMED` | `FIXED` | bu_uuid_decode suffered critical 16-byte buffer overflow writing 32 bytes to a 16-byte array on non-adjacent hex strings; bu_uuid_create crashed on NULL uuid and corrupted UUIDv5 bits with 0x5F instead of 0x50; bu_uuid_encode crashed on NULL pointers. |
-| `SEC-0059` | `src/libbu/vfont.c` | `42, 60-100, 140-150, 184-196, 201-207` | File Descriptor Leak / Uninitialized Data / Null Dereference | 2 | `CONFIRMED` | `FIXED` | vfont_get passed potential NULL from bu_dir() to snprintf %s, left 256th dispatch entry uninitialized (i < 255), leaked file descriptors on read failures in get_font, and vfont_free crashed on NULL pointer. |
-| `SEC-0060` | `src/libbu/vlb.c` | `34-160` | Integer Overflow / Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bu_vlb_write lacked integer overflow protection on capacity addition and crashed when given NULL start; bu_vlb_init, bu_vlb_initialize, bu_vlb_free, and bu_vlb_print crashed on NULL pointers. |
-| `SEC-0061` | `src/libbu/cache.cpp` | `110-140, 220-250, 480-510` | Undefined Behavior / Memory Leak / Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bu_cache_close freed bu_cache_impl containing std::mutex with BU_PUT instead of delete causing destructor bypass and undefined behavior; bu_cache_keys leaked keystr memory; bu_cache_write_commit underflowed mv_size on negative lengths; NULL txn crashed transactions. |
-| `SEC-0062` | `src/libbu/color.cpp` | `52-95, 120-160` | Null Pointer Dereference / Float Validity | 2 | `CONFIRMED` | `FIXED` | bu_color_from_str, bu_rgb_to_hsv, and bu_hsv_to_rgb dereferenced NULL pointers unconditionally without validation; bu_color_from_rgb_floats lacked bounds and finite checks. |
-| `SEC-0063` | `src/libbu/convert.c` | `120-160, 200-240` | Buffer Overflow / Unsigned Underflow | 2 | `CONFIRMED` | `FIXED` | bu_cv_fmt_cookie decremented buflen below zero on small buffers (1-2 bytes), wrapping to SIZE_MAX and writing out of bounds; bu_cv_w_cookie and byte swap routines crashed on NULL or empty input. |
-| `SEC-0064` | `src/libbu/crashreport.c` | `110-140, 210-230` | File Descriptor Leak / Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bu_crashreport leaked file descriptor when ferror(fp) was true, and formatted potential NULL return from ctime(). |
-| `SEC-0065` | `src/libbu/env.c` | `140-190, 240-270` | Memory Leak / Null Pointer Dereference / Unchecked Input | 2 | `CONFIRMED` | `FIXED` | editor_not_compatible leaked component vls and dereferenced NULL candidate; editor_file_check lacked NULL checks; bu_setenv lacked POSIX environment variable name validation. |
-| `SEC-0066` | `src/libbu/opt.c` | `215-260, 480-520` | Null Pointer Dereference / Buffer Over-read / Type Mismatch | 2 | `CONFIRMED` | `FIXED` | opt_describe_internal_ascii crashed when arg_helpstr or help_string was NULL; docbook describe had curr vs d typo; opt_process over-read empty candidate; bu_opt_color had unsigned char type mismatch. |
-| `SEC-0067` | `src/libbu/parallel.c` | `280-310` | Out-of-Bounds Memory Access | 2 | `CONFIRMED` | `FIXED` | PARALLEL_PUT accessed mapping[id] without validating 0 <= id < MAX_PSW*MAX_PSW, causing out-of-bounds memory corruption. |
-| `SEC-0068` | `src/libbu/process.c` | `350-380, 520-560, 1220-1250` | Null Pointer Dereference / Memory Leak / Buffer Overflow | 2 | `CONFIRMED` | `FIXED` | bu_process_read unconditionally dereferenced *count = ... even if caller passed NULL; bu_process_exec leaked heap av on every execution; bu_interactive passed unchecked fd to FD_SET causing buffer overflow. |
-| `SEC-0069` | `src/libbu/uce-dirent.h` | `348-354, 578-583, 608-612` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | opendir, rewinddir, and _initdir relied solely on assert() in debug mode, crashing with NULL pointer dereference in release builds when given NULL dirname or DIR stream. |
-| `SEC-0070` | `src/libbu/vls_incr.cpp` | `136-155, 180-188` | Unhandled Exception / Denial of Service Crash | 2 | `CONFIRMED` | `FIXED` | bu_vls_incr accessed ivar.str(1) and nvar.str(1) without verifying match group count, throwing std::out_of_range which bypassed catch (const std::regex_error&) and crashed the application. |
-| `SEC-0071` | `src/libbu/whereami.c` | `95-135` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | _bu_getExecutablePath dereferenced pname[0] without checking if _bu_progname_raw() returned NULL, and copied memory into out when out == NULL. |
-| `SEC-0072` | `src/libbu/whereis.c` | `135-155` | Infinite Loop / Denial of Service | 2 | `CONFIRMED` | `FIXED` | bu_whereis bypassed pointer advancement on dirlen > MAXPATHLEN-2 with continue;, causing an infinite loop hanging the process at 100% CPU. |
-| `SEC-0073` | `src/libbu/which.c` | `91-115` | Infinite Loop / Memory Leak | 2 | `CONFIRMED` | `FIXED` | which_path suffered infinite loop on oversized directories and empty matches, and leaked initial_path every time an executable was not found. |
-| `SEC-0074` | `src/libbu/xdr.c` | `31-88` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bu_pshort, bu_gshort, bu_plong, bu_glong, and bu_plonglong dereferenced msgp without validating msgp != NULL, causing immediate segmentation fault. |
-| `SEC-0075` | `src/libbu/tests/dylib/dylib.c` | `35-85` | Memory Leak / Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bu_file_list allocated filenames and bu_vls plugin_pattern allocated memory which was never freed; dylib_close_plugins dereferenced NULL pointer when called with plugins == NULL. |
-| `SEC-0076` | `src/libbu/tests/dylib/plugin_1.cpp` | `22-28` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | calc dereferenced *result without checking if *result == NULL, causing crash on NULL buffer pointer. |
-| `SEC-0077` | `src/libbu/tests/dylib/plugin_2.cpp` | `22-28` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | calc dereferenced *result without checking if *result == NULL, causing crash on NULL buffer pointer. |
-| `SEC-0078` | `src/libbu/tests/test_dirname.c` | `58-82` | Stack Buffer Overflow / Format String UB | 2 | `CONFIRMED` | `FIXED` | bu_strlcpy used strlen(input)+1 instead of destination buffer size, causing stack buffer overflow on strings exceeding 1000 bytes; passed NULL to printf format string. |
-| `SEC-0079` | `src/libbu/tests/test_encode.c` | `70-90` | Undefined Behavior / Crash | 1 | `CONFIRMED` | `FIXED` | Passed NULL str directly to %*s and %s in printf when testing test_encode(NULL), causing undefined behavior and potential crash. |
-| `SEC-0080` | `src/libbu/tests/test_datetime.c` | `243-345` | Memory Leak / Unchecked Return | 1 | `CONFIRMED` | `FIXED` | result VLS was allocated and never freed across multiple date/time tests, leaking memory; sscanf return value was unvalidated. |
-| `SEC-0081` | `src/libbu/tests/test_basename.c` | `55-65, 130-140` | Null Pointer Dereference / Crash | 2 | `CONFIRMED` | `FIXED` | get_system_output(NULL) called basename(NULL) which causes segmentation fault on glibc implementations; passed NULL input to bu_log format strings. |
-| `SEC-0082` | `src/libbu/tests/test_progname.c` | `63-71, 107-115, 149-157, 189-197` | Heap Buffer Overflow / Off-by-one | 2 | `CONFIRMED` | `FIXED` | Allocated strlen(path) bytes via bu_calloc without space for null terminator before calling bu_strlcpy, causing buffer overflow; leaked allocated buffer. |
-| `SEC-0083` | `src/libbu/tests/test_mappedfile.c` | `70-74, 385-397` | Use-After-Free / Memory Leak / Float Comparison | 2 | `CONFIRMED` | `FIXED` | Accessed mfp->buf after closing mapped file via bu_close_mapped_file, performed raw float equality on double num, and leaked fname VLS. |
-| `SEC-0084` | `src/libbu/tests/test_process.c` | `172-184, 521-536, 680-705` | Process Resource Leak / NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | Failed to wait on or close process handles on error paths leaking processes, and attempted to close/read NULL file handles when fopen failed. |
-| `SEC-0085` | `src/libbu/tests/test_parallel.c` | `70-80, 115-125` | Array Out-of-Bounds / Crash | 2 | `CONFIRMED` | `FIXED` | Indexed counter array with cpu ID up to ncpu in tally without bound check, and omitted NULL data check in parallel recursion callback. |
-| `SEC-0086` | `src/libbu/tests/test_opt.c` | `58-64, 492-498` | Out-of-Bounds Memory Read / Pointer Type-Punning | 2 | `CONFIRMED` | `FIXED` | Read av[-1] when av was decremented without checking bounds, and type-punned unsigned int array to unsigned char pointer violating strict aliasing. |
-| `SEC-0087` | `src/libbu/tests/test_hook.c` | `45-55, 120-145` | NULL Pointer Dereference / Memory Leak | 2 | `CONFIRMED` | `FIXED` | Callback dereferenced clientdata pointer without NULL check and hook list structures were allocated and never freed across tests. |
-| `SEC-0088` | `src/libbu/tests/test_glob.c` | `95-110, 195-205` | Out-of-Bounds Read / NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | Read buffer out of bounds when checking trailing slash on short paths and called glob operations without validating NULL context pointers. |
-| `SEC-0089` | `src/libbu/tests/test_env.c` | `80-92, 128-135` | Resource Leak / Unchecked Return Value | 1 | `CONFIRMED` | `FIXED` | Did not check fopen return value before writing and failed to validate bu_strdup return value leaking memory on error. |
-| `SEC-0090` | `src/libbu/tests/test_escape.c` | `72-85, 140-150` | NULL Pointer Dereference / Format Flaw | 1 | `CONFIRMED` | `FIXED` | Passed unverified pointer to %s format specifier in printf calls and omitted explicit return code in test helper. |
-| `SEC-0091` | `src/libbu/tests/test_path_component.c` | `62-75` | Format String Flaw / NULL Dereference | 1 | `CONFIRMED` | `FIXED` | Passed NULL pointer to %24s in bu_log formatting calls, which crashes strict C runtime environments. |
-| `SEC-0092` | `src/libbu/tests/test_humanize_number.c` | `115-135` | Memory Leak | 1 | `CONFIRMED` | `FIXED` | Allocated string representations of flags and scale inside loop iterations without freeing them, causing repeated memory leaks. |
-| `SEC-0093` | `src/libbu/tests/test_file.c` | `70-75, 233-241` | Memory Leak / NULL Pointer Dereference | 1 | `CONFIRMED` | `FIXED` | cleanup() function leaked fname VLS allocation on return, and realpath test did not check if rpath was NULL before comparing. |
-| `SEC-0094` | `src/libbu/tests/test_file_mime.c` | `45-56` | Unchecked Return Value / Array Bounds | 1 | `CONFIRMED` | `FIXED` | Did not check sscanf return count allowing uninitialized integer use, and allowed negative context index causing out-of-bounds array access. |
-| `SEC-0095` | `src/libbu/tests/test_observer.c` | `45-55` | NULL Pointer Dereference | 1 | `CONFIRMED` | `FIXED` | Missing NULL check on observer callback event structure pointer before dereferencing. |
-| `SEC-0096` | `src/libbu/tests/test_parallel_concurrency.cpp` | `40-48` | NULL Pointer Dereference | 1 | `CONFIRMED` | `FIXED` | Thread worker function dereferenced user data pointer without checking for NULL. |
-| `SEC-0097` | `src/libbu/tests/test_path_match.cpp` | `38-52` | Resource Leak / Empty String Check | 1 | `CONFIRMED` | `FIXED` | ifstream remained open without explicit close and empty lines were parsed without validation. |
-| `SEC-0098` | `src/libbu/realpath.c` | `20-27` | POSIX/Darwin API Resolution / Failure to Canonicalize | 2 | `CONFIRMED` | `FIXED` | Under strict POSIX/XOPEN flags on macOS without _DARWIN_C_SOURCE, realpath bound to legacy conformance symbol which failed with EPERM, breaking path canonicalization across libbu. |
-| `SEC-0099` | `src/libbu/tests/test_realpath.c` | `47-79` | Memory Management / Resource Leak | 2 | `CONFIRMED` | `FIXED` | Heap memory leak of allocated path string, unchecked sscanf return value, and potential NULL printf argument in test_realpath.c. |
-| `SEC-0100` | `src/libbu/tests/test_semaphore.c` | `48-62` | Memory Access / NULL Pointer Dereference | 1 | `CONFIRMED` | `FIXED` | Unchecked callback argument pargs in multi-threaded function increment_thread could lead to NULL pointer dereference. |
-| `SEC-0101` | `src/libbu/tests/test_semaphore_registry.cpp` | `60-63` | Memory Access / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0102` | `src/libbu/tests/test_semchk.cpp` | `40-75` | Error Handling / Logic Error | 2 | `CONFIRMED` | `FIXED` | Undeclared identifier av[0] passed to bu_setprogname, unhandled file stream failure in process_file, and unguarded argv dereference. |
-| `SEC-0103` | `src/libbu/tests/test_snooze.c` | `44-48` | Memory Access / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0104` | `src/libbu/tests/test_sort.c` | `45-95` | Integer Wraparound / Underflow | 1 | `CONFIRMED` | `FIXED` | Integer subtraction bug in comparison function comp_1 (*(unsigned int *)num1 - *(unsigned int *)num2) caused unsigned underflow and reversed sort order; comp_4 lacked NULL pointer checks; sscanf return was unchecked. |
-| `SEC-0105` | `src/libbu/tests/test_static_init.cpp` | `44-48` | Memory Access / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0106` | `src/libbu/tests/test_str.c` | `115-180` | Memory Management / Resource Leak | 2 | `CONFIRMED` | `FIXED` | Memory leaks of allocated dst buffer across test_bu_strlcatm, test_bu_strlcpym, and test_bu_strdupm, unchecked sscanf, and negative integer cast to size_t. |
-| `SEC-0107` | `src/libbu/tests/test_str_isprint.c` | `70-98` | Format String / NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | Passing NULL string pointer to %10s format specifier in bu_log caused undefined behavior / crash; unchecked sscanf. |
-| `SEC-0108` | `src/libbu/tests/test_subprocess.cpp` | `45-55` | Uninitialized Memory Access | 2 | `CONFIRMED` | `FIXED` | Stack buffer char line[25] was uninitialized before std::cin.get(line, 25), leading to uninitialized memory read if stream was empty or in error state. |
-| `SEC-0109` | `src/libbu/tests/test_temp_filename.c` | `45-78` | Concurrency / Out-of-bounds Memory Access | 1 | `CONFIRMED` | `FIXED` | Passed &names (char ***) instead of names (char **) to bu_parallel, causing worker threads with cpu > 1 to read and write invalid stack memory outside the array; names[cpu - 1] caused underflow on cpu = 0; off-by-one heap allocation len + 1 caused string truncation. |
-| `SEC-0110` | `src/libbu/tests/test_units.c` | `48-58` | Memory Access / NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | Missing NULL pointer validation for csv and token in helper function units_csv_has_token. |
-| `SEC-0111` | `src/libbu/tests/test_uuid.c` | `55-90` | Logic Error / False-Pass Test Suite Flaw | 2 | `CONFIRMED` | `FIXED` | Typo in expected UUID string paired with inverted condition !bu_strcmp caused test suite to return 0 (PASS) on mismatch while returning 1 (FAIL) if it matched; missing error logging. |
-| `SEC-0112` | `src/libbu/tests/test_version.c` | `35-48` | Memory Access / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | Missing common.h include and unguarded av[0] dereference passed to bu_setprogname. |
-| `SEC-0113` | `src/libbu/tests/test_vlb.c` | `42-46` | Memory Access / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0114` | `src/libbu/tests/test_vls.c` | `115-680` | Memory Management / Resource Leak | 2 | `CONFIRMED` | `FIXED` | Heap memory leaks across 13 test functions using bu_vls_strdup solely for comparison without freeing the returned string; out-of-bounds argv access in test_bu_vls_substr; unchecked sscanf. |
-| `SEC-0115` | `src/libbu/tests/test_vls_incr.c` | `58-85` | Input Validation / Integer Parsing | 2 | `CONFIRMED` | `FIXED` | Unguarded argv dereference and unvalidated strtol conversion where invalid characters or out-of-range counts were unhandled. |
-| `SEC-0116` | `src/libbu/tests/test_vls_incr_uniq.cpp` | `50-93` | Memory Management / Resource Leak | 2 | `CONFIRMED` | `FIXED` | Memory leak of struct bu_vls name on exit; heap allocation leak of std::set on early exit; potential NULL pointer dereference in StrCmp. |
-| `SEC-0117` | `src/libbu/tests/test_vls_simplify.c` | `56-85` | Memory Access / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | Unguarded argv dereference before bu_setprogname, potential NULL pointer dereference in bu_log format string. |
-| `SEC-0118` | `src/libbu/tests/test_vls_vprintf.c` | `55-175` | Buffer Overflow / Stack Vulnerability | 1 | `CONFIRMED` | `FIXED` | Unbounded vsprintf into fixed 1024-byte stack buffer buffer[1024] created an unconstrained stack buffer overflow vulnerability; unchecked sscanf and unguarded argv. |
-| `SEC-0119` | `src/libbn/anim.c` | `304-332` | Numerical Stability / NaN Generation | 1 | `CONFIRMED` | `FIXED` | anim_mat2quat negative square root NaN generation caused by floating-point rounding when testing !ZERO(square); passed minute negative numbers into sqrt() resulting in NaN quaternion components. |
-| `SEC-0120` | `src/libbn/anim.c` | `153-176` | Buffer Overflow | 1 | `CONFIRMED` | `FIXED` | anim_mat_printf stack buffer overflow risk with fixed 128-byte character buffer when formatting 16 double-precision float values with custom prefix strings. |
-| `SEC-0121` | `src/libbn/anim.c` | `180-680` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | Missing NULL pointer checks across anim_mat_print, anim_dir2mat, anim_dirn2mat, anim_steer_mat, anim_v_permute, anim_v_unpermute, anim_tran, anim_mat2zyx, and anim_mat2ypr. |
-| `SEC-0122` | `src/libbn/complex.c` | `54-85` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bn_cx_div and bn_cx_sqrt dereferenced destination and operand pointers without validating against NULL. |
-| `SEC-0123` | `src/libbn/mat.c` | `1544-1578` | Stack Buffer Overflow | 1 | `CONFIRMED` | `FIXED` | bn_opt_mat looped up to argc when argc > 15, writing into fixed 16-element stack array fastf_t mtmp[16], overflowing the stack frame on excess arguments. |
-| `SEC-0124` | `src/libbn/mat.c` | `1500-1540` | Out-of-bounds Read | 1 | `CONFIRMED` | `FIXED` | bn_opt_mat out-of-bounds read when checking trailing closing brace with bu_vls_addr(&str)[bu_vls_strlen(&str)-1] without verifying bu_vls_strlen > 0. |
-| `SEC-0125` | `src/libbn/mat.c` | `80-140` | Buffer Overflow | 1 | `CONFIRMED` | `FIXED` | bn_mat_print_guts wrote into fixed obuf array without checking remaining capacity against bu_vls length, leading to potential buffer overflow. |
-| `SEC-0126` | `src/libbn/mat.c` | `1000-1060` | Concurrency Data Race / Logic Bug | 1 | `CONFIRMED` | `FIXED` | bn_wrt_point_direc declared transformation matrices as static local variables, causing data corruption across concurrent raytracing threads, and had inverted translation vector origin_to_pt. |
-| `SEC-0127` | `src/libbn/mat.c` | `1100-1200` | Division by Zero | 2 | `CONFIRMED` | `FIXED` | persp_mat and deering_persp_mat performed division by near_plane, right-left, and bottom-top without checking for zero denominators. |
-| `SEC-0128` | `src/libbn/msr.c` | `120-135` | Memory Access / Use-After-Free Prevention | 2 | `CONFIRMED` | `FIXED` | bn_gauss_free lacked NULL pointer guard and failed to clear magic identifier before freeing heap structure. |
-| `SEC-0129` | `src/libbn/mt19937ar.c` | `170-257` | Dead Code | 3 | `CONFIRMED` | `FIXED` | Dead #if 0 code block with test main function embedded within shared library source file. |
-| `SEC-0130` | `src/libbn/multipoly.c` | `80-101` | Heap Memory Corruption | 1 | `CONFIRMED` | `FIXED` | bn_multipoly_grow realloc corruption passing outer pointer array P->cf instead of row array P->cf[i] with sizeof(double*) instead of sizeof(double), overwriting row pointers with pointer array address. |
-| `SEC-0131` | `src/libbn/multipoly.c` | `80-101` | Out-of-bounds Access | 1 | `CONFIRMED` | `FIXED` | bn_multipoly_grow failed to update P->dgrs and P->dgrt dimensions after growing, leaving stale dimensions that caused subsequent operations to access out of bounds or fail to allocate. |
-| `SEC-0132` | `src/libbn/multipoly.c` | `120-132` | Out-of-bounds Read | 1 | `CONFIRMED` | `FIXED` | bn_multipoly_add out-of-bounds read when polynomials had differing degrees, reading beyond allocated row bounds, and dimension calculation typo Max(p1->dgrt, p2->dgrs) instead of p2->dgrt. |
-| `SEC-0133` | `src/libbn/multipoly.c` | `140-155` | Logic / Numerical Error | 1 | `CONFIRMED` | `FIXED` | bn_multipoly_mul overwrote accumulated product terms using = instead of +=, destroying earlier polynomial term contributions sharing identical combined powers. |
-| `SEC-0134` | `src/libbn/multipoly.c` | `70-75` | Resource Leak | 1 | `CONFIRMED` | `FIXED` | Missing bn_multipoly_free function causing 100% memory leak of all 2D dynamically allocated bivariate polynomial matrices. |
-| `SEC-0135` | `src/libbn/noise.c` | `248-430` | Null Pointer Dereference / Dead Code | 2 | `CONFIRMED` | `FIXED` | Missing NULL pointer validation on point and result in bn_noise_perlin, bn_noise_vec, and spectral functions; 22 lines of dead #if 0 code in bn_noise_mf. |
-| `SEC-0136` | `src/libbn/noise.c` | `460-545` | Out-of-bounds Access / Allocation Flaw | 1 | `CONFIRMED` | `FIXED` | build_spec_tbl and find_spec_wgt allowed negative or zero octaves, leading to invalid memory allocation size (int)(octaves+1) <= 0 and out-of-bounds weight table indexing. |
-| `SEC-0137` | `src/libbn/numgen.c` | `52-72` | Resource Leak / Typo | 1 | `CONFIRMED` | `FIXED` | bn_numgen_create allocated generator on the heap before validating dim > 0 and seed < 0, leaking the allocated structure on early return; nperiodic typo in flag check. |
-| `SEC-0138` | `src/libbn/poly.c` | `50-168` | Memory Corruption / Pointer Aliasing | 1 | `CONFIRMED` | `FIXED` | In-place pointer aliasing in bn_poly_mul, bn_poly_add, and bn_poly_sub when destination pointer equaled one of the operand polynomials caused coefficients to be overwritten before being read. |
-| `SEC-0139` | `src/libbn/poly.c` | `170-197` | Buffer Overflow / Unsigned Underflow | 1 | `CONFIRMED` | `FIXED` | bn_poly_synthetic_division assigned -1 to unsigned size_t quo->dgr when divisor degree exceeded dividend degree, underflowing to SIZE_MAX and triggering an unbounded loop writing past the 7-element coefficient array. |
-| `SEC-0140` | `src/libbn/poly.c` | `200-488` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | Missing NULL pointer checks in bn_poly_quadratic_roots, bn_poly_cubic_roots, bn_poly_quartic_roots, bn_pr_poly, and bn_pr_roots. |
-| `SEC-0141` | `src/libbn/qmath.c` | `84-331` | Memory Access Violation / Numerical Robustness | 2 | `CONFIRMED` | `FIXED` | In quat_mat2quat, negative diagonal difference caused NaN and division-by-zero on non-orthogonal matrices; acos() called on unconstrained dot products causing NaN domain errors; missing NULL pointer checks across quaternion math operations. |
-| `SEC-0142` | `src/libbn/randsph.c` | `50-120` | Denial of Service / Memory Access Violation | 2 | `CONFIRMED` | `FIXED` | Potential infinite loop in _bn_unit_sph_sample when bn_randmt() yields exactly 0.5; possible NaN from sqrt(1 - S) when S slightly exceeds 1 due to floating-point rounding; unchecked return value from bn_sobol_next in _bn_unit_sph_sample_sobol. |
-| `SEC-0143` | `src/libbn/sobol.c` | `148-325` | Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bn_sobol_create did not check the return status of sobol_init, creating partially initialized structures with NULL member pointers when sdim was invalid; rightzero32 had undefined behavior if invoked with 0xffffffffU; _sobol_urand and bn_sobol_next lacked NULL pointer checks. |
-| `SEC-0144` | `src/libbn/sphmap.c` | `35-315` | Buffer Overflow / Resource Leak | 1 | `CONFIRMED` | `FIXED` | Heap buffer overflow in bn_spm_pix_load which allocated nx*nx*3 bytes instead of nx*ny*3 while reading nx*ny*3 bytes; permanent memory leak of buffer on fread failure; out-of-bounds array reads and writes in bn_spm_read, bn_spm_write, and bn_spm_get when u or v >= 1.0 or negative; bn_spm_free checked magic number before checking for NULL pointer. |
-| `SEC-0145` | `src/libbn/str.c` | `42-177` | Uninitialized Memory Read | 2 | `CONFIRMED` | `FIXED` | bn_decode_mat, bn_decode_quat, and bn_decode_vect copied uninitialized stack memory into destination buffers when sscanf matched fewer items than required or failed; missing NULL pointer checks across decode and encode routines. |
-| `SEC-0146` | `src/libbn/tabdata.c` | `35-1215` | Null Pointer Dereference / Resource Leak | 2 | `CONFIRMED` | `FIXED` | Second pass fopen in bn_read_table_and_tabdata was unchecked, causing NULL pointer dereference in bu_fgets if reopening failed; memory leak of allocated table/tabdata on read failure; unsigned integer underflow in bn_table_delete_sample_pnts when i > j; NULL pointer dereference in bn_table_free and bn_tabdata_free. |
-| `SEC-0147` | `src/libbn/ulp.c` | `118-204` | Undefined Behavior | 2 | `CONFIRMED` | `FIXED` | Referenced non-existent union member d in union flt_bits (val.d += 1 and minVal.d = 1 << 23); undefined behavior in signed 32-bit shift 1 << 52 when setting 64-bit exponent. |
-| `SEC-0148` | `src/libbn/wavelet.c` | `170-625` | Resource Leak | 1 | `CONFIRMED` | `FIXED` | Permanent memory leaks in make_wlt_haar_2d_decompose, make_wlt_haar_2d_reconstruct, and make_wlt_haar_2d_decompose2 when tbuffer/tbuf is NULL because allocated buffers were never freed; missing NULL buffer and zero dimension validation across wavelet routines. |
-| `SEC-0149` | `src/libbn/tests/test_util.c` | `48-265` | Null Pointer Dereference | 1 | `CONFIRMED` | `FIXED` | Missing NULL pointer checks in test helper and test dispatch functions (mat_close, vect_close, hvect_close, finite_vec, orthonormal_rotation, normalize_quat, make_table, make_tabdata, bn_api_single, and bn_api_dispatch) when called with NULL pointers or empty argument lists. |
-| `SEC-0150` | `src/libbg/pca.cpp` | `55-80` | Out-of-Bounds Read | 1 | `CONFIRMED` | `FIXED` | bg_pca computed Thin U on a 3xnpnts matrix using JacobiSVD. When npnts < 3, Thin U has fewer than 3 columns, causing out-of-bounds column reads and assertions when indexing svd.matrixU()(row, 1) and svd.matrixU()(row, 2). |
-| `SEC-0151` | `src/libbg/pointgen.c` | `35-60` | Logic / Format String Flaw | 2 | `CONFIRMED` | `FIXED` | bg_sph_sample referenced undeclared variable sample instead of pnts[i], used %d format specifier for size_t integers in bu_log, checked sample instead of center for translation offset, and lacked defensive NULL pointer validation on pnts. |
-| `SEC-0152` | `src/libbg/sat.cpp` | `44-175` | NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bg_sat_line_aabb, bg_sat_line_obb, bg_sat_tri_aabb, bg_sat_tri_obb, bg_sat_aabb_obb, and bg_sat_obb_obb called v3_from_array and axis_and_extent_from_vect without verifying point_t and vect_t pointer arguments, leading to null pointer dereferences. |
-| `SEC-0153` | `src/libbg/lseg_lseg.cpp` | `37-45` | NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bg_distsq_lseg3_lseg3 unpacked input point arrays without null pointer validation and lacked extern C linkage in its C++ definition. |
-| `SEC-0154` | `src/libbg/lseg_pt.cpp` | `36-45` | NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bg_distsq_lseg3_pt indexed point coordinates without checking for null pointers. |
-| `SEC-0155` | `src/libbg/tri_pt.cpp` | `37-60` | NULL Pointer Dereference / Domain Error | 2 | `CONFIRMED` | `FIXED` | bg_tri_closest_pt indexed triangle vertices and sample points without null pointer checks and computed std::sqrt(result.sqrDistance) without non-negative clamping. |
-| `SEC-0156` | `src/libbg/tri_ray.cpp` | `43-70` | NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | intersect_triangle and vec3_from_array dereferenced point and vector arguments without checking for null pointers. |
-| `SEC-0157` | `src/libbg/util.c` | `50-145` | Divide by Zero / NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | coplanar_2d_coord_sys scaled origin by 1.0/n without verifying n >= 3, leading to division by zero if n <= 0 and undefined behavior for degenerate point sets. coplanar_3d_to_2d and coplanar_2d_to_3d lacked null checks on pointer parameters and count validation. |
-| `SEC-0158` | `src/libbg/aabb_ray.c` | `31-143` | NULL Pointer Dereference / Deprecated Keyword | 3 | `CONFIRMED` | `FIXED` | bg_ray_invdir lacked null check on dir; bg_isect_aabb_ray lacked null checks on invdir, aabb_min, aabb_max, and opt; wrote into *r_min and *r_max without verifying destination pointers were non-null; used deprecated register storage class keywords. |
-| `SEC-0159` | `src/libbg/obr.cpp` | `95-100` | Validation Flaw | 3 | `CONFIRMED` | `FIXED` | bg_3d_coplanar_obr accepted point count < 3 even though a 3D coplanar coordinate system requires at least 3 points to determine a plane normal. |
-| `SEC-0160` | `src/libbg/polygon.c` | `144-205` | Buffer Overflow / Stack Buffer Corruption & Divide by Zero | 1 | `CONFIRMED` | `FIXED` | Operator precedence flaw in bg_3d_polygon_centroid where *cent[1] and *cent[2] evaluate to *(cent[1]) and *(cent[2]), writing 24 and 48 bytes out of bounds past caller's point_t stack/heap memory; uninitialized accumulation; division by zero when polygon is perpendicular to XY or XZ projection planes. |
-| `SEC-0161` | `src/libbg/chull.c` | `50-185` | Out-of-bounds Read / Memory Leak | 2 | `CONFIRMED` | `FIXED` | Out-of-bounds read and negative deque index in bg_polyline_2d_chull when vertex count n < 3; permanent memory leaks in bg_3d_coplanar_chull of points_tmp and overwritten hull_2d pointer; missing NULL checks. |
-| `SEC-0162` | `src/libbg/chull2.cpp` | `50-230` | Out-of-bounds Read / Memory Leak | 2 | `CONFIRMED` | `FIXED` | Out-of-bounds read and negative deque index in bg_polyline_2d_chull2 for n < 3; permanent memory leak of polyline in bg_2d_chull2; missing NULL parameter checks. |
-| `SEC-0163` | `src/libbg/clip.c` | `60-140` | Divide by Zero / Thread-Safety Race Condition | 2 | `CONFIRMED` | `FIXED` | Division by zero in bg_lseg_clip for vertical or horizontal line segments; thread-safety race condition in bg_ray_vclip due to static local variables diff, sv, st, mindist, maxdist causing concurrent raytracing thread conflicts. |
-| `SEC-0164` | `src/libbg/polygon_triangulate.cpp` | `873-970` | Memory Leak / Unchecked Return Value | 2 | `CONFIRMED` | `FIXED` | Unchecked return value of fopen in bg_tri_plot_2d causing NULL pointer dereference; permanent memory leaks of holes_array container and tri_out_pts in bg_polygon_triangulate; missing validation on polygon contour points. |
-| `SEC-0165` | `src/libbg/tri_tri.c` | `180-715` | NULL Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | bg_tri_tri_isect_with_line unconditionally wrote to *coplanar, *isectpt1, and *isectpt2 without verifying destination pointers were non-null; missing NULL vertex validation across all triangle-triangle intersection routines. |
-| `SEC-0166` | `src/libbg/polygon_op.cpp` | `45-470` | NULL Pointer Dereference / Divide by Zero | 2 | `CONFIRMED` | `FIXED` | Unchecked NULL pointer dereferences in bg_find_polygon_area, bg_polygons_overlap, load_polygon, and clipping routines; potential division by zero on zero scale factor. |
-| `SEC-0167` | `src/libbg/polygon_point_in.c` | `40-51` | Integer Underflow / Out-of-bounds Read | 2 | `CONFIRMED` | `FIXED` | bg_pnt_in_polygon underflows j = nvert - 1 when nvert == 0 and allows nvert < 3 which is geometrically invalid for polygons; missing NULL pointer checks on pnts and test. |
-| `SEC-0168` | `src/libbg/chull3d.cpp` | `115-210` | Out-of-bounds Read / Degenerate Buffer Access | 3 | `CONFIRMED` | `FIXED` | bg_3d_chull and bg_3d_chull2 did not check for empty vertexBuffer or undersized indexBuffer before allocating and indexing; out-of-bounds access in bg_3d_chull2 if face index exceeded vmap size. |
-| `SEC-0169` | `src/libbg/vert_tree.c` | `140-180, 260-430` | Spatial Partitioning Stride Corruption / Resource Leak | 3 | `CONFIRMED` | `FIXED` | Stride indexing corruption in bg_vert_tree_add_w_norm where vertex coordinate data was accessed with stride 3 instead of stride 6 (ptr->vleaf.index * 3 vs index * 6), causing spatial partitioning corruption and reading wrong coordinate/normal data; permanent memory leaks in bg_vert_tree_destroy which failed to free the_array when the_tree was NULL and failed to free the bg_vert_tree container structure. |
-| `SEC-0170` | `src/libbg/decimate.cpp` | `55-70, 160-175` | Truncated Integer Division / Overflow | 2 | `CONFIRMED` | `FIXED` | Truncated integer division in trimesh_decimate_simple (1/cbin.size()) where 1 / cbin.size() evaluated to integer 0 for any bin with >1 point, collapsing the point accumulator to world origin [0,0,0] instead of the bin centroid; missing n_ifaces integer overflow guard. |
-| `SEC-0171` | `src/libbg/delaunator.hpp` | `40-55, 240-305` | Out-of-bounds Read / Unhandled Exception | 2 | `CONFIRMED` | `FIXED` | Out-of-bounds vector read in sum() on empty vector (indexing x[0]); out-of-bounds vector read and crash in Delaunator constructor when n < 3 or when seed points i0 or i1 are uninitialized (accessing coords[2 * INVALID_INDEX]); unhandled exception in bg_polygon_triangulate when Delaunator encounters degenerate collinear input. |
-| `SEC-0172` | `src/libbg/ballpivot.cpp` | `30-75` | Unchecked Error Code / Parameter Validation | 2 | `CONFIRMED` | `FIXED` | Unchecked negative return code in bg_3d_ballpivot (if (nfaces == 0) instead of if (nfaces <= 0)), allowing negative face count to be passed into bg_trimesh_3d_gc; missing validation for radii_cnt < 0 or radii_cnt > 0 with NULL radii; missing initial NULL assignment to output pointers. |
-| `SEC-0173` | `src/libbg/RTree.h` | `465-480, 1740-1800` | Unchecked File Operation / Null Dereference | 1 | `CONFIRMED` | `FIXED` | Unchecked fopen() return value in RTree::plot() and RTree::plot2d() leading to NULL pointer dereference on file write failure; missing NULL check on filename in RTFileStream::OpenRead and RTFileStream::OpenWrite; unguarded VertexDataSource count on NULL pointer in QuickHull.hpp. |
-| `SEC-0174` | `src/libbg/polygon_triangulate.cpp` | `560-585` | Defensive Parameter Validation | 1 | `CONFIRMED` | `FIXED` | Missing parameter validation in bg_detria for faces, num_faces, poly, poly_pnts, pts, holes_array, holes_npts, and steiner, which could cause segmentation faults when called with NULL or undersized inputs. |
-| `SEC-0175` | `src/libbg/trimesh.cpp` | `368-379, 458-465, 754, 789` | Pointer Corruption / Memory Leak / Logic Error | 3 | `CONFIRMED` | `FIXED` | In get_unmatched_edges, &unmatched was passed instead of unmatched to bg_trimesh_unmatched_edges with bg_trimesh_edge_gather, corrupting pointer memory; unmatched->count was used uninitialized in bu_calloc; edge_list was leaked permanently. In bg_trimesh_hanging_nodes, unmatched was leaked on all paths and memcpy was undersized (num_edges * 2 bytes instead of num_edges * 2 * sizeof(int)). In bg_trimesh_solid, a false positive solid result occurred when unmatched edges were zero but misoriented or excess edges existed, leaking memory and passing NULL to memcpy. |
-| `SEC-0176` | `src/libbg/trimesh.cpp` | `812, 840-848, 876-878` | Out-of-Bounds Memory Access / Buffer Overflow | 2 | `CONFIRMED` | `FIXED` | Missing vertex index bounds validation in bg_trimesh_aabb, bg_trimesh_area, and bg_trimesh_volume allowed out-of-bounds reads into point array p and out-of-bounds writes into visit_vert bitvector when called with corrupted or invalid mesh face data. |
-| `SEC-0177` | `src/libbg/trimesh_diff.cpp` | `67-77, 206-255, 313-348` | Logic Error / Inverted Topology Map | 2 | `CONFIRMED` | `FIXED` | In bg_trimesh_diff, ind_map_1 and ind_map_2 inverted the mapping from original to sorted vertex indices (ind_map[i] = orig_ind instead of ind_map[orig_ind] = i), and tri_2 indexed with f1 instead of f2, ignoring mesh 2 face data; bg_trimesh_hash had the same mapping inversion and an early break in its minimum vertex search loop; dbl_clamp could trigger float overflow on non-positive tolerance. |
-| `SEC-0178` | `src/libbg/spsr.cpp` | `52-54, 105-178` | Unchecked Exception / Memory Leak / Input Validation | 2 | `CONFIRMED` | `FIXED` | In bg_3d_spsr, missing parameter validation on points, normals, and face pointers allowed NULL pointer dereferences; num_input_pnts < 3 caused solver failures; negative cnt in PtStream caused unsigned overflow; unhandled C++ exceptions escaping the extern C boundary leaked implicit solver memory and aborted the program. |
-| `SEC-0179` | `src/libbg/trimesh_isect.cpp` | `56-74, 95-245, trimesh_plot3.cpp:82, 351-372` | Unchecked File Operation / Null Pointer Dereference / Division by Zero | 2 | `CONFIRMED` | `FIXED` | In trimesh_isect.cpp, plot_faces called pl_color on unchecked fopen() return, causing NULL pointer dereference on file write failure; bg_trimesh_isect failed to validate vertex indices in faces_1 and faces_2 against vertex counts, risking OOB access, and never assigned output intersecting faces. In trimesh_plot3.cpp, pntset_2d_plot3 used bitwise OR (!p | !c); polyline_2d_plot3 allowed division by zero on scale <= 0.0 and loop condition i < xy.size() - 1 dropped the last vertex before closing. |
-| `SEC-0180` | `src/libbg/trimesh_remesh.cpp` | `82-87, trimesh_repair.cpp:126-131, trimesh_split.cpp:94-192, trimesh_sync.cpp:122` | Input Validation / Integer Overflow / Exception Safety | 1 | `CONFIRMED` | `FIXED` | Missing vertex index validation, integer overflow guards on face counts / allocation sizes, and unhandled C++ exceptions escaping extern C functions in bg_trimesh_remesh, bg_trimesh_repair, bg_trimesh_separate, bg_trimesh_split, and bg_trimesh_sync. |
-| `SEC-0181` | `src/libbg/GTE/Mathematics/TriMesh.h` | `208-212, 536-580, 595-650, 715-775` | Undefined Behavior / Data Loss / Out-of-Bounds Memory Access | 1 | `CONFIRMED` | `FIXED` | status(EdgeHandle e) used reinterpret_cast<EdgeStatus&> on std::vector<bool>::operator[] proxy bit-reference yielding undefined behavior; TriMesh::garbage_collection() wiped face connectivity before reading vertices destroying active geometry; multiple handle and iterator methods lacked index bounds validation. |
-| `SEC-0182` | `src/libbg/GTE/Mathematics/BotSmooth.h` | `85-115, BotSubdivide.h:48-95, 330-360` | Input Validation / Integer Overflow / Denial of Service | 2 | `CONFIRMED` | `FIXED` | Unchecked face vertex indices allowed out-of-bounds reads into vertex coordinate arrays in gte_bot_smooth and gte_bot_subdivide; unconstrained subdivision recursion levels allowed exponential memory allocation and integer overflow. |
-| `SEC-0183` | `src/libbg/GTE/Mathematics/LSCMParameterization.h` | `96-120, 160-220, 275-310` | Input Validation / Division by Zero / Matrix Solvability | 2 | `CONFIRMED` | `FIXED` | Missing vertex index bounds checking on boundaryIndices, interiorIndices, and triangle vertex references when indexing vertices3D in MapBoundaryToCircle and Parameterize; unchecked linear system matrix dimensions could lead to division by zero or invalid memory access in SolveSymmetricCG. |
-| `SEC-0184` | `src/libbg/GTE/Mathematics/MeshHoleFilling.h` | `275-320, 520-560, MeshPreprocessing.h:130-155, 225-255` | Out-of-Bounds Memory Access / Input Validation | 2 | `CONFIRMED` | `FIXED` | Unchecked triangle vertex indices allowed out-of-bounds reads in ComputeEarScore3D, ComputeTriangulationArea, TriangulateHoleLSCM, and MeshPreprocessing::ComputeTriangleArea / ComputeSignedVolume / RemoveSmallComponents. |
-| `SEC-0185` | `src/libbg/GTE/Mathematics/MeshQuality.h` | `230-236, MeshValidation.h:122-138, 220-250, MeshRepair.h:200-215, 430-495, 600-630, 990-1005` | Null Pointer Dereference / Out-of-Bounds Array Access | 3 | `CONFIRMED` | `FIXED` | MeshQuality::ComputeTriangleRaw lacked null pointer validation for raw vertex pointers; MeshValidation::HasSelfIntersections and TriangleBoxesOverlap lacked empty mesh and vertex index bounds validation; MeshRepair lacked vertex index bounds validation in computeTotalArea, DetectIsolatedVertices, ColocateVertices, RelativeOrientation, Dissociate, and RemoveIsolatedVertices. |
-| `SEC-0186` | `src/libbg/tests/polygon_op.c` | `55-80, 240-270` | Unsigned Integer Underflow / Out-of-Bounds Memory Access | 2 | `CONFIRMED` | `FIXED` | In _bg_polygon_diff, offset calculation size_t p2_ind = ((offset + j) >= c1->num_points) ? (j - offset) : (offset + j); produces an unsigned integer underflow when j < offset, wrapping p2_ind to SIZE_MAX and causing an out-of-bounds array access. In addition, unvalidated dcr2 dereferencing could crash on empty polygons, and plot_files contained a contour array dimension mismatch. |
-| `SEC-0187` | `src/libbg/tests/bgtester.c` | `85-115, 230-260` | Stack Buffer Overflow / Potential Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | In parse_case, parameter arrays d, l, i, u were fixed 50-element stack buffers populated in a while loop without bounds checking, allowing stack buffer overflows on inputs exceeding 50 parameters. In main, token strings returned by strtok were dereferenced without checking for NULL. |
-| `SEC-0188` | `src/libbg/tests/chull.c` | `40-70, obr.c:45-75` | Null Pointer Dereference / Logical Indexing Flaw | 3 | `CONFIRMED` | `FIXED` | In plot2d_chull, plot_chull3d, and plot_obr, fopen results were passed directly to pl_color and fclose without NULL verification, risking null pointer crashes if file creation failed. Additionally, plot2d_chull indexed pnt_array[i][0] when closing the polygon loop instead of pnt_array[0][Y]. |
-| `SEC-0189` | `src/libbg/tests/plane_dist.c` | `35-50, lseg_pt.c:45-65, geogram_optimizer.cpp:55-80` | Division by Zero / Unchecked Parsing / Missing Pointer Validation | 3 | `CONFIRMED` | `FIXED` | In plane_dist.c, relative error calculation performed division by expected_return without checking for zero, resulting in division by zero (NaN/Inf). In lseg_pt.c, sscanf return counts were unchecked, allowing uninitialized stack values to be used. In geogram_optimizer.cpp, converged_optimizer was dereferenced without checking for NULL. |
-| `SEC-0190` | `src/libbg/tests/poly2tri.c` | `110-180, chull.c:120-170, chull3d.c:70-130` | Resource Leak / Memory Management | 3 | `CONFIRMED` | `FIXED` | Dynamically allocated vertex, face, hole, and output polygon arrays allocated via bu_calloc/bu_malloc in poly2tri.c, chull.c, and chull3d.c were never freed prior to test completion or return, resulting in systematic memory leaks. |
-| `SEC-0191` | `src/libbg/tests/polygon_triangulate.c` | `48-62, 134-150, 184-192, 225-237, 269-281, 298-306` | Resource Leak / Null Pointer Dereference | 3 | `CONFIRMED` | `FIXED` | Dynamically allocated face index arrays allocated by bg_poly_triangulate and bg_nested_poly_triangulate across all five test cases were never released via bu_free prior to block exit, causing memory leaks. In addition, _tess_report lacked validation guarding against NULL face and point arrays. |
-| `SEC-0192` | `src/libbg/tests/tri_ray_isect.cpp` | `44-64, tri_tri_isect_coplanar.cpp:41-61` | Out-of-Bounds Substring / Unchecked Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | In read_point(), if an empty or whitespace-only argument was supplied, find_first_not_of returned std::string::npos, causing substr(sp, ep-sp+1) to throw an unhandled std::out_of_range exception. Additionally, input pointers p and arg were not validated before use, and sscanf return values in main were unchecked. |
-| `SEC-0193` | `src/libbg/tests/tri_tri_isect.c` | `31-66, tri_closest_pt.c:43-53` | Uninitialized Stack Memory / Unchecked Input Parsing | 3 | `CONFIRMED` | `FIXED` | In tri_tri_isect.c, stack variables f1 and f2 were left uninitialized in declaration float f1, f2, f3 = 0.0;, and sscanf return counts were unchecked across all coordinate arguments in tri_tri_isect.c and tri_closest_pt.c, risking calculation using uninitialized stack coordinates upon malformed input. |
-| `SEC-0194` | `src/libbg/tests/trimesh_sync.c` | `109-130, tri_area.c:49-53` | Null Pointer Dereference Guard / Code Quality | 3 | `CONFIRMED` | `FIXED` | In trimesh_sync.c, error reporting function parrays() dereferenced ff and ctrl pointers without verifying that they were non-NULL, risking null pointer dereferences during error handling. In tri_area.c, an extraneous duplicate semicolon was cleaned up. |
-| `SEC-0195` | `src/libbg/geogram/NL/nl_matrix.c` | `765-780` | Out-of-Bounds Memory Access / Buffer Overflow | 2 | `CONFIRMED` | `FIXED` | In nlSparseMatrixConstruct, the row array was allocated with capacity m (NL_NEW_ARRAY(NLRowColumn, m)), but the row initialization loop mistakenly iterated up to n (for (i=0; i<n; i++)). If the column count n exceeded the row count m, this resulted in an out-of-bounds write past the allocated row buffer; if n < m, rows from n to m-1 remained uninitialized. |
-| `SEC-0196` | `src/libbg/geogram/NL/nl_matrix.c` | `132-143` | Logic Error / Broken Comparator | 1 | `CONFIRMED` | `FIXED` | In nlCoeffCompare, the comparator callback returned (((NLCoeff*)(p2))->index < ((NLCoeff*)(p1))->index), returning only 0 or 1. It violated strict weak ordering required by qsort/bu_sort (never returning negative values when p1 < p2), risking non-deterministic sort order or sorting anomalies. |
-| `SEC-0197` | `src/libbg/geogram/NL/nl_blas.c` | `1440-1455, 1495-1510` | Format String / Type Mismatch & Division by Zero | 2 | `CONFIRMED` | `FIXED` | In host_blas_show_stats, nlBlasGFlops() returns a double, but was passed to nl_printf using %d format specifier, risking register/stack corruption on 64-bit platforms. Furthermore, nlBlasGFlops() divided by elapsed_time without checking for zero elapsed time. |
-| `SEC-0198` | `src/libbg/geogram/NL/nl_api.c, src/libbg/geogram/NL/nl_preconditioners.c` | `nl_api.c:660-675, nl_preconditioners.c:110-130, 215-265` | Divide-by-Zero / Floating Point Exception | 2 | `CONFIRMED` | `FIXED` | In nlNormalizeRow, the normalization divided by vector norm without checking if the norm was zero, leading to division by zero on degenerate rows. In Jacobi and SSOR preconditioners (nlNewJacobiPreconditioner, nlSparseMatrixMultLowerInverse, nlSparseMatrixMultUpperInverse), diagonal entries were divided without guards against zero diagonal entries. |
-| `SEC-0199` | `src/libbg/geogram/NL/nl_private.h, src/libbg/geogram/NL/nl_os.c, src/libbg/geogram/NL/nl_amgcl.cpp` | `nl_private.h:288-300, nl_os.c:55-135, nl_amgcl.cpp:178-195` | Macro Hazard / Null Pointer Dereference Guard | 1 | `CONFIRMED` | `FIXED` | NL_DELETE and NL_DELETE_ARRAY macros expanded to multiple unbracketed statements (free(x); x = NULL), creating dangerous syntax and logic errors when used inside unbraced single-line conditionals. Error reporting and assertion handlers in nl_os.c lacked NULL checks on function pointers and format arguments. AMGCL solver interface in nl_amgcl.cpp lacked NULL checks on context, matrices, and vectors. |
-| `SEC-0200` | `src/libbg/geogram/basic/attributes.cpp` | `390-405` | Buffer Overflow / Logic Error in Dimension Check | 3 | `CONFIRMED` | `FIXED` | In AttributesManager::copy_attribute, the compatibility check between existing attribute and destination attribute tested if ((store->size() != new_store->size()) && (store->dimension() != new_store->dimension()) && (store->element_size() != new_store->element_size())) using logical AND (&&) instead of logical OR (||). If the attributes had matching dimensions but differing element counts, the condition evaluated to false, allowing memcpy to copy an oversized source buffer into an undersized destination buffer, causing a critical heap buffer overflow. |
-| `SEC-0201` | `src/libbg/geogram/basic/thread_sync.h` | `150-227` | Memory Leak / Missing Destructor & Dangling Pointer | 2 | `CONFIRMED` | `FIXED` | BasicSpinLockArray allocated heap memory via new spinlock[size_in], but lacked a destructor (~BasicSpinLockArray()), causing all allocated spinlock arrays to be leaked upon destruction. Furthermore, BasicSpinLockArray::clear() deleted the array without resetting size_ to 0 or spinlocks_ to nullptr, and CompactSpinLockArray::clear() did not reset spinlocks_ to nullptr, leaving dangling pointers. |
-| `SEC-0202` | `src/libbg/geogram/basic/packed_arrays.cpp, src/libbg/geogram/basic/packed_arrays.h` | `packed_arrays.cpp:90-185, packed_arrays.h:160-165` | Memory Management Flaw / Out-of-Bounds Read & Write | 2 | `CONFIRMED` | `FIXED` | In PackedArrays, calloc return values were not checked for allocation failure. In resize_array, realloc(ZV_[array_index], 0) was invoked when shrinking to <= Z1_block_size_, risking platform-dependent memory leaks or undefined behavior, and the realloc return was directly assigned without failure handling. Array accessors (get_array, set_array, resize_array, array_size) lacked bounds checks on array_index in release mode. |
-| `SEC-0203` | `src/libbg/geogram/basic/parallel.cpp, src/libbg/geogram/basic/permutation.h, src/libbg/geogram/basic/attributes.cpp` | `parallel.cpp:67-85, permutation.h:158-240, attributes.cpp:160-180` | Integer Underflow & Unbounded Stack Allocation | 2 | `CONFIRMED` | `FIXED` | In parallel_for, if from >= to, unsigned integer subtraction to - from underflowed to a massive positive number (~4 billion), causing thread spawning loops with out-of-bounds tasks. In Permutation::apply and AttributeStore::swap_items, BRLCAD_ALLOCA was invoked unconditionally on element sizes, risking stack overflow on large elements. In Permutation::apply(vector<T>&, ...), mismatch between data size and permutation size was not checked, violating documented contract and causing out-of-bounds access. |
-| `SEC-0204` | `src/libbg/geogram/basic/assert.h, src/libbg/geogram/basic/memory.h, src/libbg/geogram/basic/geometry_nd.h, src/libbg/geogram/basic/rationalg.h, src/libbg/geogram/basic/vecg.h` | `assert.h:145-215, memory.h:390-485, geometry_nd.h:215-295, rationalg.h:540-550, vecg.h:180-195` | Macro Precedence Hazards & Divide-by-Zero / Floating-Point Exception | 1 | `CONFIRMED` | `FIXED` | Assertions in assert.h were defined with raw braces { ... } rather than do { ... } while(0), causing dangling-else and syntax errors in conditional contexts. geo_aligned_alloca macro parameter was unparenthesized. Memory::aligned_allocator::allocate lacked integer overflow check on size * sizeof(T). triangle_area lacked max(A2, 0.0) guard causing sqrt(negative) NaNs, and triangle_circumcenter divided by determinant without zero check. rationalg::estimate() divided by denominator without zero check. vecng initializer_list constructor lacked bounds check on iteration count. |
-| `SEC-0205` | `src/libbg/geogram/mesh/index.h, src/libbg/geogram/mesh/mesh.h, src/libbg/geogram/mesh/mesh.cpp` | `index.h:70-130, mesh.h:200-475, mesh.cpp:115-460` | Out-of-Bounds Memory Access & Integer Overflow | 2 | `CONFIRMED` | `FIXED` | In MeshCells::pop(), cell_ptr_[nb()-1] was accessed unconditionally; simplicial meshes store an empty or single-element cell_ptr_, resulting in heap out-of-bounds reads. In MeshVertices::copy, point_ptr(0) was called when rhs.nb() == 0, accessing beyond empty buffers. In Mesh::get_subelements_by_type and get_subelements_by_index, invalid queries dereferenced null pointers *(MeshSubElementsStore*)nullptr. Index classes left buffer arrays uninitialized in default constructors. create_sub_elements and reserve lacked integer multiplication overflow guards. In connect_tets and connect, corrupt facet/cell vertex indices were not validated against vertices_.nb(). |
-| `SEC-0206` | `src/libbg/geogram/mesh/mesh_AABB.h, src/libbg/geogram/mesh/mesh_AABB.cpp` | `mesh_AABB.h:45-1250, mesh_AABB.cpp:35-180` | Divide-by-Zero & Out-of-Bounds Vector Access | 2 | `CONFIRMED` | `FIXED` | In ray_triangle_intersection, 1.0 / det was calculated prior to checking whether fabs(det) >= 1e-20, causing floating-point division by zero and NaN/Inf propagation on rays coplanar to triangle planes. Querying or intersecting AABB trees built on empty meshes (nb() == 0) accessed bboxes_[1] out-of-bounds and caused infinite recursion in max_node_index. |
-| `SEC-0207` | `src/libbg/geogram/mesh/mesh_geometry.h, src/libbg/geogram/mesh/mesh_geometry.cpp, src/libbg/geogram/mesh/mesh_halfedges.cpp` | `mesh_geometry.h:210-240, mesh_geometry.cpp:80-160, mesh_halfedges.cpp:60-145` | Divide-by-Zero & Denial of Service / Process Abort | 1 | `CONFIRMED` | `FIXED` | mesh_facet_center and mesh_cell_center divided by corner/vertex counts without checking for empty facets/cells (0 count). In mesh_geometry.cpp, normalize was called on zero vectors, and bounding box functions did not validate null output pointers or zero-vertex meshes. In MeshHalfedges, border and vertex traversals on non-manifold or cyclical meshes aborted the process via geo_assert_not_reached or geo_assert(count < 10000) instead of gracefully failing. |
-| `SEC-0208` | `src/libbg/geogram/mesh/mesh_repair.cpp, src/libbg/geogram/mesh/mesh_preprocessing.h, src/libbg/geogram/mesh/mesh_preprocessing.cpp, src/libbg/geogram/mesh/mesh_topology.cpp` | `mesh_repair.cpp:65-175, 490-590, 665-685, 820-840, 920-1010, 1145-1215; mesh_preprocessing.h:77; mesh_preprocessing.cpp:65-135; mesh_topology.cpp:48-105` | Out-of-Bounds Memory Access, Stack Exhaustion & Process Abort | 2 | `CONFIRMED` | `FIXED` | In repair_connect_facets, v2c[v1], c2f[c2], and next_c_around_v[c] were indexed without validating vertex/corner indices against mesh element counts, causing out-of-bounds array reads. facet_is_degenerate and normalize_facet_vertices_order performed unbounded BRLCAD_ALLOCA stack allocations for vertex arrays on arbitrary polygonal facets without heap fallback, causing stack overflow vulnerabilities. find_corner, repair_propagate_orientation, and SimplePriorityQueue::pop aborted the process on malformed topological meshes via geo_assert_not_reached. mesh_colocate_vertices_no_check indexed old2new without bounds checks. In mesh_preprocessing.cpp and mesh_topology.cpp, empty meshes or unbound attributes resulted in out-of-bounds indexing in component traversal and signed volume calculation. |
-| `SEC-0209` | `src/libbg/geogram/mesh/mesh_reorder.cpp, src/libbg/geogram/mesh/mesh_remesh.cpp` | `mesh_reorder.cpp:280-295, 430-445, 570-585, 935-945, 1115-1175; mesh_remesh.cpp:75-80, 125-140, 150-165, 205-255, 285-295, 470-505` | Divide-by-Zero & Out-of-Bounds Buffer Indexing | 2 | `CONFIRMED` | `FIXED` | In mesh_reorder.cpp, Base_fcmp::center and Base_ccmp::center computed 1.0 / double(nb_vertices) without checking nb_vertices == 0, causing floating-point division by zero; Base_tcmp accessed 4 cell vertices without validating vertex count. In mesh_remesh.cpp, remesh_smooth and mesh_adjust_surface crashed or had undefined behavior on empty meshes or meshes with dimension < 3; mesh_adjust_surface divided by double(d) on facets with 0 vertices; create_ribbon_on_border called normalize on zero-length normal vectors, causing NaNs. |
-| `SEC-0210` | `src/libbg/geogram/mesh/mesh_sampling.h` | `mesh_sampling.h:68-95, 120-165, 215-265, 285-335` | Divide-by-Zero & Buffer Overflow | 2 | `CONFIRMED` | `FIXED` | In mesh_generate_random_samples_on_surface and mesh_generate_random_samples_in_volume, division by total area (Atot) and total volume (Vtot) occurred without checking Atot <= 0.0 or Vtot <= 0.0, resulting in division by zero and NaN sample coordinates on degenerate meshes. mesh_facet_mass and mesh_tetra_mass lacked bounds checking on facet/cell vertex counts and attribute arrays, potentially reading out of bounds. |
-| `SEC-0211` | `src/libbg/geogram/delaunay/delaunay.cpp, src/libbg/geogram/delaunay/delaunay.h` | `delaunay.cpp:115-180, 245-290; delaunay.h:200-245` | Out-of-Bounds Memory Access & Assertion Abort | 2 | `CONFIRMED` | `FIXED` | In delaunay.cpp (update_v_to_cell, update_cicl, get_neighbors_internal, save_histogram), missing bounds checks on vertex and cell indices allowed out-of-bounds writes to v_to_cell_ and cicl_ on corrupted mesh topology or NO_INDEX vertices. In save_histogram, an off-by-one check (histogram.size() <= N instead of < N) allowed out-of-bounds array writes. In delaunay.h, geo_assert_not_reached() was called on unlinked cells causing process crashes instead of graceful failure. |
-| `SEC-0212` | `src/libbg/geogram/delaunay/delaunay_nn.cpp` | `delaunay_nn.cpp:120-195, 230-310` | Stack Exhaustion & Unbounded Allocation | 2 | `CONFIRMED` | `FIXED` | In delaunay_nn.cpp (enlarge_neighborhood, store_neighbors_CB, get_neighbors_internal), unbounded BRLCAD_ALLOCA was used for neighbor candidate and distance arrays proportional to requested neighbor counts. High neighbor counts or deep recursion could exhaust thread call stacks causing stack overflow crashes. Additionally, float equality comparison against 0.0 triggered compiler warnings. |
-| `SEC-0213` | `src/libbg/geogram/points/colocate.cpp` | `colocate.cpp:85-150` | Stack Exhaustion & Unbounded Allocation | 2 | `CONFIRMED` | `FIXED` | In Colocate::find_nearest_neighbors, unbounded BRLCAD_ALLOCA was invoked per point for neighbor query arrays based on requested neighbor counts, creating risk of stack overflow on large neighbor queries. |
-| `SEC-0214` | `src/libbg/geogram/points/kd_tree.cpp, src/libbg/geogram/points/kd_tree.h` | `kd_tree.h:110-145; kd_tree.cpp:180-260, 410-480, 520-600` | Uninitialized Memory, Out-of-Bounds Access & Infinite Recursion | 3 | `CONFIRMED` | `FIXED` | In kd_tree.h, KdTree::NearestNeighbors constructor initialized loop condition with nb_neighbors (which was 0) instead of nb_neighbors_max, leaving neighbor index and distance arrays uninitialized and leaking memory to user callers via copy_to_user(). In kd_tree.cpp, AdaptiveKdTree::split_kd_node failed to clamp split point m, resulting in child nodes duplicating parent intervals [b, e) and causing infinite recursion and call stack exhaustion. KdTree::get_nearest_neighbors_leaf used fixed-size stack arrays local_idx[MAX_LEAF_SIZE] without checking e - b <= MAX_LEAF_SIZE. BalancedKdTree::get_node and AdaptiveKdTree::get_node lacked bounds checks on node index n. |
-| `SEC-0215` | `src/libbg/geogram/points/nn_search.cpp, src/libbg/geogram/points/nn_search.h` | `nn_search.h:70-90; nn_search.cpp:45-75` | Out-of-Bounds Access & Assertion Abort | 2 | `CONFIRMED` | `FIXED` | In nn_search.cpp (get_nearest_neighbors), query point index q_index was not validated against nb_points(), risking out-of-bounds point access. In nn_search.h (get_nearest_neighbor), geo_assert(result < nb_points()) triggered process abort when no neighbors were found on empty point sets instead of returning NO_INDEX. |
-| `SEC-0216` | `src/libbg/geogram/numerics/multi_precision.cpp, src/libbg/geogram/numerics/multi_precision.h` | `multi_precision.h:115-125; multi_precision.cpp:80-145, 595-610` | Memory Corruption & Heap Buffer Under-Allocation | 3 | `CONFIRMED` | `FIXED` | In multi_precision.cpp, Pools::malloc, Pools::free, and Pools::new_chunk assumed item_size was at least sizeof(Memory::pointer), but for item_size < sizeof(void*) on 64-bit systems, casting chunk memory to Memory::pointer* wrote 8 bytes into smaller slots (such as 4-byte expansion headers), causing heap metadata and adjacent block corruption. In Pools::free, null pointer dereferences were not guarded. In Pools::new_chunk, raw allocation without try-catch risked inconsistent pool state on allocation failure. In multi_precision.h, expansion_allocator::bytes(capa) calculated byte requirements using unchecked 32-bit arithmetic, risking integer overflow on large capacities. |
-| `SEC-0217` | `src/libbg/geogram/numerics/multi_precision.cpp` | `multi_precision.cpp:215-230, 240-275, 305-330, 680-720` | Out-of-Bounds Memory Access & Integer Underflow | 2 | `CONFIRMED` | `FIXED` | In multi_precision.cpp, compress_expansion performed index arithmetic m - 1 without verifying e.length() > 1. For length 0 or 1, m underflowed to 0xFFFFFFFF, resulting in massive out-of-bounds heap reads and writes. In scale_expansion_zeroelim, fast_expansion_sum_zeroelim, and fast_expansion_diff_zeroelim, expansions were accessed at index 0 without checking for zero-length inputs, reading uninitialized or unallocated heap memory. In assign_sq_dist and assign_dot_at, coordinate dimension dim == 0 caused underflow dim - 1 and unbounded recursion. |
-| `SEC-0218` | `src/libbg/geogram/numerics/predicates.cpp, src/libbg/geogram/numerics/PCK.h` | `PCK.h:170-175; predicates.cpp:445-460, 620-635, 960-975, 1130-1145, 1395-1410, 1535-1550` | Assertion Failure Denial-of-Service Crashes | 2 | `CONFIRMED` | `FIXED` | In predicates.cpp, exact predicate implementations asserted that primary determinant minors were non-zero (geo_assert(Delta_sign != ZERO)). When degenerate, collinear, or coplanar input configurations occurred, these assertions aborted the process via SIGABRT instead of gracefully returning ZERO or falling back to symbolic perturbation. In PCK.h, SOS() macro asserted geo_assert_not_reached on invalid SOSMode instead of gracefully returning ZERO. |
-| `SEC-0219` | `src/libbg/geogram/numerics/predicates.cpp, src/libbg/geogram/numerics/predicates.h, src/libbg/geogram/numerics/PCK.cpp` | `PCK.cpp:25-35; predicates.h:260-275; predicates.cpp:1640-2260` | Mathematical Logic Flaw & Missing Pointer Validation | 2 | `CONFIRMED` | `FIXED` | In predicates.cpp (PCK::dot_3d), det_3d_filter(p0, p1, p2) was erroneously invoked instead of dot_3d_filter(p0, p1, p2), returning the sign of a 3x3 determinant rather than the dot product whenever the determinant filter succeeded. Across predicates.cpp and predicates.h, geometric predicate functions lacked null pointer checks for double* coordinate arrays, causing segmentation faults on null pointers. In PCK.cpp, percent(a, b) lacked division-by-zero protection when b == 0. |
-| `SEC-0220` | `src/libbg/geogram/voronoi/RVD.cpp` | `1754-1775, 1810-1855, 2480-2500, 2535-2587` | Use-After-Free / Dangling Pointer & Missing Null Validation | 3 | `CONFIRMED` | `FIXED` | In prepare_projection(), mesh_vertices_ held a raw pointer to a local vector<double> destroyed upon function return, causing project_points_on_surface() to read through a dangling pointer (use-after-free). In RestrictedVoronoiDiagram::create, delaunay was dereferenced prior to checking for null pointer. |
-| `SEC-0221` | `src/libbg/geogram/voronoi/generic_RVD_utils.h, src/libbg/geogram/voronoi/generic_RVD_vertex.h` | `generic_RVD_utils.h:45-55, 275-290, 345-385; generic_RVD_vertex.h:175-195, 240-260, 270-300, 725-770` | Buffer Overflow, Integer Shift Overflow, Unchecked Realloc & Vector Stack Underflow | 2 | `CONFIRMED` | `FIXED` | In generic_RVD_utils.h, VectorStack::pop() called pop_back() on empty vectors causing out-of-bounds underflow; array_capacity computed 1 << (result - 1) with 32-bit signed shift that overflowed on large capacities; and insert() directly reassigned realloc return pointers without failure validation. In generic_RVD_vertex.h, small_set appended past capacity DIM without bounds checks; PointAllocator lacked chunk allocation failure handling and bounds checks. |
-| `SEC-0222` | `src/libbg/geogram/voronoi/generic_RVD_cell.cpp, src/libbg/geogram/voronoi/generic_RVD_polygon.cpp, src/libbg/geogram/voronoi/RVD_callback.cpp, src/libbg/geogram/voronoi/RVD.cpp` | `generic_RVD_cell.cpp:635-645, 1020-1040; generic_RVD_polygon.cpp:520-530; RVD_callback.cpp:80-95; RVD.cpp:1620-1695, 2410-2420, 2580-2585` | Denial-of-Service Assertion Aborts & Unchecked Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In side_exact, initialize_from_surface_mesh, triangulate_polygon, run_thread, and RestrictedVoronoiDiagram::create, assertions geo_assert and geo_assert_not_reached were triggered on non-simplex facets, unexpected topology, or unhandled dimensions, terminating the process via SIGABRT. |
-| `SEC-0223` | `src/libbg/geogram/voronoi/CVT.cpp, src/libbg/geogram/voronoi/CVT.h` | `CVT.h:120-140, 195-215; CVT.cpp:60-80, 135-155, 175-195, 230-260, 310-340, 360-390` | Out-of-Bounds Access, Missing Null Guards & Zero Division | 2 | `CONFIRMED` | `FIXED` | In CVT.cpp and CVT.h, constructors and member methods accepted Mesh* and double* pointers without null validation, accessed empty embedding vectors, and performed unvalidated indexing and division when dimension_ or point counts were zero. |
-| `SEC-0224` | `src/libbg/geogram/third_party/LBFGSpp/include/LBFGS.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSB.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/BFGSMat.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/BKLDLT.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/Cauchy.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/LineSearchBacktracking.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/LineSearchBracketing.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/LineSearchMoreThuente.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/LineSearchNocedalWright.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/Param.h, src/libbg/geogram/third_party/LBFGSpp/include/LBFGSpp/SubspaceMin.h` | `LBFGS.h:170-175, 230-240; LBFGSB.h:205-215; BFGSMat.h:115-125, 270-340, 480-505; BKLDLT.h:80-95, 125-140, 160-175; Cauchy.h:120-145, 175-190; LineSearchMoreThuente.h:34-55, 71-125; LineSearchNocedalWright.h:42-50, 94-98; Param.h:210, 368; SubspaceMin.h:44-58, 134-138` | Division by Zero, Out-of-bounds Vector Access & Dimension Validation | 2 | `CONFIRMED` | `FIXED` | In LBFGSpp optimization routines, missing zero guards on matrix determinants, Hessian eigenvalues, line search denominators, and empty input vector dimensions allowed potential divisions by zero, infinite loops, and out-of-bounds array access on degenerate or singular optimization problems. |
-| `SEC-0225` | `src/libbg/geogram/third_party/amgcl/amgcl/adapter/zero_copy.hpp, src/libbg/geogram/third_party/amgcl/amgcl/amg.hpp, src/libbg/geogram/third_party/amgcl/amgcl/backend/builtin.hpp, src/libbg/geogram/third_party/amgcl/amgcl/backend/detail/matrix_ops.hpp, src/libbg/geogram/third_party/amgcl/amgcl/backend/interface.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/detail/galerkin.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/plain_aggregates.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/pointwise_aggregates.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/smoothed_aggr_emin.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/smoothed_aggregation.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/tentative_prolongation.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/inverse.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/qr.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/sort_row.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/spgemm.hpp, src/libbg/geogram/third_party/amgcl/amgcl/make_solver.hpp, src/libbg/geogram/third_party/amgcl/amgcl/preconditioner/dummy.hpp, src/libbg/geogram/third_party/amgcl/amgcl/relaxation/spai0.hpp, src/libbg/geogram/third_party/amgcl/amgcl/reorder/cuthill_mckee.hpp, src/libbg/geogram/third_party/amgcl/amgcl/solver/cg.hpp, src/libbg/geogram/third_party/amgcl/amgcl/solver/skyline_lu.hpp, src/libbg/geogram/third_party/amgcl/amgcl/util.hpp, src/libbg/geogram/third_party/amgcl/amgcl/value_type/interface.hpp` | `zero_copy.hpp:95-105; amg.hpp:145-180, 205-220; builtin.hpp:170-195, 410-440, 520-565; matrix_ops.hpp:75-95; interface.hpp:85-95; galerkin.hpp:60-70; plain_aggregates.hpp:115-130, 160-198; pointwise_aggregates.hpp:80-140, 150-178; smoothed_aggr_emin.hpp:90-100, 170-220, 255-345; smoothed_aggregation.hpp:120-165, 190-220; tentative_prolongation.hpp:50-60, 95-175; inverse.hpp:45-75; qr.hpp:155-205, 385-405, 580-600; sort_row.hpp:35-45; spgemm.hpp:70-125, 425-460; make_solver.hpp:88-100; dummy.hpp:80-105; spai0.hpp:75-115; cuthill_mckee.hpp:80-165; cg.hpp:145-205; skyline_lu.hpp:100-175, 185-255; util.hpp:205-225; interface.hpp:145-155` | Out-of-bounds Array Access, Null Dereference, Division by Zero & Traversal Flaw | 2 | `CONFIRMED` | `FIXED` | In AMGCL solver and preconditioner routines, missing bounds checks on row/column indices and negative aggregate IDs allowed out-of-bounds array reads and writes. Missing checks for singular pivots, zero denominators, and zero spectral radius allowed divisions by zero. Unchecked matrix and vector pointers allowed null pointer dereferences. A loop condition logic error in Cuthill-McKee reordering skipped node 0 during graph level set traversal. |
-| `SEC-0226` | `src/libbrep/BBNode.cpp, src/libbrep/BRNode.cpp, src/libbrep/PullbackCurve.cpp, src/libbrep/Subcurve.cpp, src/libbrep/Subsurface.cpp, src/libbrep/assembly.cpp, src/libbrep/boolean.cpp, src/libbrep/brep_defines.h` | `BBNode.cpp:137, 209-214, 230-265, 305-325, 345-350, 400-410, 498-504, 508-525, 560-610; BRNode.cpp:60-65, 105-110, 260-295, 360-400, 412-420, 514-520; PullbackCurve.cpp:3190-3195, 3380-3386, 3390-3475, 3505-3590, 3820-3825, 4578-4581, 5359-5363; Subcurve.cpp:49, 69-93; Subsurface.cpp:50, 72-118; assembly.cpp:58-75, 353-402, 456-458; boolean.cpp:98, 142-225, 3356-3395; brep_defines.h:64` | Null Pointer Dereference, Division by Zero, Out-of-bounds Array Access | 2 | `CONFIRMED` | `FIXED` | In libbrep core evaluation, trimming, assembly, and pullback routines, missing null checks on curve, surface, face, and child pointers could result in null pointer dereferences. Missing checks against zero denominators in cubic curve interpolation, knot intervals, Newton solver steps, and basis control ratio calculations could cause division by zero. Edge index parameters in edge merging routines lacked array bounds checks before indexing brep edge tables. |
-| `SEC-0227` | `src/libbrep/debug_plot.cpp, src/libbrep/edit.cpp, src/libbrep/px_event.cpp, src/libbrep/quality.cpp, src/libbrep/ssx_event.cpp` | `debug_plot.cpp:137; edit.cpp:556-563, 680, 699-718, 832, 858-876; px_event.cpp:35-50; quality.cpp:70, 222-241; ssx_event.cpp:82-112` | Null Pointer Dereference, Division by Zero, Out-of-bounds Array Access, Incorrect Comparison Logic | 2 | `CONFIRMED` | `FIXED` | ON_PX_EVENT::Compare() had inverted null-pointer return values and returned bool instead of proper 3-way int; DumpSSXEvent() dereferenced curve pointers without null checks; bbox_contains() operated on potentially invalid points; edge quality loop accessed vertex and trim arrays without bounds checks; brep_edge_create() lacked index bounds validation; calculateTangentVectors(), getPosRoot(), bsplineBasisFuns(), and solveTridiagonalint() had unguarded divisions; write_plot_to_file() used fopen() result without NULL check. |
-| `SEC-0228` | `src/libbrep/cdt/cdt.cpp, src/libbrep/cdt/cdt_util.cpp, src/libbrep/cdt/mesh.cpp, src/libbrep/cdt/ovlps_simple.cpp, src/libbrep/cdt/surf.cpp, src/libbrep/cdt/tri_isect.cpp` | `cdt.cpp:755-763; cdt_util.cpp:39, 159, 180, 205, 230, 246, 262; mesh.cpp:176, 198, 225-245, 1301, 1391, 2648, 4139, 4252, 4276, 4304, 4322, 4344, 4362, 4380, 4412, 4474, 4521, 4536, 4550, 4565, 4617, 5124, 5896, 5908, 6167; ovlps_simple.cpp:315, 388-396; surf.cpp:140; tri_isect.cpp:120` | Null Pointer Dereference, Out-of-bounds Vector Access, Resource Leaks | 2 | `CONFIRMED` | `FIXED` | In libbrep CDT routines, missing size validation and null pointer checks on bedge_seg_t::uedges() in cdt.cpp and ovlps_simple.cpp caused potential out-of-bounds vector access and null pointer dereferences when accessing face meshes. In mesh.cpp, bedge_seg_t::uedges() dereferenced CDT state pointers, trim indices, face pointers, and polygon pointers without validation. Across mesh.cpp, cdt_util.cpp, tri_isect.cpp, and surf.cpp, pervasive unchecked fopen() return values in debug and plotting routines caused potential NULL pointer dereferences when writing to plot files. |
-| `SEC-0229` | `src/libbrep/shape_recognition/cone.cpp, src/libbrep/shape_recognition/cylinder.cpp, src/libbrep/shape_recognition/pipeline.cpp, src/libbrep/shape_recognition/planar.cpp, src/libbrep/shape_recognition/shape_recognition.cpp, src/libbrep/shape_recognition/sphere.cpp, src/libbrep/shape_recognition/sr_util.cpp, src/libbrep/shape_recognition/torus.cpp` | `cone.cpp:42-100, 116-242; cylinder.cpp:45-165, 184-358; pipeline.cpp:40-173, 280-410; planar.cpp:201-230, 294-352, 503-510, 531-547, 748-855, 960-1010; shape_recognition.cpp:163-171, 347-353, 410-454, 525-591; sphere.cpp:40-95, 115-180, 187-200; sr_util.cpp:42-75, 189-195, 248-256, 508-515, 626-635; torus.cpp:36-192` | Memory Access Violation, Out-of-bounds Array Access, Memory Leaks, Division by Zero, Null Pointer Dereference | 2 | `CONFIRMED` | `FIXED` | In planar.cpp, an off-by-one loop condition j <= array_end - array_start caused out-of-bounds read and write in triangulate_array_with_holes; outer_pt_ind, holes arrays, vert_map, and loop_starts leaked on every triangulation; BU_PTBL_GET dereferenced empty island_children causing null dereference crash; in cylinder.cpp, points[3] was accessed without checking points count > 3, and implicit_plane_ind was indexed without bounds checks; in cone.cpp, loop over cone planes indexed plane 1 when count was 1, and sin(C) was divided without zero checking; in pipeline.cpp, nde array leaked across multiple return paths, and nonplanar_surfaces was dereferenced when empty; in shape_recognition.cpp, unchecked fol_to_i iterator dereference caused crash, subbrep_shoal_data leaked when shoal_csg failed, and face_surface_types and uninserted sb leaked on failure; in sr_util.cpp, BU_PUT for obj->nucleus erroneously freed subbrep_shoal_data with struct csg_obj_params size/tag, and empty face->m_li caused out-of-bounds loop access; in sphere.cpp, a typo c2->IsArc(NULL, &a1) left a2 uninitialized and leaked curve duplicates c1 and c2; in torus.cpp, arc loop leaked curve ecv and ep_normal was incorrectly set to torus.plane.Normal(). |
-| `SEC-0230` | `src/libbrep/tools/tools.cpp, src/libbrep/tools/tools_util.cpp, src/libbrep/tests/brep_cdt_hole_face17.c, src/libbrep/tests/brep_cdt_hole_face27.c, src/libbrep/tests/brep_cdt_invalid.cpp, src/libbrep/tests/brep_cdt_mesh.cpp, src/libbrep/tests/assembly.cpp, src/libbrep/tests/ppx.cpp, src/libbrep/tests/pullback_context.cpp, src/libbrep/tests/test_curve_intersect.cpp, src/libbrep/tests/test_point_intersect.cpp` | `tools.cpp:43-70, 83-143, 197-286; tools_util.cpp:40-49, 83-148, 158-180, 182-228, 230-271; brep_cdt_mesh.cpp:27-48; brep_cdt_hole_face17.c:22-35, 3360-3415; brep_cdt_hole_face27.c:22-35, 6300-6355; assembly.cpp:103-109; ppx.cpp:218-225; pullback_context.cpp:504-512; test_curve_intersect.cpp:35-85; test_point_intersect.cpp:45-145` | Memory Leaks, Uncontrolled Recursion, Out-of-bounds Array Access, Null Pointer Dereference, Logic Error | 2 | `CONFIRMED` | `FIXED` | In libbrep tools and tests: in tools.cpp, find_next_point placed recursion limit inside else block, causing infinite recursion and stack exhaustion; ON_Curve_Get_Tangent and ON_Curve_Has_Tangent lacked null pointer and direction bounds checks; in ON_Surface_IsStraight, frames[0] and frames[1] were repeatedly indexed instead of frames[i] and frames[j]; in tools_util.cpp, ON_BrepTikz leaked duplicate edge curves on non-linear edges, and lacked null pointer and array bounds checks; in brep_cdt_mesh.cpp, invalid argument count printed usage but proceeded without exiting, dereferencing invalid argv[1]; in brep_cdt_hole_face17.c and brep_cdt_hole_face27.c, multiple heap-allocated arrays leaked on test completion; across test executables, argv[0] was passed to bu_setprogname without validating argc > 0 and argv != NULL. |
-| `SEC-0231` | `src/libfft/fftfast.c, src/libfft/splitdit.c, src/libfft/ditsplit.c, src/libfft/fftc.c, src/libfft/ifftc.c, src/libfft/splitditc.c, src/libfft/ditsplitc.c, src/libfft/fftest.c` | `fftfast.c:54-85, 120-165, 203-245, 290-345; splitdit.c:33-40; ditsplit.c:39-46; fftc.c:45-75; ifftc.c:44-75; splitditc.c:44-60; ditsplitc.c:46-62; fftest.c:39-60` | Infinite Loop Denial of Service, Null Pointer Dereference, Division by Zero, Missing Bounds Validation | 2 | `CONFIRMED` | `FIXED` | In libfft routines: in fftfast.c, init_sintab hung in an infinite loop if size was zero or negative, calloc return values were unchecked leading to null pointer dereferences, cdiv divided by sum-of-squares without checking for zero, and cfft, icfft, scramble, butterflies, and complex arithmetic functions lacked null pointer checks on data/result pointers. In splitdit.c and ditsplit.c, rfft and irfft lacked null checks and minimum length validation on input arrays. In fftc.c and ifftc.c, parse_fft_length permitted invalid size 1 and lacked upper bound checks, and main dereferenced argv without pointer validation. In splitditc.c and ditsplitc.c, generator functions lacked minimum dimension guards and embedded full source file paths. |
-| `SEC-0232` | `src/libtermio/libtermio.h, src/libtermio/linenoise.hpp` | `libtermio.h:176-215, 235-360, 780-795, 1100-1155; linenoise.hpp:2015-2060, 2075-2125, 2215-2240, 2325-2385, 2690-2740` | Buffer Overflow, Out-of-Bounds Array Access, Division by Zero & Missing Pointer Validation | 2 | `CONFIRMED` | `FIXED` | In libtermio: in libtermio.h, terminal parameter storage arrays save_tio and curr_tio were sized FOPEN_MAX (which can be as low as 20 on POSIX platforms) and lacked file descriptor bounds checking across clr_Echo, reset_Tty, save_Tty, set_Cbreak, and set_Raw, allowing out-of-bounds array writes on large or invalid file descriptors; termio_getch lacked FD_SET bounds checking on fd (fd >= FD_SETSIZE causes stack buffer overflow in select/FD_SET); in linenoise.hpp, EditHistoryNext used unbounded strcpy() from history strings into buf_ risking buffer overflow, EditInsert failed to check if len_ + clen exceeded buf_len_ leading to buffer overflow on multi-byte UTF-8 insertions, completeLine used unchecked string indexing &lc[i][0] on potentially empty strings and failed to clamp snprintf return value causing len_ to exceed buf_len_, refreshSingleLine and refreshMultiLine divided and modulo'd by cols_ without checking for <= 0 leading to division-by-zero crashes, and LoadHistory/SaveHistory/AddHistory/SetPrompt lacked null pointer validation. |
-| `SEC-0233` | `src/libpc/gecode_librt_test.cpp, src/libpc/solver_test.cpp, src/libpc/vm_test.cpp, src/libpc/domain_constraint_propagator.cpp, src/libpc/cartesian-heart.cpp, src/libpc/gecode_solver_test.cpp` | `gecode_librt_test.cpp:45-95; solver_test.cpp:43-85, 90-115; vm_test.cpp:38-45, 70-78, 140-145; domain_constraint_propagator.cpp:60-110; cartesian-heart.cpp:112-120; gecode_solver_test.cpp:70-75` | Out-of-Bounds Array Access, Division by Zero, and Missing Pointer Validation | 2 | `CONFIRMED` | `FIXED` | In libpc routines: in gecode_librt_test.cpp, add_constraint_coincident_pnt, add_constraint_perpendicular_vect, and add_constraint_pnt_on_line_segment indexed Space variable arrays with unchecked point indices risking out-of-bounds array access; in solver_test.cpp, constraint functors f1-f4 dereferenced getVariablebyID() return pointers without null checks, and getParameter('G') was dereferenced without null checking; in vm_test.cpp, div() divided by parameter b without zero protection, and findfunction dereferenced ct** ap without null validation; in domain_constraint_propagator.cpp, DisEq::post, copy, propagate, and diseq accepted Space* home without null checks; across test drivers, argv[0] was passed to bu_setprogname without validating argc > 0 and argv != NULL. |
-| `SEC-0234` | `src/nirt/main.cpp, src/nirt/showshot.c` | `main.cpp:145-158, 260-312, 460-505, 595-635, 740-815, 875-905; showshot.c:65-85, 90-100, 115-140` | Use-After-Free, Double-Free, Buffer Overflow, and Resource Leaks | 2 | `CONFIRMED` | `FIXED` | In nirt routines: in main.cpp, db_close(dbip) was invoked before reading database metadata dbi_local2base and dbi_title leading to use-after-free; ns was freed with BU_PUT but left non-NULL on failure paths triggering double-free in the cleanup block; in nirt_dest_cmd, popen/fopen/pclose logic set both io_data->out and io_data->err to the same pointer leading to double-pclose/double-fclose and leaked unclosed file handles on re-routing; in list_formats, fopen return was unchecked causing potential NULL pointer dereference; in the matrix reading loop, rt_read_cmd returned heap buffers that were leaked on each iteration; when no database file argument was provided, argv[0] was indexed out-of-bounds. In showshot.c, region name rname was populated in an unbounded character loop risking stack buffer overflow; radius input was unvalidated against zero or negative values; argv[0] was passed to bu_setprogname without validating argc > 0. |
-| `SEC-0235` | `src/bwish/cmd.c, src/bwish/input.c, src/bwish/main.c` | `cmd.c:80-155, 210-245, 250-285, 290-350; input.c:135-150, 220-240, 255-285, 320-335, 365-425, 490-530; main.c:75-85, 230-265, 280-288, 315-335` | Heap/Stack Buffer Overflow, Pointer Underflow, and Memory Leaks | 2 | `CONFIRMED` | `FIXED` | In bwish/btclsh routines: in cmd.c, historyInit allocated cmdhist with sizeof(struct bu_cmdhist_obj) instead of sizeof(struct bu_cmdhist) in realloc, and history_record_priv lacked capacity check before writing to cmdhist[currHist.size] risking heap buffer overflow; history_prev, history_cur, and history_next lacked bounds and empty-list checks; cmd_history leaked fp and continued processing on invalid option; in input.c, inputHandler loop condition evaluated buf[++i] when i == count - 1 leading to out-of-bounds read of buf[BU_PAGE_SIZE]; processChar underflowed size_t to SIZE_MAX when checking trailing newline on an empty string; backward-word and CTRL_W formed out-of-bounds pointers before the start of the string when index was zero; temporary bu_vls buffers were leaked across multiple editing operations; in main.c, tty_usable passed unvalidated file descriptors into FD_SET causing potential stack buffer overflow on fd >= FD_SETSIZE; main dereferenced unchecked argv[0] and lacked null verification on Tcl_CreateInterp. |
-| `SEC-0236` | `bench/clean.c, bench/compute.c, bench/run.c, bench/pixcmp.c, bench/benchmark.c` | `clean.c:70-90; compute.c:50-85; run.c:64-90; pixcmp.c:201-375; benchmark.c:80-105, 285-345, 385-455, 475-625, 820-965` | Format String Bugs, Division Errors, File Descriptor Leaks, and Bounds Checks | 2 | `CONFIRMED` | `FIXED` | In bench suite tools: in clean.c, clean_obstacles reused un-truncated vls instances appending .log to .pix strings creating corrupted paths and leaked heap buffers; in compute.c, average() decremented element count in loop condition causing division by negative one instead of total element count; in run.c, format string %s received a struct bu_vls by value corrupting the varargs stack; in pixcmp.c, argv[1] was dereferenced out-of-bounds when argc == 1, effective file size subtraction underflowed unsigned size_t when skip exceeded file size, and file pointers were leaked on exit paths; in benchmark.c, unchecked getenv("LOGFILE") and fopen returns risked null dereferences, inverted bu_strncasecmp logic caused any non-instruction flag to abort into instructions mode, option=value parsing used the key instead of the value, open(logfile) leaked file descriptors, %.2lfs format string received a const char* instead of double, and bu_vls structs were leaked across all exit paths. |
-| `SEC-0237` | `src/art/tile.cpp, src/art/brlcadplugin.h, src/art/brlcadplugin.cpp, src/art/art.cpp` | `tile.cpp:63-88; brlcadplugin.h:60-65; brlcadplugin.cpp:120-175, 215-260, 325-455, 525-540; art.cpp:270-285, 400-405, 479-514, 550-600, 740-750, 880-910, 1065-1075, 1135-1145, 1280-1310, 1375-1380, 1415-1445, 1475-1545, 1605-1615` | Buffer Bounds, Resource Leaks, Null Dereferences, and Out-of-Bounds Memory Access | 2 | `CONFIRMED` | `FIXED` | In art Appleseed ray tracing integration: in tile.cpp, on_tile_end lacked null checks on frame and framebuffer handle fbp, lacked tile index bounds checks, inverted row offset calculation risked out-of-bounds row indexing on edge pixels, and pixel buffer reads lacked size bounds validation; in brlcadplugin.h, Model lacked static linkage risking duplicate symbols; in brlcadplugin.cpp, brlcad_hit lacked null validation on ap and PartHeadp and dereferenced unchecked pt_inseg and pt_outseg pointers, BrlcadObject constructor dereferenced unchecked p_ap and rti_dbip pointers, BrlcadObject::release leaked rtip by never calling rt_i_destroy, intersect routines lacked null checks on resources and name, get_id allowed unbounded thread counter indexing past MAX_PSW in resources array leading to out-of-bounds heap access, and configure_raytrace_application leaked heap-allocated objv and accessed objects[0] without bounds validation; in art.cpp, color_hook called BU_CK_STRUCTPARSE before checking null pointer sp, art_validate_options performed raw float equality on airdensity, art_parse_light_intensity lacked pointer checks on bright and fract, register_region opened a ged instance per visited region and leaked it on all non-light paths while failing to check for GED_NULL, build_project opened a secondary dbip and leaked it every frame without calling db_close, temporary bu_vls instances fov, dimensions, and str were leaked on exit paths, art_save_image lacked null checks on filename and frame pointer, and main lacked argv[0] guards and leaked resources on failure exits. |
-| `SEC-0238` | `src/launcher/launcher.c, src/launcher/registry.c, src/launcher/launch.c, src/launcher/fbtext.c, src/launcher/ui_fb.c, src/launcher/ui_text.c` | `launcher.c:48-62, 73-95; registry.c:59-87, 92-104, 110-165, 190-210, 235-260; launch.c:46-72, 120-135; fbtext.c:83-119, 174-198; ui_fb.c:64-88, 108-170, 174-237, 260-272, 380-422; ui_text.c:56-72` | Buffer Overflow, Out-of-bounds Array Access, Null Pointer Dereference, and Input Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD launcher tools and UI: in launcher.c, bu_setprogname(argv[0]) was called without validating argc > 0 and argv != NULL, list_apps dereferenced r without checking for NULL, and fprintf hardcoded binary name instead of using bu_getprogname(); in registry.c, registry_grow and trim lacked null pointer validation on inputs, registry_resolve dereferenced unchecked pointer e, registry_parse and registry_add_builtins failed to check registry_grow return values risking null dereference if growth failed, and app_registry_load failed to check bu_dir return values before probing paths and directory existence; in launch.c, prepend_bindir_to_path unchecked bu_dir return before using bindir, and launch_shell used un-buffered static bu_which pointer across multiple function invocations; in fbtext.c, draw_char lacked framebuffer vertical row bounds checks risking out-of-bounds row indexing on edge pixels and lacked pointer validation on fbp, vfp, and vdp, and fbtext_draw calculated width limit without margin margin check; in ui_fb.c, fill_rect, draw_border, blit_icv, load_splash, redraw, and activate lacked null pointer checks on framebuffer, image, and registry structures, load_splash lacked zero/negative dimension guards, redraw and activate indexed r->apps without bounds-checking button action indices, and mouse click and Enter key handlers indexed button array without bounds validation; in ui_text.c, print_menu lacked null pointer checks on r. |
-| `SEC-0239` | `src/isst/gfile.h, src/isst/gfile.cpp, src/isst/isstgl.h, src/isst/isstgl.cpp, src/isst/main.cpp, src/isst/main_window.cpp, src/isst/isstapp.cpp` | `gfile.h:44-55; gfile.cpp:45-55, 60-120, 130-200, 210-235, 240-340; isstgl.h:58-69, 79-95; isstgl.cpp:37-67, 68-106, 108-126, 128-250, 280-295, 300-330, 340-390; main.cpp:35-40, 50-75; main_window.cpp:61-78, 99-103; isstapp.cpp:28-42` | Buffer Overflow, Memory Leaks, Division by Zero, Null Pointer Dereference, and Out-of-Bounds Memory Access | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD ISST interactive ray-tracing subsystem: in gfile.h and gfile.cpp, GFile lacked constructor and destructor leaving pointer members uninitialized; closedb() only freed the tie wrapper and leaked tie tree internals, meshes list, and mesh attributes; load_g() leaked dbip if db_dirbuild() failed, left dangling pointers in tribuf and dbip, and leaked allocated strings from db_path_to_string() on every region; in nmg_to_adrt_internal(), vert_count increment and buffer writing occurred before bounds validation risking out-of-bounds array writes on non-triangle loops and called bu_exit() instead of gracefully skipping; in nmg_to_adrt_regstart(), BoT face vertex indices lacked bounds checking against num_vertices risking heap out-of-bounds reads and leaked intern memory from rt_db_get_internal(); file-static gcvwriter global state caused concurrency and re-entrancy issues; in isstgl.h and isstgl.cpp, TIERenderer constructor left camera struct uninitialized causing multiplication of garbage integers in texdata buffer allocation, resize() performed unchecked integer division by width risking division by zero, res_decr() miscalculated horizontal resolution using height instead of width, render() dereferenced NULL tie if no scene was loaded, set_tie() updated renderer state without acquiring render mutex, and camera.view_list was leaked in destructor; in main.cpp, argc check if (argc > 1) prevented loading single file arguments and lacked argv[0] null guard; in main_window.cpp, raw C casts and unchecked canvas pointers were used; in isstapp.cpp, statusBar and canvas pointers were dereferenced without null checks. |
-| `SEC-0240` | `src/libbv/adc.c, src/libbv/diff.c, src/libbv/font.c, src/libbv/hash.c, src/libbv/knobs.cpp, src/libbv/lod.cpp, src/libbv/polygon.c, src/libbv/polygon_fill.cpp, src/libbv/polygon_op.cpp, src/libbv/snap.c, src/libbv/tests/list.c, src/libbv/tests/plot3.c, src/libbv/tests/test_camera.c, src/libbv/tests/test_lod_cache.cpp, src/libbv/tests/vlist.c, src/libbv/util.cpp, src/libbv/view_sets.cpp, src/libbv/vlist.c` | `adc.c:48-95; diff.c:60-120, 180-240; font.c:50-80; hash.c:70-130, 200-280; knobs.cpp:60-110, 190-260, 480-530; lod.cpp:90-140, 240-300, 390-440, 500-550, 1200-1260; polygon.c:80-140, 200-350, 400-520, 600-750; polygon_fill.cpp:40-90, 120-180; polygon_op.cpp:60-90; snap.c:70-130, 180-250, 300-380; tests/list.c:60-100, 150-170, 350-370, 490-535; tests/plot3.c:50-80; tests/test_camera.c:280-290; tests/test_lod_cache.cpp:280-290; tests/vlist.c:40-65; util.cpp:45-55, 335-445, 480-515, 560-675, 940-1055, 1125-1150, 1200-1540, 1630-1910; view_sets.cpp:40-120; vlist.c:40-60, 115-135, 175-215, 220-235, 240-255, 260-275, 325-340, 360-395, 400-475, 565-675` | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Array Access, and Null Pointer Dereferences | 1 | `CONFIRMED` | `FIXED` | In BRL-CAD libbv view library: in vlist.c, bv_vlblock_to_objs leaked cname and oobjs data structures, and bv_vlblock_init suffered integer overflow and out-of-bounds writes when max_ent < 2; in util.cpp, bv_free leaked display list freelist nodes and freed scene object internal state, division by zero was possible in _bv_trans, _bv_scale, and isize calculations, and bv_obj_get_vo mismatched free list tracking and dereferenced null pointer structures; in lod.cpp, POPState divisions lacked zero-extent checks, and bv_mesh_lod_free leaked context and state; in knobs.cpp, divisions by gv_scale and gv_size lacked ZERO checks; in polygon.c, polygon_fill.cpp, and snap.c, missing array bounds checks risked out-of-bounds memory accesses and divisions lacked zero checks; in test binaries, plot3.c leaked file pointers and inverted text mode, tests/vlist.c indexed argv before checking argc and leaked vlist nodes, and tests/list.c had an off-by-one loop in convert_points. |
-| `SEC-0241` | `src/libdm/X/color.c, src/libdm/X/dm-X.c, src/libdm/X/if_X24.c, src/libdm/axes.c, src/libdm/clip.c, src/libdm/dm-generic.c, src/libdm/dm-gl.c, src/libdm/dm_plugins.cpp, src/libdm/dm_util.c, src/libdm/fb_generic.c, src/libdm/fb_paged_io.c, src/libdm/fb_util.c, src/libdm/fbserv.c, src/libdm/glx/if_ogl.c, src/libdm/if_mem.c, src/libdm/if_remote.c, src/libdm/if_stack.c, src/libdm/labels.c, src/libdm/postscript/dm-ps.c, src/libdm/qtgl/dm-qtgl.cpp, src/libdm/qtgl/fb-qtgl.cpp, src/libdm/scale.c, src/libdm/swrast/dm-swrast.cpp, src/libdm/swrast/fb-swrast.cpp, src/libdm/tkswrast/dm-tkswrast.cpp, src/libdm/view.c, src/libdm/wgl/dm-wgl.c, src/libdm/wgl/if_wgl.c` | `X/color.c:70-130, 200-240; X/dm-X.c:200-250, 480-530, 600-660; X/if_X24.c:480-530, 1100-1160; axes.c:80-140, 200-260; clip.c:70-130, 180-230; dm-generic.c:50-90; dm-gl.c:180-240, 380-440; dm_plugins.cpp:60-140; dm_util.c:40-80; fb_generic.c:80-150; fb_paged_io.c:60-150; fb_util.c:60-140; fbserv.c:160-220, 380-430; glx/if_ogl.c:480-540, 950-1050; if_mem.c:70-140, 200-260; if_remote.c:120-180, 240-300; if_stack.c:60-120; labels.c:80-140, 200-260; postscript/dm-ps.c:120-180, 320-380; qtgl/dm-qtgl.cpp:160-220, 400-470; qtgl/fb-qtgl.cpp:200-260, 400-470, 750-820; scale.c:60-80; swrast/dm-swrast.cpp:180-250, 420-490; swrast/fb-swrast.cpp:210-270, 420-490, 750-820; tkswrast/dm-tkswrast.cpp:70-130; view.c:120-190, 320-400, 500-600; wgl/dm-wgl.c:180-250, 410-480; wgl/if_wgl.c:200-270, 440-510, 800-870` | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 1 | `CONFIRMED` | `FIXED` | In BRL-CAD libdm display manager and framebuffer library: in X/color.c, _X_copy_cmap had out-of-bounds write risk, float cast truncation in X_get_pixel, and division by zero in X_allocate_color_cube; in X/if_X24.c and X/dm-X.c, off-by-one loop bound in X24_cmap, integer overflow in X24_getmem, missing XDestroyImage resource leaks, and division by zero in X_reshape; in glx/if_ogl.c, wgl/if_wgl.c, and dm-gl.c, integer overflow in getmem, leaks on context creation failures, division by zero in reshape and clipper, and bounds check vulnerabilities in image routines; in postscript/dm-ps.c, NULL pointer checks and memory leaks in ps_close and draw routines; in qtgl and swrast backends, unprotected VIEWFACTOR macro, out-of-bounds scanline writes in xmit_scanlines, division by zero in fb_clipper, and leaks of dm_log and memory contexts; in tkswrast, NULL pointer dereferences in event and buffer handlers; in clip.c, division by zero when dx/dy is zero and unsafe static locals; in axes.c, view.c, scale.c, and labels.c, unchecked pointer dereferences, division by zero in aspect/FPS calculations, unbounded tick iteration, and buffer overflow in POINT_LABEL_STR; in fb_generic.c and fb_paged_io.c, unchecked division by zero in page calculations and zoom; in if_mem.c, if_remote.c, and if_stack.c, integer multiplication overflow in allocation, unclosed sockets/resources on error paths, and unbounded stack buffer copy in stk_open. |
-| `SEC-0242` | `src/libgcv/bottess.c, src/libgcv/facetize.c, src/libgcv/plugins/decimate/decimate.c, src/libgcv/plugins/fastgen4/fastgen4_read.c, src/libgcv/plugins/fastgen4/fastgen4_write.cpp, src/libgcv/plugins/iges/tests/test_gcv_iges.cpp, src/libgcv/plugins/iges/tests/test_iges_brep.cpp, src/libgcv/plugins/iges/tests/test_iges_document.cpp, src/libgcv/plugins/iges/tests/test_iges_import.cpp, src/libgcv/plugins/iges/tests/test_iges_orientation.cpp, src/libgcv/plugins/iges/tests/test_iges_rays.cpp, src/libgcv/plugins/iges/tests/test_iges_writer.cpp, src/libgcv/plugins/jt/jt_read.cpp, src/libgcv/plugins/jt/test_jt_parser.cpp, src/libgcv/plugins/jt/test_jt_topology.cpp, src/libgcv/plugins/obj/obj_read.c, src/libgcv/plugins/obj/obj_write.c, src/libgcv/plugins/obj/tri_face.c, src/libgcv/plugins/ply/ply_read.c, src/libgcv/plugins/ply/ply_write.c, src/libgcv/plugins/rhino/rhino_read.cpp, src/libgcv/plugins/scad/scad_read.c, src/libgcv/plugins/stl/stl_read.c, src/libgcv/plugins/stl/stl_write.cpp, src/libgcv/plugins/vrml/vrml_read/file_util.cpp, src/libgcv/plugins/vrml/vrml_read/string_util.cpp, src/libgcv/plugins/vrml/vrml_read/test_vrml1_parser.cpp, src/libgcv/plugins/vrml/vrml_read/vrml_read.cpp, src/libgcv/plugins/vrml/vrml_write.c, src/libgcv/region_end.c, src/libgcv/region_end_mc.c, src/libgcv/tests/test_bottess.c, src/libgcv/tests/test_context.c, src/libgcv/tri_intersect.c` | `bottess.c:80-140, 200-260, 480-530; facetize.c:60-120; plugins/decimate/decimate.c:70-130; plugins/fastgen4/fastgen4_read.c:80-140; plugins/fastgen4/fastgen4_write.cpp:100-160; plugins/iges/tests/test_*.cpp:40-100; plugins/jt/jt_read.cpp:80-150; plugins/obj/obj_read.c:120-180; plugins/obj/obj_write.c:90-150; plugins/obj/tri_face.c:60-120; plugins/ply/ply_read.c:80-140; plugins/ply/ply_write.c:100-160; plugins/rhino/rhino_read.cpp:120-180; plugins/scad/scad_read.c:60-120; plugins/stl/stl_read.c:70-130; plugins/stl/stl_write.cpp:80-140; plugins/vrml/vrml_read/*:60-140; plugins/vrml/vrml_write.c:90-160; region_end.c:70-140; region_end_mc.c:80-150; tests/test_bottess.c:40-80; tests/test_context.c:40-80; tri_intersect.c:50-110` | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libgcv geometry conversion library and plugins: in bottess.c, fixed -Wbad-function-cast float-to-integer conversion by using safe integer arithmetic for face count partitioning, added bounds checks on polygon vertices, and plugged memory leaks; in plugins/obj/obj_read.c and ply_write.c, initialized structure members preventing undefined memory reads and uninitialized pointer dereferences; in plugins/fastgen4, obj, ply, stl, jt, rhino, and vrml readers/writers, guarded against division by zero in normal and scaling calculations, added boundary validation on vertex and triangle indices, and prevented resource leaks on error exit paths; in region_end.c and region_end_mc.c, added cleanup for intermediate geometry allocations; in standalone tests, guarded input arguments and initialized bu_setprogname(argv[0]). |
-
-
-
-
-
-
-
-
-
-
-| `SEC-0243` | `src/libged/3ptarb/3ptarb.c, src/libged/adc/adc.c, src/libged/adjust/adjust.c, src/libged/alphanum.h, src/libged/analyze/arb8.cpp, src/libged/analyze/arbn.cpp, src/libged/analyze/ars.cpp, src/libged/analyze/op_pnts_vol.cpp, src/libged/analyze/sketch.cpp, src/libged/analyze/superell.cpp, src/libged/analyze/util.cpp, src/libged/arb/arb.cpp, src/libged/arb/repair.cpp, src/libged/arb/rotate_arb_face.c, src/libged/arced/arced.c, src/libged/arot/arot.c, src/libged/arrange/nest_raster.cpp, src/libged/bb/bb.c, src/libged/bev/bev.c, src/libged/bo/bo.c, src/libged/ged_util.cpp` | `3ptarb.c:70-130; adc.c:160-230, 480-530; adjust.c:80-140; alphanum.h:50-100; analyze/arb8.cpp:100-140; analyze/arbn.cpp:80-130; analyze/ars.cpp:40-100; analyze/op_pnts_vol.cpp:120-180; analyze/sketch.cpp:60-120; analyze/superell.cpp:70-130; analyze/util.cpp:100-180; arb/arb.cpp:80-140; arb/repair.cpp:60-120; arb/rotate_arb_face.c:70-130; arced/arced.c:90-140; arot/arot.c:60-120; arrange/nest_raster.cpp:80-130; bb/bb.c:90-160; bev/bev.c:100-180; bo/bo.c:70-140; ged_util.cpp:210-270` | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged command implementations (3ptarb, adc, adjust, alphanum, analyze, arb, arced, arot, arrange, bb, bev, bo, and ged_util): in 3ptarb.c, fixed memory leak of internal.idb_ptr when db_diradd fails; in adc.c, prevented stack buffer overflow by clamping argc > 3 before populating user_pt[3], added ZERO(gv_scale) guards preventing division by zero, and corrected pos_model vs pos_view typo in MAT4X3PNT; in adjust.c, prevented memory leak and fixed double-free on wdb_put_internal; in alphanum.h, added NULL pointer checks and replaced unsigned long subtraction with direct comparison to prevent integer wrap-around; in analyze/arb8.cpp, arbn.cpp, ars.cpp, op_pnts_vol.cpp, sketch.cpp, superell.cpp, and util.cpp, added NULL pointer checks, checked wdb_dbopen return values, prevented division by zero, bounded ARS curve and point indices, bounded face table widths, and plugged resource leaks; in arb.cpp, repair.cpp, rotate_arb_face.c, and arced.c, eliminated double-free bugs following database insertion and validated ARB type ranges; in arot.c and ged_util.cpp, added input validation and ZERO(MAGNITUDE(axis)) division-by-zero guards; in arrange/nest_raster.cpp, guarded voxel_count against division by zero; in bb.c, eliminated unconditional double-free of new_intern and freed memory on db_diradd failure; in bev.c, validated boolean operator, cleaned up intermediate trees and NMG models on error paths, and fixed memory leaks; in bo.c, checked NULL pointer returns and added integer multiplication overflow checks before file output. |
-| `SEC-0244` | `src/libged/bot/bot.cpp, src/libged/bot/bot_condense.c, src/libged/bot/bot_decimate.c, src/libged/bot/bot_face_fuse.c, src/libged/bot/bot_face_sort.c, src/libged/bot/bot_flip.c, src/libged/bot/bot_flood_exterior.cpp, src/libged/bot/bot_fuse.c, src/libged/bot/bot_merge.c, src/libged/bot/bot_openvdb.cpp, src/libged/bot/bot_smooth.c, src/libged/bot/bot_split.c, src/libged/bot/bot_sync.c, src/libged/bot/bot_vertex_fuse.c, src/libged/bot/check.cpp, src/libged/bot/decimate.cpp, src/libged/bot/dump/bot_dump.cpp, src/libged/bot/dump/dxf.c, src/libged/bot/dump/obj.c, src/libged/bot/dump/sat.c, src/libged/bot/dump/stl.c, src/libged/bot/edbot.c, src/libged/bot/exterior.cpp, src/libged/bot/extrude.cpp, src/libged/bot/info.cpp, src/libged/bot/pick.cpp, src/libged/bot/remesh.cpp, src/libged/bot/smooth.cpp, src/libged/bot/subdivide.cpp, src/libged/brep/brep.cpp, src/libged/brep/conversion.cpp, src/libged/brep/csg.cpp, src/libged/brep/dplot.c, src/libged/brep/dplot_reader.c, src/libged/brep/info.cpp, src/libged/brep/intersect.cpp, src/libged/brep/pick.cpp, src/libged/brep/plot.cpp, src/libged/brep/repair.cpp, src/libged/brep/tikz.cpp, src/libged/brep/topology.cpp, src/libged/brep/valid.cpp` | `bot/bot.cpp:148-166; bot/bot_*.c:40-150; bot/check.cpp:50-90; bot/decimate.cpp:40-90; bot/dump/*:40-160; bot/edbot.c:70-130; bot/exterior.cpp:60-120; bot/extrude.cpp:70-130; bot/info.cpp:50-100; bot/pick.cpp:40-90; bot/remesh.cpp:50-100; bot/smooth.cpp:60-120; bot/subdivide.cpp:50-100; brep/brep.cpp:100-180; brep/conversion.cpp:80-180; brep/csg.cpp:60-220; brep/dplot.c:50-110; brep/dplot_reader.c:60-120; brep/info.cpp:70-150; brep/intersect.cpp:60-130; brep/pick.cpp:50-110; brep/plot.cpp:80-500; brep/repair.cpp:60-140; brep/tikz.cpp:35-240; brep/topology.cpp:55-275; brep/valid.cpp:60-535` | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Array Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged bot and brep command implementations: across bot subcommands, ensured proper rt_db_internal initialization and cleanup, added array bounds checks on vertices, faces, and thicknesses, guarded against division by zero in normal and decimation calculations, prevented memory leaks of internal structures and allocated vertex/face buffers on error paths, and fixed double-free hazards on wdb_export/wdb_put_internal; in bot dumping routines (dxf, obj, sat, stl), added bounds checks, validated fopen returns, and plugged resource leaks; in brep subcommands (brep, conversion, csg, dplot, dplot_reader, info, intersect, pick, plot, repair, tikz, topology, valid), fixed memory leaks of internal structures and temporary trees, added NULL pointer checks on brep and surface pointers, guarded array and trim indices across all plotting and validity commands, fixed copy-paste typo in repair and rgb check in tikz, added division-by-zero protection on scale calculation, and validated return values of edge creation. |
-| `SEC-0245` | `src/libged/cc/cc.c, src/libged/check/check.c, src/libged/check/check_adj_air.c, src/libged/check/check_centroid.c, src/libged/check/check_exp_air.c, src/libged/check/check_gap.c, src/libged/check/check_mass.c, src/libged/check/check_moments.c, src/libged/check/check_overlaps.c, src/libged/check/check_surf_area.c, src/libged/check/check_unconf_air.c, src/libged/check/check_volume.c, src/libged/coil/coil.c, src/libged/color/color.c, src/libged/columns.c, src/libged/comb/comb.c, src/libged/comb_std/comb_std.c, src/libged/combmem/combmem.c, src/libged/concat/concat.cpp, src/libged/constraint/constraint.c, src/libged/copymat/copymat.c, src/libged/cpi/cpi.c, src/libged/dbi_state.cpp, src/libged/debug/debug2c/debug2c.cpp` | `cc.c:70-95; check/check.c:190-210, 440-520; check/check_adj_air.c:40-60, 95-105; check/check_centroid.c:35-50; check/check_exp_air.c:40-60, 95-105; check/check_gap.c:40-60, 95-105; check/check_mass.c:35-50; check/check_moments.c:160-175; check/check_overlaps.c:165-175, 230-260; check/check_surf_area.c:35-50; check/check_unconf_air.c:40-65, 95-110; check/check_volume.c:35-80; coil/coil.c:330-405, 440-555; color/color.c:165-245; columns.c:45-80; comb/comb.c:110-120, 480-550; comb_std/comb_std.c:330-350, 610-660; combmem/combmem.c:470-498; concat/concat.cpp:280-335, 400-475; constraint/constraint.c:30-175; copymat/copymat.c:90-155; cpi/cpi.c:85-100; dbi_state.cpp:240-305, 455-465; debug/debug2c/debug2c.cpp:150-160` | Memory Leaks, Double-Free, Division by Zero, Infinite Loop, Array Out-of-Bounds, and File Descriptor Leaks | 2 | `CONFIRMED` | `FIXED` | In libged Batch 3 commands: in cc.c and cpi.c, freed internal representation on db_diradd failure and removed redundant double-free on write; in check/*.c routines, added NULL checks, guarded against division by zero on uninitialized unit values, plugged plot file descriptor leaks on raytrace failure, and freed heap VLS instances; in coil.c, freed allocated sections on exit paths, validated sscanf on -S, prevented division by zero, and clamped negative lengths; in color.c, fixed cnt != 9 typo to cnt != 5 and ensured temp file deletion on error paths; in columns.c, added NULL checks on input strings; in comb.c, comb_std.c, combmem.c, and copymat.c, fixed double-frees following rt_db_put_internal, freed internal structures across decimation iterations and diradd errors, freed rt_tree_array in combmem, and fixed infinite loop on paren evaluation; in concat.cpp, guarded argv[1] bounds, closed incoming database on error exits, and freed internal memory on copy failures; in constraint.c, validated argc bounds across all subcommands; in dbi_state.cpp, deleted view_states map in destructor, and aborted/cleared transactions on cache retrieval failure; in debug2c.cpp, checked file open success before reading. |
-| `SEC-0246` | `src/libged/decompose/decompose.c, src/libged/delay/delay.c, src/libged/display_list.c, src/libged/dm/dm.c, src/libged/dm/ert.cpp, src/libged/dm/screengrab.c, src/libged/draw.cpp, src/libged/draw/bigE.c, src/libged/draw/draw.c, src/libged/draw/draw2.cpp, src/libged/draw/loadview.cpp, src/libged/draw/preview.cpp, src/libged/dsp/dsp.c, src/libged/dump/dump.c, src/libged/dup/dup.c, src/libged/eac/eac.c, src/libged/edcodes/edcodes.c` | `decompose.c:110-185; delay.c:50-75; display_list.c:130-170, 715-770; dm/dm.c:280-320, 680-775; dm/ert.cpp:115-180; dm/screengrab.c:60-140; draw.cpp:210-240, 310-335, 785-845; draw/bigE.c:70-200; draw/draw.c:840-865, 1260-1285; draw/draw2.cpp:260-310; draw/loadview.cpp:140-180, 220-370; draw/preview.cpp:190-205, 370-475; dsp/dsp.c:85-125; dump/dump.c:60-70; dup/dup.c:50-165, 220-235; eac/eac.c:75-90; edcodes/edcodes.c:45-65, 110-135, 220-285` | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 4 commands: in decompose.c, fixed memory leaks on non-NMG solids and db_lookup/db_diradd failures, replaced sprintf with snprintf, and eliminated double-free of new_m; in delay.c, validated sec/usec against negative values before select(); in display_list.c, added NULL checks across erase and hash helpers and handled failure in invent_solid; in dm/dm.c, guarded argc > 0 before argv indexing, freed dm_name leaks, and corrected return status; in dm/ert.cpp, guarded against division by zero in aspect ratio, fixed loop index typo, and freed bu_vls; in dm/screengrab.c, freed dm_name on help path, added ndmp NULL guard, fixed argv bounds, and freed idata on failure; in draw.cpp, guarded division by zero, plugged db_intern leaks in csg_wireframe_update and brep_adaptive_plot, and cleaned up on draw_scene error paths; in draw/bigE.c, resolved TODO by freeing dgcdp, plugged dgcdp->ap leak on each iteration, and prevented duplicate ptbl initializations; in draw/draw.c, freed brep_intern on get_path_and_state error and freed obj_path in ged_redraw_core; in draw/draw2.cpp, guarded dbi_state and corrected view state lookup loop; in draw/loadview.cpp, prevented size_t underflows, freed tcl_argv, fixed orientation quaternion bounds, and guarded against division by zero; in draw/preview.cpp, prevented buffer overflow in ged_cm_tree, checked argc >= 2 before fopen, and freed gd_rt_cmd and ged_tmp_uptrs; in dsp/dsp.c, validated xy argument count, fixed off-by-one bounds check, fixed intern2 typo in diff subcommand, and freed intern on lookup/read errors; in dump/dump.c, used wdb_close on rt_wdb; in dup/dup.c, enforced max_entries check to prevent array bounds overflow; in eac/eac.c, freed vls on read error, checked ID_COMBINATION, and used rt_db_free_internal; in edcodes/edcodes.c, added NULL pointer checks in comparisons, checked argc >= 2, freed av on fopen error, and used rt_db_free_internal. |
-| `SEC-0247` | `src/libged/edit/edarb.c, src/libged/edit/edit.cpp, src/libged/edit/facedef.c, src/libged/edit/rotate_eto.c, src/libged/edit/rotate_extrude.c, src/libged/edit/rotate_hyp.c, src/libged/edit/rotate_tgc.c, src/libged/edit/scale_ehy.c, src/libged/edit/scale_ell.c, src/libged/edit/scale_epa.c, src/libged/edit/scale_eto.c, src/libged/edit/scale_extrude.c, src/libged/edit/scale_hyp.c, src/libged/edit/scale_metaball.c, src/libged/edit/scale_part.c, src/libged/edit/scale_pipe.c, src/libged/edit/scale_rhc.c, src/libged/edit/scale_rpc.c, src/libged/edit/scale_superell.c, src/libged/edit/scale_tgc.c, src/libged/edit/scale_tor.c, src/libged/edit/translate_extrude.c, src/libged/edit/translate_tgc.c, src/libged/edit/uri.hh` | `edarb.c:125-135, 175-185, 215-275, 325-335; edit.cpp:1350-1365, 1515-1555; facedef.c:190-205, 385-395; rotate_eto.c:38-46; rotate_extrude.c:38-45; rotate_hyp.c:38-46; rotate_tgc.c:38-46; scale_ehy.c:38-52; scale_ell.c:38-92; scale_epa.c:38-52; scale_eto.c:38-115; scale_extrude.c:38-52; scale_hyp.c:38-75; scale_metaball.c:45-56; scale_part.c:38-50; scale_pipe.c:255-268; scale_rhc.c:38-56; scale_rpc.c:38-56; scale_superell.c:38-92; scale_tgc.c:38-170; scale_tor.c:38-46; translate_extrude.c:38-48; translate_tgc.c:38-48; uri.hh:54-64` | Memory Leaks, Double-Free, Dangling Pointer, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged edit commands (src/libged/edit/*): in edarb.c and facedef.c, eliminated double-free hazards where rt_db_free_internal was called after GED_DB_PUT_INTERN (which unconditionally frees the internal structure), added ARB edge bounds validation (1 to 12) in edarb_edgedir, and validated argc >= 4 before accessing argv in edarb_facedef; in edit.cpp, scoped bn_tol to function scope in cmd_checkpoint::exec to prevent dangling pointer in s->tol, and in cmd_perturb::dp_perturb ensured intern is freed on all exit paths, prevented double-free of pintern contents on write failure, and freed the pintern container struct; in rotate_*.c, scale_*.c, and translate_*.c, guarded against NULL attribute pointers and empty strings before indexing; across scale_*.c (scale_ehy, scale_ell, scale_epa, scale_eto, scale_extrude, scale_hyp, scale_part, scale_rhc, scale_rpc, scale_superell, scale_tgc), guarded all vector MAGNITUDE calculations against division by zero in non-relative scaling modes; and in uri.hh, guarded against constructing std::string from NULL uri_text pointer. |
-| `SEC-0248` | `src/libged/editit/editit.c, src/libged/edmater/edmater.c, src/libged/env/env.c, src/libged/env/env2c/env2c.cpp, src/libged/erase/erase.c, src/libged/erase/erase2.cpp, src/libged/exec.cpp, src/libged/exists/exists.c, src/libged/expand/expand.c, src/libged/eye_pos/eye_pos.c` | `editit.c:58-95; edmater.c:72-100; env.c:50-56; env2c.cpp:184-198, 480-488, 575-585; erase.c:76-105, 130-145, 172-185; erase2.cpp:72-80, 104-115; exec.cpp:37-58, 80-100; exists.c:224-248, 300-312, 472-530, 665-672; expand.c:36-54, 75-95; eye_pos.c:38-54, 80-90` | Memory Leaks, Out-of-bounds Memory Access, Logic Errors, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 6 commands: in editit.c, corrected bu_opt_desc array indexing collision (d[0]..d[4]) where -e and -f overwrote -h and -? options, handled negative opt_ret return values, and freed bu_vls buffers on error and help paths; in edmater.c, passed argc + 1 instead of argc to ged_exec_wmater to prevent argument truncation and failure in wmater, guarded argc <= 1 before accessing argv[0], and matched bu_malloc allocation tag; in env.c, added gedp and gedp->ged_result_str NULL checks and validated argc > 0; in env2c.cpp, validated argc range (3..4), added negative argc check on bu_opt_parse in generated env_cmd code, and broadened exception catching to std::exception; in erase.c, freed new_argv on the attribute lookup path, freed bu_vls across all exits, prevented out-of-bounds indexing in bu_avs_add, and properly skipped flag arguments in erase -r and default paths without variable shadowing; in erase2.cpp, guarded negative opt_ret from bu_opt_parse, freed cvls on failure, and guarded against argc <= 0 and NULL bvs before calling erase_path; in exec.cpp, guarded against NULL argv[0] when argc decreases, checked gedp->i and gedp->i->i before dereferencing, and decremented cmd_recursion_depth_cnt and popped exec_stack when recursion limit is exceeded to prevent persistent command lockouts; in exists.c, guarded against out-of-bounds pointer advances and NULL dereferences in t_lex, isoperand, primary, and binop, and checked leftover tokens without modifying pointer; in expand.c, scoped backslash tracking per argument to prevent state leaking across arguments, used bu_vls_putc, and guarded against NULL string arguments; and in eye_pos.c, corrected unit conversion from dbi_base2local to dbi_local2base when converting user-specified eye coordinates to base units. |
-| `SEC-0249` | `src/libged/facetize/brep.cpp, src/libged/facetize/facetize.cpp, src/libged/facetize/nmg.cpp, src/libged/facetize/old_facetize.cpp, src/libged/facetize/old_facetize_log.c, src/libged/facetize/regions.cpp, src/libged/facetize/subprocess/brep_csg.cpp, src/libged/facetize/subprocess/continuation.cpp, src/libged/facetize/subprocess/main.cpp, src/libged/facetize/subprocess/nmg.cpp, src/libged/facetize/subprocess/sample.cpp, src/libged/facetize/subprocess/spsr.cpp, src/libged/facetize/subprocess/util.cpp, src/libged/facetize/tess_opts.h, src/libged/facetize/tri.cpp, src/libged/facetize/util.cpp` | `brep.cpp:115-235; facetize.cpp:115-125; nmg.cpp:215-230, 395-460; old_facetize.cpp:925-1055, 1200-1210, 1275-1315, 1375-1475, 1630-1640, 1915-1925; old_facetize_log.c:45-120; regions.cpp:145-165, 340-410, 810-850; brep_csg.cpp:145-160; continuation.cpp:125-140, 260-285; main.cpp:210-230, 520-530; nmg.cpp:65-75; sample.cpp:125-145; spsr.cpp:95-105; util.cpp:45-90; tess_opts.h:205-235; tri.cpp:335-345, 415-425, 1720-1745; util.cpp:445-470, 715-745` | Use-After-Free, Memory Leaks, Double-Free, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 7 facetize commands (src/libged/facetize/*): in brep.cpp, fixed Cat 1 Use-After-Free of wgedp database handle across iterative meshing attempts, freed br ptbl and in_intern on early failure, and freed bot export allocations on write failure; in facetize.cpp, added argc <= 0 bounds checks in _ged_facetize_objs; in nmg.cpp, corrected 4 BU_PUT struct type mismatches freeing union tree nodes as struct directory, eliminated double-free of intern on rt_db_put_internal failure, and freed intern on db_diradd failure; in old_facetize.cpp, guarded against division by zero on obj_bbox_vol, freed temporary bot faces and vertices in continuation retry and abortion paths, eliminated duplicate bounding box check, ensured bot is freed on all decimation and validity failure exits, replaced mismatched calloc/bu_free with bu_calloc, and paired BU_GET with BU_PUT for manifold_mesh; in old_facetize_log.c, validated stderr file descriptor and guarded against NULL struct pointers in log redirection hooks; in regions.cpp, freed dpa directory array on lookup error, freed ir on search failure, handled wdbip reopen failure, freed tree_list nodes with BU_PUT, eliminated double-frees of eval_roots and ir, and cleaned up on bu_vls_incr error; in subprocess/brep_csg.cpp, fixed kill argument array bounds and layout; in subprocess/continuation.cpp, freed candidate bot on retry and continue paths, replaced incorrect BU_PUT pointer type with rt_bot_internal_free, and cleaned up bot on decimation failure; in subprocess/main.cpp, freed cache_dir on early help/list exits and added NULL check on seed; in subprocess/nmg.cpp, verified intern->idb_meth->ft_tessellate function pointer before invocation; in subprocess/sample.cpp, checked obj_bbox_vol with ZERO before division; in subprocess/spsr.cpp, validated point cloud array bounds and counts; in subprocess/util.cpp, added NULL and empty checks before decimate, write_bot, and manifold checks; in tess_opts.h, freed temporary bu_vls in method_optstr and fixed plate_max_time copy-paste error; in tri.cpp, eliminated duplicate curtree allocation, freed td_name on error paths, and used bu_calloc for bot vertices and faces; and in util.cpp, validated _ged_facetize_write_bot inputs, freed internal representation on diradd failure, and closed wdbip on error exits in _ged_facetize_working_file_setup. |
-| `SEC-0250` | `src/libged/fb2pix/fb2pix.c, src/libged/fbclear/fbclear.c, src/libged/form/form.c, src/libged/fracture/fracture.c, src/libged/garbage_collect/garbage_collect.cpp, src/libged/gdiff/gdiff.c, src/libged/ged.cpp, src/libged/ged_cmd_scanner.cpp, src/libged/ged_exec.cpp, src/libged/ged_init.cpp` | `fb2pix/fb2pix.c:50-130; fbclear/fbclear.c:45-80; form/form.c:50-80; fracture/fracture.c:55-195; garbage_collect/garbage_collect.cpp:110-185; gdiff/gdiff.c:50-55, 140-192, 280-295, 370-380; ged.cpp:552-556, 628-654, 735-742, 820-835, 840-900; ged_cmd_scanner.cpp:323-330; ged_exec.cpp:42-50, 95-103; ged_init.cpp:128-138, 160-170` | Memory Corruption, Memory Leaks, Resource Leaks, Catastrophic Data Loss Hazard, Recursion Lockout Bug, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 8 core and command implementations: in fb2pix.c, validated image dimensions against non-positive values, modernized error logging, and guarded fclose against stdout/NULL; in fbclear.c, replaced floating-point comparison with ZERO/integer literals, supported unquoted RGB arguments, and routed error diagnostics to ged_result_str; in form.c, reordered argc check ahead of database check and reported unsupported form type errors to result string; in fracture.c, freed old_intern across all exits, prevented log10(0) domain error on empty model, fixed cross-model region bug where new shell pointed to old region shell list head, replaced static global frac_stat with local status, freed NMG model on db_diradd failure, and expanded newname/prefix buffers to 256 bytes; in garbage_collect.cpp, plugged memory leak of bu_external in object copy loop, guarded against division by zero on old_file_size, verified stream write success before deleting the original database to prevent data destruction, checked db_ls path count and validity, and ensured working file cleanup on errors; in gdiff.c, guarded tolerance retrieval against NULL wdbp, guarded path bounds, initialized rt_db_internal structures, freed in1 on in2 retrieval failure, validated ID_COMBINATION types, guarded msgs against NULL dereference, reordered db_lookup before allocating full paths, and checked raydiff results before access; in ged.cpp, resolved heap corruption caused by BU_PUT struct type mismatch freeing struct bu_list as struct bu_vls for gd_headDisplay and gd_headVDraw, zeroed ged_cbs on allocation with memset to prevent uninitialized counters triggering false recursive warnings, verified wdbp and dbip before creating ged struct in ged_open, decremented callback recursion depth before error return to prevent permanent callback lockout, and added NULL checks in callback handlers; in ged_cmd_scanner.cpp, eliminated duplicate and out-of-bounds argv checks in generated wrappers; in ged_exec.cpp, guarded argv[0] and argc before bu_setprogname and verified plugin function pointers before dispatch; in ged_init.cpp, allocated sentinel NULL termination for command array and guarded filenames before path lookup. |
-| `SEC-0251` | `src/libged/ged_inside.c, src/libged/ged_private.h, src/libged/ged_track.c, src/libged/ged_util.cpp, src/libged/get/get.c, src/libged/get_autoview/get_autoview.c, src/libged/get_comb/get_comb.c, src/libged/get_eyemodel/get_eyemodel.c, src/libged/get_obj_bounds.c, src/libged/get_solid_kp.c` | `ged_inside.c:130-170, 310-335, 430-490, 600-660, 720-790; ged_private.h:505-515; ged_track.c:160-230, 350-410, 480-550, 620-660; ged_util.cpp:110-140, 320-350, 610-670, 890-950; get/get.c:60-95; get_autoview/get_autoview.c:55-85; get_comb/get_comb.c:65-140; get_eyemodel/get_eyemodel.c:45-75; get_obj_bounds.c:70-130, 220-270; get_solid_kp.c:50-90, 150-220, 310-390` | Memory Leaks, Buffer Overflow, Double-Free, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 9 utilities (ged_inside, ged_track, ged_util, get, get_autoview, get_comb, get_eyemodel, get_obj_bounds, get_solid_kp): in ged_inside.c, eliminated memory leaks of rt_db_internal on early returns and interactive prompt paths, fixed out-of-bounds argv[2] access on completion, cleared dangling idb_ptr after nmg_km to avoid double-free, fixed copy-paste typo in unit_d scaling (mag_b vs mag_c), and guarded against negative sqrt radicand and division by zero across tgc, ell, rpc, rhc, epa, ehy, and eto routines; in ged_track.c, resolved longstanding 30-year-old swap bug where tr[0] was overwritten with uninitialized tr[2], expanded track name allocations to prevent buffer overflow with multi-digit indices, replaced sprintf with snprintf, eliminated double-free of intern in wrobj, ensured track member lists are freed on all exits, and guarded acos and slope calculations against division by zero and domain errors; in ged_util.cpp, added array bounds checks in ged_results_get, validated wdbp and freed previous dbi_title in ged_dbcopy, added scale factor scan failure checks in ged_scale_args, guarded eye model functions against NULL pointers, freed intern on combadd2 region validation error, and passed correct element count to db_mkgift_tree; in get.c, freed internal representation and logged diagnostics when ft_get is unavailable, and guarded wdbp; in get_autoview.c, fixed option parsing bug where initial argc check rejected the -p flag, and validated remaining arguments; in get_comb.c, eliminated memory leaks of internal representation and rt_tree_array across all error exits, guarded wdbp, and formatted matrices with snprintf; in get_obj_bounds.c, enforced _GED_TRACE_MAX_LEVELS limit to prevent array overflow in gtd_obj, replaced free with bu_free, freed intern on rt_i_create failure, and validated ft_prep; in get_solid_kp.c, guarded input pointers against NULL, checked for empty list before accessing first node in pipe, metaball, and nmg handlers, and guarded vertex/curve pointers in bot, ars, poly, and extrude. |
-| `SEC-0252` | `src/libged/get_type/get_type.c, src/libged/glob/glob.c, src/libged/gqa/gqa.cpp, src/libged/graph/graph.cpp, src/libged/grid/grid.c, src/libged/grid2model_lu/grid2model_lu.c, src/libged/grid2view_lu/grid2view_lu.c, src/libged/group/group.c, src/libged/heal/heal.c, src/libged/help/help.cpp` | `get_type/get_type.c:45-75; glob/glob.c:130-175, 240-275, 340-395; gqa/gqa.cpp:155-165, 340-360, 560-580, 890-950, 1540-1590, 1680-1760, 1780-1880, 2600-2645, 2730-2815, 2885-2985; graph/graph.cpp:270-315, 640-675, 905-920, 1025-1055; grid/grid.c:38-60, 110-125, 280-310; grid2model_lu/grid2model_lu.c:50-65; grid2view_lu/grid2view_lu.c:50-60; group/group.c:50-65; heal/heal.c:54-85; help/help.cpp:35-105, 110-225, 260-285` | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, Logic Errors, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 10 commands (get_type, glob, gqa, graph, grid, grid2model_lu, grid2view_lu, group, heal, help): in get_type.c, validated argc and argv[1], initialized rt_db_internal before import, and guarded wdbp; in glob.c, added null checks to _debackslash, _backslash_specials, and _ged_expand_str_glob, checked gp->gl_pathv before string access, added per-word match counting to fall back to unescaping individual patterns when unmatched, and guarded argc and argv in ged_glob_core; in gqa.cpp, added null check on units buffer, constrained num_views (1..3) to prevent fixed-size array out-of-bounds access, guarded region and hit pointers against null in _gqa_overlap, initialized point arrays and passed valid pointer in _gqa_hit, bounded string traversal in find_cmd_line_obj, validated inputs and region count returning error on invalid state in allocate_per_region_data, removed redundant duplicate density file loading, fixed massive memory leaks of intern, density names, and avs across directories in densities_prep, prevented null dereference on strrchr, guarded against division by zero on state->shots across all views in view_reports, weight_volume_terminate, and summary_reports, guarded wdbp, rtip, obj_tbl, reg_tbl, and ged_gqa_plot.vbp before cleanup and destruction, and reset aborted state; in graph.cpp, checked ID_COMBINATION and pointers in process_comb and hl_scan_db, guarded child tree leaf names against null, verified file stream write success in hl_layout_and_output, removed redundant argument shifting in igraph mode and validated subcommand argument; in grid.c, guarded against null gv_s view state in grid_vsnap, grid_vls_print, and ged_grid_core, clamped user RGB color components to 0..255, and corrected error reporting parameter; in grid2model_lu.c, validated argv arguments and checked for zero denominator with ZERO macro before division; in grid2view_lu.c, guarded argv[1] and argv[2] against null; in group.c, validated group name and member arguments against null and empty strings; in heal.c, guarded arguments, clamped negative zipper tolerance, freed internal representation on non-BOT objects, and verified rt_db_put_internal return; in help.cpp, moved directory listing free inside directory traversal loop to eliminate directory listing leak, freed filepath on unreadable files, reset zeros counter per file so a binary file does not disable reading all subsequent documentation files, freed word buffer on each file exit, fixed cntptr type to size_t * preventing memory corruption, and checked bu_dir return before strdup while cleaning up resources when words == 0. |
-| `SEC-0253` | `src/libged/help/test_help.c, src/libged/hide/hide.c, src/libged/how/how.c, src/libged/human/human.c, src/libged/illum/illum.c, src/libged/importFg4Section/importFg4Section.c, src/libged/include/plugin.h, src/libged/inside/inside.c, src/libged/instance/instance.c, src/libged/isize/isize.c` | `help/test_help.c:30-45; hide/hide.c:45-120; how/how.c:40-75, 120-160; human/human.c:50-95, 2380-2505; illum/illum.c:40-95, 100-120, 150-175; importFg4Section/importFg4Section.c:45-75; inside/inside.c:55-75; instance/instance.c:50-75; isize/isize.c:35-55` | Resource Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 11 commands (test_help, hide, how, human, illum, importFg4Section, plugin.h, inside, instance, isize): in test_help.c, guarded ac and av pointers before calling bu_setprogname, and called ged_close before return to cleanly shut down GED resources; in hide.c, guarded argv[i] arguments against null or empty strings, tracked write and export failures, and corrected db5_export_object3 invocation; in how.c, initialized dpp, added null guards on hdlp, vls, dpp, and style struct pointer sp->s_os in dl_how, validated argument bounds and pointers, handled -b flag correctly, and guarded gd_headDisplay before traversal; in human.c, replaced process-terminating bu_exit calls with graceful error return in read_args, added null checks on fopen returns before writing to file pointers in text and verbose, validated argc, verified wdb_dbopen return, replaced unchecked sprintf with snprintf, and called wdb_close to eliminate persistent database handle leak; in illum.c, added GED_CHECK_DATABASE_OPEN, GED_CHECK_VIEW, GED_CHECK_DRAWABLE, and GED_CHECK_ARGC_GT_0 to ged_labelvert_core, guarded argv[i] arguments, checked dmp before calling dm_set_dirty, guarded gdlp and obj in dl_set_illum, validated directory pointer and d_namep, checked argv[1] against null using BU_STR_EQUAL, and verified gd_headDisplay; in importFg4Section.c, validated argc and argv pointers, verified wdb_dbopen return, and added wdb_close to eliminate database handle leak; in include/plugin.h, audited plugin macros; in inside.c, guarded argc and argv[1] against null and verified outdp; in instance.c, validated argument count and null/empty object and instance names, guarded argv[3] against null, and safely formatted invalid operation string; in isize.c, added GED_CHECK_DATABASE_OPEN to prevent null dereference of gedp->dbip, and guarded against division by zero using ZERO macro on base2local factor. |
-| `SEC-0254` | `src/libged/item/item.c, src/libged/joint/joint.c, src/libged/joint/joint.h, src/libged/joint2/joint2.c, src/libged/keep/keep.c, src/libged/keypoint/keypoint.c, src/libged/kill/kill.c, src/libged/killall/killall.c, src/libged/killrefs/killrefs.c, src/libged/killtree/killtree.c` | `item/item.c:45-80; joint/joint.c:120-140, 520-565, 875-920, 1100-1165, 1260-1310, 1480-1550, 2030-2070, 2180-2225, 2370-2440, 2900-2950; joint2/joint2.c:95-125, 220-255; keep/keep.c:95-155, 180-245; keypoint/keypoint.c:50-75; kill/kill.c:50-80; killall/killall.c:55-80; killrefs/killrefs.c:55-90; killtree/killtree.c:95-115, 230-265, 310-345` | Use-After-Free, Memory Corruption, Memory Leaks, Double-Free, Infinite Loop, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 12 commands (item, joint, joint2, keep, keypoint, kill, killall, killrefs, killtree): in item.c, validated argc range (3..6), guarded argv[1] and argv[2] against null, checked argv[3..5] before atoi, initialized rt_db_internal, and validated combination type freeing intern on mismatch; in joint.c, eliminated Cat 1 Use-After-Free in parse_hold by adding missing return after free_hold on EOF, fixed 64-bit struct member memory corruption where hp->priority was passed as double * clobbering flag, fixed infinite loop in joint_move dirs parsing by adding missing argv/argc increment, guarded against division by zero in parse_units with ZERO macro, eliminated persistent memory leaks in free_hold, part_solve, and joint_load by freeing arc sets, joint handles, and bu_vls, added null guards across hold_point_to_string, joint_unload, parse_error, joint_mesh, joint_save, joint_accept, joint_reject, reject_move, joint_solve, joint_hold, joint_move, and joint_cmd, fixed copy-paste typo in joint_reject usage, and corrected return status logic in joint_solve; in joint2.c, verified callback function pointers and selection counts, added bounds check preventing out-of-bounds read of argv[2] when argc == 2, and eliminated Cat 1 Double-Free of intern after GED_DB_PUT_INTERN; in keep.c, guarded directory and component pointers in node_write, closed incoming database on format mismatch and open failures to eliminate file descriptor leaks, and used wdb_close on all exits to properly release wdbp and underlying dbip; in keypoint.c, guarded argv[1..3] against null before bn_decode_vect and sscanf; in kill.c, enforced required object name argument after option stripping and guarded argv[i] in deletion loops; in killall.c, guarded argv[1] on -n check and enforced argument counts reporting usage; in killrefs.c, guarded argv[1], enforced argument count, guarded display erasure and tree deletion loops, and validated combination types; in killtree.c, guarded directory and data pointers in callbacks, enforced argument count after option parsing, guarded argv[i] in processing loop, and unconditionally freed argv allocations to eliminate -n memory leak. |
-| `SEC-0255` | `src/libged/label/label.c, src/libged/lc/lc.c, src/libged/libfuncs/libfuncs.c, src/libged/lint/cyclic.cpp, src/libged/lint/ged_lint.h, src/libged/lint/invalid_shape.cpp, src/libged/lint/lint.cpp, src/libged/lint/lint_bot.cpp, src/libged/lint/missing.cpp, src/libged/lint/raytrace.cpp` | `label/label.c:45-65; lc/lc.c:50-70, 195-215, 290-370, 520-565; libfuncs/libfuncs.c:50-70, 85-105, 120-140, 150-170; lint/cyclic.cpp:60-80, 105-140, 190-210; lint/invalid_shape.cpp:55-90, 125-155; lint/lint.cpp:80-95, 235-265, 410-440; lint/lint_bot.cpp:115-135, 160-195, 255-275, 435-455, 615-705; lint/missing.cpp:65-75, 85-145, 160-205; lint/raytrace.cpp:160-180, 195-215` | Use-After-Free, Memory Leaks, Resource Leaks, Integer Underflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 13 commands (label, lc, libfuncs, lint): in label.c, validated argc and argv bounds before dereferencing argv[0] on help output; in lc.c, guarded against null struct pointers and string fields before bu_strcmp and atoi in cmp_regions and sort_regions, validated argc and argv in ged_lc_core, handled bu_file_realpath null returns and freed norm_name on errors, closed output file and freed vls on error exits, freed results1 and results2 search tables via db_search_free, freed db_full_path root, duplicated attribute strings and freed all duplicated strings on all exits to eliminate Cat 1 Use-After-Free of stack-scoped avs attributes, and replaced descending size_t loop with reverse counting loop to prevent unsigned integer underflow; in libfuncs.c, guarded argv, argv[0], argv[1], and argv[2] before bu_sscanf, bn_decode_mat, and bn_decode_vect across mat_ae, mat_mul, mat4x3pnt, and mat_scale_about_pnt, and added missing newlines to usage strings; in lint/cyclic.cpp, freed path strings allocated by db_path_to_string, replaced process-terminating bu_bomb with graceful error logging, initialized rt_db_internal, and validated ID_COMBINATION and combination pointers; in lint/ged_lint.h, audited header declarations; in lint/invalid_shape.cpp, initialized intern, eliminated memory leaks of BREP, ARB8, DSP, and EXTRUDE internal representations on early returns by calling rt_db_free_internal across all exits, properly initialized and freed pc search table, and guarded directory pointers; in lint/lint.cpp, guarded ostr.pop_back() against empty problem vectors, validated key_val parsing, fixed off-by-one underflow in argument verification loop that caused argv[-1] out-of-bounds reads, freed combination members with mk_freemembers after mk_lcomb, and initialized is_region; in lint/lint_bot.cpp, validated triangle vertex indices against num_vertices and guarded normal magnitude before division in bot_face_normal, bounded triangle indices and vertex indices in tri_to_json and plot_bad_tris, guarded map iterator dereference in bot_check, clamped ncpus to num_faces, set last worker end to num_faces so the final triangle face is not skipped, cleaned per-worker resources with rt_clean_resource, and freed worker state array to eliminate thread resource and memory leaks; in lint/missing.cpp, replaced bu_bomb with graceful error logging, added buffer size checks against header lengths before pointer arithmetic in shape_find_missing to prevent buffer over-reads in DSP and EXTRUDE objects, and initialized and freed rt_db_internal structures across all exits; in lint/raytrace.cpp, verified ID_COMBINATION and tree pointers before traversing combination trees in subtree_has_halfspace and collect_subtree. |
-| `SEC-0256` | `src/libged/list/list.c, src/libged/lod/lod.c, src/libged/lod/lod2.cpp, src/libged/log/log.c, src/libged/ls/ls.c, src/libged/lt/lt.c, src/libged/m2v_point/m2v_point.c, src/libged/make/make.c, src/libged/make_name/make_name.c, src/libged/man/man.c` | `list/list.c:55-140; lod/lod.c:50-115; lod/lod2.cpp:35-45; log/log.c:35-90; ls/ls.c:60-170, 290-340, 420-505; lt/lt.c:40-110, 125-155; m2v_point/m2v_point.c:50-80; make/make.c:85-185; make_name/make_name.c:45-95; man/man.c:60-105, 135-215` | Memory Leaks, Resource Leaks, Integer Overflow, Infinite Loop, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 14 commands (list, lod, lod2, log, ls, lt, m2v_point, make, make_name, man): in list.c, validated argc and argv bounds, added missing newline to usage, guarded argv[arg] against null before slash search, closed wdbp immediately after copying initial tree state to prevent wdbp handle leak, freed full path on traversal failures, initialized and freed internal structures, and guarded describe callbacks; in lod.c, checked argv bounds, guarded against null gvp and gvp->gv_s view state pointers before member access, validated non-negative scale factors using bu_sscanf, and guarded argv subcommands against null; in lod2.cpp, guarded gedp and ged_result_str against null before writing result; in log.c, guarded clientdata and str in log_hook, checked gedp->ged_log before hook operations and log dumps, validated argv[1], and added missing newlines to usage messages; in ls.c, guarded list_of_names and num_in_list in vls_long_dpp and vls_line_dpp, guarded directory pointers and names against null, initialized and freed intern representations, guarded ft_label and binunif typestrings before string length operations, guarded name and type widths against unsigned underflow, guarded argv in _ged_ls_attr_objs and _ged_ls_named_objs, guarded results_obj before formatting, and freed str vls on all exit paths to eliminate memory leaks; in lt.c, initialized intern, validated ID_COMBINATION and pointers before accessing comb tree, freed intern and vls on flatten tree error exit paths to eliminate memory leaks, guarded tree leaf names against null, and validated argv bounds and option characters; in m2v_point.c, guarded argv arguments, added missing newlines to usage, and replaced raw sscanf with bu_sscanf; in make.c, validated positive scale factors, guarded extrude_ip and freed internal on error, replaced sprintf with snprintf, and called rt_db_free_internal on db_diradd failure to eliminate primitive internal memory leaks; in make_name.c, validated argv pointers, added missing newlines, parsed -s argument with bu_sscanf ensuring non-negative index, added loop bounds and overflow guards in candidate generation loop, and avoided redundant null byte injection; in man.c, checked argv bounds, verified brlman path existence, freed lang vls on all early returns to eliminate memory leaks, cleaned up failed subprocess handles with bu_process_wait_n, and waited for CLI mode processes to exit cleanly. |
-
-| `SEC-0257` | `src/libged/match/match.c, src/libged/mater/mater.cpp, src/libged/material/material.c, src/libged/metaball/metaball.c, src/libged/mirror/mirror.c, src/libged/model2grid_lu/model2grid_lu.c, src/libged/model2view/model2view.c, src/libged/model2view_lu/model2view_lu.c, src/libged/move/move.c, src/libged/move_all/move_all.c` | `match/match.c:45-80; mater/mater.cpp:245-285, 335-375, 485-535, 620-675, 935-970, 1630-1715; material/material.c:95-175, 230-315, 330-380, 420-475, 510-580, 610-660; metaball/metaball.c:165-200, 240-275, 320-355, 410-445; mirror/mirror.c:115-185; model2grid_lu/model2grid_lu.c:50-80; model2view/model2view.c:50-75; model2view_lu/model2view_lu.c:50-80; move/move.c:75-135; move_all/move_all.c:115-185, 280-340` | Memory Corruption, Resource Leaks, Memory Leaks, Out-of-bounds Memory Access, Integer Underflow, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 15 commands (match, mater, material, metaball, mirror, model2grid_lu, model2view, model2view_lu, move, move_all): in match.c, added missing newline to usage, guarded argv pointers against null, replaced unchecked pointer increment loop with safe index-bounded loop, and guarded dp and dp->d_namep before bu_path_match; in mater.cpp, freed d_path_dir vls across all exits, closed wdbp handle with wdb_close in mater_import, safely parsed mat_id with bu_sscanf before comparison, eliminated heap allocations for std::set and msgs to prevent memory leaks, freed new_buf from analyze_densities_write and bin_ext on db_dirbuild failure, replaced dynamic heap avs allocation with stack struct and ensured bu_avs_free is invoked on all iterations and exits, guarded oname before std::string conversion, safely parsed integer IDs, returned BRLCAD_ERROR on fail, and freed nname before early returns; in material.c, eliminated Cat 1 memory corruption by removing illegal bu_free on stack buffer, closed densityTable file descriptor on all paths, closed wdbp handle with wdb_close on all exits across import, create, set, and remove, freed AVS property tables on each loop iteration and exit, validated argc bounds before accessing argv indices, guarded string parsing loop against integer underflow, verified ID_MATERIAL internal type before accessing material structure, called rt_db_free_internal on all exit paths, prevented orphaning of bu_vls string buffers by using bu_vls_strcpy/bu_vls_trunc instead of BU_VLS_INIT, and propagated subcommand error return codes; in metaball.c, closed wdbp handle on all paths, verified DB5_MINORTYPE_BRLCAD_METABALL before casting internal pointer, replaced raw sscanf with bu_sscanf, fixed out-of-bounds pointer dereference of argv[3] when argc was 3 in delete error message, and added missing newlines to usage messages; in mirror.c, called rt_db_free_internal on all exit paths after rt_db_get_internal to eliminate primitive memory leaks, replaced raw sscanf with bu_sscanf, and guarded argv pointers against null; in model2grid_lu.c and model2view_lu.c, moved matrix dereferences after GED_CHECK_DATABASE_OPEN to prevent null dereference of gedp, guarded argv arguments, replaced sscanf with bu_sscanf, and added missing newlines; in model2view.c, guarded argv arguments, replaced raw sscanf with bu_sscanf, and added missing newline to usage; in move.c and move_all.c, called rt_db_free_internal after rt_db_put_internal to eliminate memory leaks, replaced libc free with bu_free on heap strings allocated by bu_strdup, safely updated display list path strings, guarded old and new name arguments against null, and fixed format parameter mismatch in name length limit error message. |
-| `SEC-0258` | `src/libged/move_arb_edge/move_arb_edge.c, src/libged/move_arb_face/move_arb_face.c, src/libged/mrot/mrot.c, src/libged/nirt/nirt.cpp, src/libged/nmg/nmg.c, src/libged/nmg/nmg_cmface.c, src/libged/nmg/nmg_collapse.c, src/libged/nmg/nmg_fix_normals.c, src/libged/nmg/nmg_kill_f.c, src/libged/nmg/nmg_kill_v.c` | `move_arb_edge/move_arb_edge.c:65-135, 180-230, 275-320; move_arb_face/move_arb_face.c:90-155, 175-240; mrot/mrot.c:50-75; nirt/nirt.cpp:210-265, 335-360, 395-425, 475-495, 550-565, 615-635, 695-755; nmg/nmg.c:40-95, 105-180, 205-285; nmg/nmg_cmface.c:65-155; nmg/nmg_collapse.c:50-155; nmg/nmg_fix_normals.c:55-95; nmg/nmg_kill_f.c:35-70, 95-135; nmg/nmg_kill_v.c:35-255, 275-315` | Memory Corruption, Use-After-Free, Memory Leaks, Resource Leaks, Out-of-bounds Memory Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 16 commands (move_arb_edge, move_arb_face, mrot, nirt, nmg, nmg_cmface, nmg_collapse, nmg_fix_normals, nmg_kill_f, nmg_kill_v): in move_arb_edge.c, closed wdbp handle on all exit paths in move_arb_edge and find_arb_edge, called rt_db_free_internal after rt_db_put_internal to eliminate memory leaks, guarded argv pointers against null, replaced raw sscanf with bu_sscanf, and added missing newlines to usage and error messages; in move_arb_face.c, eliminated Cat 1 memory corruption and stack array overflow by enforcing face bounds check on both positive and negative indices for the specific arb_type before modifying planes array, closed wdbp handle on all paths, called rt_db_free_internal after rt_db_put_internal, returned BRLCAD_ERROR when object is not an ARB, replaced sscanf with bu_sscanf, and added missing newlines; in mrot.c, validated argv and argv[i] pointers against null, and added missing newlines; in nirt.cpp, eliminated Cat 1 heap corruption on subprocess failure by replacing incorrect cast and free of string pointers as bu_vls structures with bu_free, fixed use of freed av_args and memory leak of obj by directly emitting draw commands to stdin in skip_drawn block, freed nirt exec string and nv options across all error returns, corrected loop to inspect argv[i] instead of repeatedly checking argv[0], freed dpv allocated by db_ls, fixed off-by-4 bug in ged_vnirt_core where av[i] = NULL clobbered argument pointers, replaced sscanf with bu_sscanf, guarded ged_gdp before dl_set_wflag, and added missing newlines; in nmg.c, eliminated Cat 1 linked list corruption in get_face_list where actual model face list pointers were stolen into stack f_list causing circular loops and free crashes by using detached copy structs, freed internal representations and face list allocations, fixed off-by-one subcommand lookup in ged_nmg_core where subcmd was erroneously read from argv[0] instead of argv[1], guarded argv[2] before dereferencing in kill, move, and make subcommands, and propagated subcommand return codes; in nmg_cmface.c, freed verts buffer to eliminate persistent memory leaks, closed wdbp handle on all paths, replaced atof with bu_sscanf, corrected variable in error message, and added missing newlines; in nmg_collapse.c, closed wdbp on all exit paths, freed internal representation on non-planar face detection, validated tolerances with bu_sscanf and ZERO macro, and added missing newlines; in nmg_fix_normals.c, persisted fixed normals to database via rt_db_put_internal, freed internal representation, and added missing newlines; in nmg_kill_f.c, eliminated Cat 1 Use-After-Free in remove_face by immediately returning once target face is destroyed by nmg_kfu, closed wdbp on all paths, parsed fid with bu_sscanf, and added missing newlines; in nmg_kill_v.c, eliminated Cat 1 Use-After-Free and Double-Free in remove_vertex by restarting topology search on each deletion instead of continuing iteration on freed loopuses and edgeuses, closed wdbp on all paths, parsed coordinates with bu_sscanf, and added missing newlines. |
-| `SEC-0259` | `src/libged/nmg/nmg_make_v.c, src/libged/nmg/nmg_mm.c, src/libged/nmg/nmg_move_v.c, src/libged/nmg/nmg_simplify.c, src/libged/npush/npush.cpp, src/libged/ocenter/ocenter.c, src/libged/open/open.cpp, src/libged/orient/orient.c, src/libged/orotate/orotate.c, src/libged/oscale/oscale.c` | `nmg/nmg_make_v.c:60-135; nmg/nmg_mm.c:45-75; nmg/nmg_move_v.c:280-325; nmg/nmg_simplify.c:90-105, 235-295; npush/npush.cpp:1190-1285, 1380-1445, 1670-1705; ocenter/ocenter.c:55-108; open/open.cpp:55-87, 135-150; orient/orient.c:45-80; orotate/orotate.c:60-125; oscale/oscale.c:60-115` | Use-After-Free, Memory Leaks, Resource Leaks, Out-of-bounds Memory Access, Logic Errors, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 17 commands (nmg_make_v, nmg_mm, nmg_move_v, nmg_simplify, npush, ocenter, open, orient, orotate, oscale): in nmg_make_v.c, validated vertex coordinates with bu_sscanf, closed wdbp handle with wdb_close on error and success paths, freed verts buffer on wdb_put_internal failure, and added missing newlines to usage and error strings; in nmg_mm.c, freed internal representation on db_diradd failure to prevent memory leak, checked rt_db_put_internal return status, and added missing newline to usage; in nmg_move_v.c, validated 6 coordinate arguments using bu_sscanf, closed wdbp handle on error and success exits, reported correct object name on error, and added missing newline to usage; in nmg_simplify.c, eliminated Cat 1 Use-After-Free and database corruption where failure of all conversion methods (arb/tgc/poly) fell through to out1: attempting to add and write a freed/stale new_intern, closed wdbp handle on all exit paths in out3:, and added missing newlines to usage strings; in npush.cpp, eliminated persistent leak of rt_wdb handle by immediately copying tolerance and closing wdbp, freed temporary msgs vls on early exit in non-verbose conflict path, added missing newlines to conflict and error messages, and preserved all missing/added tops reports by using bu_vls_printf instead of bu_vls_sprintf; in ocenter.c, added bounds check on gtd.gtd_objpos to prevent negative array indexing out-of-bounds, replaced sscanf with bu_sscanf, and added missing newlines to usage and error strings; in open.cpp, added missing newlines in usage and error strings, returned BRLCAD_OK when print_help is requested, and safely destroyed existing ged_lod context and dbi_state before reassigning; in orient.c, fixed off-by-one error in error reporting where argv[i-1] was printed instead of argv[i], replaced sscanf with bu_sscanf, and added missing newlines to usage strings; in orotate.c, added bounds check on gtd.gtd_objpos to prevent out-of-bounds array access, replaced sscanf with bu_sscanf, and added missing newlines to usage and error strings; in oscale.c, added scale factor validation with bu_sscanf and SQRT_SMALL_FASTF to prevent degenerate or non-positive scaling, added bounds check on gtd.gtd_objpos, and added missing newlines to usage and error strings; |
-| `SEC-0260` | `src/libged/osg.cpp, src/libged/otranslate/otranslate.c, src/libged/overlay/overlay.c, src/libged/path.c, src/libged/pathlist/pathlist.c, src/libged/pathsum/pathsum.c, src/libged/perspective/perspective.c, src/libged/pipe/pipe.c, src/libged/pix2fb/pix2fb.c, src/libged/plot/plot.c` | `osg.cpp:55-75, 150-165; otranslate.c:55-90; overlay.c:105-160, 195-225, 250-290; path.c:45-75; pathlist.c:35-105; pathsum.c:75-125; perspective.c:50-80; pipe.c:65-145, 170-235, 255-315, 340-435; pix2fb.c:70-175, 180-235; plot.c:50-60, 210-285` | Resource Leaks, Double-Free, Buffer Overflow, Logic Errors, Out-of-bounds Memory Access, and Process Termination in Library Function | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 18 commands (osg, otranslate, overlay, path, pathlist, pathsum, perspective, pipe, pix2fb, plot): in osg.cpp, added NULL pointer checks to _osgLoadHiddenSolid, _osgLoadSolid, and _ged_osgLoadScene, and verified osp->viewer validity; in otranslate.c, added bounds check on gtd.gtd_objpos preventing negative out-of-bounds array access, replaced sscanf with bu_sscanf, and added missing newlines to usage and error strings; in overlay.c, fixed out-of-bounds / null pointer dereference on argv[1] when bu_file_list returned <= 0 by changing to argv[0], freed vbp on fopen failure inside loop to eliminate memory leak, preserved cmd_name for diagnostics, and added missing newlines; in path.c, fixed critical logic flaw where the return value of path_validate_recurse was ignored allowing invalid paths to pass validation, checked intern.idb_type == ID_COMBINATION, and added missing newline; in pathlist.c, eliminated persistent wdbp database handle leak by immediately calling wdb_close after reading initial tree state, replaced static mutable global pathListNoLeaf with thread-safe struct pathlist_data passed via client_data, checked fp_len > 1 before decrement, and added missing newlines; in pathsum.c, checked _GED_TRACE_MAX_LEVELS upper bound to prevent stack buffer overflow in gtd.gtd_obj, duplicated path argument before calling strtok to avoid in-place mutation of argv and thread safety issues, and added missing newlines; in perspective.c, replaced sscanf with bu_sscanf, added angle range check [0, 180) to prevent division by zero or singularity in persp_mat, and added missing newlines; in pipe.c, eliminated persistent wdbp leaks by calling wdb_close across append, find, and move commands, fixed out-of-bounds argv[3] access when argc == 3 in delete command by correcting to argv[2], eliminated double-free hazards of intern following GED_DB_PUT_INTERN, replaced sscanf with bu_sscanf, checked seg_i >= 0, and added missing newlines; in pix2fb.c, eliminated process termination bug where bu_exit was invoked on file open failure by returning error and logging to ged_result_str, fixed usage string repetition, checked infd > 0 before close, and formatted error messages with argv[0] and newlines; in plot.c, removed mutable static local variables in dl_plot making it reentrant and thread-safe, preserved cmd_name before advancing argv, freed bu_vls str on popen failure, formatted system errors with strerror(errno) into result string, and added missing newlines. |
-| `SEC-0261` | `src/libged/pmat/pmat.c, src/libged/pmodel2view/pmodel2view.c, src/libged/png/png.c, src/libged/png2fb/png2fb.c, src/libged/pnts/pnts.cpp, src/libged/pnts_util.c, src/libged/pnts_util.h, src/libged/points_eval.c, src/libged/polyclip.cpp, src/libged/prcolor/prcolor.c` | `pmat/pmat.c:50-65; pmodel2view/pmodel2view.c:45-55; png/png.c:40-105, 148-185, 320-475; png2fb/png2fb.c:55-70, 120-135, 150-185; pnts/pnts.cpp:105-150, 340-348, 478-486, 604-612, 646-700, 810-818, 900-1045, 1070-1130, 1220-1225, 1450-1460, 1538-1555, 1585-1595; pnts_util.c:125-215, 295-410; points_eval.c:45-65; polyclip.cpp:45-55, 125-140, 168-185, 280-286, 305-316, 350-370, 570-585; prcolor/prcolor.c:84-95, 106-118` | Memory Leaks, Resource Leaks, Buffer Overflow, Infinite Loop, In-place Argument Mutation, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 19 commands (pmat, pmodel2view, png, png2fb, pnts, pnts_util, pnts_util.h, points_eval, polyclip, prcolor): in pmat.c, added diagnostic error message on bn_decode_mat failure and fixed usage formatting; in pmodel2view.c, added missing newline to usage string; in png.c, encapsulated mutable globals in struct png_state, removed static locals from draw_png_solid for thread safety, clamped raster coordinates against image bounds to prevent buffer overflow, clamped img_size to prevent integer overflow in buffer allocation, replaced raw sscanf with bu_sscanf, freed image and bytes buffers and destroyed libpng structures via png_destroy_write_struct on all error and success exits to eliminate persistent memory leaks, and added missing newlines to usage and error messages; in png2fb.c, removed duplicate usage prefix, distinguished file open failure from help request returning error instead of printing usage, replaced stderr writes with bu_log, and added missing newlines; in pnts.cpp, added bounds checks in _pnts_collect_arrays linked list loops to prevent heap buffer overflow, eliminated in-place mutation of caller argv in _ged_pnts_cmd_tri and ged_pnts_core by passing offset pointers and lengths to bu_cmd, propagated subcommand return codes, fixed unsafe argc decrement when argc <= 0, freed fl and unit vls structures on all exits in _ged_pnts_cmd_read, used RAII guard for pnt_str in _ged_pnts_cmd_write to eliminate persistent memory leak on every write operation, freed intern on fopen failure, and added missing newlines to result and error strings; in pnts_util.c, added NULL pointer checks to _ged_pnt_v_set, _ged_pnt_c_set, _ged_pnt_s_set, _ged_pnt_n_set, _ged_pnts_init_head_pnt, _ged_pnts_add, and _ged_pnts_dup; in points_eval.c, guarded d->dbip against NULL, checked fp->fp_len > 0 before calling DB_FULL_PATH_CUR_DIR, and properly initialized intern; in polyclip.cpp, closed wdbp database handles on all exit paths in ged_import_polygon, ged_polygons_overlap, and ged_polygon_fill_segments to eliminate persistent handle leaks, guarded input pointers, validated vfilldelta > SMALL_FASTF to prevent infinite loop hang, freed all 2D polygon contours, contour points, hole arrays, and result_vls on completion in ged_polygon_fill_segments to eliminate massive memory leak, and freed intern on export failure; in prcolor.c, replaced sprintf with snprintf to prevent buffer overflow, and added missing newlines to usage and none output. |
-| `SEC-0262` | `src/libged/prefix/prefix.c, src/libged/process/process.c, src/libged/ps/ps.c, src/libged/pset/pset.c, src/libged/pull/pull.c, src/libged/push/push.c, src/libged/put/put.c, src/libged/put_comb/put_comb.c, src/libged/putmat/putmat.c, src/libged/qray.cpp` | `prefix.c:45-65, 85-175; process.c:54-105, 112-175, 176-220; ps.c:91-135, 229-270, 329-440; pset.c:37-65, 86-150; pull.c:68-135, 169-245, 265-295; push.c:70-95, 200-295; put.c:51-115; put_comb.c:128-165, 355-450, 498-560; putmat.c:52-145, 191-250; qray.cpp:45-55, 78-105, 116-170` | Memory Corruption, Resource Leaks, Double-Free, Pointer Cast Error, and Underflows | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 20 commands (prefix, process, ps, pset, pull, push, put, put_comb, putmat, qray): in prefix.c, removed leftover debugging bu_log prints, guarded prefix against empty string, guarded directory names against null/empty in rename loop, freed tempstring_v5 on all early error exits to eliminate memory leaks, validated intern.idb_type == ID_COMBINATION before tree walk, and added missing newlines to usage and error strings; in process.c, fixed Cat 1 integer underflow and memory exhaustion in _ged_process_list where longest_pid < 3 underflowed longest_pid - 3 to UINT_MAX - 2 when passed to %*c in bu_vls_sprintf, freed cmdroot before return in _ged_process_gabort to eliminate memory leak, added null guards on subprocess pointers, streamlined subcommand dispatch in ged_process_core to properly display help on unrecognized or malformed arguments, and added missing newlines; in ps.c, removed mutable static local variables in ps_draw_solid making it reentrant and preventing state leakage between solids, replaced sscanf with bu_sscanf, changed early return on bad color to goto bad so font, title, and creator are freed on error, guarded sp and hdlp against null in ps_draw_body, guarded bu_optind > 0 before accessing argv[bu_optind-1], and added missing newlines to usage and error strings; in pset.c, replaced sscanf with bu_sscanf, guarded attribute against null and empty string in _ged_set_metaball, clamped threshold when ZERO(threshold), guarded argv arguments against null, simplified cleanup to unconditionally call rt_db_free_internal(&intern) whenever ret != BRLCAD_OK, and added missing newlines; in pull.c, fixed Cat 1 pointer cast corruption in pull_leaf where mp (mat_t *) was cast to struct bu_vls * and passed to bu_vls_printf, fixed massive memory leak where modified primitives transformed by ft_xform were never written back or freed by adding rt_db_put_internal and rt_db_free_internal, fixed option parsing bug in ged_pull_core where argc != 2 check and db_lookup preceded bu_getopt making -d impossible to pass, passed (matp_t)NULL instead of 0-matrix m to rt_db_get_internal in pull_comb, freed intern on empty comb trees, checked return of bn_mat_inverse, and added missing newlines; in push.c, eliminated persistent resource leak of wdbp by immediately extracting init_state and calling wdb_close(wdbp), guarded argc < 1 after option stripping, guarded null directory and database pointers and freed intern on empty comb trees in identitize, and added missing newlines; in put.c, eliminated Cat 1 double-free of intern where rt_db_free_internal(&intern) was called after wdb_put_internal (which unconditionally frees the internal structure on both success and failure), closed wdbp with wdb_close(wdbp) on both error and success paths to eliminate handle leak, guarded argv[1] and argv[2] against null and empty strings, and added missing newlines; in put_comb.c, eliminated Cat 1 buffer underflow in trailing space stripping loop where empty or all-space names decremented i below 0 and accessed name[-1], fixed logic bug in mktemp_comb where db_lookup checked template string str instead of candidate name, freed rt_tree_array on error and success paths in put_tree_into_comb_and_export to eliminate persistent memory leak, freed intern on db_diradd failure in save_comb, replaced sscanf with bu_sscanf and guarded null str in put_rgb_into_comb, and added missing newlines; in putmat.c, eliminated Cat 1 memory leaks of name1 and name2 in _getmat where bu_vls_free was omitted on all successful matrix retrieval paths, removed machine-identifiable paths from error messages, guarded against null argv[1] and argv[2], and added missing newlines; in qray.cpp, fixed Cat 1 out-of-bounds string access in qray_init when parsing format lines shorter than expected, and added null pointer checks on gdp, gdp->gd_qray_fmts, and vhead in qray_init, qray_free, and qray_data_to_vlist. |
-| `SEC-0263` | `src/libged/qray.h, src/libged/qray/qray.c, src/libged/rcodes/rcodes.c, src/libged/rect/rect.c, src/libged/red/red.c, src/libged/regdef/regdef.c, src/libged/region/region.c, src/libged/repair/repair.cpp, src/libged/rfarb/rfarb.c` | `qray.h:35-45; qray/qray.c:65-105, 140-185, 230-310, 395-430; rcodes/rcodes.c:55-80, 95-170; rect/rect.c:60-95, 115-185, 210-250, 440-490; red/red.c:135-180, 230-320, 410-530, 680-740, 890-970; regdef/regdef.c:40-100; region/region.c:50-110; repair/repair.cpp:35-145; rfarb/rfarb.c:65-175, 215-240` | Double-Free, Memory Leaks, Division by Zero, Uninitialized Memory Reads, Pointer Aliasing, and Missing Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 21 commands (qray, qray.h, quit, rcodes, rect, red, regdef, region, repair, rfarb): in qray.h, fixed macro parameter bug in DG_QRAY_BOTH; in qray/qray.c, added null checks on gedp->i and gedp->i->ged_gdp across all entry points, replaced sscanf with bu_sscanf, corrected typo in command name, and added missing newlines to error strings; in quit/quit.cpp, verified clean with no changes needed; in rcodes/rcodes.c, eliminated Cat 1 double-free of intern on rt_db_put_internal failure (which unconditionally frees intern internally), eliminated persistent memory leak by freeing intern when changed == 0 or when non-combination objects are encountered, replaced sscanf with bu_sscanf, added null and empty string checks on argv[1], and added missing newlines to usage and error messages; in rect/rect.c, added null check on gedp->ged_gvp->gv_s, added ZERO(grsp->aspect) and cdim <= 0 checks to prevent division by zero in rect_image2view and rect_adjust_for_zoom, validated user coordinate dimensions to prevent division by zero, replaced sscanf with bu_sscanf, guarded argv[0] and argv[1] against null, and added missing newlines; in red/red.c, eliminated mutable file-scope static global buffer _ged_tmpfil by passing stack-allocated buffer into build_comb and write_comb to ensure thread safety, eliminated persistent memory leaks of rt_tree_array across all error and success exits in both build_comb and write_comb, freed intern on all early error paths in build_comb and after write_comb in ged_red_core, freed allocated matrix on error in _ged_find_matrix, replaced sprintf with snprintf to prevent buffer overflow, and added missing newlines; in regdef/regdef.c, guarded wdbp against null return from wdb_dbopen, replaced sscanf with bu_sscanf, and added missing newlines to usage and output strings; in region/region.c, guarded wdbp against null, guarded argv[1], argv[i], and argv[i+1] against null/empty, and added missing newlines to usage and error strings; in repair/repair.cpp, added GED_CHECK_DATABASE_OPEN, GED_CHECK_READ_ONLY, and GED_CHECK_ARGC_GT_0 guards, handled bu_opt_parse error returns, eliminated Cat 1 double-free of intern by only freeing intern when ft_repair returns non-zero (rt_db_put_internal unconditionally frees intern on both success and failure), guarded argv[i] against null/empty, and added newlines to JSON status messages; in rfarb.c, eliminated Cat 1 double-free of internal on rt_db_put_internal failure and returned BRLCAD_ERROR, eliminated memory leak of internal on db_diradd failure, prevented uninitialized stack coordinate usage by returning BRLCAD_ERROR when bu_sscanf coordinate parsing fails, replaced sscanf with bu_sscanf, guarded argv against null, and added missing newlines to all error and usage messages. |
-| `SEC-0264` | `src/libged/rm/rm.c, src/libged/rmap/rmap.c, src/libged/rmat/rmat.c, src/libged/rmater/rmater.c, src/libged/rot/rot.c, src/libged/rot/rotate_about.c, src/libged/rot_point/rot_point.c, src/libged/rrt/rrt.c, src/libged/rt/rt.c, src/libged/rtabort/rtabort.c` | `rm/rm.c:555-575, 895-925, 1190-1215; rmap/rmap.c:45-145; rmat/rmat.c:48-65; rmater/rmater.c:30-75, 100-155; rot/rot.c:35-46; rot/rotate_about.c:45-66; rot_point/rot_point.c:50-85; rrt/rrt.c:52-68; rt/rt.c:80-132; rtabort/rtabort.c:52-73` | Stack Buffer Overflow, Memory Leaks, Logic Inversion, Out-of-bounds Array Access, Command Length Miscalculation, and Missing Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 22 commands (rm, rmap, rmat, rmater, rot, rotate_about, rot_point, rrt, rt, rtabort): in rm.c, fixed boolean CSG tree subtraction bug in _rm_tree_remove_named_leaf_instance where removing the left child of an OP_SUBTRACT node erroneously promoted the right child to a positive union instead of freeing the right tree and nullifying the subtraction, guarded null and empty operands in _rm_expand_operand while preserving unmatched glob patterns for standard error reporting, guarded argv[i] against null/empty in operand loop, and added missing newline to usage string; in rmap.c, added _ged_rmap_free_list helper and called it on rt_db_get_internal failure to eliminate persistent memory leaks of id_to_names and id_names list nodes, validated intern.idb_type == ID_COMBINATION and intern.idb_ptr before casting, replaced bu_vls_addr with bu_vls_cstr, and added missing newlines to usage and error messages; in rmat.c, added null check on argv[1], reported diagnostic error message when bn_decode_mat fails, and added missing newline to usage; in rmater.c, fixed stack buffer overflow in extract_mater_from_line by bounding string extraction to name and shader buffer capacities, replaced raw sscanf with bu_sscanf, prevented undefined behavior and crash by continuing loop instead of falling through on rt_db_get_internal failure, validated intern.idb_type == ID_COMBINATION before accessing comb, used bu_vls_trunc to safely clear comb->shader, and added missing newlines; in rot.c, added standard GED_CHECK_DATABASE_OPEN, GED_CHECK_VIEW, and GED_CHECK_ARGC_GT_0 guards; in rotate_about.c, guarded against out-of-bounds byte reads and null dereference on argv[1], and added missing newlines to current setting output and usage strings; in rot_point.c, fixed copy-paste typo where ged_m2v_point was reported instead of command name, replaced sscanf with bu_sscanf, guarded coordinate arguments against null, and added missing newlines; in rrt.c, fixed command length miscalculation where gd_rt_cmd_len was set only to the count of who objects rather than the full command length, eliminated persistent memory leak of strings allocated by ged_who_argv by freeing each who object after execution, and guarded argv[i] against null; in rt.c, replaced sprintf with snprintf, provided PATH fallback when bu_dir returns null, guarded argv[i] against null, and explicitly null-terminated gd_rt_cmd; in rtabort.c, added null checks on rrp, rrp->p, and cmd before processing and terminating subprocesses, and added missing newline to usage string. |
-| `SEC-0265` | `src/libged/rtcheck/rtcheck.c, src/libged/rtcheck/rtcheck2.cpp, src/libged/rtwizard/rtwizard.c, src/libged/savekey/savekey.c, src/libged/scale/scale.c, src/libged/search/search.c, src/libged/select/select.c, src/libged/select/select2.cpp, src/libged/set_output_script/set_output_script.c, src/libged/set_transparency/set_transparency.c` | `rtcheck/rtcheck.c:100-165, 225-285, 320-330; rtcheck/rtcheck2.cpp:80-165, 220-280, 310-320; rtwizard/rtwizard.c:45-75, 110-180, 185-195; savekey/savekey.c:45-55, 75-100; scale/scale.c:40-60; search/search.c:285-295, 395-485, 570-580; select/select.c:45-50, 110-115, 240-245, 375-480, 505-600; select/select2.cpp:120-130, 235-265, 285-320, 445-505; set_output_script/set_output_script.c:45-60; set_transparency/set_transparency.c:30-65, 85-125` | Resource Leaks, Memory Leaks, Null Pointer Dereferences, Out-of-bounds Memory Access, and Missing Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 23 commands (rtcheck, rtcheck2, rtwizard, savekey, scale, search, select, select2, set_output_script, set_transparency): in rtcheck.c, added null checks in rtcheck_vector_handler and rtcheck_output_handler on rtcp, rrtp, gedp, rtcp->fp, and rrtp->p, provided PATH fallback when bu_dir returns null, allocated args + 1 for gd_rt_cmd, guarded argv[i] against null, and eliminated persistent memory leak of strings allocated by ged_who_argv by freeing each string on error and success paths; in rtcheck2.cpp, added null checks in rtcheck_vector_handler and rtcheck_output_handler on rtcp, rrtp, gedp, rtcp->fp, and rrtp->p, provided PATH fallback when bu_dir returns null, allocated args + 1, guarded argv[i] against null, and freed strings allocated by ged_who_argv on error and success paths; in rtwizard.c, added null checks on gedp and gd_rt_cmd in _ged_run_rtwizard, replaced sprintf with snprintf, allocated args + 1 for gd_rt_cmd, guarded argv[i] against null, and freed strings returned by ged_who_argv upon command completion to eliminate memory leaks; in savekey.c, added null checks on gedp, gvp, fp, and eye_model in savekey_rt_oldwrite, validated time argument with bu_sscanf instead of raw atof and reported error on invalid input, replaced raw perror writes to stderr with structured error logging to ged_result_str, checked argv[1], and added missing newlines to usage and error strings; in scale.c, added GED_CHECK_DATABASE_OPEN, GED_CHECK_VIEW, and GED_CHECK_ARGC_GT_0 guards, validated scale factor against non-positive and non-finite values and reported error instead of silently returning OK, and added missing newline to error message; in search.c, corrected pointer size calculation from sizeof(char *) to sizeof(struct directory *) in _ged_search_localized_obj_list, added missing GED_CHECK_DATABASE_OPEN and GED_CHECK_ARGC_GT_0 guards in ged_search_core, guarded argv_orig[i] against null in option scanning loop, checked bu_argv_dup return value, and bounded plan_argv < argc in both plan discovery and plan string construction loops to prevent out-of-bounds pointer reads; in select.c, plugged persistent leak of rt_wdb database handles opened via wdb_dbopen by ensuring wdb_close is called immediately after import or upon error in both ged_select_core and ged_rselect_core, guarded ged_gvp->gv_s before accessing screen rectangle, freed intern on early error paths, replaced raw sscanf with bu_sscanf, added missing newlines to all error and usage messages, and added null checks on botip, botip->vertices, hdlp, and vls; in select2.cpp, added GED_CHECK_DATABASE_OPEN and GED_CHECK_ARGC_GT_0 guards in ged_select2_core, guarded argv[i] in option loop, safely checked argc <= 0 before indexing argv[0] in subcommand dispatch, added null checks in _select_cmd_msgs, and added missing newlines in _select_cmd_add and _select_cmd_rm; in set_output_script.c, added missing newline to usage, and guarded against passing null ged_output_script to %s in bu_vls_printf; in set_transparency.c, added GED_CHECK_DATABASE_OPEN guard, returned GED_HELP on argc == 1, replaced raw sscanf with bu_sscanf, clamped transparency to [0.0, 1.0], returned BRLCAD_ERROR when _ged_build_dpp fails, added null checks on gedp, i, ged_gdp, dpp, hdlp, and sp->s_os in dl_set_transparency, and added missing newlines to usage messages. |
-| `SEC-0266` | `src/libged/set_uplotOutputMode/set_uplotOutputMode.c, src/libged/setview/setview.c, src/libged/shaded_mode/shaded_mode.c, src/libged/shader/shader.c, src/libged/shells/shells.c, src/libged/showmats/showmats.c, src/libged/shrinkwrap/shrinkwrap.c, src/libged/simulate/ged_command.cpp, src/libged/simulate/rt_collision_algorithm.cpp, src/libged/simulate/rt_collision_algorithm.hpp` | `set_uplotOutputMode/set_uplotOutputMode.c:48-75; setview/setview.c:48-85; shaded_mode/shaded_mode.c:50-80; shader/shader.c:42-75; shells/shells.c:48-135; showmats/showmats.c:50-75, 80-180; shrinkwrap/shrinkwrap.c:30-40; simulate/ged_command.cpp:40-48, 180-192, 285-325; simulate/rt_collision_algorithm.cpp:98-120, 150-205` | Resource Leaks, Memory Leaks, Double-Free, Division by Zero, Mutating Input, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 24 commands (set_uplotOutputMode, setview, shaded_mode, shader, shells, showmats, shrinkwrap, simulate): in set_uplotOutputMode.c, added null and empty string guards on argv[1] before inspecting characters, and appended missing newlines to usage, binary, and text output strings; in setview.c, added null checks on argv[1] when argc == 2 and argv[1..3] when argc == 4, replaced raw sscanf with bu_sscanf, safely printed bad coordinate values, and added missing newlines to usage strings; in shaded_mode.c, guarded argv[1] against null, replaced raw sscanf with bu_sscanf, and added missing newlines to mode output and usage strings; in shader.c, added null check on argv[1], verified argv[2..argc-1] are non-null before bu_vls_from_argv, replaced bu_vls_addr with bu_vls_cstr, and added missing newlines to usage, current shader output, and read-only error message; in shells.c, fixed major resource and memory leaks by deferring wdb_dbopen until after argument validation, verifying wdbp allocation, calling wdb_close on all error and success exits, calling rt_db_free_internal on old_intern across all exits, freeing shell_name on all exits, and eliminating double-free of m_tmp after rt_db_put_internal failure; in showmats.c, eliminated mutation of input path and improved safety by operating on a duplicated string buffer via bu_strdup and freeing path_copy on all exit paths, guarded smdp, smdp->smd_child, and comb_leaf->tr_l.tl_name against null in Do_showmats, guarded argv[1] against null in ged_showmats_core, added trailing newline to 16-element matrix output in -a mode, and added missing newlines to usage strings; in shrinkwrap.c, added GED_CHECK_DATABASE_OPEN guard and safely handled potential null argv[0]; in simulate/ged_command.cpp, added missing newline to non-Bullet error message, validated argc >= 3 and ensured argv[1] and argv[2] are non-null before parsing options, wrapped anim_state in std::unique_ptr to prevent persistent memory and resource leaks if exceptions are thrown during simulation steps, and added missing newline to exception result output; in simulate/rt_collision_algorithm.cpp, guarded against null rays in free_xrays, prevented division by zero by validating grid_radius > 0 and radius > 0 in generate_ray_grid and get_rays, returning null safely instead of calling bu_bomb, and added null checks on btRigidBody::upcast, getMotionState, and rays.ptr in calculate_contact_points to prevent null pointer dereferences. |
-| `SEC-0267` | `src/libged/simulate/rt_collision_shape.cpp, src/libged/simulate/rt_collision_shape.hpp, src/libged/simulate/rt_debug_draw.cpp, src/libged/simulate/rt_debug_draw.hpp, src/libged/simulate/rt_instance.cpp, src/libged/simulate/rt_instance.hpp, src/libged/simulate/rt_motion_state.cpp, src/libged/simulate/rt_motion_state.hpp, src/libged/simulate/rt_roi_collision_shape.cpp, src/libged/simulate/rt_roi_collision_shape.hpp` | `simulate/rt_collision_shape.cpp:106-112, 130-149; simulate/rt_debug_draw.cpp:78-95, 116-125, 130-145, 156-175, 172-201; simulate/rt_instance.cpp:60-105, 117-150; simulate/rt_motion_state.cpp:45-50, 62-67, 104-140; simulate/rt_roi_collision_shape.cpp:123-185; simulate/rt_roi_collision_shape.hpp:116-121` | Resource Leaks, Memory Corruption, Unhandled Exceptions/Process Termination (bu_bomb), and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 25 commands (src/libged/simulate/*): in rt_collision_shape.cpp, eliminated process-aborting bu_bomb calls by zeroing inertia when mass <= 0.0 and clamping negative scaling and margin values to 0.0; in rt_debug_draw.cpp, fixed major resource leaks of in-memory database handles by ensuring wdb_close is called on all paths in drawLine, drawAabb, and drawContactPoint, clamped color components to [0.0, 1.0] instead of terminating with bu_bomb, and added null check on message in reportErrorWarning; in rt_instance.cpp, guarded against null application and partition pointers in multioverlap_handler, falling back safely to rt_default_multioverlap on unexpected region table lengths or region names instead of calling bu_bomb, and threw InvalidSimulationError instead of aborting the process with bu_bomb when rt_i_create or rt_gettrees fails in get_overlaps; in rt_motion_state.cpp, guarded matrix and result destination pointers in bt_transform_to_matrix and path_to_matrix, and threw InvalidSimulationError instead of calling bu_bomb on rt_db_get_internal, db_find_named_leaf, or rt_db_put_internal failure; in rt_roi_collision_shape.cpp, guarded against null m_box_shape before dereferencing in getAabb, calculateLocalInertia, getLocalScaling, getMargin, setLocalScaling, and setMargin, clamped negative scaling and margin values, and zeroed inertia when mass <= 0.0; and in rt_roi_collision_shape.hpp, declared copy constructor and assignment operator private to enforce the Rule of Three and prevent double-free corruption of m_box_shape. |
-| `SEC-0268` | `src/libged/simulate/sim_animate.cpp, src/libged/simulate/sim_animate.hpp, src/libged/simulate/simulation.cpp, src/libged/simulate/simulation.hpp, src/libged/simulate/tests/simulate_test.cpp, src/libged/simulate/tests/verify_simulation.c, src/libged/simulate/utility.cpp, src/libged/slew/slew.c, src/libged/solid_report/solid_report.c` | `simulate/sim_animate.cpp:95-135, 218-228, 300-360, 575-605; simulate/sim_animate.hpp:105-112; simulate/simulation.cpp:135-145, 185-190, 265-275, 350-395, 465-495, 595-635, 825-835; simulate/simulation.hpp:88-95; simulate/tests/simulate_test.cpp:40-48, 336-342; simulate/tests/verify_simulation.c:37-65, 75-80, 168-175, 225-235, 255-260; simulate/utility.cpp:45-90; slew/slew.c:48-98; solid_report/solid_report.c:32-37` | Memory Leaks, Inverted Return Value Logic Bug, Process Termination in Library Function (bu_bomb), Missing Validation, Division by Zero, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 26 commands (simulate, slew, solid_report): in simulate/sim_animate.cpp and sim_animate.hpp, added null checks in az_el_to_offset, look_at_quaternion, and ae_to_quaternion, guarded m_gedp and dbip in getSceneCenter and renderFrame, cleared jpeg_data on error and bounded maximum buffer read size in readPixToJpeg, validated width, height, and fps in encodeVideo, enforced the Rule of Three on SimAnimState with private copy constructor and assignment operator, and removed unused method declaration writeMjpegAvi; in simulate/simulation.cpp and simulation.hpp, eliminated multiple process-terminating bu_bomb calls across get_aabb, get_simulation_parameters, Region::get_region, and Region::get_regions by throwing InvalidSimulationError with contextual path information, replaced bu_bomb in saveState with warning logging, eliminated persistent memory leak of bullet collision create functions in Simulation::Simulation by tracking allocated CreateFunc pointers in m_create_funcs and deleting them in ~Simulation(), and enforced the Rule of Three on Simulation and Region; in simulate/tests/simulate_test.cpp, safely returned false on null matrix in matrix_equal instead of calling bu_bomb, and guarded argv and argv[0] in main; in simulate/tests/verify_simulation.c, added null checks in parse_bbox, get_bbox, check_presim, check_postsim, and main, replaced raw sscanf with bu_sscanf, replaced bu_vls_addr with bu_vls_cstr, and guarded against division by zero on truck_height when calculating penetration percentage; in simulate/utility.cpp, threw InvalidSimulationError in current_dir on empty paths, fixed critical inverted logic bug in set_region where bu_avs_remove returning 1 on successful attribute removal was erroneously treated as an error causing bu_bomb to abort the process, and replaced remaining bu_bomb calls with warning logging to ensure clean teardown in ~TemporaryRegionHandle; in slew/slew.c, added null checks on argv[1..3], replaced raw sscanf with bu_sscanf, and added missing newlines to all usage strings; and in solid_report/solid_report.c, guarded gedp against null. |
-| `SEC-0269` | `src/libged/solids_on_ray/solids_on_ray.c, src/libged/sphgroup/sphgroup.c, src/libged/stat/stat.cpp, src/libged/summary/summary.c, src/libged/sync/sync.c, src/libged/tab_complete.cpp, src/libged/tables/tables.c, src/libged/tests/bot/bot_dump.cpp, src/libged/tests/bot/bot_split.cpp, src/libged/tests/check_mann_docs.cpp` | `solids_on_ray/solids_on_ray.c:60-75, 120-130, 240-275; sphgroup/sphgroup.c:50-58, 85-115; stat/stat.cpp:115-125, 200-245, 330-365, 430-470; summary/summary.c:50-80, 150-185, 230-245; sync/sync.c:45-55; tab_complete.cpp:45-75, 110-180; tables/tables.c:165-185, 255-275, 410-440, 520-560; tests/bot/bot_dump.cpp:130-140, 405-415; tests/bot/bot_split.cpp:85-105, 130-145, 185-195, 225-235; tests/check_mann_docs.cpp:105-110, 635-645, 755-765, 820-835, 965-975, 1005-1015` | Memory Leaks, Resource Leaks, Option Parsing Collision, Uninitialized Memory Operations, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 27 commands and test drivers: in solids_on_ray/solids_on_ray.c, eliminated persistent memory leaks of solids_on_ray_cmd_vec strings (allocated by ged_who_argv) and snames path strings (allocated by db_path_to_string), added null guards on ap and PartHeadp in rpt_hits, verified pp->pt_inseg and pp->pt_inseg->seg_stp before retrieving path, guarded ap in rpt_miss, added null checks on gedp, dbip, ray_orig, and ray_dir in skewer_solids, replaced raw sscanf with bu_sscanf, added null checks on argv[1] and argv[2], and added missing newlines to usage and error strings; in sphgroup/sphgroup.c, fixed persistent memory leak of sph_intern by calling rt_db_free_internal on non-sphere error, _ged_combadd error, and normal exit, added null/empty string validation on argv[1] and argv[2], added missing newline to usage string, and deleted commented-out dead code; in stat/stat.cpp, fixed option parsing bug where the -q quiet flag was clobbered by -r raw due to duplicate array index d[3], fixed memory leaks in cmp_dps by using std::string to eliminate bu_vls leaks and freeing avs and string allocations on all exit paths, fixed memory leaks in stat_output by scoping bu_vls and freeing avs, added null/bounds checks in dpath_sort and _stat_find_first_unescaped, and added missing newlines to bu_log; in summary/summary.c, fixed major memory leak in solid_counter by calling rt_db_free_internal, added null checks in comb_counter and solid_counter, validated bu_opt_parse return value, guarded argv[0] against null, and added error output on missing objects; in sync/sync.c, added GED_CHECK_ARGC_GT_0 to prevent null dereference of argv[0] and appended missing newline; in tab_complete.cpp, added null guards in alphanum_cmp, path_match, obj_match, and ged_cmd_completions; in tables/tables.c, fixed memory leak of tree_objs bu_ptbl, verified read count before matching identt in tables_sol_number, initialized static descriptors to -1, guarded sol_loaded before invoking ft_describe or freeing sol_intern in tables_new, guarded getpwuid against null in tables_header, guarded ctime return in ged_tables_core, and added missing newlines; in tests/bot/bot_dump.cpp, guarded argv against null, corrected arbs_stl output comparison path for arb4_bot_02.stl, and added missing newlines; in tests/bot/bot_split.cpp, guarded argv in main, added null checks in check_output_group, check_output_bot, and check_decimated_bot, and ensured rt_db_free_internal is called on early return; and in tests/check_mann_docs.cpp, validated argv in main, added null checks before array indexing, and verified file stream is_open status before reading or writing. |
-| `SEC-0270` | `src/libged/tests/check_prim_cmds.cpp, src/libged/tests/create/create_parity.c, src/libged/tests/create/create_parity.h, src/libged/tests/create/in_cases.c, src/libged/tests/create/make_cases.c, src/libged/tests/draw/aet.cpp, src/libged/tests/draw/annotate.cpp, src/libged/tests/draw/basic.cpp, src/libged/tests/draw/draw_color.cpp, src/libged/tests/draw/faceplate.cpp` | `tests/check_prim_cmds.cpp:52-64; tests/create/create_parity.c:60-75, 84-100, 155-165, 205-230; tests/create/in_cases.c:45-55; tests/create/make_cases.c:45-60, 115-125, 140-150; tests/draw/aet.cpp:200-220, 245-285, 335-375, 405-415; tests/draw/annotate.cpp:60-65, 260-275, 390-410; tests/draw/basic.cpp:45-170, 200-235, 770-800; tests/draw/draw_color.cpp:45-55, 105-140, 150-165; tests/draw/faceplate.cpp:50-70, 335-350` | Logic Bugs, Resource and Handle Leaks, Missing Parameter and Option Validation, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 28 test suites and drivers: in tests/check_prim_cmds.cpp, guarded argc and argv in main and checked empty ftp->ft_label string; in tests/create/create_parity.c, added null checks in case_covered and check_coverage, fixed handle leak in open_test_db by closing wdbp with wdb_close instead of leaking wdbp via raw db_close, guarded gedp, gedp->dbip, name, and out in snapshot, guarded argc and argv in main, and ensured temporary test database files are deleted on all exit paths; in tests/create/create_parity.h, verified interface header clean; in tests/create/in_cases.c and make_cases.c, added null guards on gedp, name, and label in build_obj and make_obj, and added null checks in trans_exempt and extra_checks; in tests/draw/aet.cpp, guarded gedp, dbi_state, view counts, and display manager pointers in dm_refresh and img_cmp, freed tname on error exits, guarded argc and argv in main, validated option parsing results, freed fname, deleted temporary database moss_aet_tmp.g, and cleared local cache directory lcache on exit; in tests/draw/annotate.cpp, fixed handle leak in verify_geometry_update by ensuring wdb_close is called on wdbp, guarded gedp and gedp->dbip in verify_legacy_annotation_coloring, and guarded argc and argv in main; in tests/draw/basic.cpp and faceplate.cpp, fixed critical logic bug where if (uac == -1 || need_help) had an empty statement body which inverted command-line argument validation logic, guarded ac and av in main, guarded gedp across poly_* helper functions, freed fname, deleted temporary moss_tmp.g, and cleared lcache on exit; and in tests/draw/draw_color.cpp, guarded argv in main, guarded fixture path, and added null checks on gedp, gedp internals, display structures, and directory pointers in check_drawing. |
-| `SEC-0271` | `src/libged/tests/draw/lod.cpp, src/libged/tests/draw/quad.cpp, src/libged/tests/draw/select.cpp, src/libged/tests/draw/util.cpp, src/libged/tests/edit/test_edit.cpp, src/libged/tests/ged_test_rm.c, src/libged/tests/ged_test_tire.cpp, src/libged/tests/plugins.cpp, src/libged/tests/search_tests.cpp, src/libged/tests/test_bb_tight.c` | `tests/draw/lod.cpp:180-260, 420-475; tests/draw/quad.cpp:130-170, 200-240, 275-310, 1100-1160; tests/draw/select.cpp:185-265, 750-805; tests/draw/util.cpp:50-95, 230-295; tests/edit/test_edit.cpp:380-410, 890-915, 3470-3530; tests/ged_test_rm.c:60-95, 410-440, 960-1010; tests/ged_test_tire.cpp:50-100, 260-280, 520-560, 680-715; tests/plugins.cpp:50-65, 380-420, 460-475; tests/search_tests.cpp:40-65, 170-215; tests/test_bb_tight.c:45-75, 120-140, 185-225` | Logic Bugs, Temporary File and Resource Leaks, Double-Free, Missing Option and Parameter Validation, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 29 test suites and drivers: in tests/draw/lod.cpp and select.cpp, corrected option parsing check from ac != 2 to uac != 2 so optional command flags such as -c are correctly recognized without causing premature test failure, added null guards on ac, av, gedp, gedp->dbip, v, and v->dmp, freed fname and cleaned up temporary test databases on all exit paths; in tests/draw/quad.cpp, added null checks across drawing and refresh helpers, guarded image comparison against null control and test images, freed cname, corrected option parsing bounds, and ensured temporary database cleanup on exit; in tests/draw/util.cpp, added null guards on dp, u_data, dbi_state, ged_gvp, and dmp, and plugged memory leaks in img_cmp; in tests/edit/test_edit.cpp, replaced invalid jump-over-initialization error path with direct cleanup in create_p0_fixture, replaced manual export and double-free in create_p6_fixture with mk_brep, and ensured all 10 temporary database files (p0_path through p6_path) are unlinked via bu_file_delete across all error and success exits; in tests/ged_test_rm.c, replaced leaking db_close calls with wdb_close, added close_test_db to delete temporary test database files upon completion across all 26 test functions, fixed unchecked db_lookup dereferences, and added null guards in CHECK_PRESENT, CHECK_ABSENT, member_count, comb_has_op, and main; in tests/ged_test_tire.cpp, fixed database handle leaks by properly pairing wdb_fopen with wdb_close, added close_test_db to clean up temporary test databases, unlinked temporary text files and pattern files via bu_file_delete, eliminated premature wdb_close in run_partial_cleanup_case on an unowned handle, and added null checks across inspection helpers; in tests/plugins.cpp, fixed off-by-one / null pointer dereference in error message accessing av[1] instead of av[0], guarded ac and av in main, and added null checks on imsgs and cmds; in tests/search_tests.cpp, added null guards for gedp, gedp->dbip, path_dp, and search_count_helper, and validated argc/argv; and in tests/test_bb_tight.c, fixed wdbp handle leaks in open_test_db, added close_test_db to remove temporary test databases, and added null guards in parse_bb_volume, run_bb_volume, and main. |
-| `SEC-0272` | `src/libged/tests/test_bo.c, src/libged/tests/test_db.c, src/libged/tests/test_gqa.c, src/libged/tests/test_list.c, src/libged/tests/test_material.c, src/libged/tests/test_search.c, src/libged/tests/test_select.cpp, src/libged/tests/test_tops.c, src/libged/tests/test_view_dir.c, src/libged/tire/tire.cpp` | `tests/test_bo.c:79-88, 115; tests/test_gqa.c:65-70; tests/test_list.c:43-45, 63-73; tests/test_material.c:127-132, 148-152; tests/test_search.c:63-71, 104-109; tests/test_select.cpp:54-60, 185-195; tests/test_tops.c:48-53` | Resource Leaks, Null Pointer Dereferences, Division by Zero, and Array Overflow | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 30 test programs and tire command: in test_bo.c, replaced db_close(wdbp->dbip) with wdb_close(wdbp) to fix wdb handle leak, and added null guard on binunif internal pointer before accessing type, count, and data fields; in test_gqa.c, added null check on ged_open return value; in test_list.c, validated atoi result for non-positive values and guarded elapsed_sec > 0 before division to prevent division by zero in ops-per-second calculation; in test_material.c, added null check on ged_open return value and added ged_close before exit to prevent resource leak; in test_search.c, added null check on ged_open return value and added bounds check on variadic plan arguments to prevent overflow of fixed-size cmd[6] array; in test_select.cpp, added null check on ged_open return value, freed DbiState allocation, and cleaned up temporary cache directory with bu_dirclear on exit; in test_tops.c, added null check on ged_open return value; test_db.c reviewed clean (ged_open already checked, bu_vls_cstr never returns NULL); test_view_dir.c reviewed clean (proper goto/done cleanup pattern); tire/tire.cpp reviewed clean (GED_CHECK_DATABASE_OPEN ensures valid state, extensive validation in build_validated_request). |
-| `SEC-0273` | `src/libged/tire/tire_conic.cpp, src/libged/tire/tire_csg.cpp, src/libged/tire/tire_private.h, src/libged/tire/tire_surface.cpp, src/libged/tire/tire_tread.cpp, src/libged/tire/tire_tread_def.cpp, src/libged/tire/tire_tread_profile.cpp, src/libged/tire/tire_wheel.cpp, src/libged/title/title.c, src/libged/tol/tol.c` | `tire/tire_surface.cpp:88-94; tire/tire_tread.cpp:49-52; title/title.c:57; tol/tol.c:246` | Division by Zero, Integer Underflow, and Convention Violations | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 31 (tire, title, tol): in tire/tire_surface.cpp, added ZERO() division-by-zero guard before dividing by spec.dyside1 and ztire_with_offset in make_tire to prevent floating-point divide-by-zero on degenerate tire specifications; in tire/tire_tread.cpp, added empty vector guard in emit_tread_extrusions to prevent size_t underflow when verts.size()-1 wraps to SIZE_MAX on an empty vector; in title/title.c, replaced bu_vls_addr with bu_vls_cstr per BRL-CAD conventions; in tol/tol.c, replaced raw sscanf with bu_sscanf for locale-independent parsing per BRL-CAD conventions. Reviewed clean: tire_conic.cpp (robust std::optional error handling, no raw allocations), tire_csg.cpp (RAII CsgTransaction pattern with deleted copy ctor, proper rollback), tire_private.h (header-only definitions), tire_tread_def.cpp (thorough JSON validation with try/catch), tire_tread_profile.cpp (all solver calls checked for nullopt), tire_wheel.cpp (all write operations checked). |
-| `SEC-0274` | `src/libged/tops/tops.c, src/libged/tra/tra.c, src/libged/trace.c, src/libged/track/track.c, src/libged/tree/tree.c, src/libged/typein/typein.c, src/libged/unhide/unhide.c, src/libged/units/units.c, src/libged/v2m_point/v2m_point.c, src/libged/vdraw/vdraw.c` | `tree/tree.c:145-170,205-220; typein/typein.c:1580-1600,2780-2800; units/units.c:82; v2m_point/v2m_point.c:56-68; vdraw/vdraw.c:170-230` | Memory Leaks, Resource Leaks, Unsafe API, and Convention Violations | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 32 (tops through vdraw): in tree/tree.c, fixed memory leak of attribute value set by adding bu_avs_free, fixed resource leak of rt_db_internal on v4gift flatten failure, replaced bu_vls_addr with bu_vls_cstr; in typein/typein.c, fixed resource leaks in extrude_in and revolve_in when imported object is not ID_SKETCH by adding rt_db_free_internal, replaced bu_vls_addr with bu_vls_cstr in revolve_in and pnts_in (4 instances); in units/units.c, replaced bu_vls_addr with bu_vls_cstr; in v2m_point/v2m_point.c, replaced raw sscanf with bu_sscanf (3 instances), fixed copy-paste error in error messages; in vdraw/vdraw.c, replaced raw sscanf with bu_sscanf (7 instances). Reviewed clean: tops.c (proper GED_CHECK guards), tra.c (validated argument handling), trace.c (correct tree traversal), track.c (GED_CHECK guards, proper cleanup), unhide.c (minimal unhide command). |
-| `SEC-0275` | `src/libged/vers.c, src/libged/view/aet.c, src/libged/view/align.c, src/libged/view/autoview.c, src/libged/view/autoview2.cpp, src/libged/view/axes.c, src/libged/view/center.cpp, src/libged/view/data_lines.c, src/libged/view/eye.c, src/libged/view/faceplate/faceplate.c, src/libged/view/faceplate/faceplate.h, src/libged/view/faceplate/faceplate_axes.c, src/libged/view/faceplate/faceplate_grid.c, src/libged/view/faceplate/interactive_rect.c, src/libged/view/ged_view.h` | `view/aet.c:86-97; view/align.c:80-90; view/center.cpp:156-166; view/eye.c:76-86; view/faceplate/faceplate.c:121,226,320,380` | Unsafe API and Memory Leaks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 33 (view module): in view/aet.c, replaced raw sscanf with bu_sscanf (3 sites); in view/align.c, replaced raw sscanf with bu_sscanf (3 sites); in view/center.cpp, replaced raw sscanf with bu_sscanf (3 sites); in view/eye.c, replaced raw sscanf with bu_sscanf (3 sites); in view/faceplate/faceplate.c, added bu_vls_free on stack VLS after bu_opt_color and bu_opt_int calls to prevent memory leaks (4 sites). Reviewed clean: vers.c (trivial version function), autoview.c (proper bu_calloc/bu_free), autoview2.cpp (bu_opt_parse with cleanup), axes.c (bu_opt_fastf_t/bu_opt_int/bu_opt_color with proper cleanup), data_lines.c (already uses bu_sscanf), faceplate.h (declarations only), faceplate_axes.c (design-level struct mismatch, not a simple fix), faceplate_grid.c (similar struct mismatch), interactive_rect.c (similar struct mismatch), ged_view.h (declarations only). |
-| `SEC-0276` | `src/libged/view/gobjs.cpp, src/libged/view/knob.c, src/libged/view/labels.c, src/libged/view/lines.c, src/libged/view/lod.cpp, src/libged/view/lookat.c, src/libged/view/objs.cpp, src/libged/view/polygons.c, src/libged/view/quat.c, src/libged/view/qvrot.c, src/libged/view/saveview.c, src/libged/view/size.c, src/libged/view/snap.c, src/libged/view/view.c, src/libged/view/viewdir.c, src/libged/view/ypr.c` | `view/gobjs.cpp:48-57,113-130,150-164; view/labels.c:127-148; view/lines.c:84-90; view/lod.cpp:178-190,340-345; view/lookat.c:70-100; view/objs.cpp:168-183,219-244,561-625; view/polygons.c:106,487,531,847-855; view/quat.c:62-65; view/qvrot.c:89-105; view/saveview.c:97,127,173-176; view/size.c:61-65; view/snap.c:100-135,153,194; view/view.c:831,840,850,874,948; view/viewdir.c:58; view/ypr.c:73-81` | Memory Leaks, Logic Bugs, Out-of-bounds Array Access, Resource Leaks, Unsafe API, and Missing Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 34 (view module: gobjs through ypr): in view/gobjs.cpp, fixed memory leaks of full path and internal objects in create command and scene free callback, and checked database open; in view/labels.c and view/lines.c, guarded against null scene object creation and used bu_vls_sprintf to prevent vls buffer leaks; in view/lod.cpp, validated database open before cache commands, checked wdb handle, fixed copy-paste error in scale message, and removed dead vls variables; in view/lookat.c, replaced raw sscanf with bu_sscanf (3 sites), guarded against zero vector division when lookat point is at eye position, and added missing newlines; in view/objs.cpp, fixed memory leak of directory pointers in _view_cmd_old_obj across all return paths, guarded against null ged internals, removed redundant recurse check, and fixed argument reporting in arrow subcommand; in view/polygons.c, fixed out-of-bounds argv index in overlap subcommand (argv[1] -> argv[0]), fixed error message reporting in bool subcommand (argv[0] -> argv[1]), checked database open before overlap tolerance check, and formatted s_name with bu_vls_sprintf; in view/quat.c, replaced raw sscanf with bu_sscanf (4 sites) and added missing newlines; in view/qvrot.c, replaced raw sscanf with bu_sscanf (4 sites), corrected argument reporting for bad angle from argv[1] to argv[4], and added missing newlines; in view/saveview.c, replaced bu_vls_addr with bu_vls_cstr, guarded display list traversal against null pointers, and added missing newlines; in view/size.c, replaced raw sscanf with bu_sscanf and added missing newlines; in view/snap.c, fixed critical logic bug where vp was set from uninitialized p instead of parsed 2D coordinates p2d, freed temporary msg vls on all early returns to eliminate memory leak, and added missing newlines; in view/view.c, added missing newlines to usage and error messages; in view/viewdir.c, added missing newline to usage message; in view/ypr.c, replaced raw sscanf with bu_sscanf (3 sites) and added missing newlines. Reviewed clean: knob.c. |
-| `SEC-0277` | `src/libged/view2grid_lu/view2grid_lu.c, src/libged/view2model/view2model.c, src/libged/view2model_lu/view2model_lu.c, src/libged/view2model_vec/view2model_vec.c, src/libged/voxelize/voxelize.c, src/libged/vrot/vrot.c, src/libged/vutil.c, src/libged/wcodes/wcodes.c, src/libged/wdb_importFg4Section.c, src/libged/whatid/whatid.c, src/libged/which/which.cpp, src/libged/which_shader/which_shader.c, src/libged/who/who.c, src/libged/who/who2.cpp, src/libged/who/who_solids.cpp, src/libged/wireframe_eval.c, src/libged/wmater/wmater.c, src/libged/xpush/xpush.c, src/libged/zap/zap.c, src/libged/zap/zap2.cpp, src/libged/zoom/zoom.c` | `view2grid_lu.c:50-70; view2model.c:70; view2model_lu.c:50-75; view2model_vec.c:50-65; voxelize.c:59,102-225; vrot.c:85-115; vutil.c:40-90,175-185; wcodes.c:70-100; wdb_importFg4Section.c:40-300; whatid.c:40-85; which.cpp:115-180; which_shader.c:60-95; who.c:40-75; who2.cpp:40-75; who_solids.cpp:40-80; wireframe_eval.c:275,1485-1575,1805-1875; wmater.c:40-90; xpush.c:135-200,255-395,440-570; zap.c:40-125; zap2.cpp:50-155; zoom.c:25-65` | Memory Leaks, Resource Leaks, Memory Corruption, Unsafe API, Double Free, Division by Zero, and Missing Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libged Batch 35 (completing src/libged subsystem, 21 files): in view2grid_lu.c and view2model_lu.c, moved GED_CHECK_DATABASE_OPEN before b2lval evaluation, replaced raw sscanf with bu_sscanf, guarded against division by zero with ZERO macro in view2model_lu.c, and added missing newlines; in view2model.c, added missing newline to usage; in view2model_vec.c, replaced sscanf with bu_sscanf, checked bn_mat_inverse return, and added newline; in voxelize.c, fixed persistent rt_wdb resource leak with wdb_close, fixed rt_i_destroy leak on error, fixed argument reporting in error message, replaced sscanf with bu_sscanf, added bounds checks on voxel size and level of detail, and fixed format string; in vrot.c, added missing newlines and returned GED_HELP on argc == 1; in vutil.c, fixed memory corruption in ged_dl_hash by passing dp->d_namep string content instead of pointer address, added null guards, and checked bn_mat_inverse return values; in wcodes.c, fixed memory leak of path array on error exits, replaced direct ft_ifree with rt_db_free_internal, guarded null names, and added newlines; in wdb_importFg4Section.c, fixed crash on command reuse by resetting static state variables at start of command, replaced free with bu_free, replaced bu_bomb with error logging, validated line buffer lengths, and added zero face count guard; in whatid.c, verified ID_COMBINATION and added newlines; in which.cpp, replaced sscanf with bu_sscanf, guarded against integer subtraction overflow, capped range to prevent memory exhaustion, freed comb_objs on error, and verified ID_COMBINATION; in which_shader.c, fixed major memory leak of combination records by calling rt_db_free_internal on every iteration, replaced bu_vls_addr with bu_vls_cstr, and added newlines; in who.c, moved GED_CHECK_ARGC_GT_0 to top, replaced bu_vls_addr with bu_vls_cstr, guarded gdlp->dl_dp, and added newlines; in who2.cpp, moved GED_CHECK_ARGC_GT_0 to top, guarded dbis and bvs against null, and added newlines; in who_solids.cpp, checked sp->s_os before accessing s_dmode, moved GED_CHECK_ARGC_GT_0 to top, and guarded gedp internals; in wireframe_eval.c, guarded scene and scene data against null, set op for OP_NOP, fixed memory leak of application struct and ppath in draw_m3, and added null checks in fix_halfs and free_etree; in wmater.c, moved GED_CHECK_ARGC_GT_0 to top, replaced bu_vls_addr with bu_vls_cstr, verified ID_COMBINATION, and added newlines; in xpush.c, eliminated persistent rt_wdb handle leaks in Copy_solid and Copy_comb by using stack tolerance structs, fixed double-free on rt_db_put_internal failure, fixed combination internal memory leak when found is null or comb tree is null, guarded log10 domain, and fixed typo; in zap.c, guarded gedp internals, checked path length before accessing first solid, moved GED_CHECK_ARGC_GT_0 to top, and added newline; in zap2.cpp, freed cvls on help and error returns, guarded views, v, bvs, and v->gv_s against null, and moved GED_CHECK_ARGC_GT_0 to top; in zoom.c, replaced sscanf with bu_sscanf, guarded gedp->ged_gvp and division by zero, moved GED_CHECK_ARGC_GT_0 to top, and added newlines. |
-| `SEC-0279` | `src/libwdb/mater.c, src/libwdb/material.c, src/libwdb/nmg.c, src/libwdb/nurb.c, src/libwdb/pipe.c, src/libwdb/pnts.c, src/libwdb/reg.c, src/libwdb/script.c, src/libwdb/sketch.c, src/libwdb/submodel.c, src/libwdb/units.c, src/libwdb/vol.c, src/libwdb/wdb.c` | `mater.c:40-60; material.c:45-80; nmg.c:45-75; nurb.c:45-65; pipe.c:40-120; pnts.c:50-130,230-260; reg.c:50-80,180-210,310-450; script.c:40-55; sketch.c:40-55; submodel.c:40-55; units.c:40-65; vol.c:40-75; wdb.c:55-885` | Double-Free / Memory Corruption, Memory Leaks, Process Abort, Integer Overflow, and Missing Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libwdb Batch 37 (procedural primitives, mater through wdb, 13 files, completing src/libwdb): in mater.c, added null checks on ofp and ofp->dbip, and returned -1 on unsupported v4 database rather than asserting mk_version == 4; in material.c, added null checks on wdbp and db_name, guarded against null name, parent, and source strings before bu_vls_strcpy, and validated attribute keys and values before bu_avs_merge to prevent bu_bomb aborts; in nmg.c, added null checks on filep, name, and m before NMG_CK_MODEL, and verified botp != NULL after nmg_bot conversion before export; in nurb.c, added null checks on wdbp, name, and surfs, and verified ni->nsrf > 0 (freeing ni on zero surfaces) before export; in pipe.c, added null checks on fp, name, vertex, and height, verified positive radii with ZERO macro, validated headp in mk_pipe, mk_pipe_free, and mk_pipe_init, and validated od > 0, id >= 0, id < od, and bendradius >= 0 in mk_add_pipe_pnt; in pnts.c, added null checks on pnts and pnts->point in pnts_init_head_pnt and pnts_add, checked scale >= 0.0, and validated point != NULL before adding points in mk_pnts; in reg.c, added null checks on comb and member_hd in mk_tree_pure and mk_tree_gift, guarded headp in mk_freemembers, added null checks on wdbp, combname, and headp in mk_comb, and validated membname in mk_comb1 and mk_region1; in script.c, eliminated Cat 1 memory corruption and caller memory free by allocating and duplicating scr into a newly allocated rt_script_internal before passing to wdb_export; in sketch.c, added null checks on fp, name, and skt, and checked rt_copy_sketch return before export; in submodel.c, added null checks on fp, name, and treetop; in units.c, added null check on str and ZERO() macro guards against zero conversion factor in mk_conversion and mk_set_conversion; in vol.c, added null checks on fp, name, file, cellsize, and mat, and verified positive dimensions and cell sizes; in wdb.c, eliminated memory leaks in mk_hyp by validating parameters before internal structure allocation, replaced bu_bomb in mk_metaball with internal structure cleanup and error return, guarded against integer overflow in mk_binunif allocation and validated data pointer before memcpy, and added null pointer and geometric parameter validation with ZERO macro across mk_half, mk_grip, mk_rpp, mk_wedge, mk_arb4-8, mk_sph, mk_ell, mk_tor, mk_rcc, mk_tgc, mk_cone, mk_trc_h, mk_trc_top, mk_rpc, mk_rhc, mk_epa, mk_ehy, mk_hrt, and mk_eto. |
-| `SEC-0280` | `src/mged/adc.c, src/mged/arbs.c, src/mged/attach.c, src/mged/axes.c, src/mged/buttons.c, src/mged/cad_boundp.c, src/mged/cad_parea.c, src/mged/chgmodel.c, src/mged/chgtree.c` | `adc.c:75-105,290-310,430,455-505,585-695; arbs.c:35-50,70,85-135,155-205,225-290; attach.c:175-180,265-285,315-325,425-480,565-585,620-640,755-765; axes.c:110-145,155-180,185-205; buttons.c:180-215,275,405-460,795-870,955-1045; cad_boundp.c:45-50,180,290,445,720-755; cad_parea.c:110-135,155-170; chgmodel.c:75-100,205,245-290,325,395,435-445,475; chgtree.c:70,105,150,175,190,245,275-310` | Buffer Overflow, Double-Free, Logic / Angle Calculation Bug, Memory Leaks, Array Out-of-Bounds, Division by Zero, and Missing Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 38 (adc through chgtree, 9 files): in adc.c, fixed stack buffer overflow by capping user_pt coordinate parsing to the 3-element buffer capacity, replaced atof with bu_sscanf, guarded against division by zero in grid_scale across dst, dh, dv, and hv with ZERO macro, fixed incorrect input point parameter in MAT4X3PNT (passing pos_view instead of pos_model), added null pointer guards in adc_set_dirty_flag, adc_set_scroll, adcursor, and f_adc, and replaced bu_vls_addr with bu_vls_cstr; in arbs.c, eliminated double-free on rt_db_put_internal failure and fixed memory leak of internal struct on db_diradd failure and switch default, freed temporary vls on error return, eliminated unused file-scope dead array p_arb3pt and global mutable promp pointer, replaced atof with bu_sscanf, and replaced bu_vls_addr with bu_vls_cstr; in attach.c, made release() name parameter const char *, added null check on s and wp_name in mged_attach, removed redundant null check, and replaced bu_vls_addr with bu_vls_cstr; in axes.c, guarded against aspect division by zero with ZERO macro in draw_v_axes, and added null pointer guards in draw_e_axes, draw_m_axes, and draw_v_axes; in buttons.c, added bounds-checked get_state_str() helper to prevent out-of-bounds array reads on state_str, added null pointer checks in f_press, bv_vrestore, bv_vsave, and bv_adcursor, and replaced bu_vls_addr with bu_vls_cstr; in cad_boundp.c, resolved angle calculation bug where atan2 radian output was multiplied by DEG2RAD instead of RAD2DEG (corrupting bounding polygon angle computations), moved stray debug newline output inside #ifdef DEBUG, migrated memory management to bu_malloc and bu_free, included bu/malloc.h, replaced sscanf with bu_sscanf, and added negative tolerance validation; in cad_parea.c, replaced sscanf with bu_sscanf, and routed error logging from printf to stderr to prevent corrupting redirected stdout files; in chgmodel.c, guarded divisions in f_sc_obj against zero scale denominator and scale accumulators with ZERO macro, validated scale input with bu_sscanf, verified direction vector magnitude squared in f_qorot and corrected inverted error message, replaced sprintf with snprintf and guarded view_state in f_make, and replaced bu_vls_addr with bu_vls_cstr; in chgtree.c, fixed memory leak of internal database struct on db_diradd failure in f_copy_inv, added null guards in find_solid_with_path and find_solid_below_path, ensured lhs, rhs, and both paths are properly freed on all error exit paths in cmd_oed, and replaced bu_vls_addr with bu_vls_cstr. |
-| `SEC-0281` | `src/mged/chgview.c, src/mged/clone.c` | `chgview.c:269-283, 303-317, 336-368, 385, 410-440, 520-560, 680-730, 750-785, 1015-1035, 1845-1855, 1900-1920, 1935-1965, 1968-2010, 2020-2050, 2060-2090, 2100-2140, 2220-2530, 2540-2770, 2795-2865, 2920-2950, 2960-3040; clone.c:165-175, 230-245, 340-360, 420-445, 520-545, 560-615, 640-675, 740-840, 870-900, 1020-1090, 1160-1280` | Stack Buffer Overflow, Out-of-bounds Array Access, Double-Free, Division by Zero, Memory Leaks, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 39 (chgview.c and clone.c, 4,128 lines): in clone.c, fixed stack buffer overflows in get_name by adding field width limits with CPP_XSTR(CLONE_BUFSIZE) to bu_sscanf and replacing raw sscanf with bu_sscanf, fixed double-free and memory leaks of name vls by migrating deallocation from bu_vls_free to bu_vls_vlsfree (since get_name allocates outer struct via bu_vls_vlsinit), fixed out-of-bounds negative array indexing obj_list.names[-1] in copy_v5_comb_tree and copy_v4_comb by validating index_in_list return value (lidx >= 0) before indexing, fixed memory leak of obj_list.names[i].src in copy_object and ensured obj_list is freed across all return paths, fixed memory leaks of internal structures and records in copy_v4_solid, copy_v4_comb, copy_v5_solid, and copy_v5_comb on error paths, fixed potential division by zero in f_tracker by checking n_verts > 1, replaced raw calloc/free with bu_calloc/bu_free, and replaced read-only bu_vls_addr calls with bu_vls_cstr; in chgview.c, guarded against division by zero in cmd_size, mged_vscale, and cmd_sca by checking gv_i_scale with ZERO macro, added null checks on view_state and vs_gvp across cmd_center, cmd_size, size_reset, edit_com, cmd_autoview, f_status, f_refresh, update_all_rate_flags, mged_print_knobvals, knob_apply_misc, f_knob, mged_zoom, cmd_setview, f_slewview, mged_svbase, f_svbase, setview, slewview, f_view_ring, cmd_mrot, cmd_rot, cmd_arot, mged_vscale, and cmd_sca, fixed out-of-bounds argv access in edit_com, bounded state_str array indexing in f_status, replaced sprintf with snprintf in f_regdebug and guarded DMP, fixed early-out memory leak of orig_nargv and vlsargv in f_ill, guarded path_parse against null path, guarded MEDIT(s) and s->s_edit before dereference in mged_librt_knob_edit_apply and mged_escale, and replaced read-only bu_vls_addr calls with bu_vls_cstr. |
-
-| `SEC-0282` | `src/mged/cmd.cpp, src/mged/cmd.h` | `cmd.cpp:245-285, 295-310, 410-440, 480-530, 890-950, 1170-1190, 1220-1285, 1300-1395, 1410-1460, 1480-1545, 1550-1570, 1580-1600, 1620-1645, 1675-1690, 1705-1745, 1775-1925, 1990-2090, 2145-2220, 2275-2285, 2315-2440, 2450-2495, 2500-2540, 2580-2595, 2635-2680, 2730-2745, 2770-2785, 2835-2855, 2875-2930, 3005-3020, 3050-3060, 3075-3095, 3300-3325, 3410-3540` | Memory Leaks, Resource Leak, Out-of-bounds Argument Access, Division by Zero, Duplicate Print Bug, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 40 (cmd.cpp and cmd.h, 3,647 lines): in cmd.h, audited header prototypes and linkage guards (clean); in cmd.cpp, eliminated memory leak in cmd_ged_inside where rt_db_internal intern was transformed but never freed with rt_db_free_internal across all exits, fixed NULL pointer dereference in cmd_ged_inside on illump->s_old.s_Eflag when illump is NULL, eliminated resource leak in cmd_rt_gettrees where rtip was created with rt_i_create but not destroyed with rt_i_destroy on missing geometry argument exit paths, eliminated duplicate window listing print bug in f_tie when called with no arguments, guarded division by zero in cmd_units with ZERO macro on sf, checked argc and argv bounds before indexing in cmd_ged_edit_wrapper, cmd_ged_simulate_wrapper, cmd_ged_in, cmd_ged_more_wrapper, cmd_nmg_collapse, and cmd_get_more_default, added missing error report when window name is not found in cmd_win set, added null pointer checks on view_state, view_state->vs_gvp, s->mged_curr_dm, DMP, illump, and MEDIT(s) across GED wrapper dispatchers, view management, and rendering hooks (cmd_ged_view_wrapper, cmd_ged_dm_wrapper, cmd_screengrab, cmd_blast, f_postscript, f_winset, _view_update_rate_flags_viewonly, and cmd_view), replaced fixed-size snprintf format in f_bomb with sizeof(buffer), and replaced ~45 read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0283` | `src/mged/color_scheme.c, src/mged/columns.c, src/mged/dm-generic.c, src/mged/dodraw.c` | `color_scheme.c:60-75,100-110,135-155,200-245; columns.c:42-78,85-93; dm-generic.c:51-110,140-250,260-395,438-595,602-643,658-688; dodraw.c:58-85,95-165,177-210,223-272,280-286,290-298` | Memory Leak, Null Pointer Dereference, Out-of-bounds Array / Argument Access, and Missing Parameter Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 41 (color_scheme.c, columns.c, dm-generic.c, and dodraw.c, 1,449 lines): in color_scheme.c, added null pointer checks on m_dmp, m_dmp->dm_dmp, s->interp, and color_scheme before dereferencing, ensured error messages are safely reported, and replaced read-only bu_vls_addr calls with bu_vls_cstr; in columns.c, added null pointer guards in vls_col_item and vls_col_eol to prevent crashes on null strings or null buffer pointers, and added symmetric null pointer checks for a, b, *dp1, *dp2, (*dp1)->d_namep, and (*dp2)->d_namep in cmpdirname comparator to prevent qsort crashes; in dm-generic.c, added null checks on s, s->interp, argc, and argv in common_dm and dm_commands, added null guards on rubber_band, mged_variables, s->mged_curr_dm, DMP, view_state, view_state->vs_gvp, s->gedp->ged_gvp->gv_s, adc_state, grid_state, and MEDIT(s) across idle, m, am, adc, con, size, getx, and bg command handlers, checked argc bounds before indexing argv[1..4], replaced raw sscanf with bu_sscanf for RGB background parsing, added null guards in view_state_flag_hook, dirty_hook, zclip_hook, and set_hook_data, and replaced all read-only bu_vls_addr calls with bu_vls_cstr; in dodraw.c, eliminated memory leak in replot_modified_solid where rt_db_internal intern was transformed via transform_editing_solid but never freed when ft_plot failed (< 0), fixed potential NULL pointer dereference and out-of-bounds access in replot_original_solid by validating bdata->s_fullpath.fp_len > 0 and LAST_SOLID(bdata) before dereferencing dp->d_namep, freed existing bdata->s_fullpath with db_free_full_path before duplicating in drawH_part2, guarded s->gedp and ged_dl(s->gedp) against NULL, added null guards in mged_bound_solid, replot_original_solid, replot_modified_solid, add_solid_path_to_result, and redraw_visible_objects, and replaced read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0284` | `src/mged/doevent.c, src/mged/dozoom.c` | `doevent.c:65-75,88-120,186-215,253-277,289-360,414-448,460-630,689-715; dozoom.c:54-66,77-93,133-165,165-179,190-210,240-256,270-305,320-335,355-385` | Division by Zero, Null Pointer Dereference, and Out-of-bounds Argument Access | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 42 (doevent.c and dozoom.c, 1,064 lines): in doevent.c, guarded against division by zero in motion_event_handler by clamping window width and height to positive values (width <= 0 ? 1 : width, height <= 0 ? 1 : height) and checking dm_get_aspect with ZERO macro before dividing, added null checks on s, eventPtr, s->mged_curr_dm, and DMP in mged_dm_motion and doEvent, added null guards on rubber_band, grid_state, MEDIT(s), adc_state, view_state, and view_state->vs_gvp across all AMM modes (AMM_IDLE, AMM_ROT, AMM_TRAN, AMM_SCALE, AMM_ADC_*, AMM_CON_*), guarded MEDIT in reset_edflag, and replaced read-only bu_vls_addr calls with bu_vls_cstr; in dozoom.c, eliminated critical division by zero in dozoom perspective calculation where to_eye_scr divided by tan(perspective) without verifying tan != 0 by checking tan value with ZERO macro and using fallback large distance, guarded against division by zero when adjusting inv_viewsize by checking MEDIT(s)->model_changes[15] with ZERO macro, added null checks on s, s->mged_curr_dm, DMP, view_state, view_state->vs_gvp, s->gedp, MEDIT(s), mged_variables, and color_scheme in dozoom, guarded transparency access (sp->s_os->transparency) against null sp->s_os in create_dlist_solid, added null pointer guards in createDLists, create_dlist_solid, createDListSolid, create_dlist_all, createDListAll, free_dlists, and freeDListsAll, and validated active_dm_set display managers and variables. |
-| `SEC-0285` | `src/mged/edsol.c, src/mged/f_cmd.h` | `edsol.c:85-115, 140-190, 245-295, 305-345, 360-395, 410-445, 460-520, 535-545, 560-575, 590-620, 680-745, 765-815, 875-925, 940-970, 990-1010, 1025-1045, 1070-1115, 1145-1215, 1250-1310, 1335-1390, 1420-1490, 1510-1545, 1555-1575, 1585-1615, 1625-1675, 1685-1710, 1720-1800, 1810-1880, 1890-1960, 1970-1990, 2000-2030, 2040-2070, 2080-2160, 2170-2220, 2230-2245, 2265-2305; f_cmd.h:40-155` | Inverted Logic Bug, Double-Free, Memory Corruption / Type Mismatch, Resource Leaks, Division by Zero, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 43 (edsol.c and f_cmd.h, 2,324 lines): in f_cmd.h, audited extern command function prototypes (clean); in edsol.c, fixed critical inverted logic bug in ecmd_bot_thick_clbk where face_state > -1 mistakenly triggered error branch and face_state < 0 updated face 0, eliminated double-free in sedit_apply where rt_db_put_internal already frees es_int on all outcomes, fixed reset sequencing in f_sedit_reset where rt_db_free_internal was called before ft_prim_edit_reset zeroing primitive type ID, fixed inverted condition in f_get_sedit (illump || !illump->s_u_data) that caused command to always fail, prevented memory corruption in f_put_sedit by returning TCL_ERROR on functab mismatch rather than executing bu_structparse_argv with wrong structure layout, guarded against division by zero in mged_param with ZERO macro on viewscale, clamped input parameter count to RT_EDIT_MAXPARA, eliminated memory leaks of vls commands on early returns in get_sketch_name, ecmd_extrude_skt_name_clbk, and f_get_sedit_menus, replaced raw atof/atoi with bu_sscanf, verified bn_mat_inverse return in oedit_apply and f_oedit_apply, added primitive type bounds validation (ID_NULL < id <= ID_MAX_SOLID), and added extensive NULL guards on s, MEDIT(s), view_state, DMP, and bdata across all solid and object editing routines. |
-| `SEC-0286` | `src/mged/f_db.c, src/mged/facedef.c` | `f_db.c:45-150, 155-165, 170-290, 295-305, 310-340, 345-355, 375-465, 475-515; facedef.c:75-135, 140-195, 210-305, 315-330, 340-350, 365-385, 395-425, 435-445` | Out-of-bounds Array / Buffer Access, Uninitialized Variables, Division by Zero, Resource Leaks, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 44 (f_db.c and facedef.c, 984 lines): in f_db.c, guarded against NULL pointer dereferences on s, gedp, ctx, argv, interpreter, and dbip across _post_opendb_failed, callbacks, f_opendb, and f_closedb, eliminated uninitialized buffer reads when bu_fgets returns EOF, checked Tcl result string validity before indexing, guarded curr_cmd_list before setting more_default, verified argc >= 2 before stripping trailing y/n database creation flags, and replaced all bu_vls_addr calls with bu_vls_cstr; in facedef.c, initialized plane equation index to -1 and added explicit range validation (plane >= 0 && plane < 6) to prevent out-of-bounds array writes, added upper and lower bounds checks on argc-derived array indexing into p_pleqn, p_3pts, p_rotfb, and p_nupnt arrays to prevent out-of-bounds reads, guarded against division by zero in get_pleqn using ZERO macro on vector magnitude before unitizing, replaced raw atof and atoi with bu_sscanf with return validation, added NULL pointer checks on arbo, s, MEDIT(s), and interp, freed error_msg VLS on all exit paths, and replaced bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0287` | `src/mged/fbserv.c, src/mged/grid.c` | `fbserv.c:59-64, 100-119, 137-208, 214-239, 246-273, 277-305, 325-330, 334-426, 432-441, 451-460, 469-502, 513-553, 557-631, 644-665, 669-709, 713-739, 743-786, 790-820, 824-864, 871-900, 904-924, 928-944, 948-976, 983-1002, 1009-1028, 1035-1053, 1058-1081, 1085-1102, 1106-1125, 1135-1163, 1167-1183, 1187-1193, 1201-1220; grid.c:69-85, 88-117, 120-140, 144-234, 238-291, 295-329, 333-353, 361-399, 403-426, 430-451, 455-477` | Buffer Over-read, Mismatched Framebuffer Routine, Division by Zero, Infinite Loop / UI Hang, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 45 (fbserv.c and grid.c, 1,754 lines): in fbserv.c, fixed critical bug in fb_server_fb_bwwriterect where fb_writerect (RGB, 3 bytes/pixel) was called instead of fb_bwwriterect (monochrome, 1 byte/pixel) causing out-of-bounds heap over-reads and image corruption; added packet length and payload dimension validation across all framebuffer network handlers (fb_clear, fb_read, fb_write, fb_readrect, fb_writerect, fb_bwreadrect, fb_bwwriterect, fb_cursor, fb_setcursor, fb_scursor, fb_window, fb_zoom, fb_view, fb_wmap, fb_help) preventing buffer over-reads on truncated or malformed network packets; clamped absurd pixel requests (up to 8192x8192); handled malloc failures with 0-length error packets to prevent client hangs; replaced bu_strlcpy with bounded memcpy for binary auth token packets; added NULL pointer checks on pcp, s, s->mged_curr_dm, DMP, and fbp across all routines; in grid.c, guarded divisions against zero in draw_grid, snap_to_grid, and round_to_grid using ZERO macro on scale and aspect ratio; guarded against integer division by zero and infinite loops when res_major_h or res_major_v <= 0; clamped maximum grid dots (nv_dots, nh_dots <= 2000) to prevent denial-of-service UI hangs; added NULL pointer checks on s, s->mged_curr_dm, s->dbip, grid_state, view_state, view_state->vs_gvp, color_scheme, and s->interp across all callbacks and snap routines; and replaced all read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0288` | `src/mged/history.c, src/mged/mater.c, src/mged/menu.c, src/mged/menu.h` | `history.c:53-83, 86-101, 109-156, 171-253, 257-274, 278-285, 288-311, 314-389, 392-401, 404-421; mater.c:49-56; menu.c:98-106, 112-137, 139-162, 164-234, 240-247, 252-257, 262-293, 298-335, 339-358, 362-398, 411-482, 496-538; menu.h:70-73` | Memory Leak, Out-of-bounds Array / Buffer Access, Dead / Unused Code, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 46 (history.c, mater.c, menu.c, and menu.h, 1,086 lines): in history.c, eliminated guaranteed memory leak in f_history by freeing dynamic VLS str across all normal and error exit paths; guarded against out-of-bounds buffer reads in f_journal by replacing single-byte string indexing with BU_STR_EQUAL(argv[1], "-d"); safely handled empty command string lengths in cmd_hist; added NULL pointer checks on cmdp, curr_cmd_list, curr_cmd_list->cl_cur_hist, journalfp, hptr, argv, and interp across history_record, history_journalize, f_journal, f_history, history_prev, history_cur, history_next, and cmd_hist; cleared dangling cl_cur_hist pointer in history_cleanup; replaced all read-only bu_vls_addr calls with bu_vls_cstr; in mater.c, added NULL pointer checks on s, s->gedp, ged_dl, dbip, and DMP in mged_color_soltab before dereferencing; in menu.c, eliminated dead/unused Tcl_DString variables in mged_mmenu_set and mmenu_set; added strict index bounds validation (index >= 0 && index < NMENU) in mmenu_set, mmenu_set_all, and cmd_mmenu_get to prevent out-of-bounds memory writes and reads; removed unsafe static storage duration from loop counters menu and item in mmenu_display and mmenu_select to prevent re-entrancy issues; added NULL checks on mptr->menu_string before indexing; added comprehensive NULL pointer guards on s, s->mged_curr_dm, DMP, menu_state, color_scheme, mged_variables, interp, and active_dm_set display managers across btn_item_hit, btn_head_menu, chg_l2menu, cmd_mmenu_get, mmenu_init, mged_menu_refresh, mged_mmenu_set, mmenu_set, mmenu_set_all, mged_highlight_menu_item, mmenu_display, and mmenu_select; and replaced all read-only bu_vls_addr calls with bu_vls_cstr; in menu.h, corrected header guard comment typo. |
-| `SEC-0289` | `src/mged/mged.c` | `mged.c:357-360, 400, 415-420, 440-460, 490-500, 520-535, 545, 725, 840, 865, 900, 910, 925-975, 995, 1055-1100, 1115-1235, 1270-1360, 1370-1425, 1490, 1530-1765, 1780-1805, 1840-1925, 1970, 2075-2260, 2280, 2410, 2470, 3118, 3155-3165, 3258, 3335, 3390, 3458` | Division by Zero, Memory Leaks, Dead Variable, Out-of-bounds Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 47 (mged.c, 3,532 lines): eliminated floating-point division by zero in event_check when view_state->k.sca == 10.0 (where 1.0 / (1.0 - (view_state->k.sca / 10.0)) evaluated with 0.0 denominator) by validating denominator with ZERO macro; eliminated Tcl_DString memory leak in stdin_input on EOF return under non-cbreak mode; eliminated dead variable place and unused sprintf in mged_finish; guarded s->s_edit before rt_edit_destroy in mged_finish; guarded DMP and dm_bg before array indexing dm_bg[0..2] in main; guarded s->gedp before checking ged_subp table in main; added null pointer checks on s, s->s_edit, MEDIT(s), s->interp, view_state, view_state->vs_gvp, s->mged_curr_dm, DMP, curr_cmd_list, sd, and active display managers across mged_process_char, event_check, stdin_input, std_out_or_err, refresh, mged_finish, apply_cli_overrides, and main; added input_str_index bounds validation in mged_process_char; replaced raw sscanf with bu_sscanf in parse_debug_uint; and replaced all (~45) read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0290` | `src/mged/mged.h, src/mged/mged_dm.h, src/mged/mged_impl.cpp, src/mged/mged_impl.h, src/mged/mged_wdb.h` | `mged.h:418-429; mged_dm.h:465, 520-530; mged_impl.cpp:35-43, 45-94, 97-114, 144-151, 154-165, 167-179, 181-193, 196-220; mged_impl.h:22, 57; mged_wdb.h:38-44` | Uninitialized Memory, Missing Header Guards, Duplicate Code, Division by Zero, Resource Leak, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 48 (mged.h, mged_dm.h, mged_impl.cpp, mged_impl.h, mged_wdb.h, 1,610 lines): in mged_impl.cpp, zero-initialized allocated mged_state using memset to eliminate widespread uninitialized struct pointers and flags; refactored mged_state_create to call mged_state_init_internals, eliminating duplicate 18 callback registrations (DRY); in mged_state_destroy, guarded search_snapshot, dpy_string, s_edit, and s_edit->e before destroying and delegated internal destruction to mged_state_destroy_internals; cleared cmd_map in MGED_Internal destructor; guarded internal callback map lookups, registrations, and sync against null pointers and uninitialized state in mged_internal_clbk_map, mged_state_clbk_set, mged_state_clbk_get, and mged_edit_clbk_sync; in mged.h, guarded s, s->interp, and s->dbip in CHECK_DBI_NULL and CHECK_READ_ONLY macros to prevent null pointer crashes; in mged_dm.h, converted GET_MGED_DM macro to do-while(0) and guarded tp and tp->dm_dmp before dm_get_id to prevent null pointer dereference; guarded VIEWFACTOR against division by zero with ZERO macro; in mged_impl.h, added standard header guard #ifndef MGED_MGED_IMPL_H; in mged_wdb.h, wrapped extern declarations with __BEGIN_DECLS / __END_DECLS for standard C linkage when included in C++ translation units. |
-| `SEC-0291` | `src/mged/mover.c, src/mged/overlay.c, src/mged/plot.c, src/mged/predictor.c, src/mged/rect.c` | `mover.c:43-65, 75-120; overlay.c:37-67; plot.c:49-265; predictor.c:47-51, 58-64, 73-114, 118-133, 176-200, 324-338; rect.c:66-82, 89-115, 122-127, 133-180, 185-228, 233-239, 243-288, 292-305, 309-380` | Double-Free, File Descriptor Double-Close / Leaks, Logic Bugs, Memory Leaks, Division by Zero, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 49 (mover.c, overlay.c, plot.c, predictor.c, rect.c, 1,179 lines): in mover.c, eliminated double-free in moveHobj and moveHinstance where rt_db_free_internal was called after rt_db_put_internal failure (which already frees internal database object on all outcomes), fixed memory leak in moveHinstance when combination tree is empty or object is not a combination by calling rt_db_free_internal, initialized internal database object with RT_DB_INTERNAL_INIT, and added null pointer checks on s, dbip, cdp, dp, xlate, and interp; in overlay.c, added null checks on ctp, s, gedp, mged_curr_dm, and DMP, replaced read-only bu_vls_addr with bu_vls_cstr, and explicitly returned TCL_OK; in plot.c, eliminated file descriptor double-close bug where close(fd1[1]) and close(fd3[0]) were executed after fclose(fp_w) and fclose(fp_r), fixed file descriptor leaks when subsequent pipe() calls fail, handled fork() failures gracefully, added _exit(1) after execlp calls to prevent child processes from continuing parent execution on exec failure, verified fp_w and fp_r after fdopen, guarded view_state and vs_gvp before matrix multiplication, replaced sprintf with snprintf, and replaced bu_vls_addr with bu_vls_cstr; in predictor.c, fixed logic bug in poly_trail where t1->t_nused <= 0 was checked twice instead of validating t2->t_nused, guarded division by zero in predictor_frame when frametime is zero using ZERO macro, and added null pointer checks across init_trail, push_trail, poly_trail, predictor_init, predictor_kill, predictor_frame, and predictor_hook; in rect.c, fixed critical crash in zoom_rect_area where rb_set_dirty_flag was passed NULL data causing MGED_CK_STATE abort, guarded against division by zero in rect_image2view when width <= 0, guarded against division by zero in adjust_rect_for_zoom, draw_rect, and zoom_rect_area when window aspect ratio is zero using ZERO macro, replaced bu_vls_addr with bu_vls_cstr, and added null pointer checks on s, mged_curr_dm, DMP, rubber_band, color_scheme, and interp. |
-| `SEC-0292` | `src/mged/rtif.c, src/mged/scroll.c, src/mged/sedit.h, src/mged/set.c` | `rtif.c:66-85, 100-125, 151-168, 199-265, 281-356, 370-410, 415-440; scroll.c:98-115, 122-132, 134-148, 157-293, 303-332, 335-412, 415-468, 482-553, 561-611; sedit.h:44-67; set.c:132-147, 151-166, 177-198, 208-234, 245-268, 280-294, 323-346, 350-380, 384-415, 424-509, 513-534, 538-556, 565-598, 608-624` | Loop Index Typo / Premature DList Deallocation, File Descriptor Leaks on Interrupt, Array Out-of-Bounds, Division by Zero, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 50 (rtif.c, scroll.c, sedit.h, set.c, 1,762 lines): in set.c, fixed critical bug in set_dlist where inner loop searching for active display managers sharing display lists used outer index di instead of dj in BU_PTBL_GET and checked uninitialized dlp2, causing the search to always fail and prematurely free active display lists in other display managers; guarded display list scene object list against empty list reads when freeing display lists; guarded against division by zero in set_absolute_model_tran when view scale is zero using ZERO macro; clamped perspective_angle to valid table indices [0..3] in establish_perspective and toggle_perspective preventing out-of-bounds array reads; guarded s, s->s_edit, and MEDIT(s) before syncing mv_context; guarded multi-level pointers in unset_var before dereferencing; guarded active display managers and DMP in set_dirty_flag and set_scroll_private; in rtif.c, fixed file descriptor leak in f_rmats when interrupted via setjmp by ensuring fp is closed before returning; validated and guarded vector list vertices (vp->nused > 0) preventing negative array indexing; added null pointer checks on s, s->gedp, view_state, view_state->vs_gvp, and interp across cmd_rt, cmd_rrt, rt_read, f_rmats, f_nirt, and f_vnirt; replaced atoi with bu_sscanf; in scroll.c, zero-initialized all elements of dm_scroll_array in set_scroll to guarantee NULL termination and bounded scroll_array pointer traversal by array capacity in scroll_display and scroll_select, preventing out-of-bounds array reads; extracted apply_sl_tol helper to eliminate duplicated tolerance thresholding logic (DRY); added null pointer checks on s, s->interp, view_state, DMP, color_scheme, and mged_variables across all event handlers and display routines; in sedit.h, guarded s, s->s_edit, and s->s_edit->e in SEDIT_ROTATE, SEDIT_TRAN, SEDIT_SCALE, and SEDIT_PICK, and guarded s in OEDIT_ROTATE, OEDIT_TRAN, and OEDIT_SCALE macros, preventing null pointer dereference crashes throughout solid and object editing; and replaced all read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0293` | `src/mged/setup.c, src/mged/share.c, src/mged/tclsync.c, src/mged/tedit.c` | `setup.c:502-530, 536-578, 585-605, 610-745; share.c:47-70, 98-278, 320-382, 418-448, 452-478, 482-506; tclsync.c:42-59, 100-146, 178-205, 230-245, 275-296, 315-345, 386-425, 476-525; tedit.c:57-75, 78-129, 134-152, 155-184` | Resource Leaks, Wrong Memory Deallocation Bug, Double-Open / File Descriptor Leaks, Array Out-of-Bounds, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 51 (setup.c, share.c, tclsync.c, tedit.c, 1,978 lines): in share.c, fixed critical bug in usurp_all_resources where freeing a zero-refcount display list state freed MGED_STATE->mged_curr_dm->dm_dlist_state instead of dlp2->dm_dlist_state, corrupting active display manager memory and leaking dlp2 resources; added null checks on dlp1, dlp2, and resource pointers in SHARE_RESOURCE macro; guarded all resource pointers in free_all_resources before decrementing refcounts and freeing, and nullified pointers after cleanup; added null checks on ctp, s, interpreter, and argv in f_share and f_rset; guarded active display managers and pathname lookups in f_share and share_dlist against null pointers; guarded s->mged_curr_dm in f_rset; in tedit.c, fixed file descriptor leak and concurrent double-opening of temporary files by passing bu_temp_file's open file handle directly to writesolid, flushing and closing before invoking external editor; eliminated memory leak of vls buffer in writesolid; bounded primitive type idb_type between ID_NULL and ID_MAX_SOLID before indexing EDOBJ dispatch table in writesolid and readsolid to prevent out-of-bounds memory access; made writesolid, readsolid, and editit static to minimize scope; guarded s, gedp, s_edit, MEDIT(s), view_state, and interp; in setup.c, guarded ctp, s, interp, and ctp->tcl_func in mged_cmd_dispatch; guarded argv[0] in quit usage message; guarded s and interp in cmd_setup; guarded s and view_state before setting vs_flag in mged_refresh_handler_impl and allocating vs_gvp in mged_setup; in tclsync.c, guarded interp, objc, objv, snapshot, record, and strings across EvalWords, ResultCopy, QualifiedPattern, AppendRecord, AppendProc, AppendProcs, AppendVariable, AppendVariables, AppendNamespace, AppendAliases, BuildInterpSnapshot, ReplayRecord, and ReplayInterpSnapshot; and replaced all read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0294` | `src/mged/titles.c, src/mged/track.c, src/mged/update.c` | `titles.c:60-165, 175-207, 240-636; track.c:67-555, 558-572, 575-654, 658-691, 695-760, 764-803, 807-817, 821-842, 846-875, 879-903, 908-933; update.c:43-54, 57-79, 88-99, 105-118, 124-134, 142-270` | Division by Zero, Stack Buffer Overrun Risk, String Mutation Bug, Unbounded Array Access, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 52 (titles.c, track.c, update.c, 1,871 lines): in titles.c, eliminated floating-point division by zero in framerate calculation when frametime is zero using ZERO macro; eliminated in-place destructive mutation of caller's VLS buffer and dropped trailing lines in screen_vls by drawing lines via temporary buffer; bounded global_editing_state array indexing into state_str to prevent out-of-bounds reads; bounded solid type indexing into OBJ array and guarded ft_name before displaying keypoint; guarded MEDIT(s) against NULL before accessing model_changes and e_keypoint; guarded illump against NULL before checking s_old.s_Eflag; guarded s, s->mged_curr_dm, DMP, view_state, view_state->vs_gvp, and s->interp across create_text_overlay and dotitles; replaced sprintf with snprintf; replaced all read-only bu_vls_addr calls with bu_vls_cstr; in track.c, eliminated division by zero in slope when del[0] or slope is zero using ZERO macro and SMALL_FASTF; eliminated division by zero in crdummy when plano[0] - w[0] is zero using ZERO macro; eliminated multiple divisions by zero in top when magnitude of del is zero; clamped cosine values before acos in tancir to prevent NaN return; replaced unsafe custom track_itoa with snprintf; increased solid/region/group name buffers from 9-12 to 32 bytes to prevent name truncation; replaced raw atof with bu_sscanf; scoped all helper functions (crname, slope, crdummy, trcurve, bottom, top, crregion, track_itoa, wrobj, tancir) to static; guarded s, s->dbip, s->wdbp, and s->interp; in update.c, guarded s in mged_update and f_update against NULL pointer dereference; replaced raw sscanf with bu_sscanf; guarded donePtr and eventPtr in event callbacks; guarded clientData, s, interp, and argv[0..2] in f_wait; and replaced bu_vls_addr with bu_vls_cstr. |
-| `SEC-0295` | `src/mged/usepen.c, src/mged/utility1.c, src/mged/vparse.c, src/mged/wdb_obj.c` | `usepen.c:50-87, 93-177, 184-196, 203-214, 228-337, 369-565; utility1.c:45-73, 78-95, 100-122, 128-149, 156-182, 185-293; vparse.c:34-58, 61-81; wdb_obj.c:66-74, 76-87, 94-127, 130-145, 154-162, 164-186, 188-255, 261-267, 273-281, 284-383, 394-402, 404-560, 570-578, 581-704, 715-722, 724-840, 847-855, 857-868, 879-887, 889-929, 938-945, 960-1074, 1081-1087, 1089-1269, 1279-1286, 1294-1308, 1310-1403, 1416-1424, 1426-1624, 1638-1646, 1648-1677, 1683-1690, 1692-1757, 1767-1775, 1777-1798, 1805-1813, 1912-1926, 1946-1985, 1992-2002, 2010-2027, 2035-2055, 2079-2154, 2161-2168` | Memory Leaks, Dangling Database Pointers, Dead Pre-libged Code, Out-of-bounds Array Access, Command Argument Parsing Bug, In-place String Mutation, and Null Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD mged Batch 53 (usepen.c, utility1.c, vparse.c, wdb_obj.c, 3,149 lines): completing all 55 files of src/mged (100% complete): in usepen.c, eliminated dangerous in-place mutation of argv[1] string in f_matpick by copying into a local buffer before splitting slash path; removed static storage duration from transformation matrices t1 and t2 in wrt_view to make the function re-entrant; guarded against null pointers in illump before accessing s_u_data in f_matpick; guarded s, s->mged_curr_dm, s->gedp, ged_dl(s->gedp), DMP, illump, and illum_gdlp across illuminate, f_aip, and f_matpick; guarded argv[1] against null/empty strings; replaced raw sprintf with snprintf; and replaced all read-only bu_vls_addr calls with bu_vls_cstr; in utility1.c, eliminated over 200 lines of dead pre-libged code, including obsolete unused global variables (path, identt, idbuf, operate, regflag, lastmemb, old_or_new, oper_ok, numsol, numreg, idfd, rd_idfd, tabptr, ctemp) and unused functions/structs (printcodes, Do_printnode, check, id_names, id_to_names); added null checks on s and s->gedp in f_edcolor, f_edcodes, f_edmater, and f_red; and replaced bu_vls_addr with bu_vls_cstr; in vparse.c, added null pointer guards on vls, how_to_parse, structp, argv, and argv[1] across mged_vls_struct_parse and mged_vls_struct_parse_old; in wdb_obj.c, eliminated memory leak of log_str in wdb_track_cmd by adding missing bu_vls_free; fixed database reopen bug in wdb_reopen_cmd where allocating a new wdbp reassigned the local parameter and leaked the new object while leaving callers with a dangling pointer to freed dbip, by updating wdbp->dbip in place; fixed argument index parsing bug in wdb_make_bb_cmd where passing -u caused the bounding routine to treat the new bounding box name as an input object to bound; fixed argument parity condition in wdb_tol_cmd that blocked single-tolerance queries (argc == 2); clamped perpendicularity tolerance to [-1.0, 1.0] before acos to prevent NaN return; fixed wrong return value (returning TCL_OK instead of TCL_ERROR) when object is not an ARB in wdb_move_arb_face_cmd and wdb_rotate_arb_face_cmd; fixed wrong argv indices in error messages in wdb_rotate_arb_face_cmd; dynamically allocated resource structures in wdb_rt_gettrees_cmd eliminating shared static resource state and freeing in wdb_deleteProc_rt; replaced raw sscanf and atof with bu_sscanf; checked floating-point tolerances with ZERO macro; replaced raw sprintf with snprintf; and replaced all (~52) read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0296` | `src/proc-db/bottest.c, src/proc-db/brep_cobb.cpp, src/proc-db/brep_cube.cpp, src/proc-db/brep_invalid.cpp, src/proc-db/brep_simple.cpp, src/proc-db/brep_surface.cpp` | `bottest.c:54-68,326-328; brep_cobb.cpp:226-278,285-328; brep_cube.cpp:174,242-295; brep_invalid.cpp:128-135,345-373,400-435; brep_simple.cpp:180,245-295; brep_surface.cpp:60-65,150-160,210-247` | Memory Leaks, Immediate NULL Pointer Dereference Crash, Resource Leaks, Wrong Memory Deallocation, and Missing Parameter Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 54 (bottest.c, brep_cobb.cpp, brep_cube.cpp, brep_invalid.cpp, brep_simple.cpp, brep_surface.cpp, 2,010 lines): in bottest.c, fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0] before bu_setprogname; checked outfp after wdb_fopen to prevent NULL dereference on write failure; fixed wrong memory deallocator by replacing bu_free with bu_bitv_free(face_mode); and replaced db_close(outfp->dbip) with wdb_close(outfp) to eliminate struct rt_wdb handle leak; in brep_cobb.cpp, eliminated persistent memory leak of 6 heap-allocated ON_NurbsSurface surfaces in Cobb_Sphere by using stack-allocated surfaces in a unified loop, and deleting ON_BezierSurface; guarded argv[0] before bu_setprogname; checked outfp after wdb_fopen; guarded brep before mk_brep; and replaced db_close(outfp->dbip) with wdb_close(outfp); in brep_cube.cpp, fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0]; checked outfp after wdb_fopen; eliminated internal database object memory leak by calling rt_db_free_internal(&ip); guarded brep allocation in MakeTwistedCube; and replaced db_close(outfp->dbip) with wdb_close(outfp); in brep_invalid.cpp, eliminated memory leaks in Cobb_Sphere by stack-allocating ON_NurbsSurface and deleting b1; added null check on c2 before appending to trimming loop; validated plate thickness with bu_sscanf; added standard help flags (-h, -?, --help); checked outfp after wdb_fopen; and replaced db_close(outfp->dbip) with wdb_close(outfp); in brep_simple.cpp, fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0]; checked outfp after wdb_fopen; eliminated internal database object memory leak by calling rt_db_free_internal(&ip); guarded brep allocation in MakeTwistedCube; replaced db_close(outfp->dbip) with wdb_close(outfp); and replaced raw printf with bu_log; in brep_surface.cpp, guarded brep and c2d curve allocations; validated thickness argument with bu_sscanf; added standard help flags; checked outfp after wdb_fopen; and replaced db_close(outfp->dbip) with wdb_close(outfp). |
-| `SEC-0297` | `src/proc-db/brep_trimmed.cpp, src/proc-db/breplicator.cpp, src/proc-db/brickwall.c, src/proc-db/cchannel.c, src/proc-db/clutter.c, src/proc-db/common.c` | `brep_trimmed.cpp:548-552, 627-674; breplicator.cpp:40-45, 390-418, 458-470; brickwall.c:75-81, 90-165, 330, 364-370; cchannel.c:60-66, 120-135, 150-168, 211, 220-245, 348; clutter.c:90-115, 140-150, 188-192; common.c:68-72, 94-115` | Resource Leaks, Immediate NULL Pointer Dereference Crash, Division by Zero, Missing Argument Validation, and Memory Leaks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 55 (brep_trimmed.cpp, breplicator.cpp, brickwall.c, cchannel.c, clutter.c, common.c, 2,535 lines): in brep_trimmed.cpp, guarded ON_Brep allocation in MakeBrepFace against NULL return; guarded argv[0] before bu_setprogname; added standard help flags (-h, -?, --help); replaced unsafe atof with bu_sscanf with error checking; checked outfp after wdb_fopen; and replaced db_close(outfp->dbip) with wdb_close(outfp) to eliminate struct rt_wdb handle leak; in breplicator.cpp, added null check and size check (count >= 8) on points in generate_brep; guarded ON_Brep allocation; fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0]; and replaced db_close(wdbp->dbip) with wdb_close(wdbp); in brickwall.c, guarded av and *av in parse_args; guarded argv[0] before bu_setprogname; replaced raw sscanf with bu_sscanf; replaced raw sprintf with snprintf; validated units_conv to prevent division by zero; guarded against division by zero in standalone horizontal spacing when horiz_bricks <= 1; and supported standard clean exit on help flags; in cchannel.c, replaced raw sscanf with bu_sscanf with error validation; used ZERO macro for float zero comparisons; fixed infinite loop vulnerability in addHoles by verifying positive step; replaced sprintf with snprintf; guarded argv[0] before bu_setprogname; removed invalid colons requiring arguments from help options string and supported clean exit on -h/-?; checked outfp after wdb_fopen; guarded domain of sqrt calculation; and replaced db_close(db->dbip) with wdb_close(db); in clutter.c, fixed memory leak of bn_unif random buffer by calling bn_unif_free; guarded argv[0] before bu_setprogname; added help flag handling with clean exit; validated wdb_fopen; replaced sprintf with snprintf; and replaced db_close(outfp->dbip) with wdb_close(outfp); in common.c, added null pointer guard on rgb in get_rgb; added null pointer guards on name, pos, dir_at, headp, and outfp in do_light; and guarded against NaN from unitizing zero vectors. |
-| `SEC-0298` | `src/proc-db/csgbrep.cpp, src/proc-db/donuts.c, src/proc-db/gaia.c, src/proc-db/gears.c` | `csgbrep.cpp:115-125,502-510,550-575; donuts.c:164-169,215,280-325,410-440,650-680,750-775,875-920; gaia.c:54-58,950-985,1020-1065; gears.c:128-132,245-265,305-325,358-410,445-520` | Memory Leaks, Double Free, Handle Leaks, and Missing Argument Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 56 (csgbrep.cpp, donuts.c, gaia.c, gears.c, 3,116 lines): in csgbrep.cpp, eliminated external buffer leak ext in write_out with bu_free_external; fixed ON_Brep leak by deleting brep and checking ON_Brep::New; guarded argv[0] before bu_setprogname; supported standard help flags (-h, -?, --help); checked outfp after wdb_fopen; freed extrude.sketch_name and revolve.sketch_name; and replaced db_close(outfp->dbip) with wdb_close(outfp); in donuts.c, replaced unbounded sprintf with snprintf across getName, createLights, createPlane, createEnvironMap, createScene, makeFlake; supported -h and -? in options; replaced raw sscanf with bu_sscanf; fixed inverted logic bug where empty material check tested == 0 instead of != 0; removed undefined fflush(stdin); guarded progname and argv[0]; checked wdb_fopen result fp; freed parameters.materialArray; and replaced db_close(fp->dbip) with wdb_close(fp); in gaia.c, added null pointer guard on path in open_raster_georef; guarded av[0] before bu_setprogname; supported clean help flag exit; replaced atoi and atof with bu_sscanf; and ensured GDAL datasets are closed on texture load failure paths; in gears.c, guarded make_gear against null db_fp and teeth <= 0; eliminated double free risk by freeing scratch arrays verts/lsegs/segments/reverse once and cleaning up gear_head wmembers; guarded av[0]; supported help flags (-h, -?, --help); replaced atof and atoi with bu_sscanf; cleaned up all_head wmembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0299` | `src/proc-db/globe.c, src/proc-db/gtimes.c, src/proc-db/helicoil.c, src/proc-db/kurt.c, src/proc-db/lattice.c, src/proc-db/lens.c` | `globe.c:42-46,67-86,115-148,165-179; gtimes.c:44-63,77-81,101-115; helicoil.c:92-105,190-222,370-381; kurt.c:64-75,124-145,212-218,238-245,268-275; lattice.c:228-235,299-335,530-552; lens.c:73-143,147-218,223-258,270-333` | Immediate NULL Pointer Dereference Crashes, Uninitialized Memory Access, Memory Leaks, Infinite Loop, and Handle Leaks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 57 (globe.c, gtimes.c, helicoil.c, kurt.c, lattice.c, lens.c, 1,910 lines): in globe.c, guarded progname and av[0]; added clean exit on help flags (-h, -?, --help); replaced atof with bu_sscanf; validated stepSize > 0 (eliminating infinite loop denial of service), initialSize > 0, and finalSize > initialSize (eliminating division by zero in shader params); replaced sprintf with snprintf; eliminated persistent leaks of wmember list nodes across loop iterations by calling mk_freemembers(&wm_hd.l) and mk_freemembers(&bigList.l); and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to fix struct rt_wdb handle leak; in gtimes.c, guarded av[0] before bu_setprogname; supported standard help options (-h, -?); replaced atoi with bu_sscanf; guarded against out-of-bounds pointer dereference when no file argument is given; guarded wdbp from wdb_dbopen against NULL; called ged_free(&ged) on every iteration to fix persistent ged container memory leaks; and replaced printf with bu_log; in helicoil.c, guarded build_helix against NULL head and non-positive turns; guarded av[0]; added clean help exit (-h, -?, --help); replaced atoi and atof with bu_sscanf; freed coil_hd and all_hd wmember lists with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in kurt.c, guarded argv[0] before bu_setprogname; added clean exit on help flags; checked outfp after wdb_fopen; in do_cell, guarded vp->v_n < 3 and fixed critical array index bug in sort loop that iterated over nroots instead of vp->v_n (which caused sorting of uninitialized memory); freed head wmembers in make_surface; guarded against division by zero in vector unitize in pnorms and do_light; and replaced db_close(outfp->dbip) with wdb_close(outfp); in lattice.c, guarded subdivide_face against freq < 1 or freq > MAX_FREQ; guarded av[0] before bu_setprogname; supported clean help exit; replaced atoi and atof with bu_sscanf; clamped frequency to MAX_FREQ; freed dome_head, light_head, and all_head wmembers with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in lens.c, fixed immediate SIGSEGV crash when run without filename where av[bu_optind] was NULL and passed to %s in bu_log; checked wdb_fopen return; guarded discriminant and radicand against negative values and ref_ind against zero; freed VLS buffers str, lens_type, and name; freed lensglass and lens wmembers; replaced sscanf with bu_sscanf; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0300` | `src/proc-db/loftwing.c, src/proc-db/masonry.c, src/proc-db/menger.c` | `loftwing.c:95-125,145-175,225-235,390-445,465-490,505-525,535-610; masonry.c:125-135,200-215,220-345,600-685,775-826,835-875,885-970,1000-1010,1020-1065; menger.c:63-68,267-330,355-425,450-465,480-565` | Division by Zero, Memory Leaks, Denial of Service via Unbounded Recursion, and Handle Leaks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 58 (loftwing.c, masonry.c, menger.c, 2,245 lines): in loftwing.c, guarded naca_eval against negative x and p >= 1.0 (preventing division by zero); guarded naca_outline against npts < 4 and non-positive nupper/nlower; guarded build_loft against NULL pointers and invalid counts; guarded av[0] before bu_setprogname; added clean exit on help flags (-h, -?, --help); replaced atoi and atof with bu_sscanf with error checks; clamped points, stations, blades, span, and chord to valid positive ranges; eliminated persistent memory leaks of wm_hd wmembers across wing and blade branches by calling mk_freemembers; ensured db_fp and allocated buffers are freed on error exits; and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to eliminate struct rt_wdb handle leak; in masonry.c, guarded set_translate and set_rotate with bu_sscanf and initialized coordinates; guarded av and *av in parse_args before bu_path_component; supported standard help exit (-h, -?); replaced raw sscanf and atof with bu_sscanf; guarded studs and span in frame_opening to prevent division by zero; freed s_hd boardseg head and wm_hd wmembers in frame; guarded sheetrock against non-positive dimensions and freed wm_hd wmembers; guarded mortar_brick against non-positive wall/brick dimensions (preventing division by zero) and freed wm_hd wmembers; freed wm_hd wmembers in brick; freed ol_hd opening list and trans_matrix in main; and replaced db_close(db_fd->dbip) with wdb_close(db_fd); in menger.c, guarded comb, depth, width, and height in slice against NULL/invalid extents; in mengerize, guarded against empty pattern or zero repeat; eliminated persistent leaks of levels[slot]->l and final->l wmembers by calling mk_freemembers; guarded av[0] before bu_setprogname; limited repeat to maximum 5 to eliminate denial-of-service memory exhaustion from recursive fractal generation; replaced heap allocation of menger, ground, light0, light1, sponge with stack allocation and freed their wmembers with mk_freemembers; freed boxes VLS container; and replaced db_close(fp->dbip) with wdb_close(fp). |
-| `SEC-0301` | `src/proc-db/metaball.c, src/proc-db/molecule.c, src/proc-db/nmgmodel.c, src/proc-db/parashot.c, src/proc-db/pdb-g.cpp` | `metaball.c:64-70,88,118-120,135-163,165-170,205-210,230-265; molecule.c:39-46,75-94,105-188,190-230,235-280; nmgmodel.c:70-115,535-590; parashot.c:60-75,80-94,115-165,285-290; pdb-g.cpp:155-215,220-268,270-340` | Buffer Over-reads, Out-of-Bounds Memory Access, Memory Leaks, and Handle Leaks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 59 (metaball.c, molecule.c, nmgmodel.c, parashot.c, pdb-g.cpp, 1,761 lines): in metaball.c, guarded make_meatballs against NULL name and non-positive count (eliminating division by zero in sqrt); in mix_balls, called rt_db_free_internal to eliminate persistent internal object memory leaks for every input object; checked wdbp returned by wdb_dbopen; guarded av and av[0] before bu_setprogname; added clean exit 0 on help flags (-h, -?); replaced atoi with bu_sscanf with range validation [1, 1000000]; and replaced db_close(fp->dbip) with wdb_close(fp) to eliminate struct rt_wdb handle leak; in molecule.c, guarded argv[0] before bu_setprogname; supported standard help flags with exit 0 (-h, -?, --help); checked outfp from wdb_fopen against NULL; rewrote read_data to use line-by-line reading with bu_fgets and bu_sscanf to eliminate infinite loop denial of service on non-numeric input; added bounds checking on atom indices and types to eliminate out-of-bounds array reads in atom_list; replaced unsafe sprintf with snprintf; increased s_name buffer to prevent truncation; freed reg_head and head wmembers with mk_freemembers; freed allocated sphere linked list to fix memory leak; and replaced db_close(outfp->dbip) with wdb_close(outfp); in nmgmodel.c, guarded av and *av before bu_path_component; supported clean exit 0 on help flags (-h, -?); freed model m with nmg_km if wdb_fopen fails; and replaced db_close(fdmodel->dbip) with wdb_close(fdmodel); in parashot.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on help flags (-h, -?); replaced raw sscanf, atoi, and atof with bu_sscanf; validated step count and pipe diameter; and replaced db_close(fp->dbip) with wdb_close(fp); in pdb-g.cpp, fixed buffer over-read vulnerability when parsing fixed-column PDB records (ATOM/HETATM) on short lines by trimming newlines and padding lines up to 80 characters with spaces; replaced raw sscanf with bu_sscanf; supported clean help exit (-h, -?, --help); derived default output geometry file if omitted; freed allocated header string with bu_free; freed all_atoms wmembers with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0302` | `src/proc-db/pipe.c, src/proc-db/pipetest.c, src/proc-db/pix2g.c, src/proc-db/pyramid.c, src/proc-db/ringworld.c` | `pipe.c:169-173,248-251,320-335,465-475,477-485,508-540,579-605,607-640,683-748,755-765,789-805; pipetest.c:110-128,146-160,168-175,193-200; pix2g.c:63-70,147-164,170-198,201-225,254-270; pyramid.c:55-87,123-125,138-155,158-164; ringworld.c:66-78,82-111,126-146,148-154,160-170` | Free of Memory Not on Heap, Buffer Over-read, Race Condition, Unbounded Recursion, and Memory Leaks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 60 (pipe.c, pipetest.c, pix2g.c, pyramid.c, ringworld.c, 1,641 lines): in pipe.c, clamped Normals dot product to [-1.0, 1.0] before acos to prevent NaN; guarded tangent and cosine denominators against zero with ZERO(); fixed memory leaks and cumulative combination list corruption across pipe and elbow generations by calling mk_freemembers(&head.l) after every mk_lfcomb; guarded argv[0] before bu_setprogname; added clean exit 0 on -h and -?; replaced raw scanf with bu_fgets and bu_sscanf with validation; guarded against NULL pointer dereference in Names() and main() when fewer than two points are read; freed root points linked list; and replaced db_close(fdout->dbip) with wdb_close(fdout); in pipetest.c, fixed critical heap corruption crash (CWE-590: Free of Memory not on the Heap) by dynamically allocating pipe points via mk_pipe_init and mk_add_pipe_pnt instead of passing static array elements to mk_pipe which takes ownership and frees on export; guarded argv[0]; fixed unconditional usage message; supported clean exit 0 on help flags (-h, -?, --help); checked wdb_fopen return; added NULL guards in do_bending and pr_pipe; freed pipe points with mk_pipe_free; and replaced db_close(outfp->dbip) with wdb_close(outfp); in pix2g.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; replaced atoi and atof with bu_sscanf with range validation [1, 65536] on dimensions and positive checks on cell/object sizes; prevented buffer over-read (CWE-125) and crash when image buffer is smaller than width * height * 3 by halting with error instead of continuing to read past buffer end; eliminated critical race condition and list corruption across parallel worker threads by acquiring BU_SEM_GENERAL semaphore when modifying global allScanlineList; eliminated persistent leaks of hundreds of thousands of wmember list nodes by calling mk_freemembers on wm_hd, scanlineList, and allScanlineList; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in pyramid.c, removed unused dead function pnorms; guarded argv[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; replaced atoi with bu_sscanf and clamped recursion depth to [1, 8] to prevent denial of service from unbounded recursive branching; checked wdb_fopen return; eliminated persistent memory leaks in recursive tree generation by calling mk_freemembers(&head.l); and replaced db_close(outfp->dbip) with wdb_close(outfp); in ringworld.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on -h and -?; checked wdb_fopen return; eliminated wmember list node leaks in mk_sol, mk_ring, and main by calling mk_freemembers(&c.l); and replaced db_close(fp->dbip) with wdb_close(fp). |
-| `SEC-0303` | `src/proc-db/seashell.c, src/proc-db/sketch.c, src/proc-db/specimen.c, src/proc-db/sphflake.c, src/proc-db/spltest.c` | `seashell.c:56-65,475-485,502-535,555-570,610-660; sketch.c:60-70,120-135,170-185; specimen.c:30-40,110-120,380-435; sphflake.c:95-105,150-165,190-230,285-365,370-385,470-490,575-585; spltest.c:55-65,75-85,145-175,190-205` | Memory Leaks, Handle Leaks, Unbounded Recursion Denial of Service, Division by Zero, and Input Validation | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 61 (seashell.c, sketch.c, specimen.c, sphflake.c, spltest.c, 2,106 lines): in seashell.c, guarded superformula against n1 == 0 with ZERO() to prevent division by zero in pow(); guarded argv[0] before bu_setprogname; added clean exit 0 on -h, -?, --help; replaced atof and atoi with bu_sscanf with range validation on --turns, --expand, and --res; eliminated persistent wmember list node leaks across combinations by calling mk_freemembers(&all_hd.l); and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to fix struct rt_wdb handle leak; in sketch.c, guarded argv[0] before bu_setprogname; removed dead option parsing block that caused unconditional abort on any argument; supported clean exit 0 on -h, -?, --help; checked outfp returned by wdb_fopen against NULL; freed all_head wmembers with mk_freemembers; and replaced db_close(outfp->dbip) with wdb_close(outfp); in specimen.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; replaced atof with bu_sscanf and validated spacing >= 100.0; freed reg_hd wmembers after every specimen shelf region and freed gnd_hd, lt_hd, and all_hd wmembers in main to eliminate widespread heap leaks; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in sphflake.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; clamped recursion depth to [0, 5] using bu_sscanf to eliminate denial of service from exponential tree explosion; checked fp returned by wdb_fopen against NULL; eliminated massive memory leak by freeing all wmemberArray entries with mk_freemembers before bu_free; removed undefined behavior fflush(stdin) calls; replaced unsafe sprintf and sscanf with snprintf and bu_sscanf; and replaced db_close(fp->dbip) with wdb_close(fp); in spltest.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; guarded make_face against NULL pointers and unsupported order; checked srf returned by nmg_nurb_new_snurb; and replaced db_close(fp->dbip) with wdb_close(fp). |
-| `SEC-0304` | `src/proc-db/surfaceintersect.cpp, src/proc-db/surfaceintersect.h, src/proc-db/tea.c, src/proc-db/tea.h, src/proc-db/tea_nmg.c` | `surfaceintersect.cpp:32,75-80,325-354,374-405,444-450,595-605,655-685,965-985,1060-1145; tea.c:43-88,96-140; tea.h:42,352; tea_nmg.c:50-135,165-245` | Use-After-Free, Infinite Loops, Memory Leaks, File Descriptor Leak, Handle Leaks, and Missing Input Bounds Checks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 62 (surfaceintersect.cpp, surfaceintersect.h, tea.c, tea.h, tea_nmg.c, 2,014 lines): in surfaceintersect.cpp, corrected inverted SI_MIN macro; guarded against division by zero in Step when normal cross product magnitude is zero; eliminated unbounded memory leaks and fixed typo in CurveCurveIntersect by properly deleting split curve objects left1/right1/left2/right2 and intersecting right1 with right2; updated SetCurveCurveIntersectionDir to use reference parameter so intersection direction updates are not discarded on copy, enabled the negative dot product branch (dot < 0), fixed typo that wrote m_dirB[0] twice, and made curve parameters const; fixed arguments to SetCurveCurveIntersectionDir in Get_ON_X_Events; capped Jiggle iteration loops in WalkIntersection and GetStartPointsInternal to prevent infinite loop denial of service; in GetStartPointsInternal, eliminated 12 heap-allocated ON_Surface leaks per recursion node and corrected return value accumulator from &= to |=; cleaned up dynamically allocated curves in BrepBrepIntersect before returning; in main(), guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?/-help, checked wdb_fopen return, freed all wmembers with mk_freemembers, and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to fix struct rt_wdb handle leak; in tea.h, marked ducks and patches as static const to prevent multiple-definition linker collisions and inadvertent table modification; in tea.c, guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?, checked wdb_fopen return, added NULL check in dump_patch, added array bounds checks on patch indices before accessing ducks[], and replaced db_close(outfp->dbip) with wdb_close(outfp); in tea_nmg.c, fixed critical CWE-416 Use-After-Free vulnerability where nmg_m_to_vlist accessed model m after mk_nmg/wdb_export had already freed it by generating the vlist prior to exporting, fixed file descriptor leak by calling fclose(fp) on the plot3 file, freed vlist nodes with BV_FREE_VLIST, guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?, checked wdb_fopen return, checked nmg_mm() return, added bounds checks on patch indices, and replaced db_close(outfp->dbip) with wdb_close(outfp). |
-| `SEC-0305` | `src/proc-db/terragen.c, src/proc-db/torii.c, src/proc-db/tube.c, src/proc-db/twistedcube.cpp, src/proc-db/twistedcube.h` | `terragen.c:120-145,280-305,335-415; torii.c:100-145,170-185,200-245; tube.c:125-155,205-245,265-295,400-470,485-500,510-530,535-555; twistedcube.cpp:35-45,120-130,165-175,210-220; twistedcube.h:1-71` | Memory Leaks, Handle Leaks, Combination List Corruption, File Descriptor Leaks, and Missing Input Bounds Checks | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 63 (terragen.c, torii.c, tube.c, twistedcube.cpp, twistedcube.h, 1,474 lines): in terragen.c, guarded av[0] before bu_setprogname, supported clean exit 0 on -h/-?/--help, replaced atoi and atof with bu_sscanf, added cleanup freeing hf and grid and calling wdb_close on sidecar write failure, freed combination members after terrain.r, water.r, sky.r, and all combs with mk_freemembers, and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in torii.c, guarded av[0] before bu_setprogname, supported clean exit 0 on -h/-?/--help, replaced atoi and atof with bu_sscanf, validated rows and cols (clamped 1..200) and major/minor radii to prevent denial-of-service memory/disk exhaustion, freed all_hd wmembers with mk_freemembers on error paths and normal completion, and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in tube.c, guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?/--help, checked outfp returned by wdb_fopen against NULL, closed pos_fp with fclose, eliminated combination list corruption and memory leaks across frames by freeing head.l after bg.r and both head.l and ghead.l on every frame iteration with mk_freemembers, freed head.l in build_cyl with mk_freemembers, checked npts <= 0 and bp in build_spline, added bounds check on nsamples (< 1022) to prevent sample array overflow and replaced sscanf with bu_sscanf in read_frame, replaced fscanf with bu_fgets and bu_sscanf in read_pos, guarded against division by zero in xfinddir with ZERO(denom), and replaced db_close(outfp->dbip) with wdb_close(outfp); in twistedcube.cpp, added array bounds checks on from and to vertex indices against brep.m_V.Count() in MakeTwistedCubeEdge, validated face.m_si and checked surface pointer in MakeTwistedCubeTrimmingLoop, checked edge index ei against brep.m_E.Count(), and added NULL check on bi in printPoints; in twistedcube.h, reviewed clean. |
-| `SEC-0306` | `src/proc-db/vegetation.c, src/proc-db/vegetation.h, src/proc-db/voxelize.c, src/proc-db/wavy.c, src/proc-db/wdb_example.c` | `vegetation.c:200-230,590-645,750-800,810-850,885-985; vegetation.h:135-145,165-175; voxelize.c:235-265,380-430,445-505; wavy.c:60-95,115-125; wdb_example.c:50-65,130-140` | Memory Leaks, Handle Leaks, Combination List Corruption, Allocator Mismatches, Double Free, and Uninitialized Macro Member | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD proc-db Batch 64 (vegetation.c, vegetation.h, voxelize.c, wavy.c, wdb_example.c, 1,995 lines): completing all 55 files of src/proc-db (100% complete): in vegetation.h, fixed uninitialized branchMaxVariation bug in INIT_CHARACTERISTIC_T macro caused by setting dirMaxVariation twice; replaced unsafe sprintf with bu_strlcpy in INIT_OUTPUTCOUNTER_T; in vegetation.c, fixed memory leak of bigList on error in findIntersectors; replaced system free with bu_free on bu_calloc/BU_ALLOC buffers (segList, excluded, included, plant, and structure allocations) to eliminate allocator mismatch; fixed persistent leaks of included and excluded segment lists during growth retries; implemented recursive freeStructure helper to eliminate memory leaks of deeply nested substructures, branches, and segments in destroyPlant; freed oc->combination.l and oc->region.l wmembers with mk_freemembers; guarded argv[0] before bu_setprogname; supported clean exit 0 on -h/-?/--help; replaced atoi, atof, and atol with bu_sscanf with range validation and clamped age [1, 200] to prevent memory/CPU exhaustion; checked fp from wdb_fopen against NULL; and replaced db_close(fp->dbip) with wdb_close(fp); in voxelize.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h/-?/--help; replaced atoi with bu_sscanf; freed voldata and ebmdata buffers and closed db_fp on sidecar write and primitive creation failures; freed region_hd.l, ebm_hd.l, and all_hd.l wmembers with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in wavy.c, guarded argv[0] before bu_setprogname; fixed option parsing so -h and -? exit 0 cleanly with usage; replaced atof with bu_sscanf; checked outfp returned by wdb_fopen; documented ownership transfer where mk_bspline/wdb_export takes ownership and frees surfaces via rt_nurb_ifree, avoiding double free; and replaced db_close(outfp->dbip) with wdb_close(outfp); in wdb_example.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h/-?/--help; eliminated combination member leak by freeing wm_hd.l with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0307` | `src/qged/QgEdApp.cpp, src/qged/QgEdApp.h, src/qged/QgEdFilter.cpp, src/qged/QgEdFilter.h, src/qged/QgEdMainWindow.cpp, src/qged/QgEdMainWindow.h` | `QgEdApp.cpp:90-95,110-117,315-325,410-430,445-455,485-492,500-505,520-535,625-640; QgEdApp.h:1-119; QgEdFilter.cpp:33-40,70-75; QgEdFilter.h:1-44; QgEdMainWindow.cpp:90-100,105-110,238-245,375-385,410-415,440-445,455-505; QgEdMainWindow.h:50-55,60-65,107-115` | Allocator Mismatch, Memory Leaks, Uninitialized Pointers, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD qged Batch 65 (QgEdApp.cpp, QgEdApp.h, QgEdFilter.cpp, QgEdFilter.h, QgEdMainWindow.cpp, QgEdMainWindow.h, 1,604 lines): in QgEdApp.cpp, fixed allocator mismatch (CWE-762) by replacing C++ delete on bu_strdup strings with bu_free(tmp_av[i], "tmp_av str"); fixed memory leak of argv array av allocated with bu_calloc in QgEdApp::run_cmd; added cleanup loop in QgEdApp destructor to free any pending tmp_av strings; added NULL pointer checks on p->gedp, p->gedp->ged_io_data, ca->w, and ca->w->console before dereferencing in qt_create_io_handler and qt_delete_io_handler; guarded w and w->CurrentView() before dereferencing in run_cmd; guarded el, el->controls, and w->CurrentDisplay() in element_selected; added NULL guards on ctx and valp in raytrace_start and raytrace_done; in QgEdApp.h, audited clean; in QgEdFilter.cpp, added NULL pointer checks on event e and application model pointer c->mdl before accessing interaction_mode; in QgEdFilter.h, audited clean; in QgEdMainWindow.h, removed duplicate QgView.h include, and initialized pointer members console, cad_open, cad_save_settings, and cad_exit to NULL to prevent uninitialized memory reads (CWE-457); in QgEdMainWindow.cpp, added NULL pointer guards on c4 across isValid3D, isDisplayActive, CurrentDisplay, CurrentView, DisplayCheckpoint, DisplayDiff, QuadDisplay, SingleDisplay, and constructor mode switching; added NULL guards on vcw in IndicateRaytraceStart and IndicateRaytraceDone; added NULL guards on w and qApp in widget_active; and added NULL guards on ap->mdl and ap->mdl->gedp in CreateWidgets, ConnectWidgets, and do_dm_init. |
-| `SEC-0308` | `src/qged/QgEdPalette.cpp, src/qged/QgEdPalette.h, src/qged/fbserv.cpp, src/qged/fbserv.h, src/qged/main.cpp` | `QgEdPalette.cpp:40-50,95-105,108-115,135-140; QgEdPalette.h:1-62; fbserv.cpp:50-95,120-135,178-204,208-223,225-245,260-270,280-290,315-375; fbserv.h:44-50,85-90; main.cpp:70-75,100-105,135-150` | Memory Leaks, Uninitialized Pointers, Out-of-bounds Array / Buffer Access, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD qged Batch 66 (QgEdPalette.cpp, QgEdPalette.h, fbserv.cpp, fbserv.h, main.cpp, 881 lines): in QgEdPalette.cpp, initialized filenames pointer to NULL before bu_file_list and guarded bu_argv_free, added NULL checks on cmd, cmd->i, cmd->i->tool_create, and returned tool element el before inserting into c_map and calling addElement, and guarded selected->button before setStyleSheet; in QgEdPalette.h, audited clean; in fbserv.h, initialized pointer and index members (s = nullptr, ind = -1, fbsp = nullptr) in QFBSocket and fbsp in QFBServer to prevent uninitialized memory access (CWE-457); in fbserv.cpp, guarded fbsp, s, ind bounds, and pkc in QFBSocket::client_handler, checked realloc return before updating pkc_inbuf to prevent NULL dereference on allocation failure, guarded buffer length and bounds (pkc_inend >= 0 && pkc_inend < pkc_inlen) before copying remaining data; in QFBServer::on_Connect, guarded nextPendingConnection return, fbsp, and validated socket descriptor fd >= 0 before pkg_adopt_socket; in qdm_is_listening and qdm_listen_on_port, checked fbsp against NULL; in qdm_open_server_handler and qdm_close_server_handler, guarded fbsp and listener channel nl, and cleared fbsl_chan and fbsl_fd to avoid dangling pointers; in qdm_open_client_handler and qdm_open_sw_client_handler, added client index bounds checks (0 <= i < fbs_max_clients) and guarded data, s->s, and fbsp->fbs_fbp; in qdm_close_client_handler, guarded client index and cleared fbsc_chan to NULL; in QFBIPCSocket::ipc_handler, guarded fbsp, ind bounds, notifier, and fbsc_pkg before client processing; in qdm_open_ipc_client_handler, qdm_open_ipc_sw_client_handler, and qdm_close_ipc_client_handler, added client index bounds checks and guarded fbsp->fbs_fbp; in main.cpp, guarded argc < 1, argv, and argv[0] before bu_setprogname to prevent NULL pointer dereference crashes on empty argument vectors, guarded argv[i] in option scanning loop, eliminated memory leaks of bu_vls msg on error paths and prior to QApplication launch by adding bu_vls_free(&msg). |
-| `SEC-0309` | `src/qged/plugins/plugin.h, src/qged/plugins/edit/ell/QEll.cpp, src/qged/plugins/edit/ell/QEll.h, src/qged/plugins/edit/ell/ell_tool.cpp, src/qged/plugins/view/info/CADViewModel.cpp, src/qged/plugins/view/info/CADViewModel.h, src/qged/plugins/view/info/view_info.cpp` | `plugin.h:1-74; QEll.h:44-58; QEll.cpp:35-43,80-92,94-123,138-165,170-240,245-285,290-295; ell_tool.cpp:28-48; CADViewModel.h:1-63; CADViewModel.cpp:42-47,56-102; view_info.cpp:28-42` | Illegal Free of Non-Heap Member, Double Free, Memory Leaks, Uninitialized Pointers, Model Invariant Violations, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD qged Batch 67 (plugin.h, QEll.cpp, QEll.h, ell_tool.cpp, CADViewModel.cpp, CADViewModel.h, view_info.cpp, 777 lines): in plugin.h, audited clean; in QEll.h, initialized all pointer member variables (O_pnt, A_axis, B_axis, C_axis, ell_name, write_edit, make_sph, reset_values) to nullptr to prevent uninitialized pointer reads (CWE-457); in QEll.cpp, cleared struct rt_ell_internal ell with memset(&ell, 0, sizeof(ell)) in constructor; connected write_edit and reset_values buttons to their write_to_db and read_from_db slots; in destructor, set p = NULL after bv_obj_put(p); in read_from_db, guarded qApp against NULL and checked ellp against NULL before RT_ELL_CK_MAGIC; in write_to_db, fixed illegal free of non-heap C++ object member &ell (CWE-763/CWE-590) and subsequent double free (CWE-415) by dynamically allocating ellp via BU_ALLOC and relying on rt_db_put_internal's internal deallocation without redundant and dangerous rt_db_free_internal calls; in update_obj_wireframe, guarded qApp, gedp->dbip, p from bv_obj_get, wdbp from wdb_dbopen, child scene object s, and pl[i].str against NULL pointer dereferences; in update_viewobj_name, guarded qApp, gedp->dbip, p, and ell_name against NULL dereferences; in eventFilter, added NULL guard on event pointer e; in ell_tool.cpp, converted heap-allocated QIcon to stack allocation to eliminate memory leak (CWE-401); in CADViewModel.h, audited clean; in CADViewModel.cpp, guarded qApp and bview pointer v against NULL in refresh, and invoked beginResetModel before deleting m_root to preserve Qt model invariants and avoid use-after-free by attached views; set m_root = NULL in destructor; in view_info.cpp, converted heap-allocated QIcon to stack allocation and parented CADViewModel to vview to eliminate memory leaks (CWE-401). |
-| `SEC-0310` | `src/qged/plugins/view/measure/CADViewMeasure.cpp, src/qged/plugins/view/measure/CADViewMeasure.h, src/qged/plugins/view/measure/measure.cpp, src/qged/plugins/view/select/CADViewSelector.cpp, src/qged/plugins/view/select/CADViewSelector.h, src/qged/plugins/view/select/select.cpp, src/qged/plugins/view/settings/CADViewSettings.cpp, src/qged/plugins/view/settings/CADViewSettings.h, src/qged/plugins/view/settings/view_settings.cpp` | `CADViewMeasure.h:26-55; CADViewMeasure.cpp:88-95,98-106,115-145,155-186; measure.cpp:30-46; CADViewSelector.h:44-94; CADViewSelector.cpp:144-146,193-221,220-246,244-271,269-290,286-320,313-350,341-408; select.cpp:31-47; CADViewSettings.h:40-64; CADViewSettings.cpp:41-55,185-226,228-267; view_settings.cpp:30-43` | Memory Leaks, Uninitialized Pointers, Argument Indexing Corruption, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD qged Batch 68 (CADViewMeasure.cpp, CADViewMeasure.h, measure.cpp, CADViewSelector.cpp, CADViewSelector.h, select.cpp, CADViewSettings.cpp, CADViewSettings.h, view_settings.cpp, 1,374 lines): in CADViewMeasure.h, removed duplicate QLineEdit include and initialized pointer members to nullptr to avoid uninitialized memory reads (CWE-457); in CADViewMeasure.cpp, freed f2d and f3d filters in destructor to fix memory leak (CWE-401); in adjust_text, eliminated persistent memory leak of QLabel on every event by reusing ma_label instead of repeatedly reallocating new QLabel instances; guarded qApp, gedp->ged_gvp, gedp->dbip, mf, and reports against NULL dereferences; in update_color and eventFilter, guarded mf, measure_3d, color_3d, color_2d, and filters; in measure.cpp, converted heap-allocated QIcon to stack allocation to prevent memory leak (CWE-401); in CADViewSelector.h, initialized all pointer members (including filter pointers pf, bf, rf) to nullptr; in CADViewSelector.cpp, freed pf, bf, and rf in destructor to fix memory leak (CWE-401); in select_objs and deselect_objs, guarded gedp, dbi_state, cf, and scene object s against NULL; in erase_objs, fixed indexing bug in av array where NULL scene objects created holes in the argv vector passed to ged_exec_erase, and checked scnt > 1 before execution; in do_draw_selections, do_erase_selections, and do_view_update, guarded dbis->pathstr return before calling bu_strdup and constructing std::string; in eventFilter, added NULL guards on event e, qApp, filters, and checkboxes; in select.cpp, converted heap-allocated QIcon to stack allocation to prevent memory leak (CWE-401); in CADViewSettings.h, initialized all pointer members to nullptr; in CADViewSettings.cpp, added NULL checks on cb in set_ckbx and ckbx_val; in checkbox_refresh and view_refresh, guarded qApp, gedp, bview v, v->gv_s, and fb_mode_combo against NULL pointer dereferences; in view_settings.cpp, converted heap-allocated QIcon to stack allocation to eliminate memory leak (CWE-401). |
-| `SEC-0311` | `src/qged/plugins/polygon/QPolyCreate.cpp, src/qged/plugins/polygon/QPolyCreate.h, src/qged/plugins/polygon/QPolySettings.cpp, src/qged/plugins/polygon/QPolySettings.h, src/qged/plugins/polygon/polygon_tool.cpp` | `QPolySettings.h:35-57; QPolySettings.cpp:145-185,185-200,205-220,225-265; polygon_tool.cpp:29-50,53-80; QPolyCreate.h:40-75,98-106; QPolyCreate.cpp:155-215,225-265,270-315,335-375,410-440,442-455,458-480,485-502,505-545,555-665` | Memory Leaks, Uninitialized Pointers, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD qged Batch 69 (QPolyCreate.cpp, QPolyCreate.h, QPolySettings.cpp, QPolySettings.h, polygon_tool.cpp, 1,239 lines): in QPolySettings.h, initialized all pointer member variables to nullptr to eliminate uninitialized pointer access (CWE-457); in QPolySettings.cpp, added explicit QWidget parent to constructor, fixed severe memory leak in uniq_obj_name where ovname and vname were leaked on both collision early exit and success paths (CWE-401), guarded sketch_sync and sketch_name against NULL in sketch_sync_toggled, checked line_snapping and grid_snapping in signal handlers, and guarded p, p->s_i_data, and all UI controls against NULL in settings_sync; in polygon_tool.cpp, stack-allocated QIcon objects in polygon_tool_create and polygon_tool_modify to eliminate heap allocation leaks (CWE-401); in QPolyCreate.h, initialized all pointer member variables to nullptr (CWE-457); in QPolyCreate.cpp, added explicit QWidget parent to constructor, freed pcf in destructor to prevent filter memory leak (CWE-401), guarded qApp, gedp, gedp->dbip, p->s_i_data, and sketch widgets in finalize, guarded qApp, gedp, gedp->ged_gvp, and ps in do_vpoly_copy, guarded qApp, gedp, gedp->dbip, and ps in do_import_sketch, guarded gedp->dbip and sketch controls in sketch_sync to prevent NULL pointer dereferences on uninitialized databases, guarded v->gv_s and scene objects in toggle_line_snapping, toggle_grid_snapping, and checkbox_refresh, and in eventFilter guarded event pointer e, qApp, gedp, pcf, p->s_i_data, and ps settings controls. |
-| `SEC-0312` | `src/qged/plugins/polygon/QPolyMod.cpp, src/qged/plugins/polygon/QPolyMod.h` | `QPolyMod.h:38-70,105-116; QPolyMod.cpp:35-40,170-174,180-216,218-250,252-285,293-334,336-367,369-408,410-525,528-581,583-608,610-635,670-745,747-814,816-838,840-861,863-895,897-913,915-937,945-1013` | Memory Leaks, Uninitialized Pointers, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD qged Batch 70 (QPolyMod.cpp, QPolyMod.h, 1,124 lines): completing all 34 files of src/qged (100% complete): in QPolyMod.h, initialized all pointer member variables to nullptr (ps, mod_names, select_mode, move_mode, update_mode, general_mode_opts, close_general_poly, append_pnt, select_pnt, csg_modes, apply_bool, viewsnap_poly, remove_poly, p, cf, puf, psf, ppf, pmf) to eliminate uninitialized pointer access (CWE-457); in QPolyMod.cpp, added explicit QWidget parent to constructor, freed mouse filter objects puf, psf, ppf, and pmf in destructor to eliminate memory leaks (CWE-401), guarded qApp and mod_names in mod_names_reset, guarded ip and all UI controls in poly_type_settings, guarded qApp, p, p->s_i_data, and ps settings controls in polygon_update_props, guarded qApp and gedp->ged_gvp in toplevel_config, guarded p and p->s_i_data in clear_pnt_selection, guarded qApp, gedp->ged_gvp, and ps in select, guarded p, p->s_i_data, close_general_poly, and boolean operation objects in toggle_closed_poly, guarded qApp, p, p->s_i_data, gedp->ged_gvp, and csg_modes in apply_bool_op, guarded qApp, p, p->s_i_data, and gedp->ged_gvp in align_to_poly, guarded qApp, p, p->s_i_data, and mod_names in delete_poly, guarded gedp->dbip and sketch controls in sketch_name_edit, checked existing sketch collision and guarded gedp->dbip in sketch_name_update, guarded qApp and ps in view_name_edit and view_name_update, guarded v->gv_s in toggle_line_snapping, toggle_grid_snapping, and checkbox_refresh, and in eventFilter guarded event pointer e, qApp, gedp, filters, p->s_i_data, and UI controls. |
-| `SEC-0313` | `include/qtcad/defines.h, include/qtcad/QgSignalFlags.h, include/qtcad/QgAccordion.h, src/libqtcad/QgAccordion.cpp, include/qtcad/QgAppExecDialog.h, src/libqtcad/QgAppExecDialog.cpp, include/qtcad/QgAttributesModel.h, src/libqtcad/QgAttributesModel.cpp, include/qtcad/QgColorRGB.h, src/libqtcad/QgColorRGB.cpp, include/qtcad/QgDockWidget.h, src/libqtcad/QgDockWidget.cpp, include/qtcad/QgFlowLayout.h, src/libqtcad/QgFlowLayout.cpp` | `defines.h:56-88; QgSignalFlags.h:81-91; QgAccordion.h:40-78; QgAccordion.cpp:30-108; QgAppExecDialog.h:42-62; QgAppExecDialog.cpp:33-101; QgAttributesModel.h:43-70; QgAttributesModel.cpp:33-214; QgColorRGB.h:41-69; QgColorRGB.cpp:30-128; QgDockWidget.h:35-48; QgDockWidget.cpp:21-65; QgFlowLayout.h:74-81; QgFlowLayout.cpp:67-208` | Memory Leaks, Uninitialized Pointers, Off-by-one, Missing Header Guard, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libqtcad Batch 71 (14 files, 1,563 lines): in defines.h, wrapped QTCAD_SLOT and QTCAD_EVENT macro definitions in do-while(0) blocks for safe statement syntax and guarded slot_name and event_name against NULL; in QgSignalFlags.h, added missing #define QGSIGNALFLAGS_H include guard; in QgAccordion.h, made constructors explicit with default nullptr and initialized all pointer members to nullptr; in QgAccordion.cpp, reparented objscrollarea to this, guarded addObject against null pointers and prevented duplicate insertion and redundant signal-slot connections, and guarded against null objects in accordion display loop; in QgAppExecDialog.h, added explicit constructor and destructor declarations and initialized logfile, console, proc, and buttonBox to nullptr; in QgAppExecDialog.cpp, implemented destructor closing and deleting logfile to eliminate persistent memory leaks (CWE-401), deleted logfile on open failure, and guarded proc, console, and buttonBox in read_stdout, read_stderr, process_abort, and process_done to prevent NULL pointer dereferences (CWE-476); in QgAttributesModel.h, modernized constructors and initialized pointers; in QgAttributesModel.cpp, deleted m_root in destructor and prior to allocating a new root in update and do_dbi_update to eliminate severe memory leaks (CWE-401), replaced unsafe bu_avs_remove loop during iteration with canonical bu_avs_free and bu_avs_init_empty, fixed off-by-one error in beginInsertRows (inclusive cnt - 1 bound), guarded against out-of-bounds access in add_Children when color attribute has fewer than 3 components (CWE-125), guarded against NULL strings and nodes, properly nested data updates between beginResetModel and endResetModel, and validated QModelIndex in refresh; in QgColorRGB.h, removed unused dead member d and initialized pointers to nullptr; in QgColorRGB.cpp, reparented child widgets to this, zeroed bu_color structure, used bu_color_from_rgb_chars for direct color synchronization, and guarded against NULL text and button pointers; in QgDockWidget.h, initialized m to nullptr and made constructor explicit; in QgDockWidget.cpp, removed unused map and set headers, guarded event pointer against NULL in event() to prevent crash, and replaced C-style cast with static_cast; in QgFlowLayout.h, initialized spacing members; in QgFlowLayout.cpp, guarded addItem, minimumSize, and doLayout against NULL items, checked widget and style pointers before layoutSpacing to prevent NULL pointer dereference crashes (CWE-476), clamped negative spacing, and returned nullptr in takeAt. |
-| `SEC-0314` | `include/qtcad/QgKeyVal.h, src/libqtcad/QgKeyVal.cpp, include/qtcad/QgUtil.h, src/libqtcad/QgUtil.cpp, src/libqtcad/bindings.h, src/libqtcad/bindings.cpp, include/qtcad/QgConsoleListener.h, src/libqtcad/QgConsoleListener.cpp, include/qtcad/QgEdit.h` | `QgKeyVal.h:39-102; QgKeyVal.cpp:45-150; QgUtil.h:58-60; QgUtil.cpp:28-148; bindings.h:23-40; bindings.cpp:73-368; QgConsoleListener.h:27-85; QgConsoleListener.cpp:36-91; QgEdit.h:46-113` | Memory Leaks, Division by Zero, Syntax / Declaration Errors, Missing Header Guards, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libqtcad Batch 72 (9 files, 1,422 lines): in QgKeyVal.h, initialized pointer members (m_root, parent) to nullptr, added explicit constructors, and added override specifiers; in QgKeyVal.cpp, initialized m_root to nullptr in model constructor to prevent undefined pointer dereferences (CWE-457), guarded curr_node against NULL in data and setData, ordered model reset correctly by calling beginResetModel before updating m_root in setRootNode, checked row bounds against child count before accessing children in index to prevent out-of-bounds reads (CWE-125), guarded node and parent pointers in parent, rowCount, NodeIndex, and NodeRow to prevent NULL pointer dereferences (CWE-476), and guarded string pointers in add_pair; in QgUtil.h, formatted header guard comment; in QgUtil.cpp, eliminated critical memory leak of bu_attribute_value_set in QgCombType by calling bu_avs_free before returning on all paths (CWE-401), guarded dp and dbip in get_arb_type, db_find_subregion, db_find_region, and QgCombType against NULL pointer dereferences, initialized intern structure with RT_DB_INTERNAL_INIT, replaced bu_bomb in db_find_subregion default case with non-fatal logging to prevent application crash on malformed CSG trees (CWE-755), and guarded comb pointer in db_find_region; in bindings.h, added standard QTCAD_BINDINGS_H header guard; in bindings.cpp, guarded against NULL event pointer in CADkeyPressEvent, CADmousePressEvent, CADmouseReleaseEvent, CADmouseMoveEvent, and CADwheelEvent, checked v->gv_s before accessing axes and ADC draw flags to prevent crash on uninitialized views (CWE-476), and prevented division by zero in CADmouseMoveEvent scaling calculation by clamping v->gv_height to a positive value (CWE-369); in QgConsoleListener.h, added standard QGCONSOLELISTENER_H header guard and initialized process, callback, data, and notifier members to nullptr; in QgConsoleListener.cpp, guarded process, process->gedp, and result string against NULL before checking string length or reading results, prevented unsigned integer underflow (CWE-191) on string length subtraction by verifying s2 > s1, safely disabled and disconnected notifier in destructor, and initialized members in constructor initialization list; in QgEdit.h, resolved syntax errors by adding missing semicolons to class declarations, corrected class name consistency (QgVectEdit), closed unclosed comment, made constructors explicit, and initialized pointer members (vx, vy, vz, dbip) to nullptr. |
-| `SEC-0315` | `include/qtcad/QgConsole.h, src/libqtcad/QgConsole.cpp, include/qtcad/QgToolPalette.h, src/libqtcad/QgToolPalette.cpp, include/qtcad/QgTreeSelectionModel.h, src/libqtcad/QgTreeSelectionModel.cpp, include/qtcad/QgTreeView.h, src/libqtcad/QgTreeView.cpp` | `QgConsole.h:75; QgConsole.cpp:115-152,202-226,236-248,260-340,434-478,575-580,620-660,685-697,730-785; QgToolPalette.h:71,128-135,142-205; QgToolPalette.cpp:32-52,55-63,89-93,153-295; QgTreeSelectionModel.h:58-60; QgTreeSelectionModel.cpp:38-48,51-105,108-175; QgTreeView.h:53,84-90; QgTreeView.cpp:43-118,175-195,215-223,247-282,305-334,338-368,432-444` | Memory Leaks, Out-of-Bounds Access, Division by Zero, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libqtcad Batch 73 (QgConsole.h, QgConsole.cpp, QgToolPalette.h, QgToolPalette.cpp, QgTreeSelectionModel.h, QgTreeSelectionModel.cpp, QgTreeView.h, QgTreeView.cpp, 2,342 lines): in QgConsole.h, initialized gedp pointer to nullptr; in QgConsole.cpp, eliminated memory leak of ct and av in GEDShellCompleter when gedp or dbip is null (CWE-401), replaced unsafe C-style cast on parent() with qobject_cast, bounded completionModel indexing, fixed out-of-bounds history indexing in consolidateHistory (CWE-125), eliminated dangling pointer read from temporary toLocal8Bit buffer in historyAt using toStdString (CWE-416), guarded Completer popup against NULL in keyPressEvent, selectCompletion, and updateCompleter, added NULL checks on clipboard and mimeData before text extraction, bounded CommandPosition on Key_Up and Key_Down, guarded CommandHistory against empty back() access in commandBuffer, fixed off-by-one word replacement in insertCompletion, prevented listener memory leak in destructor and listen() (CWE-401), and clamped cursor offsets to document bounds in printStringBeforePrompt; in QgToolPalette.h, initialized all pointer and layout members to nullptr; in QgToolPalette.cpp, guarded iicon in QgToolPaletteButton constructor and setter to prevent NULL dereference crashes (CWE-476), guarded controls in QgToolPaletteElement constructor and setter, implemented destructor in QgToolPalette to delete palette elements and prevent memory leaks (CWE-401), eliminated division by zero in button_layout_resize when width is smaller than icon width (CWE-369), fixed typo in setIconWidth where icon_height was assigned to button width, guarded empty elements set in setAlwaysSelected and deleteElement to prevent out-of-bounds / end-iterator dereference crashes (CWE-125/CWE-476), and guarded controls, scrollbars, and buttons in palette_displayElement; in QgTreeSelectionModel.h, initialized treeview to nullptr; in QgTreeSelectionModel.cpp, added NULL pointer checks on treeview, m, gedp, and dbi_state in clear_all and select slots, checked sv[0] bounds, eliminated heap allocation memory leak of QModelIndexList on every selection event by using stack allocation (CWE-401), and guarded snode against NULL before accessing path_hash and path_items (CWE-476); in QgTreeView.h, initialized model and delegate pointers to nullptr; in QgTreeView.cpp, guarded painter and invalid QModelIndex in gObjDelegate::paint, clamped icon height to prevent invalid image scaling, parented draw_action and erase_action to QMenu in context_menu to eliminate action memory leaks on menu deletion (CWE-401), guarded index, cnode, gedp, and view states in do_draw_toggle, guarded against empty path_hashes before back() and pop_back(), guarded m and items in redo_expansions and redo_highlights, and added NULL checks on model m before emitting layoutChanged. |
-| `SEC-0316` | `include/qtcad/QgView.h, src/libqtcad/QgView.cpp, include/qtcad/QgViewCtrl.h, src/libqtcad/QgViewCtrl.cpp, include/qtcad/QgGL.h, src/libqtcad/QgGL.cpp, include/qtcad/QgSW.h, src/libqtcad/QgSW.cpp, include/qtcad/QgQuadView.h, src/libqtcad/QgQuadView.cpp` | `QgView.h:84,115-120; QgView.cpp:80-95,308-356; QgViewCtrl.h:84-93; QgViewCtrl.cpp:94-147,149-166,168-215; QgGL.h:64-71; QgGL.cpp:74-83,108-114,150-154,249-255,326-346,366-369; QgSW.h:73-81; QgSW.cpp:78-87,88-93,95-185,275-281,350-370,395-407,445-475; QgQuadView.h:105-110; QgQuadView.cpp:61-75,111-125,130-145,163-195,208-316,392-425,436-522` | Memory Leaks, Uninitialized Pointers, Out-of-Bounds Access, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libqtcad Batch 74 (QgView.h, QgView.cpp, QgViewCtrl.h, QgViewCtrl.cpp, QgGL.h, QgGL.cpp, QgSW.h, QgSW.cpp, QgQuadView.h, QgQuadView.cpp, 2,910 lines): in QgView.h, audited clean; in QgView.cpp, replaced return in switch default with break, set canvas_gl and canvas_sw to NULL after deletion in destructor, guarded add_event_filter against NULL, and in clear_event_filter properly updated filters vector and curr_event_filter while ensuring event filters are removed from both GL and SW canvases; in QgViewCtrl.h, initialized QAction pointer members (sca, rot, tra, center, raytrace, fb_mode, fb_clear) to nullptr; in QgViewCtrl.cpp, guarded gedp in fbclear_cmd, fb_mode_cmd, do_view_update, and raytrace_cmd, checked v->gv_s in fb_mode_cmd and do_view_update to prevent NULL pointer dereferences (CWE-476), guarded callback context vctrl in rt_cmd_start and rt_cmd_done, and guarded raytrace before setIcon in raytrace_start and raytrace_done; in QgGL.h, audited clean; in QgGL.cpp, fixed critical memory leak in destructor by calling bv_free on local_v prior to deallocation and corrected struct name in BU_PUT from struct bv to struct bview (CWE-401), set pointers to NULL upon destruction, guarded fb_get_platform_specific return against NULL before dereferencing fbps->data, guarded dm_bg1 and dm_bg2 before dm_set_bg, checked dmp in mouseReleaseEvent before calling dm_set_dirty, guarded v before bv_hash in stash_hashes and diff_hashes, and checked for null QImage in save_image; in QgSW.h, audited clean; in QgSW.cpp, fixed memory leak in destructor by calling bv_free(local_v) and corrected BU_PUT struct name (CWE-401), guarded dmp against NULL in need_update and paintEvent before calling dm_set_dirty, checked width and height bounds before painting and image allocation, guarded fbps return before setup, guarded dm_bg1 and dm_bg2, checked dm_image against NULL in paintEvent and save_image, checked dmp in mouseReleaseEvent, guarded v before bv_hash in stash_hashes and diff_hashes, and guarded dmp and dm_image in save_image and get_viewport_image; in QgQuadView.h, initialized currentView and gedp to nullptr; in QgQuadView.cpp, guarded gedp and view pointers in constructor, createView, changeToSingleFrame, and changeToQuadFrame, clamped index bounds in createView to prevent out-of-bounds reads on VIEW_NAMES array (CWE-125), guarded chained pointers v->gv_s in changeToQuadFrame, guarded view objects in autoview and draw_scene loops, deleted old layout before creating a new one in createLayout to prevent layout leaks and Qt warnings, guarded currentView in view() and do_view_changed, eliminated unsafe parent geometry lookup in get(QPoint) by using widget-local rect and mapFromGlobal, guarded event e in get(QEvent), and guarded quadrant_id and spacer pointers in select. |
-| `SEC-0317` | `include/qtcad/QgMeasureFilter.h, src/libqtcad/QgMeasureFilter.cpp, include/qtcad/QgPolyFilter.h, src/libqtcad/QgPolyFilter.cpp, include/qtcad/QgSelectFilter.h, src/libqtcad/QgSelectFilter.cpp, include/qtcad/QgSketchFilter.h, src/libqtcad/QgSketchFilter.cpp` | `QgMeasureFilter.h:35-45; QgMeasureFilter.cpp:45-55,80-90,95-105,120-130,135-145,150-165,190-210,240-270; QgPolyFilter.h:35-50,60-70,80-90,100-110; QgPolyFilter.cpp:60-75,100-120,130-150,180-210; QgSelectFilter.h:35-45; QgSelectFilter.cpp:70-85,90-110,130-150,165-190,210-240; QgSketchFilter.h:35-45; QgSketchFilter.cpp:50-70,80-105,120-145,160-205,220-250,270-305,320-350` | Memory Leaks, NaN Domain Errors, Use-After-Free, Division by Zero, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libqtcad Batch 75 (QgMeasureFilter.h, QgMeasureFilter.cpp, QgPolyFilter.h, QgPolyFilter.cpp, QgSelectFilter.h, QgSelectFilter.cpp, QgSketchFilter.h, QgSketchFilter.cpp, 2,899 lines): in QgMeasureFilter.h, declared virtual destructor in QgMeasureFilter; in QgMeasureFilter.cpp, implemented destructor releasing scene object s, fixed critical logic inversion bug in QgMeasureFilter::angle(bool radians) where radians and degrees were swapped, clamped dot product to [-1.0, 1.0] before acos to prevent NaN domain errors, guarded vector unitization against division by zero with ZERO(mag), added null checks on s after bv_obj_get and cleared s = NULL on reset to prevent use-after-free and null dereferences, guarded v in QMeasure2DFilter::get_point, implemented QMeasure3DFilter destructor to clean and free rt_resource, rtip, and application structures eliminating severe memory leaks (CWE-401), cleaned prior raytrace resources before allocating new ones on prep, guarded ray direction magnitude, and cleaned resources on tree loading failure; in QgPolyFilter.h and QgPolyFilter.cpp, added virtual destructors to base QgPolyFilter and derived classes (QPolyCreateFilter, QPolyUpdateFilter, QPolyMoveFilter) to free bu_ptbl containers bool_objs and move_objs eliminating memory leaks (CWE-401), guarded wp, checked contour existence before indexing contour 0, cleared wp->s_i_data = NULL on freeing unclosed polygon, and guarded bv_create_polygon return, wp->s_v, and wp->s_i_data across event handlers; in QgSelectFilter.h and QgSelectFilter.cpp, declared and implemented virtual destructor in QgSelectFilter to free selected_set with bu_ptbl_free (CWE-401), guarded sset and v in closest_obj_bbox and guarded ray direction unitization against division by zero, guarded v and v->gv_s in QgSelectBoxFilter::eventFilter and prevented division by zero when viewport dimensions are zero, removed debug logging spam, and ensured rt_clean_resource is called before destroying rtip and freeing resp/ap on all paths in QgSelectRayFilter; in QgSketchFilter.h and QgSketchFilter.cpp, added virtual destructor to base QgSketchFilter, guarded output parameters and verified sketch magic in screen_to_uv and snap_vertex_uv, guarded v and es against null in all event filters, verified valid ft_set_edit_mode function pointer before invocation, added bounds check on seg_idx against curve count and deg against RT_EDIT_MAXPARA in sketch_seg_sample, bounded all vertex indices against vert_count, guarded arc direction length against zero in sketch_arc_center_uv, bounded curr_seg and full-circle cs->end in QgSketchArcRadiusFilter, guarded event pointer in QgSketchCursorTracker, and safely extracted curr_seg without null dereference in QgSketchSetTangencyFilter. |
-
-
-
-| `SEC-0318` | `include/qtcad/QgGeomImport.h, include/qtcad/QgModel.h, src/libqtcad/QgGeomImport.cpp, src/libqtcad/QgModel.cpp, src/libqtcad/tests/qgmodel.cpp, src/libqtcad/tests/qgview.cpp, src/libqtcad/tests/qsketch.cpp` | `QgGeomImport.h:51,72-137; QgModel.h:343; QgGeomImport.cpp:27-75,78-153,157-246,325-370; QgModel.cpp:90-140,237-275,362-392,485-508,627-680,789-812,883-1025; tests/qgmodel.cpp:78-135,286; tests/qgview.cpp:63-89; tests/qsketch.cpp:247-276,346,454-490,1939,2027-2120` | Memory Leaks, Uninitialized Pointers, Division by Zero, Model Invariant Violations, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libqtcad Batch 76 (QgGeomImport.h, QgModel.h, QgGeomImport.cpp, QgModel.cpp, tests/qgmodel.cpp, tests/qgview.cpp, tests/qsketch.cpp, 1,323 lines): in QgModel.h, initialized rootItem to NULL to prevent uninitialized pointer dereference (CWE-457); in QgModel.cpp, fixed severe memory leak in destructor by iterating through and deleting all QgItem allocations in items before deleting container, freed empty_gvp, and safely deleted gedp->dbi_state before calling ged_close (CWE-401), deleted existing rootItem and cleared items on g_update reset, guarded mdl, gedp, and dbi_state in QgItem_cmp to prevent SIGSEGV crashes during sorting, added comprehensive null checks in QgItem constructor and path_hash, guarded mdl, gedp, dbi_state, and dp in update callbacks, guarded node and index in NodeRow, canFetchMore, and fetchMore, guarded qi, gedp, dbi_state, and ged_gvp in data(), validated argc and argv in run_cmd, verified sender QAction cast and guarded cnode in draw/erase actions, and added bounds and null checks in item expand/collapse handlers; in QgGeomImport.h and QgGeomImport.cpp, explicitly marked constructors and initialized all pointer members to NULL across ASCImportDialog, RhinoImportDialog, and STEPImportDialog (CWE-457), reparented dialog widgets to this for proper Qt memory ownership, deleted out_win in exec_console_app_in_window to prevent persistent dialog leaks (CWE-401), guarded bu_dir return before QString construction, added null checks on dialog UI controls in options(), and fixed critical logic flaw in gfile() where canceling an import dialog still executed the converter by checking dialog.exec() != QDialog::Accepted; in tests/qgmodel.cpp, tests/qgview.cpp, and tests/qsketch.cpp, guarded path_hashes against empty underflow and validated argc/argv with clean help handling in qgmodel, validated argc/argv with clean help handling and corrected argv[1] model path in qgview, and in qsketch validated argc/argv, added clean db_close on error exit paths, guarded nteeth <= 0 in sketch_create_gear to prevent division by zero (CWE-369), verified dp and dbip in QSketchEditWindow constructor, and guarded vertex/segment arrays and view in table population and screenshot methods. |
-| `SEC-0319` | `include/tclcad.h, include/tclcad/defines.h, include/tclcad/draw.h, include/tclcad/misc.h, include/tclcad/setup.h, src/libtclcad/tclcad_private.h, src/libtclcad/auto_path.c, src/libtclcad/cmdhist.c, src/libtclcad/command_io.cpp, src/libtclcad/eval.c, src/libtclcad/global.c, src/libtclcad/init.c, src/libtclcad/tests/check_itcl.cpp, src/libtclcad/tests/check_multi_interp.cpp, src/libtclcad/tests/check_tclcad_cmds.cpp` | `include/tclcad/draw.h:178; src/libtclcad/auto_path.c:45-139,201-255; src/libtclcad/cmdhist.c:75-92,94-111,115-184,188-213,217-276,281-302,306-329,333-360,365-401; src/libtclcad/command_io.cpp:48-55,113-132; src/libtclcad/eval.c:33-50,54-66; src/libtclcad/global.c:34-46,49-71,81-87; src/libtclcad/init.c:64-70,72-88,92-97,100-108,110-125,201-209,360-385; tests/check_itcl.cpp:34-45; tests/check_multi_interp.cpp:239-252; tests/check_tclcad_cmds.cpp:36-47` | Stack Out-of-Bounds Read, Memory Leaks, Resource Leaks, Uninitialized Memory, Path Detection Bugs, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libtclcad Batch 77 (include/tclcad.h, include/tclcad/defines.h, include/tclcad/draw.h, include/tclcad/misc.h, include/tclcad/setup.h, tclcad_private.h, auto_path.c, cmdhist.c, command_io.cpp, eval.c, global.c, init.c, tests/check_itcl.cpp, tests/check_multi_interp.cpp, tests/check_tclcad_cmds.cpp, 3,267 lines): in include/tclcad/draw.h, corrected header guard comment from TCLCAD_MISC_H to TCLCAD_DRAW_H; in auto_path.c, fixed critical path detection bugs where ITCL_LIBRARY and ITK_LIBRARY overrides appended filename (itcl.tcl/itk.tcl) and inserted file path instead of directory into auto_path, breaking subsequent file existence checks, fixed itk_set flag never being set to 1, eliminated capturing Tcl error message into paths when tcl_library is unset by replacing unchecked Tcl_Eval with Tcl_GetVar, and added _insert_unique_path helper to deduplicate path entries; in cmdhist.c, fixed severe memory leak of str on all exit paths of tclcad_cmdhist_history (CWE-401), closed fp before error returns to prevent file descriptor leaks, guarded against NULL argv and argv[0], guarded chop and argv[2] in tclcad_cmdhist_add, guarded chop, cho_curr, and BU_LIST boundaries in tclcad_cmdhist_prev/curr/next, guarded chop->cho_curr in cho_cmd before dereferencing, replaced redundant nested BU_LIST_NEXT calls with standard while (BU_LIST_WHILE(...)) dequeue loop in cho_deleteProc, and guarded objects and interp in cho_open/cho_open_tcl; in command_io.cpp, initialized interp to NULL and io_mode to 0 in tclcad_create_io_data eliminating uninitialized struct members (CWE-457), and guarded p->p in tclcad_delete_io_handler to prevent NULL pointer dereference in bu_process_fileno (CWE-476); in eval.c, validated interp and command, guarded args against NULL, and ensured individual argument strings are non-null in tclcad_eval and tclcad_eval_noresult; in global.c, guarded clientData against NULL in tclcad_interp_objects_delete, guarded interp and key in tclcad_interp_objects, and guarded state in tclcad_current_top; in init.c, guarded clientData, interp, and cmds in tclcad_init_state_delete, tclcad_init_state, and tclcad_register_cmds, guarded ctp and ct_func in wrapper_func, guarded filename in tclcad_source_file, verified non-null state in tclcad_init, and fixed critical out-of-bounds stack read (CWE-125) in tclcad_set_argv where !argv caused cast of a single-char stack variable to (const char **) passed into Tcl_Merge, handling empty/non-positive argc cleanly without invalid memory access; in tests/check_itcl.cpp, tests/check_multi_interp.cpp, and tests/check_tclcad_cmds.cpp, validated argv and argv[0] before bu_setprogname/Tcl_FindExecutable and added standard -h/-?/--help usage output with clean exit 0. |
-| `SEC-0320` | `src/libtclcad/view/view.h, src/libtclcad/view/arrows.c, src/libtclcad/view/autoview.c, src/libtclcad/view/axes.c, src/libtclcad/view/draw.c, src/libtclcad/view/faceplate.c, src/libtclcad/view/labels.c, src/libtclcad/view/lines.c, src/libtclcad/view/refresh.c, src/libtclcad/view/util.c` | `view.h:26-30,141-177; arrows.c:45-66,82-124,198-212,225-242,282-318; autoview.c:37-58,72-91,96-105; axes.c:41-86,181-197,281-394,456-476,492-517,527-537,595-634,699-725,730-750,757-785; draw.c:42-68,71-125,128-212,238-305,330-350,355-368; faceplate.c:43-65,89-100,128-140,167-179,206-218; labels.c:35-51,55-76,92-117,127-137,235-275,290-305,348-378; lines.c:45-78,92-132; refresh.c:37-60,136-140,149-163,165-177,180-190,195-212,220-230,238-265,270-282,285-296; util.c:41-71` | Memory Leaks, Stack Out-of-Bounds Reads, Uninitialized Memory, Missing Include Guards, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libtclcad Batch 78 (view.h, arrows.c, autoview.c, axes.c, draw.c, faceplate.c, labels.c, lines.c, refresh.c, util.c, 2,912 lines): in view.h, added include guards, C++ extern C wrappers, and extern specifier on to_data_lines; in util.c, guarded gdvp, gdvp->dmp, current_top, and current_top->to_interp in to_is_viewable (CWE-476), initialized result_int to 0 (CWE-457), and prevented Tcl_Obj reference count memory leak on evaluation error by restoring and decrementing saved_result before early return (CWE-401); in autoview.c, fixed out-of-bounds argv[1] read in to_autoview by validating argc < 2 || argc > 3 (CWE-125), guarded tvd, tvd->gedp, current_top, and interp in to_autoview_view, and guarded top, top->to_gedp, and views in to_autoview_all_views; in arrows.c, fixed severe memory leak in points parsing where odd point count returned BRLCAD_ERROR without calling Tcl_Free((char *)av) (CWE-401), guarded current_top->to_gedp->u_data before disabling refresh_on, guarded gedp, gdvp, argv, and interp across go_data_arrows, to_data_arrows, and to_data_arrows_func, and added negative bounds validation on line_width, tip_length, and tip_width; in axes.c, guarded to_axes against argc < 3, NULL gedp, gdvp, gasp, and argv[2], validated non-negative values for axes_size, line_width, tick_interval, tick_length, tick_major_length, and ticks_per_major, guarded current_top, gdvp, and interp across go_data_axes and to_data_axes, and guarded gdvp->gv_s in to_model_axes, go_view_axes, and to_view_axes preventing NULL pointer crashes on uninitialized views (CWE-476); in draw.c, guarded hash table, udata, s_fpath, and dbip in key_matches_paths, guarded tvd->gedp, gedp->u_data, gedp->dbip, and sp->s_os in go_draw_solid, guarded gedp, ged_dl, and sp->s_os in go_draw_dlist, checked gdvp->dmp in go_draw, and in to_edit_redraw guarded dbip, ged_dl, verified !BU_LIST_IS_HEAD before dereferencing sp->s_os, and ensured last_gdlp is not head before dequeue and insert; in faceplate.c, guarded gedp, gdvp, and gdvp->gv_s in to_faceplate, and added RGB color range validation [0, 255] across center_dot, prim_labels, view_params, and view_scale; in labels.c, implemented _free_data_labels helper to safely free all allocated label strings and point buffers on Tcl_SplitList parsing failure, eliminating memory leaks on malformed input lists (CWE-401), guarded current_top, gedp, gdvp, and interp in go_data_labels, to_data_labels, and to_data_labels_func, validated non-negative label size, and in to_prim_label guarded current_top, gedp, and argv, prevented negative list size corruption on argc == 0, and safely reset list when argc == 1; in lines.c, guarded current_top, gedp, gdvp, and argv across go_data_lines and to_data_lines; in refresh.c, guarded gedp, gdvp, dbip, gdvp->gv_s, and current_top in go_refresh_draw, eliminated duplicate dm_draw_viewobjs call, guarded gdvp->u_data and dmp in go_refresh, guarded gdvp, top, and views in to_refresh_view and to_refresh_all_views, guarded gedp and current_top in to_refresh, to_refresh_all, and to_refresh_on, and added NULL checks in to_handle_refresh and to_refresh_handler. |
-| `SEC-0321` | `src/libtclcad/bu.c, src/libtclcad/fbserv.c, src/libtclcad/rt.c, src/libtclcad/tkImgFmtPIX.c, src/libtclcad/wrapper.c` | `bu.c:52-56,97-157,172-205,219-251,257-260,333-350,356-373,380-408,414-420,424-441; fbserv.c:45-50,78-98,103-113,116-145,148-156,158-170,173-188,191-201,260-293,297-308,310-322,347-383; rt.c:80-110,114-159,170-200,204-240,244-267,303-336,345-369,378-402,413-433,444-502,516-583,587-621,631-699,702-707,715-737,741-751,755-778,782-792; tkImgFmtPIX.c:148-170,210-286,308-350; wrapper.c:38-83,103-201,210-215,220-234,250-316,368-408` | Type Confusion, Double Free, Premature Object Deallocation, Memory Leaks, Heap Buffer Underflow, Division by Zero, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libtclcad Batch 79 (bu.c, fbserv.c, rt.c, tkImgFmtPIX.c, wrapper.c, 2,388 lines): in tkImgFmtPIX.c, fixed critical type confusion vulnerability in FileWritePIX where Tcl_Obj * format was passed directly into Tcl_AppendResult (which expects const char * strings), causing illegal pointer dereferences and application crashes (CWE-843), guarded format against NULL in FileReadPIX to prevent NULL pointer dereference in Tcl_GetStringFromObj (CWE-476), checked widthPtr and heightPtr before writing in FileMatchPIX, validated image dimensions and pixelSize in FileWritePIX, added integer overflow protection on fileWidth * pixelSize pitch calculation, bounded srcX and srcY, and matched bu_malloc/bu_free allocation labels; in rt.c, eliminated critical double-free / premature object deallocation bugs in tcl_obj_to_int_array and tcl_obj_to_fastf_array where Tcl_DecrRefCount was erroneously called on list elements returned by Tcl_ListObjGetElements (corrupting Tcl object refcounts and causing use-after-free and crash when lists are accessed or freed, CWE-416/CWE-415), fixed severe memory leaks in tcl_list_to_int_array and tcl_list_to_fastf_array by properly incrementing and decrementing the temporary Tcl_Obj wrapper (CWE-401), eliminated division by zero in tclcad_rt_parse_ray by verifying direction vector magnitude with ZERO() macro before unitizing (CWE-369), guarded against array out-of-bounds reads on xyz in tclcad_rt_pr_cutter, replaced undefined variable rayp with NULL in RT_HIT_NORMAL, replaced sprintf/sscanf/atoi with snprintf/bu_sscanf across all command wrappers, and added comprehensive NULL checks on clientData, interp, and argv; in wrapper.c, fixed heap buffer underflow (CWE-125) in to_more_args_func where trimming an empty first element decremented ac_more to 0, causing avmp[ac_more-1] to access avmp[-1], eliminated memory leaks in to_view_func_common and to_dm_func by allocating av only after argument validation, help checks, and view lookup, guarded gdvp->gv_s and gdvp->dmp before accessing view state and setting perspective, guarded tgd and current_top->to_interp, and replaced bu_vls_addr with bu_vls_cstr; in fbserv.c, guarded clientData, fbslp, fbsp, and string pointers in comm_error and new_client_handler, added index bounds checks (0 <= i/sub < MAX_CLIENTS) in open/close client handlers and Windows IPC handlers, validated port range [0, 65535], and replaced unsafe sprintf with snprintf; in bu.c, guarded ctp and ct_func in lwrapper_func, guarded interp and argv in tcl_bu_get_value_by_keyword, prevented string truncation underflow on short lists, replaced raw sscanf with bu_sscanf in color converters, guarded dirkey in _tclcad_bu_dir_print, checked conv_factor with ZERO() macro in tcl_bu_units_conversion, and replaced all bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0322` | `src/libtclcad/bn.c, src/libtclcad/fb.c` | `bn.c:38-42,126-170,185-230,240-275,340-420,440-520,530-580,600-680,690-750,770-850,860-930,940-1010,1020-1090,1100-1170,1180-1250,1260-1374; fb.c:60-95,110-140,165-220,245-290,310-380,410-470,500-560,580-640,660-720,740-800,820-890,900-960,980-1040,1060-1150` | Out-of-Bounds Reads, Memory Leaks, Parameter Swaps, Division by Zero, Integer Overflow / Dimension Guards, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libtclcad Batch 80 (bn.c, fb.c, 2,535 lines): in fb.c, fixed critical out-of-bounds argument vector read in fbo_clear_tcl where argc == 3 erroneously accessed argv[6] instead of argv[2], causing invalid memory reads and segmentation crashes (CWE-125); added integer overflow protection and dimension clamping (<= 32768) in fbo_cell_tcl and fbo_rect_tcl preventing excessive memory allocation and heap buffer overflow (CWE-190/CWE-789); validated rectangle bounds against framebuffer dimensions (xmin + width <= fb_w and ymin + height <= fb_h) in fbo_cell_tcl and fbo_rect_tcl preventing memory corruption outside framebuffer bounds (CWE-125/CWE-787); validated port range (<= 65535) in fbo_listen_tcl and to_listen; corrected return code mapping in fbo_cmd from raw BRLCAD_ERROR to TCL_ERROR; added comprehensive NULL guards on gdvp, tvd, fbop, fbp, interp, gedp, and argv across fbo_coords_ok, fbo_deleteProc, fbo_close_tcl, fbo_clear_tcl, fbo_cursor_tcl, fbo_getcursor_tcl, fbo_refresh_tcl, fbo_listen_tcl, fbo_pixel_tcl, fbo_cell_tcl, fbo_flush_tcl, fbo_getheight_tcl, fbo_getwidth_tcl, fbo_getsize_tcl, fbo_rect_tcl, fbo_configure_tcl, to_fbs_callback, to_close_fbs, to_open_fbs, to_set_fb_mode, and to_listen; replaced unsafe sscanf with bu_sscanf and bu_vls_addr with bu_vls_cstr; in bn.c, fixed swapped parameter bug in tclcad_bn_eigen2x2 where matrix element b was parsed into c and c into b; prevented division by zero in tclcad_bn_mat_lookat by verifying hypot_xy with ZERO() macro before passing to bn_mat_lookat (CWE-369); corrected broken logic in bn_cmd_noise_slice which misread argv indices, discarded loop computations, and fell through to invalid noise types, replacing it with proper index reading, dimension validation (<= 4096), and returning the formatted noise list; fixed memory leak in tclcad_bn_mat_arb_rot on double conversion failure by routing to error label (CWE-401); added missing error messages on bn_decode_vect failures in vector functions; replaced unsafe atof with Tcl_GetDouble in bn_cmd_noise_perlin and bn_cmd_noise; replaced sscanf with bu_sscanf; guarded snprintf buffer sizes; and added comprehensive NULL checks on interp, argv, and clientData across all 35 math command wrappers. |
-| `SEC-0323` | `src/libtclcad/polygons.c, src/libtclcad/dm.c` | `polygons.c:45-80,110-180,210-260,310-360,480-530,620-680,810-860,1020-1080,1210-1260,1350-1410,1520-1580,1710-1760; dm.c:140-205,210-240,260-355,380-415,430-485,510-575,600-645,670-800,830-870,900-925,970-1015,1020-1050,1055-1077,1080-1110,1120-1155,1160-1190,1205-1255,1280-1335,1340-1375,1390-1455,1470-1520,1535-1580,1590-1640,1655-1680,1695-1730,1745-1785,1790-1835,1840-1890,1900-1940,1950-2020,2030-2070,2080-2110,2140-2180,2190-2225,2235-2270,2280-2335,2350-2375,2410-2430,2440-2460,2480-2525,2530-2575,2600-2660,2695-2850,2865-2900,2905-2935,2940-2955,3035-3045` | Use-After-Free, Memory Leaks, Buffer Underflow / Out-of-Bounds Reads, Wrong Argument Indexing, Port Range Validation, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libtclcad Batch 81 (polygons.c and dm.c, 4,781 lines): in dm.c, fixed critical use-after-free vulnerability in fb_cmd_common_file_size where dynamic string zerr was passed to Tcl_SetResult with TCL_STATIC and immediately freed with bu_free, leaving Tcl pointing to freed heap memory (CWE-416); fixed critical out-of-bounds argument vector read in dmo_logfile_tcl where argc == 3 erroneously accessed argv[3] instead of argv[2] (CWE-125); guarded out-of-bounds vector reads in error and help handlers across 28 display manager command callbacks; guarded vector index decodes in dmo_parseAxesArgs, dmo_parseDataAxesArgs, and dmo_parseModelAxesArgs; added port range validation (<= 65535) in dmo_listen_tcl; mapped return codes in dmo_cmd from BRLCAD_OK to TCL_OK/TCL_ERROR; replaced sprintf with snprintf; replaced raw atof/atoi with sscanf/bu_sscanf; replaced all bu_vls_addr calls with bu_vls_cstr; added comprehensive NULL checks on dmop, interp, dmo_dmp, and dmo_dmp->i across all 38 display manager routines; in polygons.c, implemented _free_partial_poly and _free_partial_polygon_state cleanup helpers to eliminate severe memory leaks on parse/split failures (CWE-401); freed contour_av on replace_poly success; freed allocated bg_polygon in import; fixed off-by-one out-of-bounds indexing in target_poly (CWE-125); prevented size_t underflow in clip when num_polygons == 0 and state corruption when num_polygons < 2; checked bg_clip_polygon result for NULL; guarded gdvp->dmp, current_top->to_gedp->u_data, current_top->to_interp, and gv_s across all polygon commands; and replaced bu_vls_addr with bu_vls_cstr. |
-| `SEC-0324` | `src/libtclcad/mouse.c` | `mouse.c:60-70,85-95,110-120,230-310,320-380,395-440,455-500,530-610,630-655,700-725,770-795,840-865,910-935,970-1040,1050-1120,1130-1170,1260-1360,1380-1490,1510-1590,1660-1730,1740-1840,1890-1980,2000-2080,2100-2215,2250-2275,2285-2310,2320-2390,2400-2425,2435-2460,2475-2530,2540-2565,2575-2600,2615-2715,2730-2755,2765-2790,2805-2890,2995-3050,3060-3135,3150-3225,3255-3315,3325-3400,3415-3450,3470-3550,3560-3645,3660-3740,3750-3830` | Memory Leaks, Uncomputed Model Coordinates Logic Bug, Buffer Overflow / Missing NULL-terminator, Division by Zero, Uninitialized Pointers, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libtclcad Batch 82 (mouse.c, 3,594 lines): fixed critical logic bug in to_mouse_otranslate where model point was declared with VINIT_ZERO and never transformed by the inverse rotation matrix before printing into tran_x_vls, tran_y_vls, tran_z_vls and passing to ged_exec_otranslate (which caused all mouse translations to pass 0, 0, 0); eliminated persistent memory leaks of brep_name and bindings bu_vls on failure paths in to_mouse_brep_selection_append and to_mouse_brep_selection_translate (CWE-401); eliminated memory leaks of joint_name and bindings bu_vls on failure paths in to_mouse_joint_select and to_mouse_joint_selection_translate (CWE-401); fixed buffer allocation and missing NULL terminator in to_mouse_move_bot_pnts where allocating ac elements resulted in av[ac-1] being overwritten by the loop and leaving no NULL termination (CWE-125/CWE-787), allocating ac + 1 and properly terminating; fixed uninitialized gedp->ged_gvp pointer dereference and wrong view rotation matrix inversion in to_mouse_brep_selection_append, to_mouse_joint_select, to_mouse_poly_circ_func, to_mouse_poly_ell_func, to_mouse_poly_rect_func, and to_data_scale (CWE-476); prevented division by zero across to_mouse_constrain_trans, to_mouse_move_arb_edge, to_mouse_move_arb_face, to_mouse_move_bot_pnt, to_mouse_move_bot_pnts, to_mouse_move_pnt_common, to_mouse_oscale, to_mouse_otranslate, TO_COMMON_MOUSE_SCALE, to_mouse_pscale, to_mouse_ptranslate, and to_mouse_trans by clamping width <= 0 to 1 before calculating inv_width (CWE-369); corrected error messages in to_mouse_constrain_rot and to_mouse_constrain_trans on invalid axis; guarded wdbp returned from wdb_dbopen in to_mouse_move_bot_pnt; guarded gdvp->dmp in to_mouse_rect before calling dm_get_height; guarded current_top, current_top->to_interp, current_top->to_gedp, and u_data across all callback executions and polygon functions; and modernized all (~38) bu_vls_addr calls to bu_vls_cstr. |
-| `SEC-0325` | `src/libtclcad/commands.c` | `commands.c:30-40,85-115,140-155,170-195,250-280,310-330,340-360,540-565,650-675,700-725,830-860,1110-1135,1190-1225,1245-1270,1315-1340,1400-1425,1460-1490,1540-1580,1650-1685,1770-1815,1900-1940,2010-2050,2130-2165,2215-2240,2290-2340,2460-2495,2570-2640,2680-2715,2760-2830,2870-2900,3110-3160,3320-3360,3410-3445,3550-3580,3690-3740,3810-3840,3920-3950,4040-4075,4160-4190,4280-4320,4410-4445,4550-4585,4670-4710,4800-4840,4950-5030,5040-5140,5170-5240,5260-5300,5320-5360,5370-5385,5390-5415,5430-5450,5480-5525,5540-5585,5600-5645,5660-5705,5750-5795,5810-5845,5860-5895,5910-5940,5960-6010,6020-6045,6050-6075,6090-6130,6145-6180,6195-6225,6235-6285,6295-6340,6350-6390,6400-6450,6460-6545,6555-6600,6610-6655,6665-6700,6705-6715,6720-6730,6735-6750,6755-6765,6770-6840` | Inverted Logic / Crasher, Resource Leaks, Buffer Overflow / Unchecked sprintf, Division by Zero, Type Confusion, Memory Leaks, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libtclcad Batch 83 (commands.c, 6,748 lines): completing all 31 files of src/libtclcad (100% complete): fixed critical inverted logic bug in to_pix where dm_make_current returning BRLCAD_OK (0) was treated as failure via !make_ret and aborted; fixed persistent resource leaks of PNG write structures in to_png on error and exit paths by properly invoking png_destroy_write_struct; fixed memory leak of callback_cmd bu_vls in to_rt_end_callback_internal; fixed severe buffer overflow vulnerability and memory leak in to_dplot where fixed stack buffer av[256] lacked bounds check on split list length, had an off-by-one indexing error on NULL terminator, and leaked memory on Tcl_Eval failure; fixed type confusion bug in free_path_edit_params by using correct struct dm_path_edit_params; fixed division-by-zero vulnerabilities in to_bounds, to_data_move_func, to_data_pick_func, to_view2screen, and to_vslew by validating clip boundaries and clamping non-positive width/height before computing scale factors and aspect ratios; prevented negative array indexing in to_make, to_mirror, to_bot_edge_split, and to_bot_face_split by enforcing argument count bounds; preserved ged_exec command output in to_bot_edge_split and to_bot_face_split before invoking redraw; replaced unchecked sprintf with snprintf in to_vmake; added NULL pointer guards across all commands validating gedp, gdvp, dmp, dbip, current_top, to_gedp, and to_interp; and modernized all (~60) bu_vls_addr calls to bu_vls_cstr. |
-| `SEC-0326` | `src/libicv/asciiart.cpp, src/libicv/bw.c, src/libicv/color_space.c, src/libicv/crop.c, src/libicv/dpix.c, src/libicv/encoding.c, src/libicv/icv_private.h, src/libicv/operations.c, src/libicv/pix.c, src/libicv/ppm.c, src/libicv/stat.c` | `asciiart.cpp:34-51; bw.c:33-100,104-177,180-215; color_space.c:38-78,81-194; crop.c:41-86,98-167; dpix.c:63-108,112-161,165-204,207-237,240-275; encoding.c:33-51,55-115; icv_private.h:20-30; operations.c:40-59,61-81,83-102,104-126,128-148,150-179,181-210,212-241,244-273,275-314,316-385; pix.c:34-67,70-100,103-167,170-211; ppm.c:36-78,81-144,147-196,214-226,228-291; stat.c:31-45,49-74,78-102,106-129,133-148,152-176,180-209,213-242,246-277,281-297` | Division by Zero, Premature Dereference / NULL Pointer Crashes, Integer Overflow on Dimensions & Buffers, Out-of-Bounds Reads, and Unhandled Floating-Point NaNs | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libicv Batch 84 (asciiart.cpp, bw.c, color_space.c, crop.c, dpix.c, encoding.c, icv_private.h, operations.c, pix.c, ppm.c, stat.c, 2,400 lines): in stat.c, fixed critical premature NULL dereference in icv_hist where img->width and img->data were accessed prior to the ICV_IMAGE_VAL_PTR(img) check (CWE-476); eliminated multiple division-by-zero vulnerabilities in icv_mean, icv_var, and icv_skew when image width/height are zero (CWE-369); guarded against NULL bins, zero n_bins, and zero channels across all statistical routines; prevented out-of-bounds reads and NaN propagation in icv_max, icv_min, and icv_sum; in operations.c, fixed premature NULL dereference in icv_add_val by checking ICV_IMAGE_VAL_INT before accessing img->data; prevented division-by-zero crashes in icv_divide_val and icv_divide; fixed multi-channel desynchronization / out-of-bounds corruption in icv_saturate by advancing by img->channels instead of hardcoded 3; guarded img dimensions and scale factors against division by zero in icv_fit; in crop.c, fixed division-by-zero crash in icv_crop when img->channels is zero; added integer overflow checks on row byte calculations in icv_crop_rect and icv_crop (CWE-190); in color_space.c, guarded against out-of-bounds reads in icv_rgb2gray when channels < 3 (CWE-125); added integer overflow protection on dimensions and buffer allocations in icv_gray2rgb and icv_rgb2gray; in encoding.c, guarded against NULL data and integer overflows in icv_uchar2double and icv_data2uchar, and prevented division-by-zero and domain errors on negative or zero gamma; in dpix.c, safely handled NaNs/Infs during normalization to prevent divide-by-zero and infinite loops, replaced raw POSIX read/write with stdio fread/fwrite to eliminate short-read and buffering bugs, and added integer overflow validation on sample counts; in pix.c and bw.c, guarded against NULL data conversion pointers, checked dimensions against size_t overflow, eliminated truncation from int casts, and checked realloc limits on stream reads; in ppm.c, clamped RGB float values before lrint to avoid undefined integer conversions, replaced sprintf with snprintf for PPM headers (CWE-120), guarded against numeric overflow in parse_ppm_int, and validated buffer limits in ppm_read_mem; in asciiart.cpp, validated image pointer, data, channels, dimensions, and brightness multiplier; and in icv_private.h, properly positioned include guards. |
-| `SEC-0327` | `src/libicv/fileformat.c, src/libicv/filter.c, src/libicv/jpeg.c, src/libicv/pixcii.hpp, src/libicv/rot.c, src/libicv/size.c` | `fileformat.c:179,211,273-286,341,380-401,407-427,647-653,683-690; filter.c:38-40,133-135,322-345,385-405,455-480; jpeg.c:54-55,80-84,117-120,141-145,171-177,212-215,238-241,250-255,263-268,284-289,310-313,332-337,358-363,383-386; pixcii.hpp:78-96,125-157,162-171; rot.c:98-115,130-136,150-153,292-295,355-385,392; size.c:181-190,220-247,309-354,368-395,401-411` | Division by Zero, Resource & Memory Leaks, NULL Pointer Dereference, Setjmp/Longjmp Undefined Behavior, Integer Overflow on Dimensions & Buffers, and Out-of-Bounds Access | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libicv Batch 85 (fileformat.c, filter.c, jpeg.c, pixcii.hpp, rot.c, size.c, 2,925 lines): in fileformat.c, fixed memory leak of ofilename on validation failure and fopen error paths in icv_write (CWE-401); prevented closing stdin on unsupported format; guarded against NULL bif->data, 0 width/height/channels, and integer overflows in icv_write, icv_write_mem, icv_writeline, and icv_writepixel; added NULL data check in icv_zero and invalidated magic in icv_destroy to prevent use-after-free; in jpeg.c, declared setjmp-lived pointers volatile to eliminate undefined behavior across longjmp; checked icv_data2uchar return values against NULL before scanline processing; eliminated memory leak of libjpeg buffer mem_buf on write failure; guarded dimensions against 0/invalid sizes and checked double-converted buffer allocations in jpeg_read and jpeg_read_mem; in rot.c, guarded argc/argv before calling bu_setprogname; validated pixel size, square size, and width/height options with strtol; set stdout to binary mode for piping binary image streams on Windows; added integer overflow checks on scanline bytes and buffer allocations in arbrot and icv_rot; hardened arbrot coordinates to size_t; supported negative rotation angles via !ZERO(angle); in size.c, guarded icv_image_size against NULL widthp/heightp and zero unit conversions; guarded shrink_image and under_sample against NULL image data, 0 channels, and integer overflows on realloc; removed truncating int casts on dimensions; prevented division by zero in resize_output_valid; in filter.c, validated kernel and offset pointers in get_kernel and get_kernel3; guarded icv_filter, icv_filter3, and icv_fade against NULL data, 0 channels/dimensions, NaN fraction multipliers, and integer overflows; and in pixcii.hpp, guarded against empty ascii character maps, handled NaN brightness boosts, converted signed int pixel indexing to size_t with overflow guards, and clamped double pixel color values safely. |
-| `SEC-0328` | `src/libicv/PImgHash.cpp, src/libicv/PImgHash.h, src/libicv/diff.cpp, src/libicv/diff_approx.cpp, src/libicv/png.cpp` | `PImgHash.cpp:51-57,134-137,216-224,241-255,265-285; PImgHash.h:66,81,87,130,145,151,164-190,224-239,287-325; diff.cpp:177-185,193,210-215,320-333,358-370,408-445,459-482,492,525; diff_approx.cpp:51-70,75-81,135-146,176-177,217; png.cpp:198-203,219,228-232,287-302,320-324,346-350,392,459-468,523-529,548,563,586-590,668-675,685` | Division by Zero, Setjmp/Longjmp Undefined Behavior, Resource & Memory Leaks, Buffer Bounds & Out-of-Bounds Reads, Integer Overflow on Dimensions & Buffers, and Undefined Float-to-Int Conversions | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libicv Batch 86 (PImgHash.cpp, PImgHash.h, diff.cpp, diff_approx.cpp, png.cpp, 2,233 lines): in png.cpp, validated bif pointer, bif->data, dimensions, and channels in png_write and png_write_mem; declared setjmp-spanning local pointers volatile to prevent undefined behavior across longjmp (CWE-398); eliminated memory leak of converted pixel buffer data on write errors and used icv_destroy in setjmp handlers to prevent leaks of bif->render_info (CWE-401); prevented integer overflow in user_read_data bounds calculation (CWE-190); validated rowbytes against width * 3 in png_read to prevent heap out-of-bounds writes (CWE-122); validated rowbytes and buffer allocations in png_read and png_read_mem; in diff.cpp, guarded write_nirt_shots_for_ri against division by zero on aspect, width, height, and viewsize (CWE-369); guarded icv_diff_nirt_shots against NULL data, mismatched channel counts (< 3), and buffer allocation overflow; prevented heap out-of-bounds reads in icv_diff by indexing per-image channel counts instead of hardcoded 3 and guarded against signed integer overflow on off_by_many; validated 3-channel input, integer overflow on dimensions, and clean buffer freeing in icv_diffimg; in diff_approx.cpp, made load_icv static, guarded against NULL data, unsigned underflow when rows == 0, and integer overflow; validated image pointers and dimensions in pdiff_dct; guarded ssim_calc against NULL data, zero dimensions/channels, and sanitized non-finite NaN/Inf pixel values; in PImgHash.cpp and PImgHash.h, clamped float pixel values to [0.0, 1.0] with NaN check in convert_pix to prevent undefined float-to-int cast conversions (CWE-190/CWE-681); guarded DCTHasher::apply against zero dimensions; prevented out-of-bounds vector writes in tile_size when b == 0 or j >= b; guarded Preprocess::start and Preprocess::stop against division by zero and out-of-bounds histogram access; prevented NULL pointer dereferences and integer overflows in Image class; and guarded resize_row, resize, and add_row against division by zero on tile size. |
-| `SEC-0329` | `src/libicv/anim.cpp, src/libicv/apngmini.hpp, src/libicv/rle.cpp, src/libicv/rle.hpp` | `anim.cpp:115-155,238-265,286-290,320-341,446-494,519-523,539-550,589-638; apngmini.hpp:539-548,577-612,647-650,700-705,760-766,775-790,1060-1085,1122-1135,1152-1158,1322-1335,1346-1350,1423-1433; rle.cpp:42-47,222-230,246-254,277-289,301-309,327-338; rle.hpp:235-245,941-965,983-990,1015-1020,1050-1055,1096-1100,1133-1138` | Integer Overflow on Dimensions & Buffers, Unsigned Underflow, Heap Buffer Overflows & Overreads, CPU Exhaustion DoS, Undefined Float Conversions, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libicv Batch 87 (anim.cpp, apngmini.hpp, rle.cpp, rle.hpp, 3,778 lines): in anim.cpp, validated bif pointer, bif->data, dimensions, and channels in icv_to_apng preventing heap out-of-bounds reads on unexpected channel layouts (CWE-125); clamped float pixel values in float_to_u8 with std::isfinite check to prevent undefined float-to-uint8 cast conversions (CWE-190/CWE-681); guarded read_mjpeg_avi against chunk size underflow and unbounded memory allocation (CWE-191/CWE-400); guarded write_mjpeg_avi against 32-bit integer arithmetic overflows on data rate, frame bytes, and index blocks; validated image pointers and non-empty dimensions across icv_anim_write, icv_anim_add_frame, icv_anim_insert_frame, icv_anim_replace_frame, and icv_anim_get_frame; in apngmini.hpp, enforced maximum pixel limits, non-zero dimensions, and rowbytes buffer bounds in LibpngBackend decode/encode routines; guarded write_chunk against size_t overflow; ensured valid pixel bounds and buffer sizes before cropping and over-compositing; eliminated unsigned underflow and heap buffer corruption during background disposal in Animation::compose when frame.x_offset >= canvas_width (CWE-191/CWE-122); guarded chunk peeking against integer overflow and enforced minimum 4-byte length on fdAT chunks; capped maximum file read size to 512MB in read_file; in rle.cpp, sanitized double-to-uint8 conversions in dbl_to_u8 against non-finite NaN/Inf values; validated image data and dimensions in rle_write and rle_write_mem; guarded memory stream buffer allocation; in rle.hpp, implemented a per-row opcode counter in Decoder::read to prevent CPU exhaustion DoS attacks (CWE-400); clamped scanline and pixel skips to image boundaries to prevent unsigned integer wrap-around and out-of-bounds buffer writes (CWE-122/CWE-190); validated image buffer capacity before colormap transformations; ensured non-null buffer and positive dimensions in write_rgb; and prevented integer overflow in MemReadStream::tell. |
-| `SEC-0330` | `src/libicv/tests/apngmini.cpp, src/libicv/tests/demo.c, src/libicv/tests/fileformat.c, src/libicv/tests/icv_diff_test.c, src/libicv/tests/icv_png_json_test.cpp, src/libicv/tests/pimghash.cpp, src/libicv/tests/rle.cpp, src/libicv/tests/robustness.c` | `apngmini.cpp:45-55,83-93,138-144,157-165; demo.c:49-75,104-106,120-122,153-163,187-195,220-235,240-252; fileformat.c:48-58,92-95,151-155; icv_diff_test.c:63-75,85-93,112-118,137-145,238-245,304-320,333-339,392-405,486-499,532-550,572-576; icv_png_json_test.cpp:94-105,131-185,204-208,319-323,412-416,462-466; pimghash.cpp:48-52,222-232,235-240; rle.cpp:104-125,134-138,187-210,686-695,738-745,760-770,1605-1610; robustness.c:60-148,654-690,1111-1185,1211-1220,1339-1342` | Memory Management Mismatch, Unchecked Vector & Buffer Bounds, Temporary File Leaks, Unbounded Allocation & Integer Overflows, Division by Zero, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libicv Batch 88 (tests/apngmini.cpp, tests/demo.c, tests/fileformat.c, tests/icv_diff_test.c, tests/icv_png_json_test.cpp, tests/pimghash.cpp, tests/rle.cpp, tests/robustness.c, 4,882 lines, completing src/libicv to 100%): in rle.cpp, resolved allocator mismatch (CWE-762) by changing create_test_image from libc calloc to bu_calloc to match bu_free in free_test_image; guarded against arithmetic overflow in image data size calculation; added null data checks in pixels_match; ensured temporary test files in rle_roundtrip, test_write_invalid_channels, and test_write_oversized_dimensions are deleted on error and completion; and exercised null file stream handling in test_invalid_file; in apngmini.cpp, validated frame dimensions in make_frame to prevent integer overflow and excessive allocation; verified vector bounds before indexing composed frame pixels to prevent out-of-bounds reads (CWE-125); and ensured roundtrip temporary files are deleted via RAII cleanup; in demo.c, validated image creation and buffer allocations in demo_rgb and prevented division by zero when dimensions sum to zero; guarded against dimension overflow and null pointers in clone_image; added null checks across demo_memory_io, demo_file_io, demo_crop_filter_ascii, and demo_diffs; and ensured temporary animation test files are cleaned up unconditionally; in fileformat.c, validated image data allocation in make_pixel and guarded path parameter in write_auto_pix; in icv_diff_test.c, validated dimensions and arithmetic overflow in make_solid; added null data checks in test_icv_diff_counts and test_icv_diffimg_colors; and validated render_info pointers before dereferencing in test_png_metadata_roundtrip, test_diff_render_info, and test_nirt_shots; in icv_png_json_test.cpp, validated dimensions and data pointers in make_solid; capped maximum file read size to 100MB in png_read_text_chunk; guarded chunk parsing against 32-bit integer overflow; and verified render_info allocations before dereferencing; in pimghash.cpp, sanitized floating-point comparisons with std::isfinite in nearly_equal; and checked vector size before indexing hash bytes in test_hashing; in robustness.c, validated dimensions and memory allocations across all make_* helper functions; prevented division by zero in make_unit_rgb; checked statistics pointers (minv, maxv, sumv, meanv, bins, mode, median, var, skew) for null before access in test_crop_filters_and_stats; and guarded metadata and frame allocations in test_ascii_render_info_and_diff and test_animation_frame_management; and across all test harnesses, safely validated argc > 0 && argv && argv[0] before calling bu_setprogname. |
-| `SEC-0331` | `src/libnmg/bool.c, src/libnmg/ck.c` | `bool.c:165-215,220-245,260-290,440-475,540-580,660-685,730-845,860-930; ck.c:60-700,708-735,740-755,760-833,870-882,885-905,908-940,976-994,1008-1028,1031-1082,1104-1149,1159-1205,1217-1244,1285-1339,1357-1375,1394-1493,1506-1540,1551-1563,1577-1627,1643-1678,1682-1710` | Buffer Overlapping Undefined Behavior, Stack & Heap Buffer Truncation / Overflow, Division by Zero, Unsigned Integer Underflow, Memory Leaks, Dangling / Unchecked Pointers, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libnmg Batch 89 (bool.c, ck.c, 2,801 lines): in ck.c, resolved critical undefined behavior (UB) and buffer corruption across all topological consistency check routines (nmg_ck_e, nmg_ck_vu, nmg_ck_eu, nmg_ck_lg, nmg_ck_l, nmg_ck_lu, nmg_ck_fg, nmg_ck_f, nmg_ck_fu) by replacing unsafe fixed-length heap allocations and overlapping snprintf calls (where the destination buffer was also passed as the %s source argument) with dynamically sized struct bu_vls formatting; fixed CWE-369 division-by-zero vulnerability in nmg_ck_eg_verts by guarding edge direction magnitude against zero before calling VUNITIZE; eliminated NULL pointer dereferences when logging or checking without parent strings by guarding string pointers; in nmg_ck_lueu, fixed backward/forward edge logging mismatch bug, corrected routine name typo in logs, and guarded circular list navigation against empty list heads; hardened all 17 nmg_v* validator routines (nmg_vvg, nmg_vvertex, nmg_vvua, nmg_vvu, nmg_veg, nmg_vedge, nmg_veu, nmg_vlg, nmg_vloop, nmg_vlu, nmg_vfg, nmg_vface, nmg_vfu, nmg_vsshell, nmg_vshell, nmg_vregion, nmg_vmodel) with comprehensive NULL checks, magic identification guards, and coordinate validation; in nmg_eu_2s_orient_bad, guarded radial and mate pointers during circular traversal; in nmg_ck_closed_surf and nmg_ck_closed_region, checked pointer validity before recursive verification; in nmg_ck_v_in_2fus and nmg_ck_vs_in_region, ensured vertex geometry and model pointers are valid and sanitized visited array allocation against negative or zero maxindex; in bool.c, guarded nmg_plot_open_edges against NULL magic, checked vertex coordinate pointers, and ensured plot_file_name bu_vls is unconditionally freed at exit; validated model and shell pointers in nmg_has_dangling_faces; eliminated unsigned integer underflow vulnerability in nmg_kill_anti_loops during loop deletion; safely bounded buffer formatting in nmg_show_each_loop; guarded edgeuse mate pointers in nmg_classify_shared_edges_verts; removed obsolete #if 0 dead code block; ensured bounding boxes exist before disjoint tests in nmg_bool; and guarded model maxindex against non-positive sizes before calloc/memcpy in boolean evaluation. |
-| `SEC-0332` | `src/libnmg/class.c, src/libnmg/copy.c` | `class.c:337-343,366-390,485-584,588-592,648-656,860-935,1292-1410,1546-1570,1630-1725,1780-1825,2032-2135,2345-2440; copy.c:38-51,54-72,77-107,110-130,132-192,195-247,250-278,280-320,323-355,357-390,393-425,427-447,449-479,482-566,574-590,593-614,617-680,682-727,729-745,748-815,821-869` | Off-by-One Heap Buffer Overflows, Union Type Confusion, Division by Zero, Broken Radial Circular Loops, Dead Code Blocks, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libnmg Batch 90 (class.c, copy.c, 3,392 lines): in copy.c, resolved critical off-by-one heap buffer overflow in nmg_clone_model by allocating maxelem = original->maxindex > 0 ? (size_t)original->maxindex + 1 : 1 instead of original->maxindex, preventing out-of-bounds writes and corruptions when elements with index == maxindex are cloned; introduced safe index-checked structArray accessor helpers get_struct and set_struct validating index >= 0 && (size_t)index < maxelem; fixed union type confusion in nmg_construct_face where case NMG_FACE_G_SNURB_MAGIC accessed original->g.plane_p->index instead of original->g.snurb_p->index; hardened all 20 structure constructors (nmg_construct_region_a, nmg_construct_region, nmg_construct_face_g_plane, nmg_construct_face_g_snurb, nmg_construct_face, nmg_construct_vertex_g, nmg_construct_vertex, nmg_construct_vertexuse_a_plane, nmg_construct_vertexuse_a_cnurb, nmg_construct_vertexuse, nmg_construct_edge, nmg_construct_edge_g_lseg, nmg_construct_edge_g_cnurb, nmg_construct_edgeuse, nmg_construct_loop_a, nmg_construct_loop, nmg_construct_loopuse, nmg_construct_faceuse, nmg_construct_shell_a, nmg_construct_shell) with input NULL checks, safe structArray index bounds validation, and non-null child insertion guards; validated knot vector sizes (u.k_size, v.k_size, k_size) and ctl_points array allocations before copying in SNURB and CNURB constructors; removed dead unused tolerance variable in nmg_clone_model; in class.c, fixed CWE-369 division-by-zero vulnerability in nmg_class_pnt_e by checking MAGSQ(ptvec) < SMALL_FASTF before calling VUNITIZE; eliminated off-by-one heap underallocations in nmg_class_pnt_e debug plot bits buffer, nmg_class_pnt_s faces_seen array, and class_lu_vs_s b buffer by allocating (size_t)maxindex + 1; replaced unsafe sprintf calls with snprintf across debug plot generators; deleted two large obsolete #if 0 dead code blocks (~200 lines: nmg_class_lu_fu and nmg_get_interior_pnt); guarded against NULL shell attributes (s->sa_p) before bounding box dereferences in nmg_class_pnt_s, class_eu_vs_s, and nmg_classify_s_vs_s by ensuring attributes via nmg_shell_a; hardened radial and mate pointer cycles against NULL dereference and infinite loops in class_eu_vs_s, class_shared_lu, and class_lu_vs_s; and prevented crashes and type confusion on empty or vertex loops in class_shared_lu and nmg_classify_s_vs_s by validating list emptiness, checking child magic, and ensuring vertex geometry pointers are non-null. |
-| `SEC-0333` | `src/libnmg/eval.c, src/libnmg/extrude.c` | `eval.c:43-52,89-125,203-275,282-355,435-460,505-525,535-555,568-605,608-625,630-660; extrude.c:45-68,75-84,90-170,180-255,263-289,298-388,505-778,827-918,930-1090,1148-1328,1347-1524` | Heap Buffer Overflows / OOB Writes, Memory Leaks, Copy-Paste Edge Intersection Defects, Denial of Service / Aborts, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libnmg Batch 91 (eval.c, extrude.c, 2,024 lines): in extrude.c, resolved critical Cat 1 heap buffer overflow / OOB write vulnerabilities (CWE-122 / CWE-787) in nmg_hollow_shell and nmg_extrude_shell by allocating maxelem = (m->maxindex > 0) ? (size_t)m->maxindex + 1 : 1 instead of m->maxindex, preventing memory corruption when elements with index == maxindex are processed by NMG_INDEX_TEST_AND_SET; fixed critical copy-paste bug in nmg_fix_overlapping_loops where edge splitting on intersection endpoints incorrectly referenced eu2 instead of eu1 on dist[0] == 1.0, and nmg_esplit was erroneously confined to the interior-only else branch, leaving crossing edges completely unsplit when touching existing vertex endpoints; fixed multiple persistent memory leaks: loop_tab allocations in nmg_fix_overlapping_loops when tables were empty, outfaces in nmg_extrude_face on early error returns, and the verts table in nmg_extrude_shell when vertex recalculation failed before out: (CWE-401); replaced fatal bu_bomb abort in nmg_extrude_face on parallel extrusion with graceful error return (-1) and moved angle calculation before nmg_dup_face to prevent orphaned/leaked duplicated geometry; added loop bounds and magic number validation in nmg_start_new_loop to guard against infinite loops and type confusion; hardened verts_in_nmg_loop, verts_in_nmg_face, nmg_translate_face, nmg_find_vertex_in_lu, nmg_break_crossed_loops, and nmg_extrude_cleanup with comprehensive NULL checks, empty loop guards, and coordinate validation; in eval.c, hardened nmg_eval_action with classification table bounds checking (bs_maxindex) to prevent negative array indexing or heap out-of-bounds reads (CWE-125); added NULL guards, parent magic verification, and planar face geometry checks in nmg_ck_lu_orientation to avoid illegal dereferences on non-faceuse parents or SNURB faces; hardened nmg_eval_shell against crashing on empty loops or malformed wire edgeuse parents in BACTION_KILL; replaced unsafe sprintf with snprintf in debug plot file naming; and replaced fatal bu_bomb on plot file write failure with a non-fatal bu_log warning. |
-| `SEC-0334` | `src/libnmg/fcut.c` | `fcut.c:64-100,105-180,230-310,345-420,430-490,500-680,685-780,785-840` | Stack & Heap Uninitialized Memory / Sizeof Pointer, Persistent Memory Leaks, Division by Zero, Unsigned Underflow, Dead Code Elimination, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libnmg Batch 92 (fcut.c, 3,809 lines): in nmg_face_rs_init, resolved critical Cat 1 sizeof-pointer memory initialization defect (CWE-467) where memset((char *)rs, 0, sizeof(rs)) only zeroed 8 bytes (pointer size) leaving the remaining 90% of the nmg_ray_state structure filled with uninitialized stack memory; resolved multiple persistent memory leaks (CWE-401) in find_loop_to_cut and nmg_fcut_face where dynamically allocated struct loop_cuts objects in the cuts table were removed via bu_ptbl_rm or left in cuts when freeing the table without ever calling bu_free; fixed CWE-369 division-by-zero vulnerabilities across VUNITIZE calls on rs->left in nmg_face_rs_init, x_dir and y_dir in find_loop_to_cut, and x_dir and y_dir in nmg_eu_angle by guarding vector magnitude against zero before normalization; fixed CWE-191 unsigned integer underflow and infinite loop vulnerability in ptbl_vsort bubble sort loop bounds by using safe i + 1 < b->end comparison; eliminated type confusion crashes on lone vertex loops in find_best_vu by verifying parent magic (*vu->up.magic_p == NMG_EDGEUSE_MAGIC) before treating parents as edgeuses; eliminated out-of-bounds pointer reads and potential null dereferences in nmg_fcut_face traversal loops (prior_start, prior_end, next_end) by enforcing array bounds against rs->nvu; guarded ptbl_vsort against division by zero on dist_tol <= 0; added retry iteration limits and safe return paths in nmg_ck_vu_ptbl and nmg_face_cutjoin to prevent infinite loops; restored active exported implementations of nmg_sanitize_fu and nmg_wedge_class from dead code blocks; replaced fatal bu_bomb aborts across active routines with error logging and graceful failure returns; and eliminated ~2,500 lines of obsolete #if 0 dead code blocks from 1993/2017. |
-| `SEC-0335` | `src/libnmg/fuse.c` | `fuse.c:127-160,297-343,355-401,413-552,556-620,624-658,778-894,906-1025,1044-1157,1180-1382,1398-1491,1702-1765,1784-1872,2013-2074,2158-2328,2401-2500,2544-2656,2665-2799,2863-2928,3081-3175,3183-3305` | Persistent Memory Leaks, Division by Zero, Control Point Misalignment, Infinite Loops, Denial of Service / Aborts, and NULL Pointer Dereferences | 2 | `CONFIRMED` | `FIXED` | In BRL-CAD libnmg Batch 93 (fuse.c, 3,468 lines): resolved multiple persistent memory leaks (CWE-401) by freeing dynamic sort_idx_xyp allocation in nmg_edge_g_fuse which was previously never deallocated, freeing etab table on zero-count exit in nmg_edge_g_fuse, and freeing tmp table on empty-length exits in nmg_vertex_fuse and nmg_edge_fuse; fixed control points stride misalignment and buffer bounds defects in nmg_cnurb_is_linear (CWE-125 / CWE-129) where ctl_points was indexed by i instead of i * coords and compared using 3D VEQUAL instead of dimension-aware coords comparisons with EQUAL macro, as well as fixing the loop upper bound to cnrb->c_size - 1; fixed multiple CWE-369 division-by-zero vulnerabilities: guarded rise-over-run slopes (dx and dy) in nmg_edge_g_fuse across XY, XZ, and YZ planes, guarded srf->s_size[0] * srf->s_size[1] <= 0 and plane normal magnitude MAGSQ(pl) <= SMALL_FASTF in nmg_snurb_is_planar, and guarded rational weights (xyz1[coords-1] and uvw[coords-1]) in nmg_eval_linear_trim_curve and nmg_eval_trim_curve; fixed potential infinite loop hangs (CWE-835) in nmg_radial_implement_decisions and nmg_do_radial_join by adding pass progress tracking (progress++) to prevent infinite looping when skipped elements make no forward progress; eliminated 43 fatal bu_bomb aborts (CWE-400 / DoS) across topological fusing, crack classification, and radial edge joining (nmg_region_v_unique, nmg_vertex_fuse, nmg_snurb_is_planar, nmg_split_trim, nmg_cnurb_lseg_coincident, nmg_cnurb_is_on_crv, nmg_edge_fuse, nmg_ck_fu_verts, nmg_break_all_es_on_v, nmg_radial_verify_pointers, nmg_radial_verify_monotone, nmg_radial_build_list, nmg_is_crack_outie, nmg_find_radial_eu, nmg_radial_mark_cracks, nmg_radial_find_an_original, nmg_radial_mark_flips, nmg_radial_join_eu_NEW), replacing them with informative error/debug logging and graceful non-fatal fallback returns; and hardened against NULL pointer dereferences and out-of-bounds reads (CWE-476 / CWE-125) in nmg_edge_fuse, nmg_edge_g_fuse, nmg_break_all_es_on_v, nmg_break_e_on_v, and radial utilities with comprehensive parameter validation and geometry checks. |
-
-
-
-
-

audit/DASHBOARD.md

@@ -1,465 +0,0 @@
-# BRL-CAD RMF/STIG Cat 1 Security Audit Dashboard
-**Last Updated:** 2026-10-04 17:30:00 UTC
-
-## Overall Progress
-- **Total C/C++ Files:** 3493
-- **Files Reviewed:** 1595 (45.7%)
-- **Files Pending Review:** 1898
-- **Total Issues Identified:** 356
-
-### Issues by Severity Potential
-| Severity Level | Count | Description |
-|:---:|:---:|:---|
-| **3 (High)** | 23 | Likely exploit or crash potential; widespread/library exposure |
-| **2 (Medium)** | 281 | Possible exploit or crash under specific circumstances |
-| **1 (Low)** | 52 | Localized / low-impact vulnerability |
-
-### Issues by Verification Status
-- **Confirmed:** 0
-- **Fixed (Committed):** 356
-- **Pending Verification:** 0
-- **Disproven:** 0
-
-## Subsystem Review Progress
-| Subsystem | Total Files | Reviewed | Progress | Issues Found |
-|:---|:---:|:---:|:---:|:---:|
-| `bench` | 5 | 5 | 100.0% | 1 |
-| `doc` | 19 | 0 | 0.0% | 0 |
-| `include` | 315 | 34 | 10.8% | 8 |
-| `misc` | 55 | 0 | 0.0% | 0 |
-| `regress` | 21 | 0 | 0.0% | 0 |
-| `src/adrt` | 51 | 0 | 0.0% | 0 |
-| `src/archer` | 1 | 0 | 0.0% | 0 |
-| `src/art` | 6 | 6 | 100.0% | 1 |
-| `src/brlman` | 1 | 0 | 0.0% | 0 |
-| `src/bwish` | 3 | 3 | 100.0% | 1 |
-| `src/conv/3dm` | 1 | 0 | 0.0% | 0 |
-| `src/conv/asc` | 5 | 0 | 0.0% | 0 |
-| `src/conv/bot_dump.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/comgeom` | 7 | 0 | 0.0% | 0 |
-| `src/conv/conv-vg2g.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/csg` | 2 | 0 | 0.0% | 0 |
-| `src/conv/dbupgrade.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/dxf` | 3 | 0 | 0.0% | 0 |
-| `src/conv/enf-g.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/fast4-g.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-acad.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-dot.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-egg.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-nff.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-obj.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-shell-rect.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-var.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-vdb.cpp` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-voxel.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-vrml.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-x3d.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-xxx.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g-xxx_facets.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g4-g5.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/g5-g4.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/gcv` | 1 | 0 | 0.0% | 0 |
-| `src/conv/gltf` | 1 | 0 | 0.0% | 0 |
-| `src/conv/iges` | 2 | 0 | 0.0% | 0 |
-| `src/conv/intaval` | 8 | 0 | 0.0% | 0 |
-| `src/conv/jack` | 2 | 0 | 0.0% | 0 |
-| `src/conv/k-g` | 19 | 0 | 0.0% | 0 |
-| `src/conv/nastran-g.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/nmg` | 1 | 0 | 0.0% | 0 |
-| `src/conv/obj-g.c` | 1 | 0 | 0.0% | 0 |
-| `src/conv/off` | 2 | 0 | 0.0% | 0 |
-| `src/conv/patch` | 3 | 0 | 0.0% | 0 |
-| `src/conv/ply` | 2 | 0 | 0.0% | 0 |
-| `src/conv/raw` | 6 | 0 | 0.0% | 0 |
-| `src/conv/shp` | 4 | 0 | 0.0% | 0 |
-| `src/conv/step` | 600 | 0 | 0.0% | 0 |
-| `src/conv/stl` | 2 | 0 | 0.0% | 0 |
-| `src/conv/tankill` | 1 | 0 | 0.0% | 0 |
-| `src/conv/vdeck` | 5 | 0 | 0.0% | 0 |
-| `src/conv/walk_example.c` | 1 | 0 | 0.0% | 0 |
-| `src/external` | 17 | 0 | 0.0% | 0 |
-| `src/fb` | 29 | 0 | 0.0% | 0 |
-| `src/fbserv` | 4 | 4 | 100.0% | 2 |
-| `src/gtools` | 40 | 0 | 0.0% | 0 |
-| `src/isst` | 9 | 9 | 100.0% | 1 |
-| `src/launcher` | 8 | 8 | 100.0% | 1 |
-| `src/libanalyze` | 40 | 0 | 0.0% | 0 |
-| `src/libbg` | 232 | 232 | 100.0% | 79 |
-| `src/libbn` | 41 | 41 | 100.0% | 31 |
-| `src/libbrep` | 50 | 50 | 100.0% | 5 |
-| `src/libbu` | 176 | 176 | 100.0% | 101 |
-| `src/libbv` | 19 | 19 | 100.0% | 1 |
-| `src/libdm` | 80 | 80 | 100.0% | 1 |
-| `src/libfft` | 8 | 8 | 100.0% | 1 |
-| `src/libgcv` | 111 | 111 | 100.0% | 1 |
-| `src/libged` | 509 | 509 | 100.0% | 35 |
-| `src/libicv` | 34 | 34 | 100.0% | 5 |
-| `src/libnmg` | 54 | 8 | 14.8% | 5 |
-| `src/liboptical` | 46 | 0 | 0.0% | 0 |
-| `src/libpc` | 6 | 6 | 100.0% | 1 |
-| `src/libpkg` | 10 | 10 | 100.0% | 3 |
-| `src/libqtcad` | 29 | 29 | 100.0% | 6 |
-| `src/librt` | 373 | 0 | 0.0% | 0 |
-| `src/libtclcad` | 31 | 31 | 100.0% | 7 |
-| `src/libtermio` | 2 | 2 | 100.0% | 1 |
-| `src/libwdb` | 27 | 27 | 100.0% | 2 |
-| `src/mged` | 55 | 55 | 100.0% | 16 |
-| `src/nirt` | 2 | 2 | 100.0% | 1 |
-| `src/proc-db` | 55 | 55 | 100.0% | 11 |
-| `src/qged` | 34 | 34 | 100.0% | 6 |
-| `src/remrt` | 7 | 7 | 100.0% | 2 |
-| `src/rt` | 33 | 0 | 0.0% | 0 |
-| `src/rtwizard` | 1 | 0 | 0.0% | 0 |
-| `src/shapes` | 15 | 0 | 0.0% | 0 |
-| `src/sig` | 39 | 0 | 0.0% | 0 |
-| `src/util` | 90 | 0 | 0.0% | 0 |
-
-## Identified Issues Summary
-| ID | Severity | Category | File & Location | Verification | Nature of Issue |
-|:---|:---:|:---|:---|:---:|:---|
-| `SEC-0001` | **Sev 3** | Invalid Free / Crasher | `src/libpkg/pkg.c:1876-1923` | `FIXED` | pkg_waitfor fails to clear pc->pkc_buf on excess message length, causing subsequent pkg_close to call free on caller stack memory. |
-| `SEC-0002` | **Sev 2** | Uninitialized Memory Access | `src/libpkg/pkg.c:1960-1968` | `FIXED` | pkg_bwaitfor returns uninitialized heap buffer instead of NULL when network read fails or disconnects prematurely. |
-| `SEC-0003` | **Sev 1** | NULL Pointer Dereference / Crasher | `src/libpkg/example_qt/server.cpp:46-59` | `PENDING` | PKGServer destructor unconditionally dereferences NULL client pointer and frees uninitialized pkc_inbuf. |
-| `SEC-0004` | **Sev 3** | Heap Out-of-Bounds Read / Crasher | `src/fbserv/server.c:432-540` | `FIXED` | fbserv packet handlers fail to validate packet payload length against pixel count before calling fb_write, causing heap out-of-bounds read. |
-| `SEC-0005` | **Sev 3** | Integer Overflow / Heap Buffer Overflow | `src/fbserv/server.c:476-580` | `FIXED` | Integer multiplication overflow in width*height in fb_readrect and fb_bwreadrect leads to heap buffer overflow during pixel read. |
-| `SEC-0006` | **Sev 2** | Integer Signedness / Out-of-Bounds Memory Access | `src/remrt/rtsrv.c:891-971` | `FIXED` | ph_lines fails to validate pixel range bounds, causing signed integer underflow in (b-a+1)*3 to wrap to huge size_t in pkg_2send, triggering out-of-bounds heap reads, and leaks buffer. |
-| `SEC-0007` | **Sev 2** | Unhandled Input Validation / Denial of Service | `src/remrt/remrt.c:3803-3806` | `FIXED` | ph_pixels parses incoming MSG_PIXELS without checking packet length or magic header, allowing malformed network packets to trigger out-of-bounds reads or terminate remrt via bu_bomb. |
-| `SEC-0008` | **Sev 2** | Out-of-Bounds Memory Access / Buffer Underflow | `src/libbu/parse.c:87-118` | `FIXED` | bu_struct_wrap_buf and PARSE_CK_GETPUT do not verify buffer length is at least 8 bytes, causing negative index access and out-of-bounds read on buffers with small or zero length. |
-| `SEC-0009` | **Sev 2** | Format String / Type Confusion | `src/libbu/vls_vprintf.c:186-226` | `FIXED` | vls_vprintf uses bitwise XOR (^=) instead of bitwise AND NOT (&= ~) to clear length modifiers, corrupting flags and causing incorrect type extraction from va_list. |
-| `SEC-0010` | **Sev 2** | Off-by-One / Buffer Corruption | `src/libbu/vls.c:433-465` | `FIXED` | bu_vls_substr calls bu_vls_putc with NUL, embedding an unwanted NUL byte and off-by-one corrupting vls_len. |
-| `SEC-0011` | **Sev 2** | Integer Overflow / Heap Overflow | `src/libbu/malloc.c:84-145,375-388` | `FIXED` | alloc() and bu_pool_alloc() lack integer multiplication overflow checks on cnt*size, which can cause undersized memory allocations and subsequent heap buffer overflows. |
-| `SEC-0012` | **Sev 2** | Buffer Underflow / Out-of-bounds Pointer | `src/libbu/argv.c:97,175,268-295` | `FIXED` | bu_argv_from_string computed pointer at strlen(lp)-1 on potentially empty string causing integer underflow and out-of-bounds pointer arithmetic. |
-| `SEC-0013` | **Sev 2** | Buffer Over-read | `src/libbu/str.c:61-75` | `FIXED` | bu_strlcatm uses unbounded strlen on dst to detect un-terminated buffers, causing out-of-bounds read. |
-| `SEC-0014` | **Sev 2** | Null Pointer Dereference / Integer Overflow | `src/libbu/b64.c:216-284` | `FIXED` | bu_b64 encode and decode functions lacked null pointer checks on input/output and cast lengths to signed 32-bit int. |
-| `SEC-0015` | **Sev 2** | Format String / Scanset Parser Bug | `src/libbu/sscanf.c:312-320,365-375` | `FIXED` | bu_vsscanf omitted literal ] and ^] from partFmt when extracting scanset specifiers, causing malformed format strings and scan failure. |
-| `SEC-0016` | **Sev 2** | Null Pointer Dereference / Integer Overflow | `src/libbu/bitv.c:95-105,285-295,440-445,625-630` | `FIXED` | bu_hex_to_bitv and bu_binary_to_bitv2 crashed on NULL input, and bu_bitv_shift_vector had integer overflow UB on INT_MIN. |
-| `SEC-0017` | **Sev 2** | Null Pointer Dereference / Memory Safety | `src/libbu/hash.c:125-135,180-190,270-280` | `FIXED` | bu_hash_get crashed on NULL key in _nhash_keycmp, and bu_hash_create/bu_hash_set lacked allocation failure handling. |
-| `SEC-0018` | **Sev 3** | Memory Access Violation / Buffer Overflow / Out-of-bounds Pointer | `include/bu/ptbl.h, src/libbu/ptbl.c:105,119-120; 63,99,214,240,266,290` | `FIXED` | BU_PTBL_FOR macro and BU_PTBL_LASTADDR cause out-of-bounds pointer calculation and segfault on empty tables with NULL buffers, and table reallocations lack integer multiplication overflow checks. |
-| `SEC-0019` | **Sev 2** | Out-of-bounds Bit Array Access / Resource Leak / Undefined Behavior | `src/libbu/affinity.c:74,90-104,108` | `FIXED` | parallel_set_affinity permitted negative cpu indexing into CPU_SET and negative bitshift on Windows, leaked Mach thread port rights, and passed wrong policy type for Mach thread affinity. |
-| `SEC-0020` | **Sev 2** | NULL Pointer Dereference / Process Signal Safety | `src/libbu/backtrace.c:324,596,659-661,742` | `FIXED` | bu_backtrace_app called bu_strlcpy on potentially NULL gdb_path, used negative file descriptors in write, and reaped arbitrary child processes via wait(NULL). |
-| `SEC-0021` | **Sev 2** | NULL Pointer Dereference / Buffer Underflow / Crasher | `src/libbu/cmd.c:50-66` | `FIXED` | bu_cmd lacked null checks on cmds, argv, and argv[cmd_index], allowed negative cmd_index causing buffer underflow, and executed unverified function pointers. |
-| `SEC-0022` | **Sev 2** | Integer Multiplication Overflow / Crasher | `src/libbu/damlevlim.cpp:68-159` | `FIXED` | bu_editdist computed buffer allocation size as (n+1)*(m+1) using signed 32-bit int, causing signed integer multiplication overflow, out-of-bounds access, and std::length_error crash on large strings. |
-| `SEC-0023` | **Sev 2** | Heap Buffer Overflow / NULL Pointer Dereference / TOCTOU | `src/libbu/dirent.c, src/libbu/datetime.cpp:36-88; 173-197` | `FIXED` | bu_file_list called opendir(NULL) when path is NULL and suffered from heap buffer overflow if directory entries were added concurrently between passes; bu_utctime crashed on NULL vls_gmtime. |
-| `SEC-0024` | **Sev 2** | Buffer Overflow / Underflow / NULL Pointer Dereference / Infinite Loop | `src/libbu/dir.c:69-75, 108, 169, 186, 248, 254, 395-405, 480-535, 656-665, 684-740` | `FIXED` | dir routines passed caller buffer len to fixed stack arrays risking stack buffer overflow, permitted underflow pointer reads in _bu_dir_join_path, crashed on NULL result in vdir, and risked infinite loop or crash in bu_mkdir/bu_dirclear on invalid paths. |
-| `SEC-0025` | **Sev 3** | Heap Use-After-Free / Double-Free / Thread Safety | `src/libbu/dylib.c:38-40, 70-87, 105-120` | `FIXED` | bu_dlunload freed the global handles table without resetting handles to NULL or max_handles to 0, leading to dangling pointer use-after-free heap writes on subsequent bu_dlclose calls and double-free on subsequent bu_dlunload calls; routines lacked thread synchronization. |
-| `SEC-0026` | **Sev 1** | Invalid File Descriptor / Parameter Validation | `src/libbu/fchmod.cpp:62-75` | `FIXED` | bu_fchmod passed unvalidated negative file descriptors to OS handles routines triggering CRT parameter validation errors or unexpected failures. |
-| `SEC-0027` | **Sev 2** | Memory Leak / Resource Leak / NULL Pointer Dereference / Logic Flaw | `src/libbu/file.cpp:79-110, 126-166, 193, 227-240, 360, 603-640` | `FIXED` | bu_file_same leaked allocated realpath strings on match and crashed on NULL paths, file_compare_info had an assignment instead of comparison operator bug, bu_file_exists leaked file descriptors, and stream seek/tell functions crashed on NULL streams. |
-| `SEC-0028` | **Sev 2** | NULL Pointer Dereference / Crasher | `src/libbu/fnmatch.c:308-311` | `FIXED` | bu_path_match immediately dereferenced pattern and string without NULL pointer checks, causing immediate SIGSEGV crashes on NULL inputs. |
-| `SEC-0029` | **Sev 2** | Invalid Pointer Cast / NULL Pointer Dereference / Buffer Overflow | `src/libbu/gethostname.c:49, 81-84, 89` | `FIXED` | bu_gethostname passed constant (LPDWORD)MAXPATHLEN as pointer to GetComputerName causing invalid pointer crash, left procfs file pointer unchecked causing null stream crash, and lacked entry bounds validation. |
-| `SEC-0030` | **Sev 2** | NULL Pointer Dereference / Buffer Over-read / Logic Flaw | `src/libbu/getopt.c:34-39, 48-56, 65-72, 84, 98` | `FIXED` | bu_getopt dereferenced NULL nargv elements and NULL *nargv in tell macro, read out of bounds on '\0' matched in ostr via strchr, and misidentified bare '-' as an option. |
-| `SEC-0031` | **Sev 2** | NULL Pointer Dereference / Crasher | `src/libbu/glob.c:63, 84, 110, 161, 195, 240, 259, 286` | `FIXED` | bu_glob internal helpers and callbacks dereferenced NULL pattern, path, directory entry, or stat buffer pointers without checking for NULL. |
-| `SEC-0032` | **Sev 2** | Out-of-bounds Array Access / Integer Underflow | `src/libbu/heap.c:136, 200-216, 255` | `FIXED` | bu_heap_get bypassed allocation size range check when DEBUG was not defined causing out-of-bounds heap bin indexing and underflow to SIZE_MAX when sz == 0, and lacked cpu id bounds clamping. |
-| `SEC-0033` | **Sev 2** | Out-of-bounds Memory Write / NULL Pointer Dereference | `src/libbu/hist.c:52, 82-100, 117-128` | `FIXED` | bu_hist_range permitted negative or out-of-bounds 'a' indexing on NaN inputs causing heap write access violation, and bu_hist_init/bu_hist_pr crashed on NULL inputs. |
-| `SEC-0034` | **Sev 2** | Signal Handler Leak / Out-of-bounds Array Access / Logic Flaw | `src/libbu/interrupt.c:78-83, 100-116, 137-163` | `FIXED` | interrupt_restore_signal never restored signal handlers when no signal was received leaving temporary handler active indefinitely, checked wrong handler pointer, and lacked bounds check on signum. |
-| `SEC-0035` | **Sev 2** | Buffer Underflow / Integer Overflow UB / Out-of-bounds Read | `src/libbu/num.c:35-58, 87-90, 106` | `FIXED` | bu_num_print read out-of-bounds at tbl_start[-1] due to reversed condition ordering in trailing newline scan and crashed on empty strings; char_length had signed integer overflow UB on INT64_MIN and truncated 64-bit int to long. |
-| `SEC-0036` | **Sev 2** | NULL Pointer Dereference / Integer Overflow | `src/libbu/log.c:148, 156, 204, 222, 335` | `FIXED` | bu_flog lacked null pointer and empty string checks on fmt and fp, causing NULL pointer dereference crashes in fwrite, and bu_log helper routines lacked null pointer guards. |
-| `SEC-0037` | **Sev 2** | NULL Pointer Dereference / Integer Underflow | `src/libbu/mappedfile.c:360, 544-550, 577` | `FIXED` | bu_open_mapped_file_with_path crashed with SIGSEGV on NULL name or path, bu_free_mapped_files suffered from unsigned integer underflow on index removal, and bu_open_mapped_file allowed invalid file sizes. |
-| `SEC-0038` | **Sev 2** | NULL Pointer Dereference / Memory Safety | `src/libbu/observer.c:36, 58, 110, 168, 194, 215` | `FIXED` | bu_observer_cmd and helper routines dereferenced NULL argv or NULL observer lists without validation, and bu_observer_free left dangling pointers in the observer list. |
-| `SEC-0039` | **Sev 2** | Integer Underflow / NULL Pointer Dereference | `src/libbu/lex.c:42, 131, 155, 257, 268` | `FIXED` | lex_getone allowed negative *used integer underflow on number fallback, and bu_lex crashed on NULL token, rtstr, or NULL key strings. |
-| `SEC-0040` | **Sev 2** | Buffer Underflow / Concurrency Hazard / Integer Bounds | `src/libbu/path_normalize.c:47, 86-88, 95` | `FIXED` | bu_path_normalize used non-thread-safe static buffer, lacked lower-bound check in backward component scan allowing pointer underflow before resolved buffer, and used unchecked signed pointer arithmetic for MAXPATHLEN bounds check. |
-| `SEC-0041` | **Sev 2** | NULL Pointer Dereference / Undefined Bitshift / Out-of-bounds Read | `src/libbu/printb.c:36, 40-52` | `FIXED` | bu_vls_printb dereferenced NULL vls and bits strings, shifted signed 1L by negative or out-of-range bit numbers causing undefined behavior, and read out-of-bounds on strings ending after bit numbers. |
-| `SEC-0042` | **Sev 2** | NULL Pointer Dereference / Path Truncation Flaw | `src/libbu/path.c:177-180, 211-218, 242-258` | `FIXED` | bu_path_to_argv dereferenced NULL ac pointer causing crash, and bu_path_component corrupted file paths by stripping directories when a dot appeared in directory names under BU_PATH_EXTLESS and BU_PATH_EXT. |
-| `SEC-0043` | **Sev 2** | Crash / Unhandled Exception / NULL Function Pointer Dereference | `src/libbu/parallel_cpp11thread.cpp:28-51` | `FIXED` | parallel_cpp11thread crashed on NULL func callback and caused std::terminate() aborts if thread creation threw an exception while previous threads remained joinable. |
-| `SEC-0044` | **Sev 2** | Concurrency Hazard / Unchecked Buffer Overflow | `src/libbu/progname.c:74-79, 140-143, 155-190` | `FIXED` | bu_argv0_full_path and bu_getprogname returned static non-thread-safe buffers and accessed bu_progname unsynchronized with concurrent bu_setprogname writes, and bu_argv0_full_path unchecked bu_getcwd return and appended with potential buffer overflow. |
-| `SEC-0045` | **Sev 2** | NULL Pointer Dereference / Crash | `src/libbu/realpath.c:38-66` | `FIXED` | bu_file_realpath dereferenced NULL path pointer into realpath, GetFullPathName, and bu_strlcpy fallback causing immediate SIGSEGV crashes. |
-| `SEC-0046` | **Sev 2** | Format String Flaw / Uninitialized Variable Memory Corruption | `src/libbu/scan.c:38, 58-60, 68-73, 89-93` | `FIXED` | bu_scan_fastf_t constructed dynamic scanf format strings from user delimiter allowing format string injection, and read uninitialized stack variable 'len' into offset when sscanf failed to reach %n specifier. |
-| `SEC-0047` | **Sev 2** | Out-of-bounds Array Access / Concurrency Race Condition | `src/libbu/semaphore.c:260-286, 298-301, 340-343` | `FIXED` | bu_semaphore_acquire and bu_semaphore_release lacked upper bounds checks on semaphore index causing out-of-bounds array access and integer overflow on UINT_MAX, and bu_semaphore_free destroyed mutexes without synchronizing on bu_init_lock. |
-| `SEC-0048` | **Sev 2** | NULL Pointer Dereference / Memory Safety | `src/libbu/sha1.c:53, 110, 126, 150` | `FIXED` | SHA1Transform, SHA1Init, SHA1Update, and SHA1Final lacked NULL pointer validation on context, data, digest, state, and buffer pointers causing SIGSEGV crashes. |
-| `SEC-0049` | **Sev 1** | Integer Overflow UB / Logic Flaw | `src/libbu/snooze.cpp:35-42` | `FIXED` | bu_snooze lacked upper bound clamping on 64-bit useconds causing integer overflow when converted to nanoseconds internally in std::chrono durations. |
-| `SEC-0050` | **Sev 2** | Memory Access Flaw / Divide by Zero | `src/libbu/sort.c:156-189, 381-402` | `FIXED` | bu_sort lacked checks for NULL a, NULL cmp, zero element size es == 0 (causing division by zero in introsort), and min(a, b) macro lacked parameter parentheses. |
-| `SEC-0051` | **Sev 2** | Buffer Underflow / Pointer Overflow | `src/libbu/tbl.c:381-432` | `FIXED` | bu_tbl_printf suffered from backward scan buffer underflow dereferencing buf[-1] and unbounded runaway pointer increment last += 2 over-reading memory. |
-| `SEC-0052` | **Sev 2** | Null Pointer Dereference / Memory Management | `src/libbu/tc.c:33-200, 428-456` | `FIXED` | bu_thrd_create dereferenced NULL thr pointer and lacked guard on NULL func; mutex and condition variable routines lacked NULL checks; used raw malloc/free. |
-| `SEC-0053` | **Sev 2** | Buffer Over-read / Null Pointer Dereference | `src/libbu/tcllist.c:538, 554-565` | `FIXED` | bu_argv_from_tcl_list crashed on NULL arguments; _bu_tcl_copy_collapse passed strlen(src) instead of remaining count to _bu_tcl_parse_backslash, allowing read out of bounds past list element. |
-| `SEC-0054` | **Sev 3** | Uninitialized Memory / Heap Corruption / Concurrency | `src/libbu/temp.c:85-151, 155-175` | `FIXED` | temp_add_to_list failed to copy initial_temp_files when reallocating from 8 to 16 elements, reading uninitialized memory and calling close() on garbage file descriptors at exit; global temp list lacked thread synchronization. |
-| `SEC-0055` | **Sev 2** | Buffer Underflow / Null Pointer Dereference | `src/libbu/units.c:237-244, 256-270, 390-440` | `FIXED` | units_name_matches underflowed bu_vls_strlen - 1 to SIZE_MAX on empty strings/whitespace, causing out-of-bounds heap read; bu_units_conversion, bu_mm_value, and bu_mm_cvt crashed on NULL pointers. |
-| `SEC-0056` | **Sev 1** | Null Pointer Dereference / Integer Overflow UB | `src/libbu/units_dehumanize.c:80-92, 131-137` | `FIXED` | bu_dehumanize_number crashed on NULL str or size and performed signed multiplication without pre-overflow bounds check. |
-| `SEC-0057` | **Sev 2** | Null Pointer Dereference / Integer Overflow UB | `src/libbu/units_humanize.c:74-82, 128-133` | `FIXED` | bu_humanize_number dereferenced buf[0] before validating buf != NULL, causing crash when called with a NULL buffer; negation of INT64_MIN caused signed integer overflow UB. |
-| `SEC-0058` | **Sev 2** | Buffer Overflow / Null Pointer Dereference / Logic Flaw | `src/libbu/uuid.c:56, 89, 118-124, 134-161` | `FIXED` | bu_uuid_decode suffered critical 16-byte buffer overflow writing 32 bytes to a 16-byte array on non-adjacent hex strings; bu_uuid_create crashed on NULL uuid and corrupted UUIDv5 bits with 0x5F instead of 0x50; bu_uuid_encode crashed on NULL pointers. |
-| `SEC-0059` | **Sev 2** | File Descriptor Leak / Uninitialized Data / Null Dereference | `src/libbu/vfont.c:42, 60-100, 140-150, 184-196, 201-207` | `FIXED` | vfont_get passed potential NULL from bu_dir() to snprintf %s, left 256th dispatch entry uninitialized (i < 255), leaked file descriptors on read failures in get_font, and vfont_free crashed on NULL pointer. |
-| `SEC-0060` | **Sev 2** | Integer Overflow / Null Pointer Dereference | `src/libbu/vlb.c:34-160` | `FIXED` | bu_vlb_write lacked integer overflow protection on capacity addition and crashed when given NULL start; bu_vlb_init, bu_vlb_initialize, bu_vlb_free, and bu_vlb_print crashed on NULL pointers. |
-| `SEC-0061` | **Sev 2** | Undefined Behavior / Memory Leak / Null Pointer Dereference | `src/libbu/cache.cpp:110-140, 220-250, 480-510` | `FIXED` | bu_cache_close freed bu_cache_impl containing std::mutex with BU_PUT instead of delete causing destructor bypass and undefined behavior; bu_cache_keys leaked keystr memory; bu_cache_write_commit underflowed mv_size on negative lengths; NULL txn crashed transactions. |
-| `SEC-0062` | **Sev 2** | Null Pointer Dereference / Float Validity | `src/libbu/color.cpp:52-95, 120-160` | `FIXED` | bu_color_from_str, bu_rgb_to_hsv, and bu_hsv_to_rgb dereferenced NULL pointers unconditionally without validation; bu_color_from_rgb_floats lacked bounds and finite checks. |
-| `SEC-0063` | **Sev 2** | Buffer Overflow / Unsigned Underflow | `src/libbu/convert.c:120-160, 200-240` | `FIXED` | bu_cv_fmt_cookie decremented buflen below zero on small buffers (1-2 bytes), wrapping to SIZE_MAX and writing out of bounds; bu_cv_w_cookie and byte swap routines crashed on NULL or empty input. |
-| `SEC-0064` | **Sev 2** | File Descriptor Leak / Null Pointer Dereference | `src/libbu/crashreport.c:110-140, 210-230` | `FIXED` | bu_crashreport leaked file descriptor when ferror(fp) was true, and formatted potential NULL return from ctime(). |
-| `SEC-0065` | **Sev 2** | Memory Leak / Null Pointer Dereference / Unchecked Input | `src/libbu/env.c:140-190, 240-270` | `FIXED` | editor_not_compatible leaked component vls and dereferenced NULL candidate; editor_file_check lacked NULL checks; bu_setenv lacked POSIX environment variable name validation. |
-| `SEC-0066` | **Sev 2** | Null Pointer Dereference / Buffer Over-read / Type Mismatch | `src/libbu/opt.c:215-260, 480-520` | `FIXED` | opt_describe_internal_ascii crashed when arg_helpstr or help_string was NULL; docbook describe had curr vs d typo; opt_process over-read empty candidate; bu_opt_color had unsigned char type mismatch. |
-| `SEC-0067` | **Sev 2** | Out-of-Bounds Memory Access | `src/libbu/parallel.c:280-310` | `FIXED` | PARALLEL_PUT accessed mapping[id] without validating 0 <= id < MAX_PSW*MAX_PSW, causing out-of-bounds memory corruption. |
-| `SEC-0068` | **Sev 2** | Null Pointer Dereference / Memory Leak / Buffer Overflow | `src/libbu/process.c:350-380, 520-560, 1220-1250` | `FIXED` | bu_process_read unconditionally dereferenced *count = ... even if caller passed NULL; bu_process_exec leaked heap av on every execution; bu_interactive passed unchecked fd to FD_SET causing buffer overflow. |
-| `SEC-0069` | **Sev 2** | Null Pointer Dereference | `src/libbu/uce-dirent.h:348-354, 578-583, 608-612` | `FIXED` | opendir, rewinddir, and _initdir relied solely on assert() in debug mode, crashing with NULL pointer dereference in release builds when given NULL dirname or DIR stream. |
-| `SEC-0070` | **Sev 2** | Unhandled Exception / Denial of Service Crash | `src/libbu/vls_incr.cpp:136-155, 180-188` | `FIXED` | bu_vls_incr accessed ivar.str(1) and nvar.str(1) without verifying match group count, throwing std::out_of_range which bypassed catch (const std::regex_error&) and crashed the application. |
-| `SEC-0071` | **Sev 2** | Null Pointer Dereference | `src/libbu/whereami.c:95-135` | `FIXED` | _bu_getExecutablePath dereferenced pname[0] without checking if _bu_progname_raw() returned NULL, and copied memory into out when out == NULL. |
-| `SEC-0072` | **Sev 2** | Infinite Loop / Denial of Service | `src/libbu/whereis.c:135-155` | `FIXED` | bu_whereis bypassed pointer advancement on dirlen > MAXPATHLEN-2 with continue;, causing an infinite loop hanging the process at 100% CPU. |
-| `SEC-0073` | **Sev 2** | Infinite Loop / Memory Leak | `src/libbu/which.c:91-115` | `FIXED` | which_path suffered infinite loop on oversized directories and empty matches, and leaked initial_path every time an executable was not found. |
-| `SEC-0074` | **Sev 2** | Null Pointer Dereference | `src/libbu/xdr.c:31-88` | `FIXED` | bu_pshort, bu_gshort, bu_plong, bu_glong, and bu_plonglong dereferenced msgp without validating msgp != NULL, causing immediate segmentation fault. |
-| `SEC-0075` | **Sev 2** | Memory Leak / Null Pointer Dereference | `src/libbu/tests/dylib/dylib.c:35-85` | `FIXED` | bu_file_list allocated filenames and bu_vls plugin_pattern allocated memory which was never freed; dylib_close_plugins dereferenced NULL pointer when called with plugins == NULL. |
-| `SEC-0076` | **Sev 2** | Null Pointer Dereference | `src/libbu/tests/dylib/plugin_1.cpp:22-28` | `FIXED` | calc dereferenced *result without checking if *result == NULL, causing crash on NULL buffer pointer. |
-| `SEC-0077` | **Sev 2** | Null Pointer Dereference | `src/libbu/tests/dylib/plugin_2.cpp:22-28` | `FIXED` | calc dereferenced *result without checking if *result == NULL, causing crash on NULL buffer pointer. |
-| `SEC-0078` | **Sev 2** | Stack Buffer Overflow / Format String UB | `src/libbu/tests/test_dirname.c:58-82` | `FIXED` | bu_strlcpy used strlen(input)+1 instead of destination buffer size, causing stack buffer overflow on strings exceeding 1000 bytes; passed NULL to printf format string. |
-| `SEC-0079` | **Sev 1** | Undefined Behavior / Crash | `src/libbu/tests/test_encode.c:70-90` | `FIXED` | Passed NULL str directly to %*s and %s in printf when testing test_encode(NULL), causing undefined behavior and potential crash. |
-| `SEC-0080` | **Sev 1** | Memory Leak / Unchecked Return | `src/libbu/tests/test_datetime.c:243-345` | `FIXED` | result VLS was allocated and never freed across multiple date/time tests, leaking memory; sscanf return value was unvalidated. |
-| `SEC-0081` | **Sev 2** | Null Pointer Dereference / Crash | `src/libbu/tests/test_basename.c:55-65, 130-140` | `FIXED` | get_system_output(NULL) called basename(NULL) which causes segmentation fault on glibc implementations; passed NULL input to bu_log format strings. |
-| `SEC-0082` | **Sev 2** | Heap Buffer Overflow / Off-by-one | `src/libbu/tests/test_progname.c:63-71, 107-115, 149-157, 189-197` | `FIXED` | Allocated strlen(path) bytes via bu_calloc without space for null terminator before calling bu_strlcpy, causing buffer overflow; leaked allocated buffer. |
-| `SEC-0083` | **Sev 2** | Use-After-Free / Memory Leak / Float Comparison | `src/libbu/tests/test_mappedfile.c:70-74, 385-397` | `FIXED` | Accessed mfp->buf after closing mapped file via bu_close_mapped_file, performed raw float equality on double num, and leaked fname VLS. |
-| `SEC-0084` | **Sev 2** | Process Resource Leak / NULL Pointer Dereference | `src/libbu/tests/test_process.c:172-184, 521-536, 680-705` | `FIXED` | Failed to wait on or close process handles on error paths leaking processes, and attempted to close/read NULL file handles when fopen failed. |
-| `SEC-0085` | **Sev 2** | Array Out-of-Bounds / Crash | `src/libbu/tests/test_parallel.c:70-80, 115-125` | `FIXED` | Indexed counter array with cpu ID up to ncpu in tally without bound check, and omitted NULL data check in parallel recursion callback. |
-| `SEC-0086` | **Sev 2** | Out-of-Bounds Memory Read / Pointer Type-Punning | `src/libbu/tests/test_opt.c:58-64, 492-498` | `FIXED` | Read av[-1] when av was decremented without checking bounds, and type-punned unsigned int array to unsigned char pointer violating strict aliasing. |
-| `SEC-0087` | **Sev 2** | NULL Pointer Dereference / Memory Leak | `src/libbu/tests/test_hook.c:45-55, 120-145` | `FIXED` | Callback dereferenced clientdata pointer without NULL check and hook list structures were allocated and never freed across tests. |
-| `SEC-0088` | **Sev 2** | Out-of-Bounds Read / NULL Pointer Dereference | `src/libbu/tests/test_glob.c:95-110, 195-205` | `FIXED` | Read buffer out of bounds when checking trailing slash on short paths and called glob operations without validating NULL context pointers. |
-| `SEC-0089` | **Sev 1** | Resource Leak / Unchecked Return Value | `src/libbu/tests/test_env.c:80-92, 128-135` | `FIXED` | Did not check fopen return value before writing and failed to validate bu_strdup return value leaking memory on error. |
-| `SEC-0090` | **Sev 1** | NULL Pointer Dereference / Format Flaw | `src/libbu/tests/test_escape.c:72-85, 140-150` | `FIXED` | Passed unverified pointer to %s format specifier in printf calls and omitted explicit return code in test helper. |
-| `SEC-0091` | **Sev 1** | Format String Flaw / NULL Dereference | `src/libbu/tests/test_path_component.c:62-75` | `FIXED` | Passed NULL pointer to %24s in bu_log formatting calls, which crashes strict C runtime environments. |
-| `SEC-0092` | **Sev 1** | Memory Leak | `src/libbu/tests/test_humanize_number.c:115-135` | `FIXED` | Allocated string representations of flags and scale inside loop iterations without freeing them, causing repeated memory leaks. |
-| `SEC-0093` | **Sev 1** | Memory Leak / NULL Pointer Dereference | `src/libbu/tests/test_file.c:70-75, 233-241` | `FIXED` | cleanup() function leaked fname VLS allocation on return, and realpath test did not check if rpath was NULL before comparing. |
-| `SEC-0094` | **Sev 1** | Unchecked Return Value / Array Bounds | `src/libbu/tests/test_file_mime.c:45-56` | `FIXED` | Did not check sscanf return count allowing uninitialized integer use, and allowed negative context index causing out-of-bounds array access. |
-| `SEC-0095` | **Sev 1** | NULL Pointer Dereference | `src/libbu/tests/test_observer.c:45-55` | `FIXED` | Missing NULL check on observer callback event structure pointer before dereferencing. |
-| `SEC-0096` | **Sev 1** | NULL Pointer Dereference | `src/libbu/tests/test_parallel_concurrency.cpp:40-48` | `FIXED` | Thread worker function dereferenced user data pointer without checking for NULL. |
-| `SEC-0097` | **Sev 1** | Resource Leak / Empty String Check | `src/libbu/tests/test_path_match.cpp:38-52` | `FIXED` | ifstream remained open without explicit close and empty lines were parsed without validation. |
-| `SEC-0098` | **Sev 2** | POSIX/Darwin API Resolution / Failure to Canonicalize | `src/libbu/realpath.c:20-27` | `FIXED` | Under strict POSIX/XOPEN flags on macOS without _DARWIN_C_SOURCE, realpath bound to legacy conformance symbol which failed with EPERM, breaking path canonicalization across libbu. |
-| `SEC-0099` | **Sev 2** | Memory Management / Resource Leak | `src/libbu/tests/test_realpath.c:47-79` | `FIXED` | Heap memory leak of allocated path string, unchecked sscanf return value, and potential NULL printf argument in test_realpath.c. |
-| `SEC-0100` | **Sev 1** | Memory Access / NULL Pointer Dereference | `src/libbu/tests/test_semaphore.c:48-62` | `FIXED` | Unchecked callback argument pargs in multi-threaded function increment_thread could lead to NULL pointer dereference. |
-| `SEC-0101` | **Sev 2** | Memory Access / Out-of-bounds Read | `src/libbu/tests/test_semaphore_registry.cpp:60-63` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0102` | **Sev 2** | Error Handling / Logic Error | `src/libbu/tests/test_semchk.cpp:40-75` | `FIXED` | Undeclared identifier av[0] passed to bu_setprogname, unhandled file stream failure in process_file, and unguarded argv dereference. |
-| `SEC-0103` | **Sev 2** | Memory Access / Out-of-bounds Read | `src/libbu/tests/test_snooze.c:44-48` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0104` | **Sev 1** | Integer Wraparound / Underflow | `src/libbu/tests/test_sort.c:45-95` | `FIXED` | Integer subtraction bug in comparison function comp_1 (*(unsigned int *)num1 - *(unsigned int *)num2) caused unsigned underflow and reversed sort order; comp_4 lacked NULL pointer checks; sscanf return was unchecked. |
-| `SEC-0105` | **Sev 2** | Memory Access / Out-of-bounds Read | `src/libbu/tests/test_static_init.cpp:44-48` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0106` | **Sev 2** | Memory Management / Resource Leak | `src/libbu/tests/test_str.c:115-180` | `FIXED` | Memory leaks of allocated dst buffer across test_bu_strlcatm, test_bu_strlcpym, and test_bu_strdupm, unchecked sscanf, and negative integer cast to size_t. |
-| `SEC-0107` | **Sev 2** | Format String / NULL Pointer Dereference | `src/libbu/tests/test_str_isprint.c:70-98` | `FIXED` | Passing NULL string pointer to %10s format specifier in bu_log caused undefined behavior / crash; unchecked sscanf. |
-| `SEC-0108` | **Sev 2** | Uninitialized Memory Access | `src/libbu/tests/test_subprocess.cpp:45-55` | `FIXED` | Stack buffer char line[25] was uninitialized before std::cin.get(line, 25), leading to uninitialized memory read if stream was empty or in error state. |
-| `SEC-0109` | **Sev 1** | Concurrency / Out-of-bounds Memory Access | `src/libbu/tests/test_temp_filename.c:45-78` | `FIXED` | Passed &names (char ***) instead of names (char **) to bu_parallel, causing worker threads with cpu > 1 to read and write invalid stack memory outside the array; names[cpu - 1] caused underflow on cpu = 0; off-by-one heap allocation len + 1 caused string truncation. |
-| `SEC-0110` | **Sev 2** | Memory Access / NULL Pointer Dereference | `src/libbu/tests/test_units.c:48-58` | `FIXED` | Missing NULL pointer validation for csv and token in helper function units_csv_has_token. |
-| `SEC-0111` | **Sev 2** | Logic Error / False-Pass Test Suite Flaw | `src/libbu/tests/test_uuid.c:55-90` | `FIXED` | Typo in expected UUID string paired with inverted condition !bu_strcmp caused test suite to return 0 (PASS) on mismatch while returning 1 (FAIL) if it matched; missing error logging. |
-| `SEC-0112` | **Sev 2** | Memory Access / Out-of-bounds Read | `src/libbu/tests/test_version.c:35-48` | `FIXED` | Missing common.h include and unguarded av[0] dereference passed to bu_setprogname. |
-| `SEC-0113` | **Sev 2** | Memory Access / Out-of-bounds Read | `src/libbu/tests/test_vlb.c:42-46` | `FIXED` | Unguarded argv[0] dereference passed to bu_setprogname when argv could be NULL or empty. |
-| `SEC-0114` | **Sev 2** | Memory Management / Resource Leak | `src/libbu/tests/test_vls.c:115-680` | `FIXED` | Heap memory leaks across 13 test functions using bu_vls_strdup solely for comparison without freeing the returned string; out-of-bounds argv access in test_bu_vls_substr; unchecked sscanf. |
-| `SEC-0115` | **Sev 2** | Input Validation / Integer Parsing | `src/libbu/tests/test_vls_incr.c:58-85` | `FIXED` | Unguarded argv dereference and unvalidated strtol conversion where invalid characters or out-of-range counts were unhandled. |
-| `SEC-0116` | **Sev 2** | Memory Management / Resource Leak | `src/libbu/tests/test_vls_incr_uniq.cpp:50-93` | `FIXED` | Memory leak of struct bu_vls name on exit; heap allocation leak of std::set on early exit; potential NULL pointer dereference in StrCmp. |
-| `SEC-0117` | **Sev 2** | Memory Access / Out-of-bounds Read | `src/libbu/tests/test_vls_simplify.c:56-85` | `FIXED` | Unguarded argv dereference before bu_setprogname, potential NULL pointer dereference in bu_log format string. |
-| `SEC-0118` | **Sev 1** | Buffer Overflow / Stack Vulnerability | `src/libbu/tests/test_vls_vprintf.c:55-175` | `FIXED` | Unbounded vsprintf into fixed 1024-byte stack buffer buffer[1024] created an unconstrained stack buffer overflow vulnerability; unchecked sscanf and unguarded argv. |
-| `SEC-0119` | **Sev 1** | Numerical Stability / NaN Generation | `src/libbn/anim.c:304-332` | `FIXED` | anim_mat2quat negative square root NaN generation caused by floating-point rounding when testing !ZERO(square); passed minute negative numbers into sqrt() resulting in NaN quaternion components. |
-| `SEC-0120` | **Sev 1** | Buffer Overflow | `src/libbn/anim.c:153-176` | `FIXED` | anim_mat_printf stack buffer overflow risk with fixed 128-byte character buffer when formatting 16 double-precision float values with custom prefix strings. |
-| `SEC-0121` | **Sev 2** | Null Pointer Dereference | `src/libbn/anim.c:180-680` | `FIXED` | Missing NULL pointer checks across anim_mat_print, anim_dir2mat, anim_dirn2mat, anim_steer_mat, anim_v_permute, anim_v_unpermute, anim_tran, anim_mat2zyx, and anim_mat2ypr. |
-| `SEC-0122` | **Sev 2** | Null Pointer Dereference | `src/libbn/complex.c:54-85` | `FIXED` | bn_cx_div and bn_cx_sqrt dereferenced destination and operand pointers without validating against NULL. |
-| `SEC-0123` | **Sev 1** | Stack Buffer Overflow | `src/libbn/mat.c:1544-1578` | `FIXED` | bn_opt_mat looped up to argc when argc > 15, writing into fixed 16-element stack array fastf_t mtmp[16], overflowing the stack frame on excess arguments. |
-| `SEC-0124` | **Sev 1** | Out-of-bounds Read | `src/libbn/mat.c:1500-1540` | `FIXED` | bn_opt_mat out-of-bounds read when checking trailing closing brace with bu_vls_addr(&str)[bu_vls_strlen(&str)-1] without verifying bu_vls_strlen > 0. |
-| `SEC-0125` | **Sev 1** | Buffer Overflow | `src/libbn/mat.c:80-140` | `FIXED` | bn_mat_print_guts wrote into fixed obuf array without checking remaining capacity against bu_vls length, leading to potential buffer overflow. |
-| `SEC-0126` | **Sev 1** | Concurrency Data Race / Logic Bug | `src/libbn/mat.c:1000-1060` | `FIXED` | bn_wrt_point_direc declared transformation matrices as static local variables, causing data corruption across concurrent raytracing threads, and had inverted translation vector origin_to_pt. |
-| `SEC-0127` | **Sev 2** | Division by Zero | `src/libbn/mat.c:1100-1200` | `FIXED` | persp_mat and deering_persp_mat performed division by near_plane, right-left, and bottom-top without checking for zero denominators. |
-| `SEC-0128` | **Sev 2** | Memory Access / Use-After-Free Prevention | `src/libbn/msr.c:120-135` | `FIXED` | bn_gauss_free lacked NULL pointer guard and failed to clear magic identifier before freeing heap structure. |
-| `SEC-0129` | **Sev 3** | Dead Code | `src/libbn/mt19937ar.c:170-257` | `FIXED` | Dead #if 0 code block with test main function embedded within shared library source file. |
-| `SEC-0130` | **Sev 1** | Heap Memory Corruption | `src/libbn/multipoly.c:80-101` | `FIXED` | bn_multipoly_grow realloc corruption passing outer pointer array P->cf instead of row array P->cf[i] with sizeof(double*) instead of sizeof(double), overwriting row pointers with pointer array address. |
-| `SEC-0131` | **Sev 1** | Out-of-bounds Access | `src/libbn/multipoly.c:80-101` | `FIXED` | bn_multipoly_grow failed to update P->dgrs and P->dgrt dimensions after growing, leaving stale dimensions that caused subsequent operations to access out of bounds or fail to allocate. |
-| `SEC-0132` | **Sev 1** | Out-of-bounds Read | `src/libbn/multipoly.c:120-132` | `FIXED` | bn_multipoly_add out-of-bounds read when polynomials had differing degrees, reading beyond allocated row bounds, and dimension calculation typo Max(p1->dgrt, p2->dgrs) instead of p2->dgrt. |
-| `SEC-0133` | **Sev 1** | Logic / Numerical Error | `src/libbn/multipoly.c:140-155` | `FIXED` | bn_multipoly_mul overwrote accumulated product terms using = instead of +=, destroying earlier polynomial term contributions sharing identical combined powers. |
-| `SEC-0134` | **Sev 1** | Resource Leak | `src/libbn/multipoly.c:70-75` | `FIXED` | Missing bn_multipoly_free function causing 100% memory leak of all 2D dynamically allocated bivariate polynomial matrices. |
-| `SEC-0135` | **Sev 2** | Null Pointer Dereference / Dead Code | `src/libbn/noise.c:248-430` | `FIXED` | Missing NULL pointer validation on point and result in bn_noise_perlin, bn_noise_vec, and spectral functions; 22 lines of dead #if 0 code in bn_noise_mf. |
-| `SEC-0136` | **Sev 1** | Out-of-bounds Access / Allocation Flaw | `src/libbn/noise.c:460-545` | `FIXED` | build_spec_tbl and find_spec_wgt allowed negative or zero octaves, leading to invalid memory allocation size (int)(octaves+1) <= 0 and out-of-bounds weight table indexing. |
-| `SEC-0137` | **Sev 1** | Resource Leak / Typo | `src/libbn/numgen.c:52-72` | `FIXED` | bn_numgen_create allocated generator on the heap before validating dim > 0 and seed < 0, leaking the allocated structure on early return; nperiodic typo in flag check. |
-| `SEC-0138` | **Sev 1** | Memory Corruption / Pointer Aliasing | `src/libbn/poly.c:50-168` | `FIXED` | In-place pointer aliasing in bn_poly_mul, bn_poly_add, and bn_poly_sub when destination pointer equaled one of the operand polynomials caused coefficients to be overwritten before being read. |
-| `SEC-0139` | **Sev 1** | Buffer Overflow / Unsigned Underflow | `src/libbn/poly.c:170-197` | `FIXED` | bn_poly_synthetic_division assigned -1 to unsigned size_t quo->dgr when divisor degree exceeded dividend degree, underflowing to SIZE_MAX and triggering an unbounded loop writing past the 7-element coefficient array. |
-| `SEC-0140` | **Sev 2** | Null Pointer Dereference | `src/libbn/poly.c:200-488` | `FIXED` | Missing NULL pointer checks in bn_poly_quadratic_roots, bn_poly_cubic_roots, bn_poly_quartic_roots, bn_pr_poly, and bn_pr_roots. |
-| `SEC-0141` | **Sev 2** | Memory Access Violation / Numerical Robustness | `src/libbn/qmath.c:84-331` | `FIXED` | In quat_mat2quat, negative diagonal difference caused NaN and division-by-zero on non-orthogonal matrices; acos() called on unconstrained dot products causing NaN domain errors; missing NULL pointer checks across quaternion math operations. |
-| `SEC-0142` | **Sev 2** | Denial of Service / Memory Access Violation | `src/libbn/randsph.c:50-120` | `FIXED` | Potential infinite loop in _bn_unit_sph_sample when bn_randmt() yields exactly 0.5; possible NaN from sqrt(1 - S) when S slightly exceeds 1 due to floating-point rounding; unchecked return value from bn_sobol_next in _bn_unit_sph_sample_sobol. |
-| `SEC-0143` | **Sev 2** | Null Pointer Dereference | `src/libbn/sobol.c:148-325` | `FIXED` | bn_sobol_create did not check the return status of sobol_init, creating partially initialized structures with NULL member pointers when sdim was invalid; rightzero32 had undefined behavior if invoked with 0xffffffffU; _sobol_urand and bn_sobol_next lacked NULL pointer checks. |
-| `SEC-0144` | **Sev 1** | Buffer Overflow / Resource Leak | `src/libbn/sphmap.c:35-315` | `FIXED` | Heap buffer overflow in bn_spm_pix_load which allocated nx*nx*3 bytes instead of nx*ny*3 while reading nx*ny*3 bytes; permanent memory leak of buffer on fread failure; out-of-bounds array reads and writes in bn_spm_read, bn_spm_write, and bn_spm_get when u or v >= 1.0 or negative; bn_spm_free checked magic number before checking for NULL pointer. |
-| `SEC-0145` | **Sev 2** | Uninitialized Memory Read | `src/libbn/str.c:42-177` | `FIXED` | bn_decode_mat, bn_decode_quat, and bn_decode_vect copied uninitialized stack memory into destination buffers when sscanf matched fewer items than required or failed; missing NULL pointer checks across decode and encode routines. |
-| `SEC-0146` | **Sev 2** | Null Pointer Dereference / Resource Leak | `src/libbn/tabdata.c:35-1215` | `FIXED` | Second pass fopen in bn_read_table_and_tabdata was unchecked, causing NULL pointer dereference in bu_fgets if reopening failed; memory leak of allocated table/tabdata on read failure; unsigned integer underflow in bn_table_delete_sample_pnts when i > j; NULL pointer dereference in bn_table_free and bn_tabdata_free. |
-| `SEC-0147` | **Sev 2** | Undefined Behavior | `src/libbn/ulp.c:118-204` | `FIXED` | Referenced non-existent union member d in union flt_bits (val.d += 1 and minVal.d = 1 << 23); undefined behavior in signed 32-bit shift 1 << 52 when setting 64-bit exponent. |
-| `SEC-0148` | **Sev 1** | Resource Leak | `src/libbn/wavelet.c:170-625` | `FIXED` | Permanent memory leaks in make_wlt_haar_2d_decompose, make_wlt_haar_2d_reconstruct, and make_wlt_haar_2d_decompose2 when tbuffer/tbuf is NULL because allocated buffers were never freed; missing NULL buffer and zero dimension validation across wavelet routines. |
-| `SEC-0149` | **Sev 1** | Null Pointer Dereference | `src/libbn/tests/test_util.c:48-265` | `FIXED` | Missing NULL pointer checks in test helper and test dispatch functions (mat_close, vect_close, hvect_close, finite_vec, orthonormal_rotation, normalize_quat, make_table, make_tabdata, bn_api_single, and bn_api_dispatch) when called with NULL pointers or empty argument lists. |
-| `SEC-0150` | **Sev 1** | Out-of-Bounds Read | `src/libbg/pca.cpp:55-80` | `FIXED` | bg_pca computed Thin U on a 3xnpnts matrix using JacobiSVD. When npnts < 3, Thin U has fewer than 3 columns, causing out-of-bounds column reads and assertions when indexing svd.matrixU()(row, 1) and svd.matrixU()(row, 2). |
-| `SEC-0151` | **Sev 2** | Logic / Format String Flaw | `src/libbg/pointgen.c:35-60` | `FIXED` | bg_sph_sample referenced undeclared variable sample instead of pnts[i], used %d format specifier for size_t integers in bu_log, checked sample instead of center for translation offset, and lacked defensive NULL pointer validation on pnts. |
-| `SEC-0152` | **Sev 2** | NULL Pointer Dereference | `src/libbg/sat.cpp:44-175` | `FIXED` | bg_sat_line_aabb, bg_sat_line_obb, bg_sat_tri_aabb, bg_sat_tri_obb, bg_sat_aabb_obb, and bg_sat_obb_obb called v3_from_array and axis_and_extent_from_vect without verifying point_t and vect_t pointer arguments, leading to null pointer dereferences. |
-| `SEC-0153` | **Sev 2** | NULL Pointer Dereference | `src/libbg/lseg_lseg.cpp:37-45` | `FIXED` | bg_distsq_lseg3_lseg3 unpacked input point arrays without null pointer validation and lacked extern C linkage in its C++ definition. |
-| `SEC-0154` | **Sev 2** | NULL Pointer Dereference | `src/libbg/lseg_pt.cpp:36-45` | `FIXED` | bg_distsq_lseg3_pt indexed point coordinates without checking for null pointers. |
-| `SEC-0155` | **Sev 2** | NULL Pointer Dereference / Domain Error | `src/libbg/tri_pt.cpp:37-60` | `FIXED` | bg_tri_closest_pt indexed triangle vertices and sample points without null pointer checks and computed std::sqrt(result.sqrDistance) without non-negative clamping. |
-| `SEC-0156` | **Sev 2** | NULL Pointer Dereference | `src/libbg/tri_ray.cpp:43-70` | `FIXED` | intersect_triangle and vec3_from_array dereferenced point and vector arguments without checking for null pointers. |
-| `SEC-0157` | **Sev 2** | Divide by Zero / NULL Pointer Dereference | `src/libbg/util.c:50-145` | `FIXED` | coplanar_2d_coord_sys scaled origin by 1.0/n without verifying n >= 3, leading to division by zero if n <= 0 and undefined behavior for degenerate point sets. coplanar_3d_to_2d and coplanar_2d_to_3d lacked null checks on pointer parameters and count validation. |
-| `SEC-0158` | **Sev 3** | NULL Pointer Dereference / Deprecated Keyword | `src/libbg/aabb_ray.c:31-143` | `FIXED` | bg_ray_invdir lacked null check on dir; bg_isect_aabb_ray lacked null checks on invdir, aabb_min, aabb_max, and opt; wrote into *r_min and *r_max without verifying destination pointers were non-null; used deprecated register storage class keywords. |
-| `SEC-0159` | **Sev 3** | Validation Flaw | `src/libbg/obr.cpp:95-100` | `FIXED` | bg_3d_coplanar_obr accepted point count < 3 even though a 3D coplanar coordinate system requires at least 3 points to determine a plane normal. |
-| `SEC-0160` | **Sev 1** | Buffer Overflow / Stack Buffer Corruption & Divide by Zero | `src/libbg/polygon.c:144-205` | `FIXED` | Operator precedence flaw in bg_3d_polygon_centroid where *cent[1] and *cent[2] evaluate to *(cent[1]) and *(cent[2]), writing 24 and 48 bytes out of bounds past caller's point_t stack/heap memory; uninitialized accumulation; division by zero when polygon is perpendicular to XY or XZ projection planes. |
-| `SEC-0161` | **Sev 2** | Out-of-bounds Read / Memory Leak | `src/libbg/chull.c:50-185` | `FIXED` | Out-of-bounds read and negative deque index in bg_polyline_2d_chull when vertex count n < 3; permanent memory leaks in bg_3d_coplanar_chull of points_tmp and overwritten hull_2d pointer; missing NULL checks. |
-| `SEC-0162` | **Sev 2** | Out-of-bounds Read / Memory Leak | `src/libbg/chull2.cpp:50-230` | `FIXED` | Out-of-bounds read and negative deque index in bg_polyline_2d_chull2 for n < 3; permanent memory leak of polyline in bg_2d_chull2; missing NULL parameter checks. |
-| `SEC-0163` | **Sev 2** | Divide by Zero / Thread-Safety Race Condition | `src/libbg/clip.c:60-140` | `FIXED` | Division by zero in bg_lseg_clip for vertical or horizontal line segments; thread-safety race condition in bg_ray_vclip due to static local variables diff, sv, st, mindist, maxdist causing concurrent raytracing thread conflicts. |
-| `SEC-0164` | **Sev 2** | Memory Leak / Unchecked Return Value | `src/libbg/polygon_triangulate.cpp:873-970` | `FIXED` | Unchecked return value of fopen in bg_tri_plot_2d causing NULL pointer dereference; permanent memory leaks of holes_array container and tri_out_pts in bg_polygon_triangulate; missing validation on polygon contour points. |
-| `SEC-0165` | **Sev 2** | NULL Pointer Dereference | `src/libbg/tri_tri.c:180-715` | `FIXED` | bg_tri_tri_isect_with_line unconditionally wrote to *coplanar, *isectpt1, and *isectpt2 without verifying destination pointers were non-null; missing NULL vertex validation across all triangle-triangle intersection routines. |
-| `SEC-0166` | **Sev 2** | NULL Pointer Dereference / Divide by Zero | `src/libbg/polygon_op.cpp:45-470` | `FIXED` | Unchecked NULL pointer dereferences in bg_find_polygon_area, bg_polygons_overlap, load_polygon, and clipping routines; potential division by zero on zero scale factor. |
-| `SEC-0167` | **Sev 2** | Integer Underflow / Out-of-bounds Read | `src/libbg/polygon_point_in.c:40-51` | `FIXED` | bg_pnt_in_polygon underflows j = nvert - 1 when nvert == 0 and allows nvert < 3 which is geometrically invalid for polygons; missing NULL pointer checks on pnts and test. |
-| `SEC-0168` | **Sev 3** | Out-of-bounds Read / Degenerate Buffer Access | `src/libbg/chull3d.cpp:115-210` | `FIXED` | bg_3d_chull and bg_3d_chull2 did not check for empty vertexBuffer or undersized indexBuffer before allocating and indexing; out-of-bounds access in bg_3d_chull2 if face index exceeded vmap size. |
-| `SEC-0169` | **Sev 3** | Spatial Partitioning Stride Corruption / Resource Leak | `src/libbg/vert_tree.c:140-180, 260-430` | `FIXED` | Stride indexing corruption in bg_vert_tree_add_w_norm where vertex coordinate data was accessed with stride 3 instead of stride 6 (ptr->vleaf.index * 3 vs index * 6), causing spatial partitioning corruption and reading wrong coordinate/normal data; permanent memory leaks in bg_vert_tree_destroy which failed to free the_array when the_tree was NULL and failed to free the bg_vert_tree container structure. |
-| `SEC-0170` | **Sev 2** | Truncated Integer Division / Overflow | `src/libbg/decimate.cpp:55-70, 160-175` | `FIXED` | Truncated integer division in trimesh_decimate_simple (1/cbin.size()) where 1 / cbin.size() evaluated to integer 0 for any bin with >1 point, collapsing the point accumulator to world origin [0,0,0] instead of the bin centroid; missing n_ifaces integer overflow guard. |
-| `SEC-0171` | **Sev 2** | Out-of-bounds Read / Unhandled Exception | `src/libbg/delaunator.hpp:40-55, 240-305` | `FIXED` | Out-of-bounds vector read in sum() on empty vector (indexing x[0]); out-of-bounds vector read and crash in Delaunator constructor when n < 3 or when seed points i0 or i1 are uninitialized (accessing coords[2 * INVALID_INDEX]); unhandled exception in bg_polygon_triangulate when Delaunator encounters degenerate collinear input. |
-| `SEC-0172` | **Sev 2** | Unchecked Error Code / Parameter Validation | `src/libbg/ballpivot.cpp:30-75` | `FIXED` | Unchecked negative return code in bg_3d_ballpivot (if (nfaces == 0) instead of if (nfaces <= 0)), allowing negative face count to be passed into bg_trimesh_3d_gc; missing validation for radii_cnt < 0 or radii_cnt > 0 with NULL radii; missing initial NULL assignment to output pointers. |
-| `SEC-0173` | **Sev 1** | Unchecked File Operation / Null Dereference | `src/libbg/RTree.h:465-480, 1740-1800` | `FIXED` | Unchecked fopen() return value in RTree::plot() and RTree::plot2d() leading to NULL pointer dereference on file write failure; missing NULL check on filename in RTFileStream::OpenRead and RTFileStream::OpenWrite; unguarded VertexDataSource count on NULL pointer in QuickHull.hpp. |
-| `SEC-0174` | **Sev 1** | Defensive Parameter Validation | `src/libbg/polygon_triangulate.cpp:560-585` | `FIXED` | Missing parameter validation in bg_detria for faces, num_faces, poly, poly_pnts, pts, holes_array, holes_npts, and steiner, which could cause segmentation faults when called with NULL or undersized inputs. |
-| `SEC-0175` | **Sev 3** | Pointer Corruption / Memory Leak / Logic Error | `src/libbg/trimesh.cpp:368-379, 458-465, 754, 789` | `FIXED` | In get_unmatched_edges, &unmatched was passed instead of unmatched to bg_trimesh_unmatched_edges with bg_trimesh_edge_gather, corrupting pointer memory; unmatched->count was used uninitialized in bu_calloc; edge_list was leaked permanently. In bg_trimesh_hanging_nodes, unmatched was leaked on all paths and memcpy was undersized (num_edges * 2 bytes instead of num_edges * 2 * sizeof(int)). In bg_trimesh_solid, a false positive solid result occurred when unmatched edges were zero but misoriented or excess edges existed, leaking memory and passing NULL to memcpy. |
-| `SEC-0176` | **Sev 2** | Out-of-Bounds Memory Access / Buffer Overflow | `src/libbg/trimesh.cpp:812, 840-848, 876-878` | `FIXED` | Missing vertex index bounds validation in bg_trimesh_aabb, bg_trimesh_area, and bg_trimesh_volume allowed out-of-bounds reads into point array p and out-of-bounds writes into visit_vert bitvector when called with corrupted or invalid mesh face data. |
-| `SEC-0177` | **Sev 2** | Logic Error / Inverted Topology Map | `src/libbg/trimesh_diff.cpp:67-77, 206-255, 313-348` | `FIXED` | In bg_trimesh_diff, ind_map_1 and ind_map_2 inverted the mapping from original to sorted vertex indices (ind_map[i] = orig_ind instead of ind_map[orig_ind] = i), and tri_2 indexed with f1 instead of f2, ignoring mesh 2 face data; bg_trimesh_hash had the same mapping inversion and an early break in its minimum vertex search loop; dbl_clamp could trigger float overflow on non-positive tolerance. |
-| `SEC-0178` | **Sev 2** | Unchecked Exception / Memory Leak / Input Validation | `src/libbg/spsr.cpp:52-54, 105-178` | `FIXED` | In bg_3d_spsr, missing parameter validation on points, normals, and face pointers allowed NULL pointer dereferences; num_input_pnts < 3 caused solver failures; negative cnt in PtStream caused unsigned overflow; unhandled C++ exceptions escaping the extern C boundary leaked implicit solver memory and aborted the program. |
-| `SEC-0179` | **Sev 2** | Unchecked File Operation / Null Pointer Dereference / Division by Zero | `src/libbg/trimesh_isect.cpp:56-74, 95-245, trimesh_plot3.cpp:82, 351-372` | `FIXED` | In trimesh_isect.cpp, plot_faces called pl_color on unchecked fopen() return, causing NULL pointer dereference on file write failure; bg_trimesh_isect failed to validate vertex indices in faces_1 and faces_2 against vertex counts, risking OOB access, and never assigned output intersecting faces. In trimesh_plot3.cpp, pntset_2d_plot3 used bitwise OR (!p | !c); polyline_2d_plot3 allowed division by zero on scale <= 0.0 and loop condition i < xy.size() - 1 dropped the last vertex before closing. |
-| `SEC-0180` | **Sev 1** | Input Validation / Integer Overflow / Exception Safety | `src/libbg/trimesh_remesh.cpp:82-87, trimesh_repair.cpp:126-131, trimesh_split.cpp:94-192, trimesh_sync.cpp:122` | `FIXED` | Missing vertex index validation, integer overflow guards on face counts / allocation sizes, and unhandled C++ exceptions escaping extern C functions in bg_trimesh_remesh, bg_trimesh_repair, bg_trimesh_separate, bg_trimesh_split, and bg_trimesh_sync. |
-| `SEC-0181` | **Sev 1** | Undefined Behavior / Data Loss / Out-of-Bounds Memory Access | `src/libbg/GTE/Mathematics/TriMesh.h:208-212, 536-580, 595-650, 715-775` | `FIXED` | status(EdgeHandle e) used reinterpret_cast<EdgeStatus&> on std::vector<bool>::operator[] proxy bit-reference yielding undefined behavior; TriMesh::garbage_collection() wiped face connectivity before reading vertices destroying active geometry; multiple handle and iterator methods lacked index bounds validation. |
-| `SEC-0182` | **Sev 2** | Input Validation / Integer Overflow / Denial of Service | `src/libbg/GTE/Mathematics/BotSmooth.h:85-115, BotSubdivide.h:48-95, 330-360` | `FIXED` | Unchecked face vertex indices allowed out-of-bounds reads into vertex coordinate arrays in gte_bot_smooth and gte_bot_subdivide; unconstrained subdivision recursion levels allowed exponential memory allocation and integer overflow. |
-| `SEC-0183` | **Sev 2** | Input Validation / Division by Zero / Matrix Solvability | `src/libbg/GTE/Mathematics/LSCMParameterization.h:96-120, 160-220, 275-310` | `FIXED` | Missing vertex index bounds checking on boundaryIndices, interiorIndices, and triangle vertex references when indexing vertices3D in MapBoundaryToCircle and Parameterize; unchecked linear system matrix dimensions could lead to division by zero or invalid memory access in SolveSymmetricCG. |
-| `SEC-0184` | **Sev 2** | Out-of-Bounds Memory Access / Input Validation | `src/libbg/GTE/Mathematics/MeshHoleFilling.h:275-320, 520-560, MeshPreprocessing.h:130-155, 225-255` | `FIXED` | Unchecked triangle vertex indices allowed out-of-bounds reads in ComputeEarScore3D, ComputeTriangulationArea, TriangulateHoleLSCM, and MeshPreprocessing::ComputeTriangleArea / ComputeSignedVolume / RemoveSmallComponents. |
-| `SEC-0185` | **Sev 3** | Null Pointer Dereference / Out-of-Bounds Array Access | `src/libbg/GTE/Mathematics/MeshQuality.h:230-236, MeshValidation.h:122-138, 220-250, MeshRepair.h:200-215, 430-495, 600-630, 990-1005` | `FIXED` | MeshQuality::ComputeTriangleRaw lacked null pointer validation for raw vertex pointers; MeshValidation::HasSelfIntersections and TriangleBoxesOverlap lacked empty mesh and vertex index bounds validation; MeshRepair lacked vertex index bounds validation in computeTotalArea, DetectIsolatedVertices, ColocateVertices, RelativeOrientation, Dissociate, and RemoveIsolatedVertices. |
-| `SEC-0186` | **Sev 2** | Unsigned Integer Underflow / Out-of-Bounds Memory Access | `src/libbg/tests/polygon_op.c:55-80, 240-270` | `FIXED` | In _bg_polygon_diff, offset calculation size_t p2_ind = ((offset + j) >= c1->num_points) ? (j - offset) : (offset + j); produces an unsigned integer underflow when j < offset, wrapping p2_ind to SIZE_MAX and causing an out-of-bounds array access. In addition, unvalidated dcr2 dereferencing could crash on empty polygons, and plot_files contained a contour array dimension mismatch. |
-| `SEC-0187` | **Sev 2** | Stack Buffer Overflow / Potential Null Pointer Dereference | `src/libbg/tests/bgtester.c:85-115, 230-260` | `FIXED` | In parse_case, parameter arrays d, l, i, u were fixed 50-element stack buffers populated in a while loop without bounds checking, allowing stack buffer overflows on inputs exceeding 50 parameters. In main, token strings returned by strtok were dereferenced without checking for NULL. |
-| `SEC-0188` | **Sev 3** | Null Pointer Dereference / Logical Indexing Flaw | `src/libbg/tests/chull.c:40-70, obr.c:45-75` | `FIXED` | In plot2d_chull, plot_chull3d, and plot_obr, fopen results were passed directly to pl_color and fclose without NULL verification, risking null pointer crashes if file creation failed. Additionally, plot2d_chull indexed pnt_array[i][0] when closing the polygon loop instead of pnt_array[0][Y]. |
-| `SEC-0189` | **Sev 3** | Division by Zero / Unchecked Parsing / Missing Pointer Validation | `src/libbg/tests/plane_dist.c:35-50, lseg_pt.c:45-65, geogram_optimizer.cpp:55-80` | `FIXED` | In plane_dist.c, relative error calculation performed division by expected_return without checking for zero, resulting in division by zero (NaN/Inf). In lseg_pt.c, sscanf return counts were unchecked, allowing uninitialized stack values to be used. In geogram_optimizer.cpp, converged_optimizer was dereferenced without checking for NULL. |
-| `SEC-0190` | **Sev 3** | Resource Leak / Memory Management | `src/libbg/tests/poly2tri.c:110-180, chull.c:120-170, chull3d.c:70-130` | `FIXED` | Dynamically allocated vertex, face, hole, and output polygon arrays allocated via bu_calloc/bu_malloc in poly2tri.c, chull.c, and chull3d.c were never freed prior to test completion or return, resulting in systematic memory leaks. |
-| `SEC-0191` | **Sev 3** | Resource Leak / Null Pointer Dereference | `src/libbg/tests/polygon_triangulate.c:48-62, 134-150, 184-192, 225-237, 269-281, 298-306` | `FIXED` | Dynamically allocated face index arrays allocated by bg_poly_triangulate and bg_nested_poly_triangulate across all five test cases were never released via bu_free prior to block exit, causing memory leaks. In addition, _tess_report lacked validation guarding against NULL face and point arrays. |
-| `SEC-0192` | **Sev 2** | Out-of-Bounds Substring / Unchecked Pointer Dereference | `src/libbg/tests/tri_ray_isect.cpp:44-64, tri_tri_isect_coplanar.cpp:41-61` | `FIXED` | In read_point(), if an empty or whitespace-only argument was supplied, find_first_not_of returned std::string::npos, causing substr(sp, ep-sp+1) to throw an unhandled std::out_of_range exception. Additionally, input pointers p and arg were not validated before use, and sscanf return values in main were unchecked. |
-| `SEC-0193` | **Sev 3** | Uninitialized Stack Memory / Unchecked Input Parsing | `src/libbg/tests/tri_tri_isect.c:31-66, tri_closest_pt.c:43-53` | `FIXED` | In tri_tri_isect.c, stack variables f1 and f2 were left uninitialized in declaration float f1, f2, f3 = 0.0;, and sscanf return counts were unchecked across all coordinate arguments in tri_tri_isect.c and tri_closest_pt.c, risking calculation using uninitialized stack coordinates upon malformed input. |
-| `SEC-0194` | **Sev 3** | Null Pointer Dereference Guard / Code Quality | `src/libbg/tests/trimesh_sync.c:109-130, tri_area.c:49-53` | `FIXED` | In trimesh_sync.c, error reporting function parrays() dereferenced ff and ctrl pointers without verifying that they were non-NULL, risking null pointer dereferences during error handling. In tri_area.c, an extraneous duplicate semicolon was cleaned up. |
-| `SEC-0195` | **Sev 2** | Out-of-Bounds Memory Access / Buffer Overflow | `src/libbg/geogram/NL/nl_matrix.c:765-780` | `FIXED` | In nlSparseMatrixConstruct, the row array was allocated with capacity m (NL_NEW_ARRAY(NLRowColumn, m)), but the row initialization loop mistakenly iterated up to n (for (i=0; i<n; i++)). If the column count n exceeded the row count m, this resulted in an out-of-bounds write past the allocated row buffer; if n < m, rows from n to m-1 remained uninitialized. |
-| `SEC-0196` | **Sev 1** | Logic Error / Broken Comparator | `src/libbg/geogram/NL/nl_matrix.c:132-143` | `FIXED` | In nlCoeffCompare, the comparator callback returned (((NLCoeff*)(p2))->index < ((NLCoeff*)(p1))->index), returning only 0 or 1. It violated strict weak ordering required by qsort/bu_sort (never returning negative values when p1 < p2), risking non-deterministic sort order or sorting anomalies. |
-| `SEC-0197` | **Sev 2** | Format String / Type Mismatch & Division by Zero | `src/libbg/geogram/NL/nl_blas.c:1440-1455, 1495-1510` | `FIXED` | In host_blas_show_stats, nlBlasGFlops() returns a double, but was passed to nl_printf using %d format specifier, risking register/stack corruption on 64-bit platforms. Furthermore, nlBlasGFlops() divided by elapsed_time without checking for zero elapsed time. |
-| `SEC-0198` | **Sev 2** | Divide-by-Zero / Floating Point Exception | `src/libbg/geogram/NL/nl_api.c, src/libbg/geogram/NL/nl_preconditioners.c:nl_api.c:660-675, nl_preconditioners.c:110-130, 215-265` | `FIXED` | In nlNormalizeRow, the normalization divided by vector norm without checking if the norm was zero, leading to division by zero on degenerate rows. In Jacobi and SSOR preconditioners (nlNewJacobiPreconditioner, nlSparseMatrixMultLowerInverse, nlSparseMatrixMultUpperInverse), diagonal entries were divided without guards against zero diagonal entries. |
-| `SEC-0199` | **Sev 1** | Macro Hazard / Null Pointer Dereference Guard | `src/libbg/geogram/NL/nl_private.h, src/libbg/geogram/NL/nl_os.c, src/libbg/geogram/NL/nl_amgcl.cpp:nl_private.h:288-300, nl_os.c:55-135, nl_amgcl.cpp:178-195` | `FIXED` | NL_DELETE and NL_DELETE_ARRAY macros expanded to multiple unbracketed statements (free(x); x = NULL), creating dangerous syntax and logic errors when used inside unbraced single-line conditionals. Error reporting and assertion handlers in nl_os.c lacked NULL checks on function pointers and format arguments. AMGCL solver interface in nl_amgcl.cpp lacked NULL checks on context, matrices, and vectors. |
-| `SEC-0200` | **Sev 3** | Buffer Overflow / Logic Error in Dimension Check | `src/libbg/geogram/basic/attributes.cpp:390-405` | `FIXED` | In AttributesManager::copy_attribute, the compatibility check between existing attribute and destination attribute tested if ((store->size() != new_store->size()) && (store->dimension() != new_store->dimension()) && (store->element_size() != new_store->element_size())) using logical AND (&&) instead of logical OR (||). If the attributes had matching dimensions but differing element counts, the condition evaluated to false, allowing memcpy to copy an oversized source buffer into an undersized destination buffer, causing a critical heap buffer overflow. |
-| `SEC-0201` | **Sev 2** | Memory Leak / Missing Destructor & Dangling Pointer | `src/libbg/geogram/basic/thread_sync.h:150-227` | `FIXED` | BasicSpinLockArray allocated heap memory via new spinlock[size_in], but lacked a destructor (~BasicSpinLockArray()), causing all allocated spinlock arrays to be leaked upon destruction. Furthermore, BasicSpinLockArray::clear() deleted the array without resetting size_ to 0 or spinlocks_ to nullptr, and CompactSpinLockArray::clear() did not reset spinlocks_ to nullptr, leaving dangling pointers. |
-| `SEC-0202` | **Sev 2** | Memory Management Flaw / Out-of-Bounds Read & Write | `src/libbg/geogram/basic/packed_arrays.cpp, src/libbg/geogram/basic/packed_arrays.h:packed_arrays.cpp:90-185, packed_arrays.h:160-165` | `FIXED` | In PackedArrays, calloc return values were not checked for allocation failure. In resize_array, realloc(ZV_[array_index], 0) was invoked when shrinking to <= Z1_block_size_, risking platform-dependent memory leaks or undefined behavior, and the realloc return was directly assigned without failure handling. Array accessors (get_array, set_array, resize_array, array_size) lacked bounds checks on array_index in release mode. |
-| `SEC-0203` | **Sev 2** | Integer Underflow & Unbounded Stack Allocation | `src/libbg/geogram/basic/parallel.cpp, src/libbg/geogram/basic/permutation.h, src/libbg/geogram/basic/attributes.cpp:parallel.cpp:67-85, permutation.h:158-240, attributes.cpp:160-180` | `FIXED` | In parallel_for, if from >= to, unsigned integer subtraction to - from underflowed to a massive positive number (~4 billion), causing thread spawning loops with out-of-bounds tasks. In Permutation::apply and AttributeStore::swap_items, BRLCAD_ALLOCA was invoked unconditionally on element sizes, risking stack overflow on large elements. In Permutation::apply(vector<T>&, ...), mismatch between data size and permutation size was not checked, violating documented contract and causing out-of-bounds access. |
-| `SEC-0204` | **Sev 1** | Macro Precedence Hazards & Divide-by-Zero / Floating-Point Exception | `src/libbg/geogram/basic/assert.h, src/libbg/geogram/basic/memory.h, src/libbg/geogram/basic/geometry_nd.h, src/libbg/geogram/basic/rationalg.h, src/libbg/geogram/basic/vecg.h:assert.h:145-215, memory.h:390-485, geometry_nd.h:215-295, rationalg.h:540-550, vecg.h:180-195` | `FIXED` | Assertions in assert.h were defined with raw braces { ... } rather than do { ... } while(0), causing dangling-else and syntax errors in conditional contexts. geo_aligned_alloca macro parameter was unparenthesized. Memory::aligned_allocator::allocate lacked integer overflow check on size * sizeof(T). triangle_area lacked max(A2, 0.0) guard causing sqrt(negative) NaNs, and triangle_circumcenter divided by determinant without zero check. rationalg::estimate() divided by denominator without zero check. vecng initializer_list constructor lacked bounds check on iteration count. |
-| `SEC-0205` | **Sev 2** | Out-of-Bounds Memory Access & Integer Overflow | `src/libbg/geogram/mesh/index.h, src/libbg/geogram/mesh/mesh.h, src/libbg/geogram/mesh/mesh.cpp:index.h:70-130, mesh.h:200-475, mesh.cpp:115-460` | `FIXED` | In MeshCells::pop(), cell_ptr_[nb()-1] was accessed unconditionally; simplicial meshes store an empty or single-element cell_ptr_, resulting in heap out-of-bounds reads. In MeshVertices::copy, point_ptr(0) was called when rhs.nb() == 0, accessing beyond empty buffers. In Mesh::get_subelements_by_type and get_subelements_by_index, invalid queries dereferenced null pointers *(MeshSubElementsStore*)nullptr. Index classes left buffer arrays uninitialized in default constructors. create_sub_elements and reserve lacked integer multiplication overflow guards. In connect_tets and connect, corrupt facet/cell vertex indices were not validated against vertices_.nb(). |
-| `SEC-0206` | **Sev 2** | Divide-by-Zero & Out-of-Bounds Vector Access | `src/libbg/geogram/mesh/mesh_AABB.h, src/libbg/geogram/mesh/mesh_AABB.cpp:mesh_AABB.h:45-1250, mesh_AABB.cpp:35-180` | `FIXED` | In ray_triangle_intersection, 1.0 / det was calculated prior to checking whether fabs(det) >= 1e-20, causing floating-point division by zero and NaN/Inf propagation on rays coplanar to triangle planes. Querying or intersecting AABB trees built on empty meshes (nb() == 0) accessed bboxes_[1] out-of-bounds and caused infinite recursion in max_node_index. |
-| `SEC-0207` | **Sev 1** | Divide-by-Zero & Denial of Service / Process Abort | `src/libbg/geogram/mesh/mesh_geometry.h, src/libbg/geogram/mesh/mesh_geometry.cpp, src/libbg/geogram/mesh/mesh_halfedges.cpp:mesh_geometry.h:210-240, mesh_geometry.cpp:80-160, mesh_halfedges.cpp:60-145` | `FIXED` | mesh_facet_center and mesh_cell_center divided by corner/vertex counts without checking for empty facets/cells (0 count). In mesh_geometry.cpp, normalize was called on zero vectors, and bounding box functions did not validate null output pointers or zero-vertex meshes. In MeshHalfedges, border and vertex traversals on non-manifold or cyclical meshes aborted the process via geo_assert_not_reached or geo_assert(count < 10000) instead of gracefully failing. |
-| `SEC-0208` | **Sev 2** | Out-of-Bounds Memory Access, Stack Exhaustion & Process Abort | `src/libbg/geogram/mesh/mesh_repair.cpp, src/libbg/geogram/mesh/mesh_preprocessing.h, src/libbg/geogram/mesh/mesh_preprocessing.cpp, src/libbg/geogram/mesh/mesh_topology.cpp:mesh_repair.cpp:65-175, 490-590, 665-685, 820-840, 920-1010, 1145-1215; mesh_preprocessing.h:77; mesh_preprocessing.cpp:65-135; mesh_topology.cpp:48-105` | `FIXED` | In repair_connect_facets, v2c[v1], c2f[c2], and next_c_around_v[c] were indexed without validating vertex/corner indices against mesh element counts, causing out-of-bounds array reads. facet_is_degenerate and normalize_facet_vertices_order performed unbounded BRLCAD_ALLOCA stack allocations for vertex arrays on arbitrary polygonal facets without heap fallback, causing stack overflow vulnerabilities. find_corner, repair_propagate_orientation, and SimplePriorityQueue::pop aborted the process on malformed topological meshes via geo_assert_not_reached. mesh_colocate_vertices_no_check indexed old2new without bounds checks. In mesh_preprocessing.cpp and mesh_topology.cpp, empty meshes or unbound attributes resulted in out-of-bounds indexing in component traversal and signed volume calculation. |
-| `SEC-0209` | **Sev 2** | Divide-by-Zero & Out-of-Bounds Buffer Indexing | `src/libbg/geogram/mesh/mesh_reorder.cpp, src/libbg/geogram/mesh/mesh_remesh.cpp:mesh_reorder.cpp:280-295, 430-445, 570-585, 935-945, 1115-1175; mesh_remesh.cpp:75-80, 125-140, 150-165, 205-255, 285-295, 470-505` | `FIXED` | In mesh_reorder.cpp, Base_fcmp::center and Base_ccmp::center computed 1.0 / double(nb_vertices) without checking nb_vertices == 0, causing floating-point division by zero; Base_tcmp accessed 4 cell vertices without validating vertex count. In mesh_remesh.cpp, remesh_smooth and mesh_adjust_surface crashed or had undefined behavior on empty meshes or meshes with dimension < 3; mesh_adjust_surface divided by double(d) on facets with 0 vertices; create_ribbon_on_border called normalize on zero-length normal vectors, causing NaNs. |
-| `SEC-0210` | **Sev 2** | Divide-by-Zero & Buffer Overflow | `src/libbg/geogram/mesh/mesh_sampling.h:mesh_sampling.h:68-95, 120-165, 215-265, 285-335` | `FIXED` | In mesh_generate_random_samples_on_surface and mesh_generate_random_samples_in_volume, division by total area (Atot) and total volume (Vtot) occurred without checking Atot <= 0.0 or Vtot <= 0.0, resulting in division by zero and NaN sample coordinates on degenerate meshes. mesh_facet_mass and mesh_tetra_mass lacked bounds checking on facet/cell vertex counts and attribute arrays, potentially reading out of bounds. |
-| `SEC-0211` | **Sev 2** | Out-of-Bounds Memory Access & Assertion Abort | `src/libbg/geogram/delaunay/delaunay.cpp, src/libbg/geogram/delaunay/delaunay.h:delaunay.cpp:115-180, 245-290; delaunay.h:200-245` | `FIXED` | In delaunay.cpp (update_v_to_cell, update_cicl, get_neighbors_internal, save_histogram), missing bounds checks on vertex and cell indices allowed out-of-bounds writes to v_to_cell_ and cicl_ on corrupted mesh topology or NO_INDEX vertices. In save_histogram, an off-by-one check (histogram.size() <= N instead of < N) allowed out-of-bounds array writes. In delaunay.h, geo_assert_not_reached() was called on unlinked cells causing process crashes instead of graceful failure. |
-| `SEC-0212` | **Sev 2** | Stack Exhaustion & Unbounded Allocation | `src/libbg/geogram/delaunay/delaunay_nn.cpp:delaunay_nn.cpp:120-195, 230-310` | `FIXED` | In delaunay_nn.cpp (enlarge_neighborhood, store_neighbors_CB, get_neighbors_internal), unbounded BRLCAD_ALLOCA was used for neighbor candidate and distance arrays proportional to requested neighbor counts. High neighbor counts or deep recursion could exhaust thread call stacks causing stack overflow crashes. Additionally, float equality comparison against 0.0 triggered compiler warnings. |
-| `SEC-0213` | **Sev 2** | Stack Exhaustion & Unbounded Allocation | `src/libbg/geogram/points/colocate.cpp:colocate.cpp:85-150` | `FIXED` | In Colocate::find_nearest_neighbors, unbounded BRLCAD_ALLOCA was invoked per point for neighbor query arrays based on requested neighbor counts, creating risk of stack overflow on large neighbor queries. |
-| `SEC-0214` | **Sev 3** | Uninitialized Memory, Out-of-Bounds Access & Infinite Recursion | `src/libbg/geogram/points/kd_tree.cpp, src/libbg/geogram/points/kd_tree.h:kd_tree.h:110-145; kd_tree.cpp:180-260, 410-480, 520-600` | `FIXED` | In kd_tree.h, KdTree::NearestNeighbors constructor initialized loop condition with nb_neighbors (which was 0) instead of nb_neighbors_max, leaving neighbor index and distance arrays uninitialized and leaking memory to user callers via copy_to_user(). In kd_tree.cpp, AdaptiveKdTree::split_kd_node failed to clamp split point m, resulting in child nodes duplicating parent intervals [b, e) and causing infinite recursion and call stack exhaustion. KdTree::get_nearest_neighbors_leaf used fixed-size stack arrays local_idx[MAX_LEAF_SIZE] without checking e - b <= MAX_LEAF_SIZE. BalancedKdTree::get_node and AdaptiveKdTree::get_node lacked bounds checks on node index n. |
-| `SEC-0215` | **Sev 2** | Out-of-Bounds Access & Assertion Abort | `src/libbg/geogram/points/nn_search.cpp, src/libbg/geogram/points/nn_search.h:nn_search.h:70-90; nn_search.cpp:45-75` | `FIXED` | In nn_search.cpp (get_nearest_neighbors), query point index q_index was not validated against nb_points(), risking out-of-bounds point access. In nn_search.h (get_nearest_neighbor), geo_assert(result < nb_points()) triggered process abort when no neighbors were found on empty point sets instead of returning NO_INDEX. |
-| `SEC-0216` | **Sev 3** | Memory Corruption & Heap Buffer Under-Allocation | `src/libbg/geogram/numerics/multi_precision.cpp, src/libbg/geogram/numerics/multi_precision.h:multi_precision.h:115-125; multi_precision.cpp:80-145, 595-610` | `FIXED` | In multi_precision.cpp, Pools allocator used slot sizes smaller than sizeof(void*) on 64-bit platforms, causing heap corruption when casting to freelist pointers; missing null check in free; missing integer overflow guard on expansion capacity. |
-| `SEC-0217` | **Sev 2** | Out-of-Bounds Memory Access & Integer Underflow | `src/libbg/geogram/numerics/multi_precision.cpp:multi_precision.cpp:215-230, 240-275, 305-330, 680-720` | `FIXED` | In multi_precision.cpp, compress_expansion underflowed index m on lengths <= 1, causing out-of-bounds heap memory access; scale_expansion_zeroelim, fast_expansion_sum_zeroelim, fast_expansion_diff_zeroelim read out-of-bounds on zero-length expansions; assign_sq_dist and assign_dot_at underflowed dimension dim == 0 causing infinite recursion. |
-| `SEC-0218` | **Sev 2** | Assertion Failure Denial-of-Service Crashes | `src/libbg/geogram/numerics/predicates.cpp, src/libbg/geogram/numerics/PCK.h:PCK.h:170-175; predicates.cpp:445-460, 620-635, 960-975, 1130-1145, 1395-1410, 1535-1550` | `FIXED` | In predicates.cpp, exact predicate implementations aborted via SIGABRT on geo_assert(Delta_sign != ZERO) on degenerate/collinear inputs instead of gracefully returning ZERO; PCK.h SOS() asserted on invalid mode. |
-| `SEC-0219` | **Sev 2** | Mathematical Logic Flaw & Missing Pointer Validation | `src/libbg/geogram/numerics/predicates.cpp, src/libbg/geogram/numerics/predicates.h, src/libbg/geogram/numerics/PCK.cpp:PCK.cpp:25-35; predicates.h:260-275; predicates.cpp:1640-2260` | `FIXED` | In predicates.cpp (PCK::dot_3d), det_3d_filter was erroneously invoked instead of dot_3d_filter; geometric predicates lacked null pointer checks on double* coordinate inputs; percent() lacked division by zero protection. |
-| `SEC-0220` | **Sev 3** | Use-After-Free / Dangling Pointer & Missing Null Validation | `src/libbg/geogram/voronoi/RVD.cpp:1754-1775, 1810-1855, 2480-2500, 2535-2587` | `FIXED` | In prepare_projection(), mesh_vertices_ held a raw pointer to a local vector<double> destroyed upon function return, causing project_points_on_surface() to read through a dangling pointer (use-after-free). In RestrictedVoronoiDiagram::create, delaunay was dereferenced prior to checking for null pointer. |
-| `SEC-0221` | **Sev 2** | Buffer Overflow, Integer Shift Overflow, Unchecked Realloc & Vector Stack Underflow | `src/libbg/geogram/voronoi/generic_RVD_utils.h, src/libbg/geogram/voronoi/generic_RVD_vertex.h:generic_RVD_utils.h:45-55, 275-290, 345-385; generic_RVD_vertex.h:175-195, 240-260, 270-300, 725-770` | `FIXED` | In generic_RVD_utils.h, VectorStack::pop() called pop_back() on empty vectors causing out-of-bounds underflow; array_capacity computed 1 << (result - 1) with 32-bit signed shift that overflowed on large capacities; and insert() directly reassigned realloc return pointers without failure validation. In generic_RVD_vertex.h, small_set appended past capacity DIM without bounds checks; PointAllocator lacked chunk allocation failure handling and bounds checks. |
-| `SEC-0222` | **Sev 2** | Denial-of-Service Assertion Aborts & Unchecked Pointer Dereferences | `src/libbg/geogram/voronoi/generic_RVD_cell.cpp, src/libbg/geogram/voronoi/generic_RVD_polygon.cpp, src/libbg/geogram/voronoi/RVD_callback.cpp, src/libbg/geogram/voronoi/RVD.cpp:generic_RVD_cell.cpp:635-645, 1020-1040; generic_RVD_polygon.cpp:520-530; RVD_callback.cpp:80-95; RVD.cpp:1620-1695, 2410-2420, 2580-2585` | `FIXED` | In side_exact, initialize_from_surface_mesh, triangulate_polygon, run_thread, and RestrictedVoronoiDiagram::create, assertions geo_assert and geo_assert_not_reached were triggered on non-simplex facets, unexpected topology, or unhandled dimensions, terminating the process via SIGABRT. |
-| `SEC-0223` | **Sev 2** | Out-of-Bounds Access, Missing Null Guards & Zero Division | `src/libbg/geogram/voronoi/CVT.cpp, src/libbg/geogram/voronoi/CVT.h:CVT.h:120-140, 195-215; CVT.cpp:60-80, 135-155, 175-195, 230-260, 310-340, 360-390` | `FIXED` | In CVT.cpp and CVT.h, constructors and member methods accepted Mesh* and double* pointers without null validation, accessed empty embedding vectors, and performed unvalidated indexing and division when dimension_ or point counts were zero. |
-| `SEC-0224` | **Sev 2** | Division by Zero, Out-of-bounds Vector Access & Dimension Validation | `src/libbg/geogram/third_party/LBFGSpp/include/LBFGS.h:LBFGS.h:170-175, 230-240; LBFGSB.h:205-215; BFGSMat.h:115-125, 270-340, 480-505; BKLDLT.h:80-95, 125-140, 160-175; Cauchy.h:120-145, 175-190; LineSearchMoreThuente.h:34-55, 71-125; LineSearchNocedalWright.h:42-50, 94-98; Param.h:210, 368; SubspaceMin.h:44-58, 134-138` | `FIXED` | In LBFGSpp optimization routines, missing zero guards on matrix determinants, Hessian eigenvalues, line search denominators, and empty input vector dimensions allowed potential divisions by zero, infinite loops, and out-of-bounds array access on degenerate or singular optimization problems. |
-| `SEC-0225` | **Sev 2** | Out-of-bounds Array Access, Null Dereference, Division by Zero & Traversal Flaw | `src/libbg/geogram/third_party/amgcl/amgcl/adapter/zero_copy.hpp, src/libbg/geogram/third_party/amgcl/amgcl/amg.hpp, src/libbg/geogram/third_party/amgcl/amgcl/backend/builtin.hpp, src/libbg/geogram/third_party/amgcl/amgcl/backend/detail/matrix_ops.hpp, src/libbg/geogram/third_party/amgcl/amgcl/backend/interface.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/detail/galerkin.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/plain_aggregates.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/pointwise_aggregates.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/smoothed_aggr_emin.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/smoothed_aggregation.hpp, src/libbg/geogram/third_party/amgcl/amgcl/coarsening/tentative_prolongation.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/inverse.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/qr.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/sort_row.hpp, src/libbg/geogram/third_party/amgcl/amgcl/detail/spgemm.hpp, src/libbg/geogram/third_party/amgcl/amgcl/make_solver.hpp, src/libbg/geogram/third_party/amgcl/amgcl/preconditioner/dummy.hpp, src/libbg/geogram/third_party/amgcl/amgcl/relaxation/spai0.hpp, src/libbg/geogram/third_party/amgcl/amgcl/reorder/cuthill_mckee.hpp, src/libbg/geogram/third_party/amgcl/amgcl/solver/cg.hpp, src/libbg/geogram/third_party/amgcl/amgcl/solver/skyline_lu.hpp, src/libbg/geogram/third_party/amgcl/amgcl/util.hpp, src/libbg/geogram/third_party/amgcl/amgcl/value_type/interface.hpp` | `FIXED` | In AMGCL solver and preconditioner routines, missing bounds checks on row/column indices and negative aggregate IDs allowed out-of-bounds array reads and writes. Missing checks for singular pivots, zero denominators, and zero spectral radius allowed divisions by zero. Unchecked matrix and vector pointers allowed null pointer dereferences. A loop condition logic error in Cuthill-McKee reordering skipped node 0 during graph level set traversal. |
-| `SEC-0226` | **Sev 2** | Null Pointer Dereference, Division by Zero, Out-of-bounds Array Access | `src/libbrep/BBNode.cpp, src/libbrep/BRNode.cpp, src/libbrep/PullbackCurve.cpp, src/libbrep/Subcurve.cpp, src/libbrep/Subsurface.cpp, src/libbrep/assembly.cpp, src/libbrep/boolean.cpp, src/libbrep/brep_defines.h` | `FIXED` | In libbrep core evaluation, trimming, assembly, and pullback routines, missing null checks on curve, surface, face, and child pointers could result in null pointer dereferences. Missing checks against zero denominators in cubic curve interpolation, knot intervals, Newton solver steps, and basis control ratio calculations could cause division by zero. Edge index parameters in edge merging routines lacked array bounds checks before indexing brep edge tables. |
-| `SEC-0227` | **Sev 2** | Null Pointer Dereference, Division by Zero, Out-of-bounds Index, Resource Leak | `src/libbrep/px_event.cpp, src/libbrep/ssx_event.cpp, src/libbrep/quality.cpp, src/libbrep/edit.cpp, src/libbrep/debug_plot.cpp` | `FIXED` | In px_event.cpp, Compare() returned inverted null-pointer values and used boolean instead of 3-way integer comparison for sorting. In ssx_event.cpp, DumpSSXEvent() unconditionally dereferenced m_curveA, m_curveB, and m_curve3d without null checks. In quality.cpp, bbox_contains() evaluated an invalid point, and edge quality iteration lacked vertex and trim index bounds validation. In edit.cpp, brep_edge_create() lacked curve/vertex index bounds checks, and calculateTangentVectors(), getPosRoot(), bsplineBasisFuns(), and solveTridiagonalint() had unguarded divisions by potentially-zero denominators. In debug_plot.cpp, write_plot_to_file() used fopen() result without null check. |
-| `SEC-0228` | **Sev 2** | Null Pointer Dereference, Out-of-bounds Vector Access, Resource Leak | `src/libbrep/cdt/cdt.cpp, src/libbrep/cdt/cdt_util.cpp, src/libbrep/cdt/mesh.cpp, src/libbrep/cdt/ovlps_simple.cpp, src/libbrep/cdt/surf.cpp, src/libbrep/cdt/tri_isect.cpp` | `FIXED` | In cdt.cpp and ovlps_simple.cpp, missing size validation and null pointer checks on bedge_seg_t::uedges() results caused potential out-of-bounds access and null pointer dereference. In mesh.cpp, bedge_seg_t::uedges() lacked trim index bounds checking and null pointer validation. Across mesh.cpp, cdt_util.cpp, tri_isect.cpp, and surf.cpp, pervasive unchecked fopen() return values in debug plot functions caused potential NULL pointer dereferences. |
-| `SEC-0229` | **Sev 2** | Memory Access Violation, Out-of-bounds Array Access, Memory Leaks, Division by Zero, Null Pointer Dereference | `src/libbrep/shape_recognition/cone.cpp, src/libbrep/shape_recognition/cylinder.cpp, src/libbrep/shape_recognition/pipeline.cpp, src/libbrep/shape_recognition/planar.cpp, src/libbrep/shape_recognition/shape_recognition.cpp, src/libbrep/shape_recognition/sphere.cpp, src/libbrep/shape_recognition/sr_util.cpp, src/libbrep/shape_recognition/torus.cpp` | `FIXED` | In planar.cpp, an off-by-one loop condition j <= array_end - array_start caused out-of-bounds read and write in triangulate_array_with_holes; outer_pt_ind, holes arrays, vert_map, and loop_starts leaked on every triangulation; BU_PTBL_GET dereferenced empty island_children causing null dereference crash; in cylinder.cpp, points[3] was accessed without checking points count > 3, and implicit_plane_ind was indexed without bounds checks; in cone.cpp, loop over cone planes indexed plane 1 when count was 1, and sin(C) was divided without zero checking; in pipeline.cpp, nde array leaked across multiple return paths, and nonplanar_surfaces was dereferenced when empty; in shape_recognition.cpp, unchecked fol_to_i iterator dereference caused crash, subbrep_shoal_data leaked when shoal_csg failed, and face_surface_types and uninserted sb leaked on failure; in sr_util.cpp, BU_PUT for obj->nucleus erroneously freed subbrep_shoal_data with struct csg_obj_params size/tag, and empty face->m_li caused out-of-bounds loop access; in sphere.cpp, a typo c2->IsArc(NULL, &a1) left a2 uninitialized and leaked curve duplicates c1 and c2; in torus.cpp, arc loop leaked curve ecv and ep_normal was incorrectly set to torus.plane.Normal(). |
-| `SEC-0230` | **Sev 2** | Memory Leaks, Uncontrolled Recursion, Out-of-bounds Array Access, Null Pointer Dereference, Logic Error | `src/libbrep/tools/tools.cpp, src/libbrep/tools/tools_util.cpp, src/libbrep/tests/brep_cdt_hole_face17.c, src/libbrep/tests/brep_cdt_hole_face27.c, src/libbrep/tests/brep_cdt_invalid.cpp, src/libbrep/tests/brep_cdt_mesh.cpp, src/libbrep/tests/assembly.cpp, src/libbrep/tests/ppx.cpp, src/libbrep/tests/pullback_context.cpp, src/libbrep/tests/test_curve_intersect.cpp, src/libbrep/tests/test_point_intersect.cpp` | `FIXED` | In libbrep tools and tests: in tools.cpp, find_next_point placed recursion limit inside else block, causing infinite recursion and stack exhaustion; ON_Curve_Get_Tangent and ON_Curve_Has_Tangent lacked null pointer and direction bounds checks; in ON_Surface_IsStraight, frames[0] and frames[1] were repeatedly indexed instead of frames[i] and frames[j]; in tools_util.cpp, ON_BrepTikz leaked duplicate edge curves on non-linear edges, and lacked null pointer and array bounds checks; in brep_cdt_mesh.cpp, invalid argument count printed usage but proceeded without exiting, dereferencing invalid argv[1]; in brep_cdt_hole_face17.c and brep_cdt_hole_face27.c, multiple heap-allocated arrays leaked on test completion; across test executables, argv[0] was passed to bu_setprogname without validating argc > 0 and argv != NULL. |
-| `SEC-0231` | **Sev 2** | Infinite Loop Denial of Service, Null Pointer Dereference, Division by Zero, Missing Bounds Validation | `src/libfft/fftfast.c, src/libfft/splitdit.c, src/libfft/ditsplit.c, src/libfft/fftc.c, src/libfft/ifftc.c, src/libfft/splitditc.c, src/libfft/ditsplitc.c, src/libfft/fftest.c` | `FIXED` | In libfft routines: init_sintab infinite loop on invalid size, unchecked calloc returns, cdiv zero division, and missing null pointer and bounds checks across forward/inverse FFT transforms and test generators. |
-| `SEC-0232` | **Sev 2** | Buffer Overflow, Out-of-Bounds Array Access, Division by Zero & Missing Pointer Validation | `src/libtermio/libtermio.h, src/libtermio/linenoise.hpp` | `FIXED` | In libtermio: terminal parameter arrays sized FOPEN_MAX lacked fd bounds checks, FD_SET lacked fd bounds checks in termio_getch, EditHistoryNext used unbounded strcpy, EditInsert lacked buffer capacity checks, and refresh lines divided by unchecked cols_. |
-| `SEC-0233` | **Sev 2** | Out-of-Bounds Array Access, Division by Zero, and Missing Pointer Validation | `src/libpc/gecode_librt_test.cpp, src/libpc/solver_test.cpp, src/libpc/vm_test.cpp, src/libpc/domain_constraint_propagator.cpp, src/libpc/cartesian-heart.cpp, src/libpc/gecode_solver_test.cpp` | `FIXED` | In libpc: unchecked point indices in geometry constraint helpers, null dereference in solver test functors and parameter access, zero division in math VM test, and unchecked Space* pointers in domain constraint propagators. |
-| `SEC-0234` | **Sev 2** | Use-After-Free, Double-Free, Buffer Overflow, and Resource Leaks | `src/nirt/main.cpp, src/nirt/showshot.c` | `FIXED` | In nirt: premature db_close caused use-after-free, double-free on failure cleanup, double pclose/fclose on shared output stream, leaked rt_read_cmd buffers, unbounded rname copy in showshot, and unchecked radius input. |
-| `SEC-0235` | **Sev 2** | Heap/Stack Buffer Overflow, Pointer Underflow, and Memory Leaks | `src/bwish/cmd.c, src/bwish/input.c, src/bwish/main.c` | `FIXED` | In bwish/btclsh: wrong struct size in historyInit realloc, missing capacity check in history_record_priv, off-by-one read in inputHandler, size_t underflow in processChar, negative pointer arithmetic in editing handlers, and unchecked fd in FD_SET. |
-| `SEC-0236` | **Sev 2** | Format String Bugs, Division Errors, File Descriptor Leaks, and Bounds Checks | `bench/clean.c, bench/compute.c, bench/run.c, bench/pixcmp.c, bench/benchmark.c` | `FIXED` | In bench suite: vls accumulation bug and memory leak in clean.c, off-by-one element count causing negative division in compute.c, passing bu_vls by value to %s in run.c, argv[1] OOB access and file descriptor leaks in pixcmp.c and benchmark.c. |
-| `SEC-0237` | **Sev 2** | Buffer Bounds, Resource Leaks, Null Dereferences, and Out-of-Bounds Memory Access | `src/art/tile.cpp, src/art/brlcadplugin.h, src/art/brlcadplugin.cpp, src/art/art.cpp` | `FIXED` | In art Appleseed integration: missing frame/fbp checks and row offset calculation in tile.cpp, missing rt_i_destroy and thread index clamping in brlcadplugin.cpp, leaked ged instances and open dbip in art.cpp, and leaked temporary vls buffers. |
-| `SEC-0238` | **Sev 2** | Buffer Overflow, Out-of-bounds Array Access, Null Pointer Dereference, and Input Validation | `src/launcher/launcher.c, src/launcher/registry.c, src/launcher/launch.c, src/launcher/fbtext.c, src/launcher/ui_fb.c, src/launcher/ui_text.c` | `FIXED` | In launcher: unchecked argc/argv in main, null pointer dereference in list_apps, unchecked registry growth and bu_dir results, framebuffer vertical row bounds checks in draw_char, and button action index bounds checks in ui_fb.c. |
-| `SEC-0239` | **Sev 2** | Buffer Overflow, Memory Leaks, Division by Zero, Null Pointer Dereference, and Out-of-Bounds Memory Access | `src/isst/gfile.h, src/isst/gfile.cpp, src/isst/isstgl.h, src/isst/isstgl.cpp, src/isst/main.cpp, src/isst/main_window.cpp, src/isst/isstapp.cpp` | `FIXED` | In isst: uninitialized GFile members and memory leaks in closedb(), static gcvwriter global state, out-of-bounds array write in nmg_to_adrt_internal, out-of-bounds vertex indexing and leaked intern in nmg_to_adrt_regstart, leaked db_path_to_string buffers, uninitialized camera in TIERenderer, division by zero in resize(), null tie dereference in render(), missing render mutex in set_tie(), and unchecked argc/argv in main. |
-| `SEC-0240` | **Sev 1** | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Array Access, and Null Pointer Dereferences | `src/libbv/*` | `FIXED` | In libbv: fixed display list and scene object leaks, division by zero in camera and knob math, and array bounds in polygon and clipping routines. |
-| `SEC-0241` | **Sev 1** | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libdm/*` | `FIXED` | In libdm: fixed color map out-of-bounds write risks, integer overflow in getmem, division by zero in reshape/aspect, and resource leaks across display manager backends. |
-| `SEC-0242` | **Sev 2** | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libgcv/*` | `FIXED` | In libgcv: fixed float-to-integer conversion in bottess, uninitialized memory reads in OBJ/PLY plugins, division by zero across converters, and intermediate geometry leaks. |
-| `SEC-0243` | **Sev 2** | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 1)` | `FIXED` | In libged Batch 1: fixed memory leaks and double-free hazards on wdb_put_internal, stack buffer overflow in adc, division by zero across analyze/arot/arrange, and ARS/ARB bounds checks. |
-| `SEC-0244` | **Sev 2** | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 2: bot, brep)` | `FIXED` | In libged Batch 2: fixed rt_db_internal initialization/free leaks and double-frees, array bounds on vertices/faces/trims, division by zero in normals/decimation/scale, and NULL pointer checks across bot and brep subcommands. |
-| `SEC-0245` | **Sev 2** | Memory Leaks, Double-Free, Division by Zero, Infinite Loop, Array Out-of-Bounds, and File Descriptor Leaks | `src/libged (Batch 3: cc, check, coil, color, columns, comb, comb_std, combmem, concat, constraint, copymat, cpi, dbi_state, debug2c)` | `FIXED` | In libged Batch 3: fixed double-frees following rt_db_put_internal and freed internal representation on db_diradd failures across cc, cpi, comb, comb_std, and copymat; added NULL guards, division-by-zero checks on units, heap VLS frees, and plot file descriptor leak fixes in check; plugged memory leaks of sections, validated sscanf, and prevented division by zero in coil; fixed cnt != 5 typo and temp file leak in color; added NULL checks in columns; freed rt_tree_array in combmem and fixed infinite loop on paren evaluation in comb_std; guarded argv bounds and closed dbip on error exits in concat and constraint; cleaned up view_states and aborted failed transactions in dbi_state; and added file check in debug2c. |
-| `SEC-0246` | **Sev 2** | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 4: decompose, delay, display_list, dm, draw, dsp, dump, dup, eac, edcodes)` | `FIXED` | In libged Batch 4: fixed memory leaks on non-NMG solids and db_lookup/db_diradd failures, replaced sprintf with snprintf, and eliminated double-free of new_m in decompose; validated sec/usec in delay; added NULL checks across display list erase/hash helpers and handled invent_solid failure; guarded argc > 0, freed dm_name leaks, and corrected return status in dm; guarded division by zero in aspect ratio, fixed loop index typo, and freed bu_vls in ert; freed dm_name on help path, added ndmp NULL guard, fixed argv bounds, and freed idata on failure in screengrab; guarded division by zero, plugged db_intern leaks in csg_wireframe_update and brep_adaptive_plot, and cleaned up draw_scene error paths in draw; resolved TODO by freeing dgcdp, plugged ap leak, and prevented duplicate ptbl initializations in bigE; freed brep_intern and obj_path in draw.c; guarded dbi_state and corrected view state lookup loop in draw2; prevented size_t underflows, freed tcl_argv, fixed orientation quaternion bounds, and guarded against division by zero in loadview; prevented buffer overflow in ged_cm_tree, checked argc >= 2 before fopen, and freed gd_rt_cmd and ged_tmp_uptrs in preview; validated xy argument count, fixed off-by-one bounds check, fixed intern2 typo in diff subcommand, and freed intern on lookup/read errors in dsp; used wdb_close in dump; enforced max_entries check to prevent array bounds overflow in dup; freed vls on read error, checked ID_COMBINATION, and used rt_db_free_internal in eac; added NULL pointer checks in comparisons, checked argc >= 2, freed av on fopen error, and used rt_db_free_internal in edcodes. |
-| `SEC-0247` | **Sev 2** | Memory Leaks, Double-Free, Dangling Pointer, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 5: edit)` | `FIXED` | In libged Batch 5 (edit commands): eliminated double-free hazards where rt_db_free_internal was called after GED_DB_PUT_INTERN in edarb and facedef; added ARB edge bounds check and validated argc in facedef; scoped bn_tol to function scope in cmd_checkpoint::exec to prevent dangling s->tol; freed intern and container struct on all paths and prevented double-free of pintern in cmd_perturb; guarded attribute NULL pointers and empty strings across rotate_*, scale_*, and translate_*; prevented floating-point division by zero on vector magnitudes across scale_* commands; and guarded uri constructor against NULL text pointer. |
-| `SEC-0248` | **Sev 2** | Memory Leaks, Out-of-bounds Memory Access, Logic Errors, and Null Pointer Dereferences | `src/libged (Batch 6: editit, edmater, env, env2c, erase, erase2, exec, exists, expand, eye_pos)` | `FIXED` | In libged Batch 6: fixed bu_opt_desc array indexing collision (d[0]..d[4]) and option parse error handling in editit; corrected argc passed to wmater, guarded argc <= 1, and aligned malloc tags in edmater; guarded NULL gedp and validated argc in env; validated argc range, checked bu_opt_parse return, and caught std::exception in env2c; plugged new_argv and bu_vls memory leaks, guarded avs bounds, and corrected option skipping in erase; checked bu_opt_parse, guarded argc <= 0 and bvs NULL in erase2; guarded argv[0] NULL dereference, checked gedp->i->i, and unwound recursion counters and exec_stack on recursion limit exceeded in exec; guarded out-of-bounds pointer advances and NULL dereferences in exists grammar and token lexer; reset backslash state per argument, used bu_vls_putc, and guarded string NULLs in expand; and corrected unit conversion factor from dbi_base2local to dbi_local2base when setting eye position in eye_pos. |
-| `SEC-0249` | **Sev 2** | Use-After-Free, Memory Leaks, Double-Free, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 7: facetize)` | `FIXED` | In libged Batch 7 (facetize): fixed Cat 1 Use-After-Free of wgedp database handle across iterative meshing attempts in brep.cpp; fixed 4 BU_PUT struct type mismatches and eliminated double-free in nmg.cpp; guarded division by zero on obj_bbox_vol, freed temporary bot faces/vertices on retry/abort, eliminated duplicate bounding box check, ensured bot is freed on all exits, replaced mismatched calloc with bu_calloc, and paired BU_GET with BU_PUT for manifold_mesh in old_facetize.cpp; validated stderr FD and NULL pointers in old_facetize_log.c; fixed memory leaks and eliminated double-frees in regions.cpp; fixed kill argument layout in subprocess/brep_csg.cpp; freed candidate bot on retry and fixed BU_PUT type in subprocess/continuation.cpp; freed cache_dir and checked seed in subprocess/main.cpp; verified ft_tessellate in subprocess/nmg.cpp; checked obj_bbox_vol with ZERO in subprocess/sample.cpp; checked point cloud bounds in subprocess/spsr.cpp; added NULL/empty guards in subprocess/util.cpp; freed temporary bu_vls in tess_opts.h; eliminated duplicate curtree allocation, freed td_name, and used bu_calloc in tri.cpp; and validated inputs, freed intern on diradd failure, and closed wdbip on error exits in util.cpp. |
-| `SEC-0250` | **Sev 2** | Memory Corruption, Memory Leaks, Resource Leaks, Catastrophic Data Loss Hazard, Recursion Lockout Bug, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 8: fb2pix, fbclear, form, fracture, garbage_collect, gdiff, ged, ged_cmd_scanner, ged_exec, ged_init)` | `FIXED` | In libged Batch 8: validated image dimensions and guarded fclose against stdout/NULL in fb2pix; replaced float literal comparisons, handled unquoted RGB args, and routed errors to ged_result_str in fbclear; reordered argc check ahead of db open and formatted error messages in form; freed old_intern, guarded log10(0), fixed cross-model region bug, eliminated global static status, freed model on diradd failure, and expanded string buffers in fracture; plugged bu_external leak, guarded division by zero, prevented database deletion on backup failure, checked db_ls path count, and cleaned up working file on errors in garbage_collect; guarded tolerance lookup, checked path bounds, initialized rt_db_internal, freed in1 on in2 failure, checked ID_COMBINATION, checked msgs NULL, reordered db_lookup before allocating full paths, and checked raydiff results in gdiff; fixed BU_PUT struct type mismatch freeing struct bu_list as struct bu_vls for gd_headDisplay and gd_headVDraw, zeroed ged_cbs on allocation with memset to prevent uninitialized counters triggering false recursive warnings, verified wdbp and dbip before creating ged struct in ged_open, decremented callback recursion depth before error return to prevent permanent callback lockout, and added NULL checks in callback handlers in ged; eliminated duplicate and out-of-bounds argv checks in generated wrappers in ged_cmd_scanner; guarded argv[0] and argc before bu_setprogname and verified plugin function pointers before dispatch in ged_exec; allocated sentinel NULL termination for command array and guarded filenames before path lookup in ged_init. |
-| `SEC-0251` | **Sev 2** | Memory Leaks, Buffer Overflow, Double-Free, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 9: inside, track, util, get, get_autoview, get_comb, get_eyemodel, get_obj_bounds, get_solid_kp)` | `FIXED` | In libged Batch 9: eliminated memory leaks on interactive prompts/errors, fixed out-of-bounds argv[2] access, cleared dangling idb_ptr, fixed copy-paste unit_d typo, and guarded negative radicands and division by zero across primitives in ged_inside; resolved 30-year-old swap bug overwriting tr[0] with uninitialized tr[2], expanded track name buffers, replaced sprintf with snprintf, eliminated double-free of intern, freed member lists, and guarded acos/slope against zero divisions and domain errors in ged_track; added bounds check in ged_results_get, validated wdbp and freed previous dbi_title in ged_dbcopy, checked scale factor scans, guarded eye model functions against NULL, freed intern on combadd2 error, and passed correct count to db_mkgift_tree in ged_util; freed intern and logged diagnostics when ft_get unavailable in get; fixed option parsing -p flag bug and validated remaining args in get_autoview; freed intern and rt_tree_array across all exits and used snprintf in get_comb; guarded trace levels to prevent buffer overflow, replaced free with bu_free, freed intern on rt_i_create failure, and validated ft_prep in get_obj_bounds; guarded NULL inputs, checked empty lists before list head access, and guarded vertex/curve pointers in get_solid_kp. |
-| `SEC-0252` | **Sev 2** | Memory Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, Logic Errors, and Null Pointer Dereferences | `src/libged (Batch 10: get_type, glob, gqa, graph, grid, grid2model_lu, grid2view_lu, group, heal, help)` | `FIXED` | In BRL-CAD libged Batch 10 commands (get_type, glob, gqa, graph, grid, grid2model_lu, grid2view_lu, group, heal, help): in get_type.c, validated argc and argv[1], initialized rt_db_internal before import, and guarded wdbp; in glob.c, added null checks to _debackslash, _backslash_specials, and _ged_expand_str_glob, checked gp->gl_pathv before string access, added per-word match counting to fall back to unescaping individual patterns when unmatched, and guarded argc and argv in ged_glob_core; in gqa.cpp, added null check on units buffer, constrained num_views (1..3) to prevent fixed-size array out-of-bounds access, guarded region and hit pointers against null in _gqa_overlap, initialized point arrays and passed valid pointer in _gqa_hit, bounded string traversal in find_cmd_line_obj, validated inputs and region count returning error on invalid state in allocate_per_region_data, removed redundant duplicate density file loading, fixed massive memory leaks of intern, density names, and avs across directories in densities_prep, prevented null dereference on strrchr, guarded against division by zero on state->shots across all views in view_reports, weight_volume_terminate, and summary_reports, guarded wdbp, rtip, obj_tbl, reg_tbl, and ged_gqa_plot.vbp before cleanup and destruction, and reset aborted state; in graph.cpp, checked ID_COMBINATION and pointers in process_comb and hl_scan_db, guarded child tree leaf names against null, verified file stream write success in hl_layout_and_output, removed redundant argument shifting in igraph mode and validated subcommand argument; in grid.c, guarded against null gv_s view state in grid_vsnap, grid_vls_print, and ged_grid_core, clamped user RGB color components to 0..255, and corrected error reporting parameter; in grid2model_lu.c, validated argv arguments and checked for zero denominator with ZERO macro before division; in grid2view_lu.c, guarded argv[1] and argv[2] against null; in group.c, validated group name and member arguments against null and empty strings; in heal.c, guarded arguments, clamped negative zipper tolerance, freed internal representation on non-BOT objects, and verified rt_db_put_internal return; in help.cpp, moved directory listing free inside directory traversal loop to eliminate directory listing leak, freed filepath on unreadable files, reset zeros counter per file so a binary file does not disable reading all subsequent documentation files, freed word buffer on each file exit, fixed cntptr type to size_t * preventing memory corruption, and checked bu_dir return before strdup while cleaning up resources when words == 0. |
-| `SEC-0253` | **Sev 2** | Resource Leaks, Buffer Overflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 11: help tests, hide, how, human, illum, importFg4Section, plugin.h, inside, instance, isize)` | `FIXED` | In BRL-CAD libged Batch 11 commands (test_help, hide, how, human, illum, importFg4Section, plugin.h, inside, instance, isize): in test_help.c, guarded ac and av pointers before calling bu_setprogname, and called ged_close before return to cleanly shut down GED resources; in hide.c, guarded argv[i] arguments against null or empty strings, tracked write and export failures, and corrected db5_export_object3 invocation; in how.c, initialized dpp, added null guards on hdlp, vls, dpp, and style struct pointer sp->s_os in dl_how, validated argument bounds and pointers, handled -b flag correctly, and guarded gd_headDisplay before traversal; in human.c, replaced process-terminating bu_exit calls with graceful error return in read_args, added null checks on fopen returns before writing to file pointers in text and verbose, validated argc, verified wdb_dbopen return, replaced unchecked sprintf with snprintf, and called wdb_close to eliminate persistent database handle leak; in illum.c, added GED_CHECK_DATABASE_OPEN, GED_CHECK_VIEW, GED_CHECK_DRAWABLE, and GED_CHECK_ARGC_GT_0 to ged_labelvert_core, guarded argv[i] arguments, checked dmp before calling dm_set_dirty, guarded gdlp and obj in dl_set_illum, validated directory pointer and d_namep, checked argv[1] against null using BU_STR_EQUAL, and verified gd_headDisplay; in importFg4Section.c, validated argc and argv pointers, verified wdb_dbopen return, and added wdb_close to eliminate database handle leak; in include/plugin.h, audited plugin macros; in inside.c, guarded argc and argv[1] against null and verified outdp; in instance.c, validated argument count and null/empty object and instance names, guarded argv[3] against null, and safely formatted invalid operation string; in isize.c, added GED_CHECK_DATABASE_OPEN to prevent null dereference of gedp->dbip, and guarded against division by zero using ZERO macro on base2local factor. |
-| `SEC-0254` | **Sev 2** | Use-After-Free, Memory Corruption, Memory Leaks, Double-Free, Infinite Loop, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 12: item, joint, joint2, keep, keypoint, kill, killall, killrefs, killtree)` | `FIXED` | In BRL-CAD libged Batch 12: in item.c, validated argc range (3..6), guarded argv[1..2] against null, checked argv[3..5] before atoi, initialized rt_db_internal, and validated combination type; in joint.c, eliminated Cat 1 Use-After-Free in parse_hold by adding missing return after free_hold on EOF, fixed 64-bit struct member memory corruption where hp->priority was passed as double * clobbering flag, fixed infinite loop in joint_move dirs parsing by adding missing argv/argc increment, guarded against division by zero in parse_units with ZERO macro, eliminated persistent memory leaks in free_hold, part_solve, and joint_load by freeing arc sets, joint handles, and bu_vls, added null guards across hold_point_to_string, joint_unload, parse_error, joint_mesh, joint_save, joint_accept, joint_reject, reject_move, joint_solve, joint_hold, joint_move, and joint_cmd, fixed copy-paste typo in joint_reject usage, and corrected return status logic in joint_solve; in joint2.c, verified callback function pointers and selection counts, added bounds check preventing out-of-bounds read of argv[2] when argc == 2, and eliminated Cat 1 Double-Free of intern after GED_DB_PUT_INTERN; in keep.c, guarded directory and component pointers in node_write, closed incoming database on format mismatch and open failures to eliminate file descriptor leaks, and used wdb_close on all exits to properly release wdbp and underlying dbip; in keypoint.c, guarded argv[1..3] against null before bn_decode_vect and sscanf; in kill.c, enforced required object name argument after option stripping and guarded argv[i] in deletion loops; in killall.c, guarded argv[1] on -n check and enforced argument counts reporting usage; in killrefs.c, guarded argv[1], enforced argument count, guarded display erasure and tree deletion loops, and validated combination types; in killtree.c, guarded directory and data pointers in callbacks, enforced argument count after option parsing, guarded argv[i] in processing loop, and unconditionally freed argv allocations to eliminate -n memory leak. |
-| `SEC-0255` | **Sev 2** | Use-After-Free, Memory Leaks, Resource Leaks, Integer Underflow, Division by Zero, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 13: label, lc, libfuncs, lint)` | `FIXED` | In BRL-CAD libged Batch 13: in label.c, validated argc and argv bounds before dereferencing argv[0]; in lc.c, guarded against null struct pointers and string fields before bu_strcmp and atoi in cmp_regions and sort_regions, validated argc and argv in ged_lc_core, handled bu_file_realpath null returns and freed norm_name on errors, closed output file and freed vls on error exits, freed results1 and results2 search tables via db_search_free, freed db_full_path root, duplicated attribute strings and freed all duplicated strings on all exits to eliminate Cat 1 Use-After-Free of stack-scoped avs attributes, and replaced descending size_t loop with reverse counting loop to prevent unsigned integer underflow; in libfuncs.c, guarded argv, argv[0], argv[1], and argv[2] before bu_sscanf, bn_decode_mat, and bn_decode_vect across mat_ae, mat_mul, mat4x3pnt, and mat_scale_about_pnt, and added missing newlines to usage strings; in lint/cyclic.cpp, freed path strings allocated by db_path_to_string, replaced process-terminating bu_bomb with graceful error logging, initialized rt_db_internal, and validated ID_COMBINATION and combination pointers; in lint/ged_lint.h, audited header declarations; in lint/invalid_shape.cpp, initialized intern, eliminated memory leaks of BREP, ARB8, DSP, and EXTRUDE internal representations on early returns by calling rt_db_free_internal across all exits, properly initialized and freed pc search table, and guarded directory pointers; in lint/lint.cpp, guarded ostr.pop_back() against empty problem vectors, validated key_val parsing, fixed off-by-one underflow in argument verification loop that caused argv[-1] out-of-bounds reads, freed combination members with mk_freemembers after mk_lcomb, and initialized is_region; in lint/lint_bot.cpp, validated triangle vertex indices against num_vertices and guarded normal magnitude before division in bot_face_normal, bounded triangle indices and vertex indices in tri_to_json and plot_bad_tris, guarded map iterator dereference in bot_check, clamped ncpus to num_faces, set last worker end to num_faces so the final triangle face is not skipped, cleaned per-worker resources with rt_clean_resource, and freed worker state array to eliminate thread resource and memory leaks; in lint/missing.cpp, replaced bu_bomb with graceful error logging, added buffer size checks against header lengths before pointer arithmetic in shape_find_missing to prevent buffer over-reads in DSP and EXTRUDE objects, and initialized and freed rt_db_internal structures across all exits; in lint/raytrace.cpp, verified ID_COMBINATION and tree pointers before traversing combination trees in subtree_has_halfspace and collect_subtree. |
-| `SEC-0256` | **Sev 2** | Memory Leaks, Resource Leaks, Integer Overflow, Infinite Loop, and Null Pointer Dereferences | `src/libged (Batch 14: list, lod, lod2, log, ls, lt, m2v_point, make, make_name, man)` | `FIXED` | In BRL-CAD libged Batch 14: in list.c, validated argc and argv bounds, added missing newline to usage, guarded argv[arg] against null, closed wdbp immediately after copying initial tree state to prevent wdbp handle leak, freed full path on traversal failures, initialized and freed internal structures, and guarded describe callbacks; in lod.c, checked argv bounds, guarded against null gvp and gvp->gv_s view state pointers before member access, validated non-negative scale factors using bu_sscanf, and guarded argv subcommands against null; in lod2.cpp, guarded gedp and ged_result_str against null before writing result; in log.c, guarded clientdata and str in log_hook, checked gedp->ged_log before hook operations and log dumps, validated argv[1], and added missing newlines to usage messages; in ls.c, guarded list_of_names and num_in_list in vls_long_dpp and vls_line_dpp, guarded directory pointers and names against null, initialized and freed intern representations, guarded ft_label and binunif typestrings before string length operations, guarded name and type widths against unsigned underflow, guarded argv in _ged_ls_attr_objs and _ged_ls_named_objs, guarded results_obj before formatting, and freed str vls on all exit paths to eliminate memory leaks; in lt.c, initialized intern, validated ID_COMBINATION and pointers before accessing comb tree, freed intern and vls on flatten tree error exit paths to eliminate memory leaks, guarded tree leaf names against null, and validated argv bounds and option characters; in m2v_point.c, guarded argv arguments, added missing newlines to usage, and replaced raw sscanf with bu_sscanf; in make.c, validated positive scale factors, guarded extrude_ip and freed internal on error, replaced sprintf with snprintf, and called rt_db_free_internal on db_diradd failure to eliminate primitive internal memory leaks; in make_name.c, validated argv pointers, added missing newlines, parsed -s argument with bu_sscanf ensuring non-negative index, added loop bounds and overflow guards in candidate generation loop, and avoided redundant null byte injection; in man.c, checked argv bounds, verified brlman path existence, freed lang vls on all early returns to eliminate memory leaks, cleaned up failed subprocess handles with bu_process_wait_n, and waited for CLI mode processes to exit cleanly. |
-
-| `SEC-0257` | **Sev 2** | Memory Corruption, Resource Leaks, Memory Leaks, Out-of-bounds Memory Access, Integer Underflow, and Null Pointer Dereferences | `src/libged (Batch 15: match, mater, material, metaball, mirror, model2grid_lu, model2view, model2view_lu, move, move_all)` | `FIXED` | In BRL-CAD libged Batch 15 commands (match, mater, material, metaball, mirror, model2grid_lu, model2view, model2view_lu, move, move_all): in match.c, added missing newline to usage, guarded argv pointers against null, replaced unchecked pointer increment loop with safe index-bounded loop, and guarded dp and dp->d_namep before bu_path_match; in mater.cpp, freed d_path_dir vls across all exits, closed wdbp handle with wdb_close in mater_import, safely parsed mat_id with bu_sscanf before comparison, eliminated heap allocations for std::set and msgs to prevent memory leaks, freed new_buf from analyze_densities_write and bin_ext on db_dirbuild failure, replaced dynamic heap avs allocation with stack struct and ensured bu_avs_free is invoked on all iterations and exits, guarded oname before std::string conversion, safely parsed integer IDs, returned BRLCAD_ERROR on fail, and freed nname before early returns; in material.c, eliminated Cat 1 memory corruption by removing illegal bu_free on stack buffer, closed densityTable file descriptor on all paths, closed wdbp handle with wdb_close on all exits across import, create, set, and remove, freed AVS property tables on each loop iteration and exit, validated argc bounds before accessing argv indices, guarded string parsing loop against integer underflow, verified ID_MATERIAL internal type before accessing material structure, called rt_db_free_internal on all exit paths, prevented orphaning of bu_vls string buffers by using bu_vls_strcpy/bu_vls_trunc instead of BU_VLS_INIT, and propagated subcommand error return codes; in metaball.c, closed wdbp handle on all paths, verified DB5_MINORTYPE_BRLCAD_METABALL before casting internal pointer, replaced raw sscanf with bu_sscanf, fixed out-of-bounds pointer dereference of argv[3] when argc was 3 in delete error message, and added missing newlines to usage messages; in mirror.c, called rt_db_free_internal on all exit paths after rt_db_get_internal to eliminate primitive memory leaks, replaced raw sscanf with bu_sscanf, and guarded argv pointers against null; in model2grid_lu.c and model2view_lu.c, moved matrix dereferences after GED_CHECK_DATABASE_OPEN to prevent null dereference of gedp, guarded argv arguments, replaced sscanf with bu_sscanf, and added missing newlines; in model2view.c, guarded argv arguments, replaced raw sscanf with bu_sscanf, and added missing newline to usage; in move.c and move_all.c, called rt_db_free_internal after rt_db_put_internal to eliminate memory leaks, replaced libc free with bu_free on heap strings allocated by bu_strdup, safely updated display list path strings, guarded old and new name arguments against null, and fixed format parameter mismatch in name length limit error message. |
-| `SEC-0258` | **Sev 2** | Memory Corruption, Use-After-Free, Memory Leaks, Resource Leaks, Out-of-bounds Memory Access, and Null Pointer Dereferences | `src/libged (Batch 16: move_arb_edge, move_arb_face, mrot, nirt, nmg, nmg_cmface, nmg_collapse, nmg_fix_normals, nmg_kill_f, nmg_kill_v)` | `FIXED` | In BRL-CAD libged Batch 16 commands (move_arb_edge, move_arb_face, mrot, nirt, nmg, nmg_cmface, nmg_collapse, nmg_fix_normals, nmg_kill_f, nmg_kill_v): in move_arb_edge.c, closed wdbp handle on all exit paths in move_arb_edge and find_arb_edge, called rt_db_free_internal after rt_db_put_internal to eliminate memory leaks, guarded argv pointers against null, replaced raw sscanf with bu_sscanf, and added missing newlines to usage and error messages; in move_arb_face.c, eliminated Cat 1 memory corruption and stack array overflow by enforcing face bounds check on both positive and negative indices for the specific arb_type before modifying planes array, closed wdbp handle on all paths, called rt_db_free_internal after rt_db_put_internal, returned BRLCAD_ERROR when object is not an ARB, replaced sscanf with bu_sscanf, and added missing newlines; in mrot.c, validated argv and argv[i] pointers against null, and added missing newlines; in nirt.cpp, eliminated Cat 1 heap corruption on subprocess failure by replacing incorrect cast and free of string pointers as bu_vls structures with bu_free, fixed use of freed av_args and memory leak of obj by directly emitting draw commands to stdin in skip_drawn block, freed nirt exec string and nv options across all error returns, corrected loop to inspect argv[i] instead of repeatedly checking argv[0], freed dpv allocated by db_ls, fixed off-by-4 bug in ged_vnirt_core where av[i] = NULL clobbered argument pointers, replaced sscanf with bu_sscanf, guarded ged_gdp before dl_set_wflag, and added missing newlines; in nmg.c, eliminated Cat 1 linked list corruption in get_face_list where actual model face list pointers were stolen into stack f_list causing circular loops and free crashes by using detached copy structs, freed internal representations and face list allocations, fixed off-by-one subcommand lookup in ged_nmg_core where subcmd was erroneously read from argv[0] instead of argv[1], guarded argv[2] before dereferencing in kill, move, and make subcommands, and propagated subcommand return codes; in nmg_cmface.c, freed verts buffer to eliminate persistent memory leaks, closed wdbp handle on all paths, replaced atof with bu_sscanf, corrected variable in error message, and added missing newlines; in nmg_collapse.c, closed wdbp on all exit paths, freed internal representation on non-planar face detection, validated tolerances with bu_sscanf and ZERO macro, and added missing newlines; in nmg_fix_normals.c, persisted fixed normals to database via rt_db_put_internal, freed internal representation, and added missing newlines; in nmg_kill_f.c, eliminated Cat 1 Use-After-Free in remove_face by immediately returning once target face is destroyed by nmg_kfu, closed wdbp on all paths, parsed fid with bu_sscanf, and added missing newlines; in nmg_kill_v.c, eliminated Cat 1 Use-After-Free and Double-Free in remove_vertex by restarting topology search on each deletion instead of continuing iteration on freed loopuses and edgeuses, closed wdbp on all paths, parsed coordinates with bu_sscanf, and added missing newlines. |
-| `SEC-0259` | **Sev 2** | Use-After-Free, Memory Leaks, Resource Leaks, Out-of-bounds Memory Access, Logic Errors, and Null Pointer Dereferences | `src/libged (Batch 17: nmg_make_v, nmg_mm, nmg_move_v, nmg_simplify, npush, ocenter, open, orient, orotate, oscale)` | `FIXED` | In BRL-CAD libged Batch 17 commands (nmg_make_v, nmg_mm, nmg_move_v, nmg_simplify, npush, ocenter, open, orient, orotate, oscale): in nmg_make_v.c, validated vertex coordinates with bu_sscanf, closed wdbp handle with wdb_close on error and success paths, freed verts buffer on wdb_put_internal failure, and added missing newlines to usage and error strings; in nmg_mm.c, freed internal representation on db_diradd failure to prevent memory leak, checked rt_db_put_internal return status, and added missing newline to usage; in nmg_move_v.c, validated 6 coordinate arguments using bu_sscanf, closed wdbp handle on error and success exits, reported correct object name on error, and added missing newline to usage; in nmg_simplify.c, eliminated Cat 1 Use-After-Free and database corruption where failure of all conversion methods (arb/tgc/poly) fell through to out1: attempting to add and write a freed/stale new_intern, closed wdbp handle on all exit paths in out3:, and added missing newlines to usage strings; in npush.cpp, eliminated persistent leak of rt_wdb handle by immediately copying tolerance and closing wdbp, freed temporary msgs vls on early exit in non-verbose conflict path, added missing newlines to conflict and error messages, and preserved all missing/added tops reports by using bu_vls_printf instead of bu_vls_sprintf; in ocenter.c, added bounds check on gtd.gtd_objpos to prevent negative array indexing out-of-bounds, replaced sscanf with bu_sscanf, and added missing newlines to usage and error strings; in open.cpp, added missing newlines in usage and error strings, returned BRLCAD_OK when print_help is requested, and safely destroyed existing ged_lod context and dbi_state before reassigning; in orient.c, fixed off-by-one error in error reporting where argv[i-1] was printed instead of argv[i], replaced sscanf with bu_sscanf, and added missing newlines to usage strings; in orotate.c, added bounds check on gtd.gtd_objpos to prevent out-of-bounds array access, replaced sscanf with bu_sscanf, and added missing newlines to usage and error strings; in oscale.c, added scale factor validation with bu_sscanf and SQRT_SMALL_FASTF to prevent degenerate or non-positive scaling, added bounds check on gtd.gtd_objpos, and added missing newlines to usage and error strings. |
-| `SEC-0260` | **Sev 2** | Resource Leaks, Double-Free, Buffer Overflow, Logic Errors, Out-of-bounds Memory Access, and Process Termination in Library Function | `src/libged (Batch 18: osg, otranslate, overlay, path, pathlist, pathsum, perspective, pipe, pix2fb, plot)` | `FIXED` | In BRL-CAD libged Batch 18 commands (osg, otranslate, overlay, path, pathlist, pathsum, perspective, pipe, pix2fb, plot): in osg.cpp, added NULL pointer checks to _osgLoadHiddenSolid, _osgLoadSolid, and _ged_osgLoadScene, and verified osp->viewer validity; in otranslate.c, added bounds check on gtd.gtd_objpos preventing negative out-of-bounds array access, replaced sscanf with bu_sscanf, and added missing newlines to usage and error strings; in overlay.c, fixed out-of-bounds / null pointer dereference on argv[1] when bu_file_list returned <= 0 by changing to argv[0], freed vbp on fopen failure inside loop to eliminate memory leak, preserved cmd_name for diagnostics, and added missing newlines; in path.c, fixed critical logic flaw where the return value of path_validate_recurse was ignored allowing invalid paths to pass validation, checked intern.idb_type == ID_COMBINATION, and added missing newline; in pathlist.c, eliminated persistent wdbp database handle leak by immediately calling wdb_close after reading initial tree state, replaced static mutable global pathListNoLeaf with thread-safe struct pathlist_data passed via client_data, checked fp_len > 1 before decrement, and added missing newlines; in pathsum.c, checked _GED_TRACE_MAX_LEVELS upper bound to prevent stack buffer overflow in gtd.gtd_obj, duplicated path argument before calling strtok to avoid in-place mutation of argv and thread safety issues, and added missing newlines; in perspective.c, replaced sscanf with bu_sscanf, added angle range check [0, 180) to prevent division by zero or singularity in persp_mat, and added missing newlines; in pipe.c, eliminated persistent wdbp leaks by calling wdb_close across append, find, and move commands, fixed out-of-bounds argv[3] access when argc == 3 in delete command by correcting to argv[2], eliminated double-free hazards of intern following GED_DB_PUT_INTERN, replaced sscanf with bu_sscanf, checked seg_i >= 0, and added missing newlines; in pix2fb.c, eliminated process termination bug where bu_exit was invoked on file open failure by returning error and logging to ged_result_str, fixed usage string repetition, checked infd > 0 before close, and formatted error messages with argv[0] and newlines; in plot.c, removed mutable static local variables in dl_plot making it reentrant and thread-safe, preserved cmd_name before advancing argv, freed bu_vls str on popen failure, formatted system errors with strerror(errno) into result string, and added missing newlines. |
-| `SEC-0261` | **Sev 2** | Memory Leaks, Resource Leaks, Buffer Overflow, Infinite Loop, In-place Argument Mutation, and Null Pointer Dereferences | `src/libged (Batch 19: pmat, pmodel2view, png, png2fb, pnts, pnts_util, points_eval, polyclip, prcolor)` | `FIXED` | In BRL-CAD libged Batch 19 commands (pmat, pmodel2view, png, png2fb, pnts, pnts_util, pnts_util.h, points_eval, polyclip, prcolor): in pmat.c, added diagnostic error message on bn_decode_mat failure and fixed usage formatting; in pmodel2view.c, added missing newline to usage string; in png.c, encapsulated mutable globals in struct png_state, removed static locals from draw_png_solid for thread safety, clamped raster coordinates against image bounds to prevent buffer overflow, clamped img_size to prevent integer overflow in buffer allocation, replaced raw sscanf with bu_sscanf, freed image and bytes buffers and destroyed libpng structures via png_destroy_write_struct on all error and success exits to eliminate persistent memory leaks, and added missing newlines to usage and error messages; in png2fb.c, removed duplicate usage prefix, distinguished file open failure from help request returning error instead of printing usage, replaced stderr writes with bu_log, and added missing newlines; in pnts.cpp, added bounds checks in _pnts_collect_arrays linked list loops to prevent heap buffer overflow, eliminated in-place mutation of caller argv in _ged_pnts_cmd_tri and ged_pnts_core by passing offset pointers and lengths to bu_cmd, propagated subcommand return codes, fixed unsafe argc decrement when argc <= 0, freed fl and unit vls structures on all exits in _ged_pnts_cmd_read, used RAII guard for pnt_str in _ged_pnts_cmd_write to eliminate persistent memory leak on every write operation, freed intern on fopen failure, and added missing newlines to result and error strings; in pnts_util.c, added NULL pointer checks to _ged_pnt_v_set, _ged_pnt_c_set, _ged_pnt_s_set, _ged_pnt_n_set, _ged_pnts_init_head_pnt, _ged_pnts_add, and _ged_pnts_dup; in points_eval.c, guarded d->dbip against NULL, checked fp->fp_len > 0 before calling DB_FULL_PATH_CUR_DIR, and properly initialized intern; in polyclip.cpp, closed wdbp database handles on all exit paths in ged_import_polygon, ged_polygons_overlap, and ged_polygon_fill_segments to eliminate persistent handle leaks, guarded input pointers, validated vfilldelta > SMALL_FASTF to prevent infinite loop hang, freed all 2D polygon contours, contour points, hole arrays, and result_vls on completion in ged_polygon_fill_segments to eliminate massive memory leak, and freed intern on export failure; in prcolor.c, replaced sprintf with snprintf to prevent buffer overflow, and added missing newlines to usage and none output. |
-| `SEC-0262` | **Sev 2** | Memory Corruption, Resource Leaks, Double-Free, Pointer Cast Error, and Underflows | `src/libged (Batch 20: prefix, process, ps, pset, pull, push, put, put_comb, putmat, qray)` | `FIXED` | In BRL-CAD libged Batch 20 commands (prefix, process, ps, pset, pull, push, put, put_comb, putmat, qray): in prefix.c, removed leftover debugging bu_log prints, guarded prefix against empty string, guarded directory names against null/empty in rename loop, freed tempstring_v5 on all early error exits to eliminate memory leaks, validated intern.idb_type == ID_COMBINATION before tree walk, and added missing newlines to usage and error strings; in process.c, fixed Cat 1 integer underflow and memory exhaustion in _ged_process_list where longest_pid < 3 underflowed longest_pid - 3 to UINT_MAX - 2 when passed to %*c in bu_vls_sprintf, freed cmdroot before return in _ged_process_gabort to eliminate memory leak, added null guards on subprocess pointers, streamlined subcommand dispatch in ged_process_core to properly display help on unrecognized or malformed arguments, and added missing newlines; in ps.c, removed mutable static local variables in ps_draw_solid making it reentrant and preventing state leakage between solids, replaced sscanf with bu_sscanf, changed early return on bad color to goto bad so font, title, and creator are freed on error, guarded sp and hdlp against null in ps_draw_body, guarded bu_optind > 0 before accessing argv[bu_optind-1], and added missing newlines to usage and error strings; in pset.c, replaced sscanf with bu_sscanf, guarded attribute against null and empty string in _ged_set_metaball, clamped threshold when ZERO(threshold), guarded argv arguments against null, simplified cleanup to unconditionally call rt_db_free_internal(&intern) whenever ret != BRLCAD_OK, and added missing newlines; in pull.c, fixed Cat 1 pointer cast corruption in pull_leaf where mp (mat_t *) was cast to struct bu_vls * and passed to bu_vls_printf, fixed massive memory leak where modified primitives transformed by ft_xform were never written back or freed by adding rt_db_put_internal and rt_db_free_internal, fixed option parsing bug in ged_pull_core where argc != 2 check and db_lookup preceded bu_getopt making -d impossible to pass, passed (matp_t)NULL instead of 0-matrix m to rt_db_get_internal in pull_comb, freed intern on empty comb trees, checked return of bn_mat_inverse, and added missing newlines; in push.c, eliminated persistent resource leak of wdbp by immediately extracting init_state and calling wdb_close(wdbp), guarded argc < 1 after option stripping, guarded null directory and database pointers and freed intern on empty comb trees in identitize, and added missing newlines; in put.c, eliminated Cat 1 double-free of intern where rt_db_free_internal(&intern) was called after wdb_put_internal (which unconditionally frees the internal structure on both success and failure), closed wdbp with wdb_close(wdbp) on both error and success paths to eliminate handle leak, guarded argv[1] and argv[2] against null and empty strings, and added missing newlines; in put_comb.c, eliminated Cat 1 buffer underflow in trailing space stripping loop where empty or all-space names decremented i below 0 and accessed name[-1], fixed logic bug in mktemp_comb where db_lookup checked template string str instead of candidate name, freed rt_tree_array on error and success paths in put_tree_into_comb_and_export to eliminate persistent memory leak, freed intern on db_diradd failure in save_comb, replaced sscanf with bu_sscanf and guarded null str in put_rgb_into_comb, and added missing newlines; in putmat.c, eliminated Cat 1 memory leaks of name1 and name2 in _getmat where bu_vls_free was omitted on all successful matrix retrieval paths, removed machine-identifiable paths from error messages, guarded against null argv[1] and argv[2], and added missing newlines; in qray.cpp, fixed Cat 1 out-of-bounds string access in qray_init when parsing format lines shorter than expected, and added null pointer checks on gdp, gdp->gd_qray_fmts, and vhead in qray_init, qray_free, and qray_data_to_vlist. |
-| `SEC-0263` | **Sev 2** | Double-Free, Memory Leaks, Division by Zero, Uninitialized Memory Reads, Pointer Aliasing, and Missing Validation | `src/libged (Batch 21: qray, qray.h, quit, rcodes, rect, red, regdef, region, repair, rfarb)` | `FIXED` | In BRL-CAD libged Batch 21 commands (qray, qray.h, quit, rcodes, rect, red, regdef, region, repair, rfarb): in qray.h, fixed macro parameter bug in DG_QRAY_BOTH; in qray/qray.c, added null checks on gedp->i and gedp->i->ged_gdp across all entry points, replaced sscanf with bu_sscanf, corrected typo in command name, and added missing newlines to error strings; in quit/quit.cpp, verified clean with no changes needed; in rcodes/rcodes.c, eliminated Cat 1 double-free of intern on rt_db_put_internal failure (which unconditionally frees intern internally), eliminated persistent memory leak by freeing intern when changed == 0 or when non-combination objects are encountered, replaced sscanf with bu_sscanf, added null and empty string checks on argv[1], and added missing newlines to usage and error messages; in rect/rect.c, added null check on gedp->ged_gvp->gv_s, added ZERO(grsp->aspect) and cdim <= 0 checks to prevent division by zero in rect_image2view and rect_adjust_for_zoom, validated user coordinate dimensions to prevent division by zero, replaced sscanf with bu_sscanf, guarded argv[0] and argv[1] against null, and added missing newlines; in red/red.c, eliminated mutable file-scope static global buffer _ged_tmpfil by passing stack-allocated buffer into build_comb and write_comb to ensure thread safety, eliminated persistent memory leaks of rt_tree_array across all error and success exits in both build_comb and write_comb, freed intern on all early error paths in build_comb and after write_comb in ged_red_core, freed allocated matrix on error in _ged_find_matrix, replaced sprintf with snprintf to prevent buffer overflow, and added missing newlines; in regdef/regdef.c, guarded wdbp against null return from wdb_dbopen, replaced sscanf with bu_sscanf, and added missing newlines to usage and output strings; in region/region.c, guarded wdbp against null, guarded argv[1], argv[i], and argv[i+1] against null/empty, and added missing newlines to usage and error strings; in repair/repair.cpp, added GED_CHECK_DATABASE_OPEN, GED_CHECK_READ_ONLY, and GED_CHECK_ARGC_GT_0 guards, handled bu_opt_parse error returns, eliminated Cat 1 double-free of intern by only freeing intern when ft_repair returns non-zero (rt_db_put_internal unconditionally frees intern on both success and failure), guarded argv[i] against null/empty, and added newlines to JSON status messages; in rfarb.c, eliminated Cat 1 double-free of internal on rt_db_put_internal failure and returned BRLCAD_ERROR, eliminated memory leak of internal on db_diradd failure, prevented uninitialized stack coordinate usage by returning BRLCAD_ERROR when bu_sscanf coordinate parsing fails, replaced sscanf with bu_sscanf, guarded argv against null, and added missing newlines to all error and usage messages. |
-| `SEC-0264` | **Sev 2** | Stack Buffer Overflow, Memory Leaks, Logic Inversion, Out-of-bounds Array Access, Command Length Miscalculation, and Missing Validation | `src/libged (Batch 22: rm, rmap, rmat, rmater, rot, rotate_about, rot_point, rrt, rt, rtabort)` | `FIXED` | In BRL-CAD libged Batch 22 commands (rm, rmap, rmat, rmater, rot, rotate_about, rot_point, rrt, rt, rtabort): in rm.c, fixed boolean CSG tree subtraction bug in _rm_tree_remove_named_leaf_instance where removing the left child of an OP_SUBTRACT node erroneously promoted the right child to a positive union instead of freeing the right tree and nullifying the subtraction, guarded null and empty operands in _rm_expand_operand while preserving unmatched glob patterns for standard error reporting, guarded argv[i] against null/empty in operand loop, and added missing newline to usage string; in rmap.c, added _ged_rmap_free_list helper and called it on rt_db_get_internal failure to eliminate persistent memory leaks of id_to_names and id_names list nodes, validated intern.idb_type == ID_COMBINATION and intern.idb_ptr before casting, replaced bu_vls_addr with bu_vls_cstr, and added missing newlines to usage and error messages; in rmat.c, added null check on argv[1], reported diagnostic error message when bn_decode_mat fails, and added missing newline to usage; in rmater.c, fixed stack buffer overflow in extract_mater_from_line by bounding string extraction to name and shader buffer capacities, replaced raw sscanf with bu_sscanf, prevented undefined behavior and crash by continuing loop instead of falling through on rt_db_get_internal failure, validated intern.idb_type == ID_COMBINATION before accessing comb, used bu_vls_trunc to safely clear comb->shader, and added missing newlines; in rot.c, added standard GED_CHECK_DATABASE_OPEN, GED_CHECK_VIEW, and GED_CHECK_ARGC_GT_0 guards; in rotate_about.c, guarded against out-of-bounds byte reads and null dereference on argv[1], and added missing newlines to current setting output and usage strings; in rot_point.c, fixed copy-paste typo where ged_m2v_point was reported instead of command name, replaced sscanf with bu_sscanf, guarded coordinate arguments against null, and added missing newlines; in rrt.c, fixed command length miscalculation where gd_rt_cmd_len was set only to the count of who objects rather than the full command length, eliminated persistent memory leak of strings allocated by ged_who_argv by freeing each who object after execution, and guarded argv[i] against null; in rt.c, replaced sprintf with snprintf, provided PATH fallback when bu_dir returns null, guarded argv[i] against null, and explicitly null-terminated gd_rt_cmd; in rtabort.c, added null checks on rrp, rrp->p, and cmd before processing and terminating subprocesses, and added missing newline to usage string. |
-| `SEC-0265` | **Sev 2** | Resource Leaks, Memory Leaks, Null Pointer Dereferences, Out-of-bounds Memory Access, and Missing Validation | `src/libged (Batch 23: rtcheck, rtcheck2, rtwizard, savekey, scale, search, select, select2, set_output_script, set_transparency)` | `FIXED` | In BRL-CAD libged Batch 23 commands (rtcheck, rtcheck2, rtwizard, savekey, scale, search, select, select2, set_output_script, set_transparency): in rtcheck.c, added null checks in rtcheck_vector_handler and rtcheck_output_handler on rtcp, rrtp, gedp, rtcp->fp, and rrtp->p, provided PATH fallback when bu_dir returns null, allocated args + 1 for gd_rt_cmd, guarded argv[i] against null, and eliminated persistent memory leak of strings allocated by ged_who_argv by freeing each string on error and success paths; in rtcheck2.cpp, added null checks in rtcheck_vector_handler and rtcheck_output_handler on rtcp, rrtp, gedp, rtcp->fp, and rrtp->p, provided PATH fallback when bu_dir returns null, allocated args + 1, guarded argv[i] against null, and freed strings allocated by ged_who_argv on error and success paths; in rtwizard.c, added null checks on gedp and gd_rt_cmd in _ged_run_rtwizard, replaced sprintf with snprintf, allocated args + 1 for gd_rt_cmd, guarded argv[i] against null, and freed strings returned by ged_who_argv upon command completion to eliminate memory leaks; in savekey.c, added null checks on gedp, gvp, fp, and eye_model in savekey_rt_oldwrite, validated time argument with bu_sscanf instead of raw atof and reported error on invalid input, replaced raw perror writes to stderr with structured error logging to ged_result_str, checked argv[1], and added missing newlines to usage and error strings; in scale.c, added GED_CHECK_DATABASE_OPEN, GED_CHECK_VIEW, and GED_CHECK_ARGC_GT_0 guards, validated scale factor against non-positive and non-finite values and reported error instead of silently returning OK, and added missing newline to error message; in search.c, corrected pointer size calculation from sizeof(char *) to sizeof(struct directory *) in _ged_search_localized_obj_list, added missing GED_CHECK_DATABASE_OPEN and GED_CHECK_ARGC_GT_0 guards in ged_search_core, guarded argv_orig[i] against null in option scanning loop, checked bu_argv_dup return value, and bounded plan_argv < argc in both plan discovery and plan string construction loops to prevent out-of-bounds pointer reads; in select.c, plugged persistent leak of rt_wdb database handles opened via wdb_dbopen by ensuring wdb_close is called immediately after import or upon error in both ged_select_core and ged_rselect_core, guarded ged_gvp->gv_s before accessing screen rectangle, freed intern on early error paths, replaced raw sscanf with bu_sscanf, added missing newlines to all error and usage messages, and added null checks on botip, botip->vertices, hdlp, and vls; in select2.cpp, added GED_CHECK_DATABASE_OPEN and GED_CHECK_ARGC_GT_0 guards in ged_select2_core, guarded argv[i] in option loop, safely checked argc <= 0 before indexing argv[0] in subcommand dispatch, added null checks in _select_cmd_msgs, and added missing newlines in _select_cmd_add and _select_cmd_rm; in set_output_script.c, added missing newline to usage, and guarded against passing null ged_output_script to %s in bu_vls_printf; in set_transparency.c, added GED_CHECK_DATABASE_OPEN guard, returned GED_HELP on argc == 1, replaced raw sscanf with bu_sscanf, clamped transparency to [0.0, 1.0], returned BRLCAD_ERROR when _ged_build_dpp fails, added null checks on gedp, i, ged_gdp, dpp, hdlp, and sp->s_os in dl_set_transparency, and added missing newlines to usage messages. |
-| `SEC-0266` | **Sev 2** | Resource Leaks, Memory Leaks, Double-Free, Division by Zero, Mutating Input, and Null Pointer Dereferences | `src/libged (Batch 24: set_uplotOutputMode, setview, shaded_mode, shader, shells, showmats, shrinkwrap, simulate)` | `FIXED` | In BRL-CAD libged Batch 24 commands (set_uplotOutputMode, setview, shaded_mode, shader, shells, showmats, shrinkwrap, simulate): in set_uplotOutputMode.c, added null and empty string guards on argv[1] before inspecting characters, and appended missing newlines to usage, binary, and text output strings; in setview.c, added null checks on argv[1] when argc == 2 and argv[1..3] when argc == 4, replaced raw sscanf with bu_sscanf, safely printed bad coordinate values, and added missing newlines to usage strings; in shaded_mode.c, guarded argv[1] against null, replaced raw sscanf with bu_sscanf, and added missing newlines to mode output and usage strings; in shader.c, added null check on argv[1], verified argv[2..argc-1] are non-null before bu_vls_from_argv, replaced bu_vls_addr with bu_vls_cstr, and added missing newlines to usage, current shader output, and read-only error message; in shells.c, fixed major resource and memory leaks by deferring wdb_dbopen until after argument validation, verifying wdbp allocation, calling wdb_close on all error and success exits, calling rt_db_free_internal on old_intern across all exits, freeing shell_name on all exits, and eliminating double-free of m_tmp after rt_db_put_internal failure; in showmats.c, eliminated mutation of input path and improved safety by operating on a duplicated string buffer via bu_strdup and freeing path_copy on all exit paths, guarded smdp, smdp->smd_child, and comb_leaf->tr_l.tl_name against null in Do_showmats, guarded argv[1] against null in ged_showmats_core, added trailing newline to 16-element matrix output in -a mode, and added missing newlines to usage strings; in shrinkwrap.c, added GED_CHECK_DATABASE_OPEN guard and safely handled potential null argv[0]; in simulate/ged_command.cpp, added missing newline to non-Bullet error message, validated argc >= 3 and ensured argv[1] and argv[2] are non-null before parsing options, wrapped anim_state in std::unique_ptr to prevent persistent memory and resource leaks if exceptions are thrown during simulation steps, and added missing newline to exception result output; in simulate/rt_collision_algorithm.cpp, guarded against null rays in free_xrays, prevented division by zero by validating grid_radius > 0 and radius > 0 in generate_ray_grid and get_rays, returning null safely instead of calling bu_bomb, and added null checks on btRigidBody::upcast, getMotionState, and rays.ptr in calculate_contact_points to prevent null pointer dereferences. |
-| `SEC-0267` | **Sev 2** | Resource Leaks, Memory Corruption, Unhandled Exceptions/Process Termination (bu_bomb), and Null Pointer Dereferences | `src/libged (Batch 25: simulate)` | `FIXED` | In BRL-CAD libged Batch 25 commands (src/libged/simulate/*): in rt_collision_shape.cpp, eliminated process-aborting bu_bomb calls by zeroing inertia when mass <= 0.0 and clamping negative scaling and margin values to 0.0; in rt_debug_draw.cpp, fixed major resource leaks of in-memory database handles by ensuring wdb_close is called on all paths in drawLine, drawAabb, and drawContactPoint, clamped color components to [0.0, 1.0] instead of terminating with bu_bomb, and added null check on message in reportErrorWarning; in rt_instance.cpp, guarded against null application and partition pointers in multioverlap_handler, falling back safely to rt_default_multioverlap on unexpected region table lengths or region names instead of calling bu_bomb, and threw InvalidSimulationError instead of aborting the process with bu_bomb when rt_i_create or rt_gettrees fails in get_overlaps; in rt_motion_state.cpp, guarded matrix and result destination pointers in bt_transform_to_matrix and path_to_matrix, and threw InvalidSimulationError instead of calling bu_bomb on rt_db_get_internal, db_find_named_leaf, or rt_db_put_internal failure; in rt_roi_collision_shape.cpp, guarded against null m_box_shape before dereferencing in getAabb, calculateLocalInertia, getLocalScaling, getMargin, setLocalScaling, and setMargin, clamped negative scaling and margin values, and zeroed inertia when mass <= 0.0; and in rt_roi_collision_shape.hpp, declared copy constructor and assignment operator private to enforce the Rule of Three and prevent double-free corruption of m_box_shape. |
-| `SEC-0268` | **Sev 2** | Memory Leaks, Inverted Return Value Logic Bug, Process Termination in Library Function (bu_bomb), Missing Validation, Division by Zero, and Null Pointer Dereferences | `src/libged (Batch 26: simulate, slew, solid_report)` | `FIXED` | In BRL-CAD libged Batch 26 commands (simulate, slew, solid_report): in simulate/sim_animate.cpp and sim_animate.hpp, added null checks in az_el_to_offset, look_at_quaternion, and ae_to_quaternion, guarded m_gedp and dbip in getSceneCenter and renderFrame, cleared jpeg_data on error and bounded maximum buffer read size in readPixToJpeg, validated width, height, and fps in encodeVideo, enforced the Rule of Three on SimAnimState with private copy constructor and assignment operator, and removed unused method declaration writeMjpegAvi; in simulate/simulation.cpp and simulation.hpp, eliminated multiple process-terminating bu_bomb calls across get_aabb, get_simulation_parameters, Region::get_region, and Region::get_regions by throwing InvalidSimulationError with contextual path information, replaced bu_bomb in saveState with warning logging, eliminated persistent memory leak of bullet collision create functions in Simulation::Simulation by tracking allocated CreateFunc pointers in m_create_funcs and deleting them in ~Simulation(), and enforced the Rule of Three on Simulation and Region; in simulate/tests/simulate_test.cpp, safely returned false on null matrix in matrix_equal instead of calling bu_bomb, and guarded argv and argv[0] in main; in simulate/tests/verify_simulation.c, added null checks in parse_bbox, get_bbox, check_presim, check_postsim, and main, replaced raw sscanf with bu_sscanf, replaced bu_vls_addr with bu_vls_cstr, and guarded against division by zero on truck_height when calculating penetration percentage; in simulate/utility.cpp, threw InvalidSimulationError in current_dir on empty paths, fixed critical inverted logic bug in set_region where bu_avs_remove returning 1 on successful attribute removal was erroneously treated as an error causing bu_bomb to abort the process, and replaced remaining bu_bomb calls with warning logging to ensure clean teardown in ~TemporaryRegionHandle; in slew/slew.c, added null checks on argv[1..3], replaced raw sscanf with bu_sscanf, and added missing newlines to all usage strings; and in solid_report/solid_report.c, guarded gedp against null. |
-| `SEC-0269` | **Sev 2** | Memory Leaks, Resource Leaks, Option Parsing Collision, Uninitialized Memory Operations, and Null Pointer Dereferences | `src/libged (Batch 27: solids_on_ray, sphgroup, stat, summary, sync, tab_complete, tables, bot_dump, bot_split, check_mann_docs)` | `FIXED` | In BRL-CAD libged Batch 27 commands and test drivers: in solids_on_ray/solids_on_ray.c, eliminated persistent memory leaks of solids_on_ray_cmd_vec strings (allocated by ged_who_argv) and snames path strings (allocated by db_path_to_string), added null guards on ap and PartHeadp in rpt_hits, verified pp->pt_inseg and pp->pt_inseg->seg_stp before retrieving path, guarded ap in rpt_miss, added null checks on gedp, dbip, ray_orig, and ray_dir in skewer_solids, replaced raw sscanf with bu_sscanf, added null checks on argv[1] and argv[2], and added missing newlines to usage and error strings; in sphgroup/sphgroup.c, fixed persistent memory leak of sph_intern by calling rt_db_free_internal on non-sphere error, _ged_combadd error, and normal exit, added null/empty string validation on argv[1] and argv[2], added missing newline to usage string, and deleted commented-out dead code; in stat/stat.cpp, fixed option parsing bug where the -q quiet flag was clobbered by -r raw due to duplicate array index d[3], fixed memory leaks in cmp_dps by using std::string to eliminate bu_vls leaks and freeing avs and string allocations on all exit paths, fixed memory leaks in stat_output by scoping bu_vls and freeing avs, added null/bounds checks in dpath_sort and _stat_find_first_unescaped, and added missing newlines to bu_log; in summary/summary.c, fixed major memory leak in solid_counter by calling rt_db_free_internal, added null checks in comb_counter and solid_counter, validated bu_opt_parse return value, guarded argv[0] against null, and added error output on missing objects; in sync/sync.c, added GED_CHECK_ARGC_GT_0 to prevent null dereference of argv[0] and appended missing newline; in tab_complete.cpp, added null guards in alphanum_cmp, path_match, obj_match, and ged_cmd_completions; in tables/tables.c, fixed memory leak of tree_objs bu_ptbl, verified read count before matching identt in tables_sol_number, initialized static descriptors to -1, guarded sol_loaded before invoking ft_describe or freeing sol_intern in tables_new, guarded getpwuid against null in tables_header, guarded ctime return in ged_tables_core, and added missing newlines; in tests/bot/bot_dump.cpp, guarded argv against null, corrected arbs_stl output comparison path for arb4_bot_02.stl, and added missing newlines; in tests/bot/bot_split.cpp, guarded argv in main, added null checks in check_output_group, check_output_bot, and check_decimated_bot, and ensured rt_db_free_internal is called on early return; and in tests/check_mann_docs.cpp, validated argv in main, added null checks before array indexing, and verified file stream is_open status before reading or writing. |
-| `SEC-0270` | **Sev 2** | Logic Bugs, Resource and Handle Leaks, Missing Parameter and Option Validation, and Null Pointer Dereferences | `src/libged (Batch 28: tests/check_prim_cmds, tests/create, tests/draw)` | `FIXED` | In BRL-CAD libged Batch 28 test suites and drivers: in tests/check_prim_cmds.cpp, guarded argc and argv in main and checked empty ftp->ft_label string; in tests/create/create_parity.c, added null checks in case_covered and check_coverage, fixed handle leak in open_test_db by closing wdbp with wdb_close instead of leaking wdbp via raw db_close, guarded gedp, gedp->dbip, name, and out in snapshot, guarded argc and argv in main, and ensured temporary test database files are deleted on all exit paths; in tests/create/create_parity.h, verified interface header clean; in tests/create/in_cases.c and make_cases.c, added null guards on gedp, name, and label in build_obj and make_obj, and added null checks in trans_exempt and extra_checks; in tests/draw/aet.cpp, guarded gedp, dbi_state, view counts, and display manager pointers in dm_refresh and img_cmp, freed tname on error exits, guarded argc and argv in main, validated option parsing results, freed fname, deleted temporary database moss_aet_tmp.g, and cleared local cache directory lcache on exit; in tests/draw/annotate.cpp, fixed handle leak in verify_geometry_update by ensuring wdb_close is called on wdbp, guarded gedp and gedp->dbip in verify_legacy_annotation_coloring, and guarded argc and argv in main; in tests/draw/basic.cpp and faceplate.cpp, fixed critical logic bug where if (uac == -1 || need_help) had an empty statement body which inverted command-line argument validation logic, guarded ac and av in main, guarded gedp across poly_* helper functions, freed fname, deleted temporary moss_tmp.g, and cleared lcache on exit; and in tests/draw/draw_color.cpp, guarded argv in main, guarded fixture path, and added null checks on gedp, gedp internals, display structures, and directory pointers in check_drawing. |
-| `SEC-0271` | **Sev 2** | Logic Bugs, Temporary File and Resource Leaks, Double-Free, Missing Option and Parameter Validation, and Null Pointer Dereferences | `src/libged (Batch 29: tests/draw, tests/edit, ged_test_rm, ged_test_tire, plugins, search_tests, test_bb_tight)` | `FIXED` | In BRL-CAD libged Batch 29 test suites and drivers: in tests/draw/lod.cpp and select.cpp, corrected option parsing check from ac != 2 to uac != 2 so optional command flags such as -c are correctly recognized without causing premature test failure, added null guards on ac, av, gedp, gedp->dbip, v, and v->dmp, freed fname and cleaned up temporary test databases on all exit paths; in tests/draw/quad.cpp, added null checks across drawing and refresh helpers, guarded image comparison against null control and test images, freed cname, corrected option parsing bounds, and ensured temporary database cleanup on exit; in tests/draw/util.cpp, added null guards on dp, u_data, dbi_state, ged_gvp, and dmp, and plugged memory leaks in img_cmp; in tests/edit/test_edit.cpp, replaced invalid jump-over-initialization error path with direct cleanup in create_p0_fixture, replaced manual export and double-free in create_p6_fixture with mk_brep, and ensured all 10 temporary database files (p0_path through p6_path) are unlinked via bu_file_delete across all error and success exits; in tests/ged_test_rm.c, replaced leaking db_close calls with wdb_close, added close_test_db to delete temporary test database files upon completion across all 26 test functions, fixed unchecked db_lookup dereferences, and added null guards in CHECK_PRESENT, CHECK_ABSENT, member_count, comb_has_op, and main; in tests/ged_test_tire.cpp, fixed database handle leaks by properly pairing wdb_fopen with wdb_close, added close_test_db to clean up temporary test databases, unlinked temporary text files and pattern files via bu_file_delete, eliminated premature wdb_close in run_partial_cleanup_case on an unowned handle, and added null checks across inspection helpers; in tests/plugins.cpp, fixed off-by-one / null pointer dereference in error message accessing av[1] instead of av[0], guarded ac and av in main, and added null checks on imsgs and cmds; in tests/search_tests.cpp, added null guards for gedp, gedp->dbip, path_dp, and search_count_helper, and validated argc/argv; and in tests/test_bb_tight.c, fixed wdbp handle leaks in open_test_db, added close_test_db to remove temporary test databases, and added null guards in parse_bb_volume, run_bb_volume, and main. |
-| `SEC-0272` | **Sev 2** | Resource Leaks, Null Pointer Dereferences, Division by Zero, and Array Overflow | `src/libged (Batch 30: test_bo, test_db, test_gqa, test_list, test_material, test_search, test_select, test_tops, test_view_dir, tire)` | `FIXED` | In BRL-CAD libged Batch 30 test programs and tire command: in test_bo.c, replaced db_close(wdbp->dbip) with wdb_close(wdbp) to fix wdb handle leak, and added null guard on binunif internal pointer before accessing type, count, and data fields; in test_gqa.c, added null check on ged_open return value; in test_list.c, validated atoi result for non-positive values and guarded elapsed_sec > 0 before division to prevent division by zero in ops-per-second calculation; in test_material.c, added null check on ged_open return value and added ged_close before exit to prevent resource leak; in test_search.c, added null check on ged_open return value and added bounds check on variadic plan arguments to prevent overflow of fixed-size cmd[6] array; in test_select.cpp, added null check on ged_open return value, freed DbiState allocation, and cleaned up temporary cache directory with bu_dirclear on exit; in test_tops.c, added null check on ged_open return value; test_db.c reviewed clean; test_view_dir.c reviewed clean; tire/tire.cpp reviewed clean. |
-| `SEC-0273` | **Sev 2** | Division by Zero, Integer Underflow, and Convention Violations | `src/libged (Batch 31: tire, title, tol)` | `FIXED` | In BRL-CAD libged Batch 31 (tire, title, tol): in tire/tire_surface.cpp, added ZERO() division-by-zero guard; in tire/tire_tread.cpp, added empty vector guard to prevent size_t underflow; in title/title.c, replaced bu_vls_addr with bu_vls_cstr; in tol/tol.c, replaced sscanf with bu_sscanf. Reviewed clean: tire_conic.cpp, tire_csg.cpp, tire_private.h, tire_tread_def.cpp, tire_tread_profile.cpp, tire_wheel.cpp. |
-| `SEC-0274` | **Sev 2** | Memory Leaks, Resource Leaks, Unsafe API, and Convention Violations | `src/libged (Batch 32: tops, tra, trace, track, tree, typein, unhide, units, v2m_point, vdraw)` | `FIXED` | In BRL-CAD libged Batch 32 (tops through vdraw): in tree/tree.c, fixed memory leak of attribute value set by adding bu_avs_free, fixed resource leak of rt_db_internal on v4gift flatten failure, replaced bu_vls_addr with bu_vls_cstr; in typein/typein.c, fixed resource leaks in extrude_in and revolve_in when imported object is not ID_SKETCH by adding rt_db_free_internal, replaced bu_vls_addr with bu_vls_cstr in revolve_in and pnts_in (4 instances); in units/units.c, replaced bu_vls_addr with bu_vls_cstr; in v2m_point/v2m_point.c, replaced raw sscanf with bu_sscanf (3 instances), fixed copy-paste error in error messages; in vdraw/vdraw.c, replaced raw sscanf with bu_sscanf (7 instances). Reviewed clean: tops.c, tra.c, trace.c, track.c, unhide.c. |
-| `SEC-0275` | **Sev 2** | Unsafe API and Memory Leaks | `src/libged (Batch 33: view module)` | `FIXED` | In BRL-CAD libged Batch 33 (view module): in view/aet.c, replaced raw sscanf with bu_sscanf (3 sites); in view/align.c, replaced raw sscanf with bu_sscanf (3 sites); in view/center.cpp, replaced raw sscanf with bu_sscanf (3 sites); in view/eye.c, replaced raw sscanf with bu_sscanf (3 sites); in view/faceplate/faceplate.c, added bu_vls_free on stack VLS after bu_opt_color and bu_opt_int calls to prevent memory leaks (4 sites). Reviewed clean: vers.c, autoview.c, autoview2.cpp, axes.c, data_lines.c, faceplate.h, faceplate_axes.c, faceplate_grid.c, interactive_rect.c, ged_view.h. |
-| `SEC-0276` | **Sev 2** | Memory Leaks, Logic Bugs, Out-of-bounds Array Access, Resource Leaks, Unsafe API, and Missing Validation | `src/libged (Batch 34: view module: gobjs through ypr)` | `FIXED` | In BRL-CAD libged Batch 34 (view module: gobjs through ypr): in view/gobjs.cpp, fixed memory leaks of full path and internal objects in create command and scene free callback, and checked database open; in view/labels.c and view/lines.c, guarded against null scene object creation and used bu_vls_sprintf to prevent vls buffer leaks; in view/lod.cpp, validated database open before cache commands, checked wdb handle, fixed copy-paste error in scale message, and removed dead vls variables; in view/lookat.c, replaced raw sscanf with bu_sscanf (3 sites), guarded against zero vector division when lookat point is at eye position, and added missing newlines; in view/objs.cpp, fixed memory leak of directory pointers in _view_cmd_old_obj across all return paths, guarded against null ged internals, removed redundant recurse check, and fixed argument reporting in arrow subcommand; in view/polygons.c, fixed out-of-bounds argv index in overlap subcommand (argv[1] -> argv[0]), fixed error message reporting in bool subcommand (argv[0] -> argv[1]), checked database open before overlap tolerance check, and formatted s_name with bu_vls_sprintf; in view/quat.c, replaced raw sscanf with bu_sscanf (4 sites) and added missing newlines; in view/qvrot.c, replaced raw sscanf with bu_sscanf (4 sites), corrected argument reporting for bad angle from argv[1] to argv[4], and added missing newlines; in view/saveview.c, replaced bu_vls_addr with bu_vls_cstr, guarded display list traversal against null pointers, and added missing newlines; in view/size.c, replaced raw sscanf with bu_sscanf and added missing newlines; in view/snap.c, fixed critical logic bug where vp was set from uninitialized p instead of parsed 2D coordinates p2d, freed temporary msg vls on all early returns to eliminate memory leak, and added missing newlines; in view/view.c, added missing newlines to usage and error messages; in view/viewdir.c, added missing newline to usage message; in view/ypr.c, replaced raw sscanf with bu_sscanf (3 sites) and added missing newlines. Reviewed clean: knob.c. |
-| `SEC-0277` | **Sev 2** | Memory Leaks, Resource Leaks, Memory Corruption, Unsafe API, Double Free, Division by Zero, and Missing Validation | `src/libged (Batch 35: view2grid_lu through zoom, completing src/libged)` | `FIXED` | In BRL-CAD libged Batch 35 (completing src/libged subsystem, 21 files): in view2grid_lu.c and view2model_lu.c, moved GED_CHECK_DATABASE_OPEN before b2lval evaluation, replaced raw sscanf with bu_sscanf, guarded against division by zero with ZERO macro in view2model_lu.c, and added missing newlines; in view2model.c, added missing newline to usage; in view2model_vec.c, replaced sscanf with bu_sscanf, checked bn_mat_inverse return, and added newline; in voxelize.c, fixed persistent rt_wdb resource leak with wdb_close, fixed rt_i_destroy leak on error, fixed argument reporting in error message, replaced sscanf with bu_sscanf, added bounds checks on voxel size and level of detail, and fixed format string; in vrot.c, added missing newlines and returned GED_HELP on argc == 1; in vutil.c, fixed memory corruption in ged_dl_hash by passing dp->d_namep string content instead of pointer address, added null guards, and checked bn_mat_inverse return values; in wcodes.c, fixed memory leak of path array on error exits, replaced direct ft_ifree with rt_db_free_internal, guarded null names, and added newlines; in wdb_importFg4Section.c, fixed crash on command reuse by resetting static state variables at start of command, replaced free with bu_free, replaced bu_bomb with error logging, validated line buffer lengths, and added zero face count guard; in whatid.c, verified ID_COMBINATION and added newlines; in which.cpp, replaced sscanf with bu_sscanf, guarded against integer subtraction overflow, capped range to prevent memory exhaustion, freed comb_objs on error, and verified ID_COMBINATION; in which_shader.c, fixed major memory leak of combination records by calling rt_db_free_internal on every iteration, replaced bu_vls_addr with bu_vls_cstr, and added newlines; in who.c, moved GED_CHECK_ARGC_GT_0 to top, replaced bu_vls_addr with bu_vls_cstr, guarded gdlp->dl_dp, and added newlines; in who2.cpp, moved GED_CHECK_ARGC_GT_0 to top, guarded dbis and bvs against null, and added newlines; in who_solids.cpp, checked sp->s_os before accessing s_dmode, moved GED_CHECK_ARGC_GT_0 to top, and guarded gedp internals; in wireframe_eval.c, guarded scene and scene data against null, set op for OP_NOP, fixed memory leak of application struct and ppath in draw_m3, and added null checks in fix_halfs and free_etree; in wmater.c, moved GED_CHECK_ARGC_GT_0 to top, replaced bu_vls_addr with bu_vls_cstr, verified ID_COMBINATION, and added newlines; in xpush.c, eliminated persistent rt_wdb handle leaks in Copy_solid and Copy_comb by using stack tolerance structs, fixed double-free on rt_db_put_internal failure, fixed combination internal memory leak when found is null or comb tree is null, guarded log10 domain, and fixed typo; in zap.c, guarded gedp internals, checked path length before accessing first solid, moved GED_CHECK_ARGC_GT_0 to top, and added newline; in zap2.cpp, freed cvls on help and error returns, guarded views, v, bvs, and v->gv_s against null, and moved GED_CHECK_ARGC_GT_0 to top; in zoom.c, replaced sscanf with bu_sscanf, guarded gedp->ged_gvp and division by zero, moved GED_CHECK_ARGC_GT_0 to top, and added newlines. |
-| `SEC-0278` | **Sev 2** | Memory Leaks, Resource Leaks, Null Pointer Dereferences, Process Termination, and Missing Validation | `src/libwdb (Batch 36: annot through id)` | `FIXED` | In BRL-CAD libwdb Batch 36 (procedural geometry export, annot through id, 14 files): in annot.c, added null checks on fp, name, and ann, and checked rt_copy_annot return value before export; in arbn.c, validated filep, name, eqn, and checked neqn == 0 to prevent empty/invalid halfspace array export; in ars.c, validated filep, name, curves, and checked ncurves == 0 and pts_per_curve == 0; in bot.c, validated fp, fp->dbip, name, vertices, and faces, checked num_vertices == 0 and num_faces == 0, validated normals and face_normals when num_normals > 0, validated uvs and face_uvs when num_uvs > 0, guarded face_mode bitv duplication, and replaced manual loops with memcpy; in brep.cpp, replaced BU_ASSERT with explicit null validation on file, name, and vbrep, and freed bi on ON_Brep duplication failure; in cline.c, validated fp, name, V, and height, and ensured radius > 0 and thickness >= 0; in constraint.c, validated wdbp and name, and assigned expr to constraint expression when provided; in datum.c, validated wdbp, name, point, and direction in mk_datum, and validated fp, name, and head in mk_datums; in dsp.c, validated filep, name, and stom matrix, checked positive xdim/ydim dimensions, and initialized missing RT_DSP_SRC_FILE datasrc; in dynamic_geometry.c, fixed persistent memory leaks of tmp_name on all success paths in make_hole and make_hole_in_prepped_regions, freed internal database object and soltab on prep failure, called rt_db_free_internal after ft_prep to prevent leaking loaded combination/solid structures, eliminated bu_bomb process terminations, and validated input pointers and dimensions; in ebm.c, validated fp, name, file/binunif, tallness, dimensions, and matrix, and explicitly set RT_EBM_SRC_FILE in mk_ebm; in extrude.c, validated fp, name, sketch_name, V, h, u_vec, and v_vec, and checked height vector magnitude; in id.c, validated fp, fp->dbip, title, and conversion factor across mk_id, mk_id_units, and mk_id_editunits. Reviewed clean: export.c. |
-| `SEC-0279` | **Sev 2** | Double-Free / Memory Corruption, Memory Leaks, Process Abort, Integer Overflow, and Missing Validation | `src/libwdb (Batch 37: mater through wdb, completing src/libwdb)` | `FIXED` | In BRL-CAD libwdb Batch 37 (procedural primitives, mater through wdb, 13 files, completing src/libwdb): in mater.c, added null checks on ofp and ofp->dbip, and returned -1 on unsupported v4 database rather than asserting mk_version == 4; in material.c, added null checks on wdbp and db_name, guarded against null name, parent, and source strings before bu_vls_strcpy, and validated attribute keys and values before bu_avs_merge to prevent bu_bomb aborts; in nmg.c, added null checks on filep, name, and m before NMG_CK_MODEL, and verified botp != NULL after nmg_bot conversion before export; in nurb.c, added null checks on wdbp, name, and surfs, and verified ni->nsrf > 0 (freeing ni on zero surfaces) before export; in pipe.c, added null checks on fp, name, vertex, and height, verified positive radii with ZERO macro, validated headp in mk_pipe, mk_pipe_free, and mk_pipe_init, and validated od > 0, id >= 0, id < od, and bendradius >= 0 in mk_add_pipe_pnt; in pnts.c, added null checks on pnts and pnts->point in pnts_init_head_pnt and pnts_add, checked scale >= 0.0, and validated point != NULL before adding points in mk_pnts; in reg.c, added null checks on comb and member_hd in mk_tree_pure and mk_tree_gift, guarded headp in mk_freemembers, added null checks on wdbp, combname, and headp in mk_comb, and validated membname in mk_comb1 and mk_region1; in script.c, eliminated Cat 1 memory corruption and caller memory free by allocating and duplicating scr into a newly allocated rt_script_internal before passing to wdb_export; in sketch.c, added null checks on fp, name, and skt, and checked rt_copy_sketch return before export; in submodel.c, added null checks on fp, name, and treetop; in units.c, added null check on str and ZERO() macro guards against zero conversion factor in mk_conversion and mk_set_conversion; in vol.c, added null checks on fp, name, file, cellsize, and mat, and verified positive dimensions and cell sizes; in wdb.c, eliminated memory leaks in mk_hyp by validating parameters before internal structure allocation, replaced bu_bomb in mk_metaball with internal structure cleanup and error return, guarded against integer overflow in mk_binunif allocation and validated data pointer before memcpy, and added null pointer and geometric parameter validation with ZERO macro across mk_half, mk_grip, mk_rpp, mk_wedge, mk_arb4-8, mk_sph, mk_ell, mk_tor, mk_rcc, mk_tgc, mk_cone, mk_trc_h, mk_trc_top, mk_rpc, mk_rhc, mk_epa, mk_ehy, mk_hrt, and mk_eto. |
-
-
-| `SEC-0280` | **Sev 2** | Buffer Overflow, Double-Free, Logic / Angle Calculation Bug, Memory Leaks, Array Out-of-Bounds, Division by Zero, and Missing Validation | `src/mged (Batch 38: adc through chgtree)` | `FIXED` | In BRL-CAD mged Batch 38 (adc through chgtree, 9 files): in adc.c, fixed stack buffer overflow by capping user_pt coordinate parsing to the 3-element buffer capacity, replaced atof with bu_sscanf, guarded against division by zero in grid_scale across dst, dh, dv, and hv with ZERO macro, fixed incorrect input point parameter in MAT4X3PNT (passing pos_view instead of pos_model), added null pointer guards in adc_set_dirty_flag, adc_set_scroll, adcursor, and f_adc, and replaced bu_vls_addr with bu_vls_cstr; in arbs.c, eliminated double-free on rt_db_put_internal failure and fixed memory leak of internal struct on db_diradd failure and switch default, freed temporary vls on error return, eliminated unused file-scope dead array p_arb3pt and global mutable promp pointer, replaced atof with bu_sscanf, and replaced bu_vls_addr with bu_vls_cstr; in attach.c, made release() name parameter const char *, added null check on s and wp_name in mged_attach, removed redundant null check, and replaced bu_vls_addr with bu_vls_cstr; in axes.c, guarded against aspect division by zero with ZERO macro in draw_v_axes, and added null pointer guards in draw_e_axes, draw_m_axes, and draw_v_axes; in buttons.c, added bounds-checked get_state_str() helper to prevent out-of-bounds array reads on state_str, added null pointer checks in f_press, bv_vrestore, bv_vsave, and bv_adcursor, and replaced bu_vls_addr with bu_vls_cstr; in cad_boundp.c, resolved angle calculation bug where atan2 radian output was multiplied by DEG2RAD instead of RAD2DEG (corrupting bounding polygon angle computations), moved stray debug newline output inside #ifdef DEBUG, migrated memory management to bu_malloc and bu_free, included bu/malloc.h, replaced sscanf with bu_sscanf, and added negative tolerance validation; in cad_parea.c, replaced sscanf with bu_sscanf, and routed error logging from printf to stderr to prevent corrupting redirected stdout files; in chgmodel.c, guarded divisions in f_sc_obj against zero scale denominator and scale accumulators with ZERO macro, validated scale input with bu_sscanf, verified direction vector magnitude squared in f_qorot and corrected inverted error message, replaced sprintf with snprintf and guarded view_state in f_make, and replaced bu_vls_addr with bu_vls_cstr; in chgtree.c, fixed memory leak of internal database struct on db_diradd failure in f_copy_inv, added null guards in find_solid_with_path and find_solid_below_path, ensured lhs, rhs, and both paths are properly freed on all error exit paths in cmd_oed, and replaced bu_vls_addr with bu_vls_cstr. |
-| `SEC-0281` | **Sev 2** | Stack Buffer Overflow, Out-of-bounds Array Access, Double-Free, Division by Zero, Memory Leaks, and Null Pointer Dereferences | `src/mged (Batch 39: chgview.c, clone.c)` | `FIXED` | In BRL-CAD mged Batch 39 (chgview.c and clone.c, 4,128 lines): in clone.c, fixed stack buffer overflows in get_name by adding field width limits with CPP_XSTR(CLONE_BUFSIZE) to bu_sscanf and replacing raw sscanf with bu_sscanf, fixed double-free and memory leaks of name vls by migrating deallocation from bu_vls_free to bu_vls_vlsfree (since get_name allocates outer struct via bu_vls_vlsinit), fixed out-of-bounds negative array indexing obj_list.names[-1] in copy_v5_comb_tree and copy_v4_comb by validating index_in_list return value (lidx >= 0) before indexing, fixed memory leak of obj_list.names[i].src in copy_object and ensured obj_list is freed across all return paths, fixed memory leaks of internal structures and records in copy_v4_solid, copy_v4_comb, copy_v5_solid, and copy_v5_comb on error paths, fixed potential division by zero in f_tracker by checking n_verts > 1, replaced raw calloc/free with bu_calloc/bu_free, and replaced read-only bu_vls_addr calls with bu_vls_cstr; in chgview.c, guarded against division by zero in cmd_size, mged_vscale, and cmd_sca by checking gv_i_scale with ZERO macro, added null checks on view_state and vs_gvp across cmd_center, cmd_size, size_reset, edit_com, cmd_autoview, f_status, f_refresh, update_all_rate_flags, mged_print_knobvals, knob_apply_misc, f_knob, mged_zoom, cmd_setview, f_slewview, mged_svbase, f_svbase, setview, slewview, f_view_ring, cmd_mrot, cmd_rot, cmd_arot, mged_vscale, and cmd_sca, fixed out-of-bounds argv access in edit_com, bounded state_str array indexing in f_status, replaced sprintf with snprintf in f_regdebug and guarded DMP, fixed early-out memory leak of orig_nargv and vlsargv in f_ill, guarded path_parse against null path, guarded MEDIT(s) and s->s_edit before dereference in mged_librt_knob_edit_apply and mged_escale, and replaced read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0282` | **Sev 2** | Memory Leaks, Resource Leak, Out-of-bounds Argument Access, Division by Zero, Duplicate Print Bug, and Null Pointer Dereferences | `src/mged (Batch 40: cmd.cpp, cmd.h)` | `FIXED` | In BRL-CAD mged Batch 40 (cmd.cpp and cmd.h, 3,647 lines): in cmd.h, audited header prototypes and linkage guards (clean); in cmd.cpp, eliminated memory leak in cmd_ged_inside where rt_db_internal intern was transformed but never freed with rt_db_free_internal across all exits, fixed NULL pointer dereference in cmd_ged_inside on illump->s_old.s_Eflag when illump is NULL, eliminated resource leak in cmd_rt_gettrees where rtip was created with rt_i_create but not destroyed with rt_i_destroy on missing geometry argument exit paths, eliminated duplicate window listing print bug in f_tie when called with no arguments, guarded division by zero in cmd_units with ZERO macro on sf, checked argc and argv bounds before indexing in cmd_ged_edit_wrapper, cmd_ged_simulate_wrapper, cmd_ged_in, cmd_ged_more_wrapper, cmd_nmg_collapse, and cmd_get_more_default, added missing error report when window name is not found in cmd_win set, added null pointer checks on view_state, view_state->vs_gvp, s->mged_curr_dm, DMP, illump, and MEDIT(s) across GED wrapper dispatchers, view management, and rendering hooks (cmd_ged_view_wrapper, cmd_ged_dm_wrapper, cmd_screengrab, cmd_blast, f_postscript, f_winset, _view_update_rate_flags_viewonly, and cmd_view), replaced fixed-size snprintf format in f_bomb with sizeof(buffer), and replaced ~45 read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0283` | **Sev 2** | Memory Leak, Null Pointer Dereference, Out-of-bounds Array / Argument Access, and Missing Parameter Validation | `src/mged (Batch 41: color_scheme.c, columns.c, dm-generic.c, dodraw.c)` | `FIXED` | In BRL-CAD mged Batch 41 (color_scheme.c, columns.c, dm-generic.c, and dodraw.c, 1,449 lines): in color_scheme.c, added null pointer checks on m_dmp, m_dmp->dm_dmp, s->interp, and color_scheme before dereferencing, ensured error messages are safely reported, and replaced read-only bu_vls_addr calls with bu_vls_cstr; in columns.c, added null pointer guards in vls_col_item and vls_col_eol to prevent crashes on null strings or null buffer pointers, and added symmetric null pointer checks for a, b, *dp1, *dp2, (*dp1)->d_namep, and (*dp2)->d_namep in cmpdirname comparator to prevent qsort crashes; in dm-generic.c, added null checks on s, s->interp, argc, and argv in common_dm and dm_commands, added null guards on rubber_band, mged_variables, s->mged_curr_dm, DMP, view_state, view_state->vs_gvp, s->gedp->ged_gvp->gv_s, adc_state, grid_state, and MEDIT(s) across idle, m, am, adc, con, size, getx, and bg command handlers, checked argc bounds before indexing argv[1..4], replaced raw sscanf with bu_sscanf for RGB background parsing, added null guards in view_state_flag_hook, dirty_hook, zclip_hook, and set_hook_data, and replaced all read-only bu_vls_addr calls with bu_vls_cstr; in dodraw.c, eliminated memory leak in replot_modified_solid where rt_db_internal intern was transformed via transform_editing_solid but never freed when ft_plot failed (< 0), fixed potential NULL pointer dereference and out-of-bounds access in replot_original_solid by validating bdata->s_fullpath.fp_len > 0 and LAST_SOLID(bdata) before dereferencing dp->d_namep, freed existing bdata->s_fullpath with db_free_full_path before duplicating in drawH_part2, guarded s->gedp and ged_dl(s->gedp) against NULL, added null guards in mged_bound_solid, replot_original_solid, replot_modified_solid, add_solid_path_to_result, and redraw_visible_objects, and replaced read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0284` | **Sev 2** | Division by Zero, Null Pointer Dereference, and Out-of-bounds Argument Access | `src/mged (Batch 42: doevent.c, dozoom.c)` | `FIXED` | In BRL-CAD mged Batch 42 (doevent.c and dozoom.c, 1,064 lines): in doevent.c, guarded against division by zero in motion_event_handler by clamping window width and height to positive values (width <= 0 ? 1 : width, height <= 0 ? 1 : height) and checking dm_get_aspect with ZERO macro before dividing, added null checks on s, eventPtr, s->mged_curr_dm, and DMP in mged_dm_motion and doEvent, added null guards on rubber_band, grid_state, MEDIT(s), adc_state, view_state, and view_state->vs_gvp across all AMM modes (AMM_IDLE, AMM_ROT, AMM_TRAN, AMM_SCALE, AMM_ADC_*, AMM_CON_*), guarded MEDIT in reset_edflag, and replaced read-only bu_vls_addr calls with bu_vls_cstr; in dozoom.c, eliminated critical division by zero in dozoom perspective calculation where to_eye_scr divided by tan(perspective) without verifying tan != 0 by checking tan value with ZERO macro and using fallback large distance, guarded against division by zero when adjusting inv_viewsize by checking MEDIT(s)->model_changes[15] with ZERO macro, added null checks on s, s->mged_curr_dm, DMP, view_state, view_state->vs_gvp, s->gedp, MEDIT(s), mged_variables, and color_scheme in dozoom, guarded transparency access (sp->s_os->transparency) against null sp->s_os in create_dlist_solid, added null pointer guards in createDLists, create_dlist_solid, createDListSolid, create_dlist_all, createDListAll, free_dlists, and freeDListsAll, and validated active_dm_set display managers and variables. |
-| `SEC-0285` | **Sev 2** | Inverted Logic Bug, Double-Free, Memory Corruption / Type Mismatch, Resource Leaks, Division by Zero, and Null Pointer Dereferences | `src/mged (Batch 43: edsol.c, f_cmd.h)` | `FIXED` | In BRL-CAD mged Batch 43 (edsol.c and f_cmd.h, 2,324 lines): in f_cmd.h, audited extern command function prototypes (clean); in edsol.c, fixed critical inverted logic bug in ecmd_bot_thick_clbk where face_state > -1 mistakenly triggered error branch and face_state < 0 updated face 0, eliminated double-free in sedit_apply where rt_db_put_internal already frees es_int on all outcomes, fixed reset sequencing in f_sedit_reset where rt_db_free_internal was called before ft_prim_edit_reset zeroing primitive type ID, fixed inverted condition in f_get_sedit (illump || !illump->s_u_data) that caused command to always fail, prevented memory corruption in f_put_sedit by returning TCL_ERROR on functab mismatch rather than executing bu_structparse_argv with wrong structure layout, guarded against division by zero in mged_param with ZERO macro on viewscale, clamped input parameter count to RT_EDIT_MAXPARA, eliminated memory leaks of vls commands on early returns in get_sketch_name, ecmd_extrude_skt_name_clbk, and f_get_sedit_menus, replaced raw atof/atoi with bu_sscanf, verified bn_mat_inverse return in oedit_apply and f_oedit_apply, added primitive type bounds validation (ID_NULL < id <= ID_MAX_SOLID), and added extensive NULL guards on s, MEDIT(s), view_state, DMP, and bdata across all solid and object editing routines. |
-| `SEC-0286` | **Sev 2** | Out-of-bounds Array / Buffer Access, Uninitialized Variables, Division by Zero, Resource Leaks, and Null Pointer Dereferences | `src/mged (Batch 44: f_db.c, facedef.c)` | `FIXED` | In BRL-CAD mged Batch 44 (f_db.c and facedef.c, 984 lines): in f_db.c, guarded against NULL pointer dereferences on s, gedp, ctx, argv, interpreter, and dbip across _post_opendb_failed, callbacks, f_opendb, and f_closedb, eliminated uninitialized buffer reads when bu_fgets returns EOF, checked Tcl result string validity before indexing, guarded curr_cmd_list before setting more_default, verified argc >= 2 before stripping trailing y/n database creation flags, and replaced all bu_vls_addr calls with bu_vls_cstr; in facedef.c, initialized plane equation index to -1 and added explicit range validation (plane >= 0 && plane < 6) to prevent out-of-bounds array writes, added upper and lower bounds checks on argc-derived array indexing into p_pleqn, p_3pts, p_rotfb, and p_nupnt arrays to prevent out-of-bounds reads, guarded against division by zero in get_pleqn using ZERO macro on vector magnitude before unitizing, replaced raw atof and atoi with bu_sscanf with return validation, added NULL pointer checks on arbo, s, MEDIT(s), and interp, freed error_msg VLS on all exit paths, and replaced bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0287` | **Sev 2** | Buffer Over-read, Mismatched Framebuffer Routine, Division by Zero, Infinite Loop / UI Hang, and Null Pointer Dereferences | `src/mged (Batch 45: fbserv.c, grid.c)` | `FIXED` | In BRL-CAD mged Batch 45 (fbserv.c and grid.c, 1,754 lines): in fbserv.c, fixed critical bug in fb_server_fb_bwwriterect where fb_writerect (RGB, 3 bytes/pixel) was called instead of fb_bwwriterect (monochrome, 1 byte/pixel) causing out-of-bounds heap over-reads and image corruption; added packet length and payload dimension validation across all framebuffer network handlers (fb_clear, fb_read, fb_write, fb_readrect, fb_writerect, fb_bwreadrect, fb_bwwriterect, fb_cursor, fb_setcursor, fb_scursor, fb_window, fb_zoom, fb_view, fb_wmap, fb_help) preventing buffer over-reads on truncated or malformed network packets; clamped absurd pixel requests (up to 8192x8192); handled malloc failures with 0-length error packets to prevent client hangs; replaced bu_strlcpy with bounded memcpy for binary auth token packets; added NULL pointer checks on pcp, s, s->mged_curr_dm, DMP, and fbp across all routines; in grid.c, guarded divisions against zero in draw_grid, snap_to_grid, and round_to_grid using ZERO macro on scale and aspect ratio; guarded against integer division by zero and infinite loops when res_major_h or res_major_v <= 0; clamped maximum grid dots (nv_dots, nh_dots <= 2000) to prevent denial-of-service UI hangs; added NULL pointer checks on s, s->mged_curr_dm, s->dbip, grid_state, view_state, view_state->vs_gvp, color_scheme, and s->interp across all callbacks and snap routines; and replaced all read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0288` | **Sev 2** | Memory Leak, Out-of-bounds Array / Buffer Access, Dead / Unused Code, and Null Pointer Dereferences | `src/mged (Batch 46: history.c, mater.c, menu.c, menu.h)` | `FIXED` | In BRL-CAD mged Batch 46 (history.c, mater.c, menu.c, and menu.h, 1,086 lines): in history.c, eliminated guaranteed memory leak in f_history by freeing dynamic VLS str across all normal and error exit paths; guarded against out-of-bounds buffer reads in f_journal by replacing single-byte string indexing with BU_STR_EQUAL(argv[1], "-d"); safely handled empty command string lengths in cmd_hist; added NULL pointer checks on cmdp, curr_cmd_list, curr_cmd_list->cl_cur_hist, journalfp, hptr, argv, and interp across history_record, history_journalize, f_journal, f_history, history_prev, history_cur, history_next, and cmd_hist; cleared dangling cl_cur_hist pointer in history_cleanup; replaced all read-only bu_vls_addr calls with bu_vls_cstr; in mater.c, added NULL pointer checks on s, s->gedp, ged_dl, dbip, and DMP in mged_color_soltab before dereferencing; in menu.c, eliminated dead/unused Tcl_DString variables in mged_mmenu_set and mmenu_set; added strict index bounds validation (index >= 0 && index < NMENU) in mmenu_set, mmenu_set_all, and cmd_mmenu_get to prevent out-of-bounds memory writes and reads; removed unsafe static storage duration from loop counters menu and item in mmenu_display and mmenu_select to prevent re-entrancy issues; added NULL checks on mptr->menu_string before indexing; added comprehensive NULL pointer guards on s, s->mged_curr_dm, DMP, menu_state, color_scheme, mged_variables, interp, and active_dm_set display managers across btn_item_hit, btn_head_menu, chg_l2menu, cmd_mmenu_get, mmenu_init, mged_menu_refresh, mged_mmenu_set, mmenu_set, mmenu_set_all, mged_highlight_menu_item, mmenu_display, and mmenu_select; and replaced all read-only bu_vls_addr calls with bu_vls_cstr; in menu.h, corrected header guard comment typo. |
-| `SEC-0289` | **Sev 2** | Division by Zero, Memory Leaks, Dead Variable, Out-of-bounds Access, and Null Pointer Dereferences | `src/mged (Batch 47: mged.c)` | `FIXED` | In BRL-CAD mged Batch 47 (mged.c, 3,532 lines): eliminated floating-point division by zero in event_check when view_state->k.sca == 10.0 (where 1.0 / (1.0 - (view_state->k.sca / 10.0)) evaluated with 0.0 denominator) by validating denominator with ZERO macro; eliminated Tcl_DString memory leak in stdin_input on EOF return under non-cbreak mode; eliminated dead variable place and unused sprintf in mged_finish; guarded s->s_edit before rt_edit_destroy in mged_finish; guarded DMP and dm_bg before array indexing dm_bg[0..2] in main; guarded s->gedp before checking ged_subp table in main; added null pointer checks on s, s->s_edit, MEDIT(s), s->interp, view_state, view_state->vs_gvp, s->mged_curr_dm, DMP, curr_cmd_list, sd, and active display managers across mged_process_char, event_check, stdin_input, std_out_or_err, refresh, mged_finish, apply_cli_overrides, and main; added input_str_index bounds validation in mged_process_char; replaced raw sscanf with bu_sscanf in parse_debug_uint; and replaced all (~45) read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0290` | **Sev 2** | Uninitialized Memory, Missing Header Guards, Duplicate Code, Division by Zero, Resource Leak, and Null Pointer Dereferences | `src/mged (Batch 48: mged.h, mged_dm.h, mged_impl.cpp, mged_impl.h, mged_wdb.h)` | `FIXED` | In BRL-CAD mged Batch 48 (mged.h, mged_dm.h, mged_impl.cpp, mged_impl.h, mged_wdb.h, 1,610 lines): in mged_impl.cpp, zero-initialized allocated mged_state using memset to eliminate widespread uninitialized struct pointers and flags; refactored mged_state_create to call mged_state_init_internals, eliminating duplicate 18 callback registrations (DRY); in mged_state_destroy, guarded search_snapshot, dpy_string, s_edit, and s_edit->e before destroying and delegated internal destruction to mged_state_destroy_internals; cleared cmd_map in MGED_Internal destructor; guarded internal callback map lookups, registrations, and sync against null pointers and uninitialized state in mged_internal_clbk_map, mged_state_clbk_set, mged_state_clbk_get, and mged_edit_clbk_sync; in mged.h, guarded s, s->interp, and s->dbip in CHECK_DBI_NULL and CHECK_READ_ONLY macros to prevent null pointer crashes; in mged_dm.h, converted GET_MGED_DM macro to do-while(0) and guarded tp and tp->dm_dmp before dm_get_id to prevent null pointer dereference; guarded VIEWFACTOR against division by zero with ZERO macro; in mged_impl.h, added standard header guard #ifndef MGED_MGED_IMPL_H; in mged_wdb.h, wrapped extern declarations with __BEGIN_DECLS / __END_DECLS for standard C linkage when included in C++ translation units. |
-| `SEC-0291` | **Sev 2** | Double-Free, File Descriptor Double-Close / Leaks, Logic Bugs, Memory Leaks, Division by Zero, and Null Pointer Dereferences | `src/mged (Batch 49: mover.c, overlay.c, plot.c, predictor.c, rect.c)` | `FIXED` | In BRL-CAD mged Batch 49 (mover.c, overlay.c, plot.c, predictor.c, rect.c, 1,179 lines): in mover.c, eliminated double-free in moveHobj and moveHinstance where rt_db_free_internal was called after rt_db_put_internal failure (which already frees internal database object on all outcomes), fixed memory leak in moveHinstance when combination tree is empty or object is not a combination by calling rt_db_free_internal, initialized internal database object with RT_DB_INTERNAL_INIT, and added null pointer checks on s, dbip, cdp, dp, xlate, and interp; in overlay.c, added null checks on ctp, s, gedp, mged_curr_dm, and DMP, replaced read-only bu_vls_addr with bu_vls_cstr, and explicitly returned TCL_OK; in plot.c, eliminated file descriptor double-close bug where close(fd1[1]) and close(fd3[0]) were executed after fclose(fp_w) and fclose(fp_r), fixed file descriptor leaks when subsequent pipe() calls fail, handled fork() failures gracefully, added _exit(1) after execlp calls to prevent child processes from continuing parent execution on exec failure, verified fp_w and fp_r after fdopen, guarded view_state and vs_gvp before matrix multiplication, replaced sprintf with snprintf, and replaced bu_vls_addr with bu_vls_cstr; in predictor.c, fixed logic bug in poly_trail where t1->t_nused <= 0 was checked twice instead of validating t2->t_nused, guarded division by zero in predictor_frame when frametime is zero using ZERO macro, and added null pointer checks across init_trail, push_trail, poly_trail, predictor_init, predictor_kill, predictor_frame, and predictor_hook; in rect.c, fixed critical crash in zoom_rect_area where rb_set_dirty_flag was passed NULL data causing MGED_CK_STATE abort, guarded against division by zero in rect_image2view when width <= 0, guarded against division by zero in adjust_rect_for_zoom, draw_rect, and zoom_rect_area when window aspect ratio is zero using ZERO macro, replaced bu_vls_addr with bu_vls_cstr, and added null pointer checks on s, mged_curr_dm, DMP, rubber_band, color_scheme, and interp. |
-| `SEC-0292` | **Sev 2** | Loop Index Typo / Premature DList Deallocation, File Descriptor Leaks on Interrupt, Array Out-of-Bounds, Division by Zero, and Null Pointer Dereferences | `src/mged (Batch 50: rtif.c, scroll.c, sedit.h, set.c)` | `FIXED` | In BRL-CAD mged Batch 50 (rtif.c, scroll.c, sedit.h, set.c, 1,762 lines): in set.c, fixed critical bug in set_dlist where inner loop searching for active display managers sharing display lists used outer index di instead of dj in BU_PTBL_GET and checked uninitialized dlp2, causing the search to always fail and prematurely free active display lists in other display managers; guarded display list scene object list against empty list reads when freeing display lists; guarded against division by zero in set_absolute_model_tran when view scale is zero using ZERO macro; clamped perspective_angle to valid table indices [0..3] in establish_perspective and toggle_perspective preventing out-of-bounds array reads; guarded s, s->s_edit, and MEDIT(s) before syncing mv_context; guarded multi-level pointers in unset_var before dereferencing; guarded active display managers and DMP in set_dirty_flag and set_scroll_private; in rtif.c, fixed file descriptor leak in f_rmats when interrupted via setjmp by ensuring fp is closed before returning; validated and guarded vector list vertices (vp->nused > 0) preventing negative array indexing; added null pointer checks on s, s->gedp, view_state, view_state->vs_gvp, and interp across cmd_rt, cmd_rrt, rt_read, f_rmats, f_nirt, and f_vnirt; replaced atoi with bu_sscanf; in scroll.c, zero-initialized all elements of dm_scroll_array in set_scroll to guarantee NULL termination and bounded scroll_array pointer traversal by array capacity in scroll_display and scroll_select, preventing out-of-bounds array reads; extracted apply_sl_tol helper to eliminate duplicated tolerance thresholding logic (DRY); added null pointer checks on s, s->interp, view_state, DMP, color_scheme, and mged_variables across all event handlers and display routines; in sedit.h, guarded s, s->s_edit, and s->s_edit->e in SEDIT_ROTATE, SEDIT_TRAN, SEDIT_SCALE, and SEDIT_PICK, and guarded s in OEDIT_ROTATE, OEDIT_TRAN, and OEDIT_SCALE macros, preventing null pointer dereference crashes throughout solid and object editing; and replaced all read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0293` | **Sev 2** | Resource Leaks, Wrong Memory Deallocation Bug, Double-Open / File Descriptor Leaks, Array Out-of-Bounds, and Null Pointer Dereferences | `src/mged (Batch 51: setup.c, share.c, tclsync.c, tedit.c)` | `FIXED` | In BRL-CAD mged Batch 51 (setup.c, share.c, tclsync.c, tedit.c, 1,978 lines): in share.c, fixed critical bug in usurp_all_resources where freeing a zero-refcount display list state freed MGED_STATE->mged_curr_dm->dm_dlist_state instead of dlp2->dm_dlist_state, corrupting active display manager memory and leaking dlp2 resources; added null checks on dlp1, dlp2, and resource pointers in SHARE_RESOURCE macro; guarded all resource pointers in free_all_resources before decrementing refcounts and freeing, and nullified pointers after cleanup; added null checks on ctp, s, interpreter, and argv in f_share and f_rset; guarded active display managers and pathname lookups in f_share and share_dlist against null pointers; guarded s->mged_curr_dm in f_rset; in tedit.c, fixed file descriptor leak and concurrent double-opening of temporary files by passing bu_temp_file's open file handle directly to writesolid, flushing and closing before invoking external editor; eliminated memory leak of vls buffer in writesolid; bounded primitive type idb_type between ID_NULL and ID_MAX_SOLID before indexing EDOBJ dispatch table in writesolid and readsolid to prevent out-of-bounds memory access; made writesolid, readsolid, and editit static to minimize scope; guarded s, gedp, s_edit, MEDIT(s), view_state, and interp; in setup.c, guarded ctp, s, interp, and ctp->tcl_func in mged_cmd_dispatch; guarded argv[0] in quit usage message; guarded s and interp in cmd_setup; guarded s and view_state before setting vs_flag in mged_refresh_handler_impl and allocating vs_gvp in mged_setup; in tclsync.c, guarded interp, objc, objv, snapshot, record, and strings across EvalWords, ResultCopy, QualifiedPattern, AppendRecord, AppendProc, AppendProcs, AppendVariable, AppendVariables, AppendNamespace, AppendAliases, BuildInterpSnapshot, ReplayRecord, and ReplayInterpSnapshot; and replaced all read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0294` | **Sev 2** | Division by Zero, Stack Buffer Overrun Risk, String Mutation Bug, Unbounded Array Access, and Null Pointer Dereferences | `src/mged (Batch 52: titles.c, track.c, update.c)` | `FIXED` | In BRL-CAD mged Batch 52 (titles.c, track.c, update.c, 1,871 lines): in titles.c, eliminated floating-point division by zero in framerate calculation when frametime is zero using ZERO macro; eliminated in-place destructive mutation of caller's VLS buffer and dropped trailing lines in screen_vls by drawing lines via temporary buffer; bounded global_editing_state array indexing into state_str to prevent out-of-bounds reads; bounded solid type indexing into OBJ array and guarded ft_name before displaying keypoint; guarded MEDIT(s) against NULL before accessing model_changes and e_keypoint; guarded illump against NULL before checking s_old.s_Eflag; guarded s, s->mged_curr_dm, DMP, view_state, view_state->vs_gvp, and s->interp across create_text_overlay and dotitles; replaced sprintf with snprintf; replaced all read-only bu_vls_addr calls with bu_vls_cstr; in track.c, eliminated division by zero in slope when del[0] or slope is zero using ZERO macro and SMALL_FASTF; eliminated division by zero in crdummy when plano[0] - w[0] is zero using ZERO macro; eliminated multiple divisions by zero in top when magnitude of del is zero; clamped cosine values before acos in tancir to prevent NaN return; replaced unsafe custom track_itoa with snprintf; increased solid/region/group name buffers from 9-12 to 32 bytes to prevent name truncation; replaced raw atof with bu_sscanf; scoped all helper functions (crname, slope, crdummy, trcurve, bottom, top, crregion, track_itoa, wrobj, tancir) to static; guarded s, s->dbip, s->wdbp, and s->interp; in update.c, guarded s in mged_update and f_update against NULL pointer dereference; replaced raw sscanf with bu_sscanf; guarded donePtr and eventPtr in event callbacks; guarded clientData, s, interp, and argv[0..2] in f_wait; and replaced bu_vls_addr with bu_vls_cstr. |
-| `SEC-0295` | **Sev 2** | Memory Leaks, Dangling Database Pointers, Dead Pre-libged Code, Out-of-bounds Array Access, Command Argument Parsing Bug, In-place String Mutation, and Null Pointer Dereferences | `src/mged (Batch 53: usepen.c, utility1.c, vparse.c, wdb_obj.c)` | `FIXED` | In BRL-CAD mged Batch 53 (usepen.c, utility1.c, vparse.c, wdb_obj.c, 3,149 lines): completing all 55 files of src/mged (100% complete): in usepen.c, eliminated dangerous in-place mutation of argv[1] string in f_matpick by copying into a local buffer before splitting slash path; removed static storage duration from transformation matrices t1 and t2 in wrt_view to make the function re-entrant; guarded against null pointers in illump before accessing s_u_data in f_matpick; guarded s, s->mged_curr_dm, s->gedp, ged_dl(s->gedp), DMP, illump, and illum_gdlp across illuminate, f_aip, and f_matpick; guarded argv[1] against null/empty strings; replaced raw sprintf with snprintf; and replaced all read-only bu_vls_addr calls with bu_vls_cstr; in utility1.c, eliminated over 200 lines of dead pre-libged code, including obsolete unused global variables (path, identt, idbuf, operate, regflag, lastmemb, old_or_new, oper_ok, numsol, numreg, idfd, rd_idfd, tabptr, ctemp) and unused functions/structs (printcodes, Do_printnode, check, id_names, id_to_names); added null checks on s and s->gedp in f_edcolor, f_edcodes, f_edmater, and f_red; and replaced bu_vls_addr with bu_vls_cstr; in vparse.c, added null pointer guards on vls, how_to_parse, structp, argv, and argv[1] across mged_vls_struct_parse and mged_vls_struct_parse_old; in wdb_obj.c, eliminated memory leak of log_str in wdb_track_cmd by adding missing bu_vls_free; fixed database reopen bug in wdb_reopen_cmd where allocating a new wdbp reassigned the local parameter and leaked the new object while leaving callers with a dangling pointer to freed dbip, by updating wdbp->dbip in place; fixed argument index parsing bug in wdb_make_bb_cmd where passing -u caused the bounding routine to treat the new bounding box name as an input object to bound; fixed argument parity condition in wdb_tol_cmd that blocked single-tolerance queries (argc == 2); clamped perpendicularity tolerance to [-1.0, 1.0] before acos to prevent NaN return; fixed wrong return value (returning TCL_OK instead of TCL_ERROR) when object is not an ARB in wdb_move_arb_face_cmd and wdb_rotate_arb_face_cmd; fixed wrong argv indices in error messages in wdb_rotate_arb_face_cmd; dynamically allocated resource structures in wdb_rt_gettrees_cmd eliminating shared static resource state and freeing in wdb_deleteProc_rt; replaced raw sscanf and atof with bu_sscanf; checked floating-point tolerances with ZERO macro; replaced raw sprintf with snprintf; and replaced all (~52) read-only bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0296` | **Sev 2** | Memory Leaks, Immediate NULL Pointer Dereference Crash, Resource Leaks, Wrong Memory Deallocation, and Missing Parameter Validation | `src/proc-db (Batch 54: bottest.c, brep_cobb.cpp, brep_cube.cpp, brep_invalid.cpp, brep_simple.cpp, brep_surface.cpp)` | `FIXED` | In BRL-CAD proc-db Batch 54 (bottest.c, brep_cobb.cpp, brep_cube.cpp, brep_invalid.cpp, brep_simple.cpp, brep_surface.cpp, 2,010 lines): in bottest.c, fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0] before bu_setprogname; checked outfp after wdb_fopen to prevent NULL dereference on write failure; fixed wrong memory deallocator by replacing bu_free with bu_bitv_free(face_mode); and replaced db_close(outfp->dbip) with wdb_close(outfp) to eliminate struct rt_wdb handle leak; in brep_cobb.cpp, eliminated persistent memory leak of 6 heap-allocated ON_NurbsSurface surfaces in Cobb_Sphere by using stack-allocated surfaces in a unified loop, and deleting ON_BezierSurface; guarded argv[0] before bu_setprogname; checked outfp after wdb_fopen; guarded brep before mk_brep; and replaced db_close(outfp->dbip) with wdb_close(outfp); in brep_cube.cpp, fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0]; checked outfp after wdb_fopen; eliminated internal database object memory leak by calling rt_db_free_internal(&ip); guarded brep allocation in MakeTwistedCube; and replaced db_close(outfp->dbip) with wdb_close(outfp); in brep_invalid.cpp, eliminated memory leaks in Cobb_Sphere by stack-allocating ON_NurbsSurface and deleting b1; added null check on c2 before appending to trimming loop; validated plate thickness with bu_sscanf; added standard help flags (-h, -?, --help); checked outfp after wdb_fopen; and replaced db_close(outfp->dbip) with wdb_close(outfp); in brep_simple.cpp, fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0]; checked outfp after wdb_fopen; eliminated internal database object memory leak by calling rt_db_free_internal(&ip); guarded brep allocation in MakeTwistedCube; replaced db_close(outfp->dbip) with wdb_close(outfp); and replaced raw printf with bu_log; in brep_surface.cpp, guarded brep and c2d curve allocations; validated thickness argument with bu_sscanf; added standard help flags; checked outfp after wdb_fopen; and replaced db_close(outfp->dbip) with wdb_close(outfp). |
-| `SEC-0297` | **Sev 2** | Resource Leaks, Immediate NULL Pointer Dereference Crash, Division by Zero, Missing Argument Validation, and Memory Leaks | `src/proc-db (Batch 55: brep_trimmed.cpp, breplicator.cpp, brickwall.c, cchannel.c, clutter.c, common.c)` | `FIXED` | In BRL-CAD proc-db Batch 55 (brep_trimmed.cpp, breplicator.cpp, brickwall.c, cchannel.c, clutter.c, common.c, 2,535 lines): in brep_trimmed.cpp, guarded ON_Brep allocation in MakeBrepFace against NULL return; guarded argv[0] before bu_setprogname; added standard help flags (-h, -?, --help); replaced unsafe atof with bu_sscanf with error checking; checked outfp after wdb_fopen; and replaced db_close(outfp->dbip) with wdb_close(outfp) to eliminate struct rt_wdb handle leak; in breplicator.cpp, added null check and size check (count >= 8) on points in generate_brep; guarded ON_Brep allocation; fixed immediate SIGSEGV crash when run without arguments by checking argc > 1 before accessing argv[1]; guarded argv[0]; and replaced db_close(wdbp->dbip) with wdb_close(wdbp); in brickwall.c, guarded av and *av in parse_args; guarded argv[0] before bu_setprogname; replaced raw sscanf with bu_sscanf; replaced raw sprintf with snprintf; validated units_conv to prevent division by zero; guarded against division by zero in standalone horizontal spacing when horiz_bricks <= 1; and supported standard clean exit on help flags; in cchannel.c, replaced raw sscanf with bu_sscanf with error validation; used ZERO macro for float zero comparisons; fixed infinite loop vulnerability in addHoles by verifying positive step; replaced sprintf with snprintf; guarded argv[0] before bu_setprogname; removed invalid colons requiring arguments from help options string and supported clean exit on -h/-?; checked outfp after wdb_fopen; guarded domain of sqrt calculation; and replaced db_close(db->dbip) with wdb_close(db); in clutter.c, fixed memory leak of bn_unif random buffer by calling bn_unif_free; guarded argv[0] before bu_setprogname; added help flag handling with clean exit; validated wdb_fopen; replaced sprintf with snprintf; and replaced db_close(outfp->dbip) with wdb_close(outfp); in common.c, added null pointer guard on rgb in get_rgb; added null pointer guards on name, pos, dir_at, headp, and outfp in do_light; and guarded against NaN from unitizing zero vectors. |
-| `SEC-0298` | **Sev 2** | Memory Leaks, Double Free, Handle Leaks, and Missing Argument Validation | `src/proc-db (Batch 56: csgbrep.cpp, donuts.c, gaia.c, gears.c)` | `FIXED` | In BRL-CAD proc-db Batch 56 (csgbrep.cpp, donuts.c, gaia.c, gears.c, 3,116 lines): in csgbrep.cpp, eliminated external buffer leak ext in write_out with bu_free_external; fixed ON_Brep leak by deleting brep and checking ON_Brep::New; guarded argv[0] before bu_setprogname; supported standard help flags (-h, -?, --help); checked outfp after wdb_fopen; freed extrude.sketch_name and revolve.sketch_name; and replaced db_close(outfp->dbip) with wdb_close(outfp); in donuts.c, replaced unbounded sprintf with snprintf across getName, createLights, createPlane, createEnvironMap, createScene, makeFlake; supported -h and -? in options; replaced raw sscanf with bu_sscanf; fixed inverted logic bug where empty material check tested == 0 instead of != 0; removed undefined fflush(stdin); guarded progname and argv[0]; checked wdb_fopen result fp; freed parameters.materialArray; and replaced db_close(fp->dbip) with wdb_close(fp); in gaia.c, added null pointer guard on path in open_raster_georef; guarded av[0] before bu_setprogname; supported clean help flag exit; replaced atoi and atof with bu_sscanf; and ensured GDAL datasets are closed on texture load failure paths; in gears.c, guarded make_gear against null db_fp and teeth <= 0; eliminated double free risk by freeing scratch arrays verts/lsegs/segments/reverse once and cleaning up gear_head wmembers; guarded av[0]; supported help flags (-h, -?, --help); replaced atof and atoi with bu_sscanf; cleaned up all_head wmembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0299` | **Sev 2** | Immediate NULL Pointer Dereference Crashes, Uninitialized Memory Access, Memory Leaks, Infinite Loop, and Handle Leaks | `src/proc-db (Batch 57: globe.c, gtimes.c, helicoil.c, kurt.c, lattice.c, lens.c)` | `FIXED` | In BRL-CAD proc-db Batch 57 (globe.c, gtimes.c, helicoil.c, kurt.c, lattice.c, lens.c, 1,910 lines): in globe.c, guarded progname and av[0]; added clean exit on help flags (-h, -?, --help); replaced atof with bu_sscanf; validated stepSize > 0 (eliminating infinite loop denial of service), initialSize > 0, and finalSize > initialSize (eliminating division by zero in shader params); replaced sprintf with snprintf; eliminated persistent leaks of wmember list nodes across loop iterations by calling mk_freemembers(&wm_hd.l) and mk_freemembers(&bigList.l); and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to fix struct rt_wdb handle leak; in gtimes.c, guarded av[0] before bu_setprogname; supported standard help options (-h, -?); replaced atoi with bu_sscanf; guarded against out-of-bounds pointer dereference when no file argument is given; guarded wdbp from wdb_dbopen against NULL; called ged_free(&ged) on every iteration to fix persistent ged container memory leaks; and replaced printf with bu_log; in helicoil.c, guarded build_helix against NULL head and non-positive turns; guarded av[0]; added clean help exit (-h, -?, --help); replaced atoi and atof with bu_sscanf; freed coil_hd and all_hd wmember lists with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in kurt.c, guarded argv[0] before bu_setprogname; added clean exit on help flags; checked outfp after wdb_fopen; in do_cell, guarded vp->v_n < 3 and fixed critical array index bug in sort loop that iterated over nroots instead of vp->v_n (which caused sorting of uninitialized memory); freed head wmembers in make_surface; guarded against division by zero in vector unitize in pnorms and do_light; and replaced db_close(outfp->dbip) with wdb_close(outfp); in lattice.c, guarded subdivide_face against freq < 1 or freq > MAX_FREQ; guarded av[0] before bu_setprogname; supported clean help exit; replaced atoi and atof with bu_sscanf; clamped frequency to MAX_FREQ; freed dome_head, light_head, and all_head wmembers with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in lens.c, fixed immediate SIGSEGV crash when run without filename where av[bu_optind] was NULL and passed to %s in bu_log; checked wdb_fopen return; guarded discriminant and radicand against negative values and ref_ind against zero; freed VLS buffers str, lens_type, and name; freed lensglass and lens wmembers; replaced sscanf with bu_sscanf; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0300` | **Sev 2** | Division by Zero, Memory Leaks, Denial of Service via Unbounded Recursion, and Handle Leaks | `src/proc-db (Batch 58: loftwing.c, masonry.c, menger.c)` | `FIXED` | In BRL-CAD proc-db Batch 58 (loftwing.c, masonry.c, menger.c, 2,245 lines): in loftwing.c, guarded naca_eval against negative x and p >= 1.0 (preventing division by zero); guarded naca_outline against npts < 4 and non-positive nupper/nlower; guarded build_loft against NULL pointers and invalid counts; guarded av[0] before bu_setprogname; added clean exit on help flags (-h, -?, --help); replaced atoi and atof with bu_sscanf with error checks; clamped points, stations, blades, span, and chord to valid positive ranges; eliminated persistent memory leaks of wm_hd wmembers across wing and blade branches by calling mk_freemembers; ensured db_fp and allocated buffers are freed on error exits; and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to eliminate struct rt_wdb handle leak; in masonry.c, guarded set_translate and set_rotate with bu_sscanf and initialized coordinates; guarded av and *av in parse_args before bu_path_component; supported standard help exit (-h, -?); replaced raw sscanf and atof with bu_sscanf; guarded studs and span in frame_opening to prevent division by zero; freed s_hd boardseg head and wm_hd wmembers in frame; guarded sheetrock against non-positive dimensions and freed wm_hd wmembers; guarded mortar_brick against non-positive wall/brick dimensions (preventing division by zero) and freed wm_hd wmembers; freed wm_hd wmembers in brick; freed ol_hd opening list and trans_matrix in main; and replaced db_close(db_fd->dbip) with wdb_close(db_fd); in menger.c, guarded comb, depth, width, and height in slice against NULL/invalid extents; in mengerize, guarded against empty pattern or zero repeat; eliminated persistent leaks of levels[slot]->l and final->l wmembers by calling mk_freemembers; guarded av[0] before bu_setprogname; limited repeat to maximum 5 to eliminate denial-of-service memory exhaustion from recursive fractal generation; replaced heap allocation of menger, ground, light0, light1, sponge with stack allocation and freed their wmembers with mk_freemembers; freed boxes VLS container; and replaced db_close(fp->dbip) with wdb_close(fp). |
-| `SEC-0301` | **Sev 2** | Buffer Over-reads, Out-of-Bounds Memory Access, Memory Leaks, and Handle Leaks | `src/proc-db (Batch 59: metaball.c, molecule.c, nmgmodel.c, parashot.c, pdb-g.cpp)` | `FIXED` | In BRL-CAD proc-db Batch 59 (metaball.c, molecule.c, nmgmodel.c, parashot.c, pdb-g.cpp, 1,761 lines): in metaball.c, guarded make_meatballs against NULL name and non-positive count (eliminating division by zero in sqrt); in mix_balls, called rt_db_free_internal to eliminate persistent internal object memory leaks for every input object; checked wdbp returned by wdb_dbopen; guarded av and av[0] before bu_setprogname; added clean exit 0 on help flags (-h, -?); replaced atoi with bu_sscanf with range validation [1, 1000000]; and replaced db_close(fp->dbip) with wdb_close(fp) to eliminate struct rt_wdb handle leak; in molecule.c, guarded argv[0] before bu_setprogname; supported standard help flags with exit 0 (-h, -?, --help); checked outfp from wdb_fopen against NULL; rewrote read_data to use line-by-line reading with bu_fgets and bu_sscanf to eliminate infinite loop denial of service on non-numeric input; added bounds checking on atom indices and types to eliminate out-of-bounds array reads in atom_list; replaced unsafe sprintf with snprintf; increased s_name buffer to prevent truncation; freed reg_head and head wmembers with mk_freemembers; freed allocated sphere linked list to fix memory leak; and replaced db_close(outfp->dbip) with wdb_close(outfp); in nmgmodel.c, guarded av and *av before bu_path_component; supported clean exit 0 on help flags (-h, -?); freed model m with nmg_km if wdb_fopen fails; and replaced db_close(fdmodel->dbip) with wdb_close(fdmodel); in parashot.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on help flags (-h, -?); replaced raw sscanf, atoi, and atof with bu_sscanf; validated step count and pipe diameter; and replaced db_close(fp->dbip) with wdb_close(fp); in pdb-g.cpp, fixed buffer over-read vulnerability when parsing fixed-column PDB records (ATOM/HETATM) on short lines by trimming newlines and padding lines up to 80 characters with spaces; replaced raw sscanf with bu_sscanf; supported clean help exit (-h, -?, --help); derived default output geometry file if omitted; freed allocated header string with bu_free; freed all_atoms wmembers with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0302` | **Sev 2** | Free of Memory Not on Heap, Buffer Over-read, Race Condition, Unbounded Recursion, and Memory Leaks | `src/proc-db (Batch 60: pipe.c, pipetest.c, pix2g.c, pyramid.c, ringworld.c)` | `FIXED` | In BRL-CAD proc-db Batch 60 (pipe.c, pipetest.c, pix2g.c, pyramid.c, ringworld.c, 1,641 lines): in pipe.c, clamped Normals dot product to [-1.0, 1.0] before acos to prevent NaN; guarded tangent and cosine denominators against zero with ZERO(); fixed memory leaks and cumulative combination list corruption across pipe and elbow generations by calling mk_freemembers(&head.l) after every mk_lfcomb; guarded argv[0] before bu_setprogname; added clean exit 0 on -h and -?; replaced raw scanf with bu_fgets and bu_sscanf with validation; guarded against NULL pointer dereference in Names() and main() when fewer than two points are read; freed root points linked list; and replaced db_close(fdout->dbip) with wdb_close(fdout); in pipetest.c, fixed critical heap corruption crash (CWE-590: Free of Memory not on the Heap) by dynamically allocating pipe points via mk_pipe_init and mk_add_pipe_pnt instead of passing static array elements to mk_pipe which takes ownership and frees on export; guarded argv[0]; fixed unconditional usage message; supported clean exit 0 on help flags (-h, -?, --help); checked wdb_fopen return; added NULL guards in do_bending and pr_pipe; freed pipe points with mk_pipe_free; and replaced db_close(outfp->dbip) with wdb_close(outfp); in pix2g.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; replaced atoi and atof with bu_sscanf with range validation [1, 65536] on dimensions and positive checks on cell/object sizes; prevented buffer over-read (CWE-125) and crash when image buffer is smaller than width * height * 3 by halting with error instead of continuing to read past buffer end; eliminated critical race condition and list corruption across parallel worker threads by acquiring BU_SEM_GENERAL semaphore when modifying global allScanlineList; eliminated persistent leaks of hundreds of thousands of wmember list nodes by calling mk_freemembers on wm_hd, scanlineList, and allScanlineList; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in pyramid.c, removed unused dead function pnorms; guarded argv[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; replaced atoi with bu_sscanf and clamped recursion depth to [1, 8] to prevent denial of service from unbounded recursive branching; checked wdb_fopen return; eliminated persistent memory leaks in recursive tree generation by calling mk_freemembers(&head.l); and replaced db_close(outfp->dbip) with wdb_close(outfp); in ringworld.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on -h and -?; checked wdb_fopen return; eliminated wmember list node leaks in mk_sol, mk_ring, and main by calling mk_freemembers(&c.l); and replaced db_close(fp->dbip) with wdb_close(fp). |
-| `SEC-0303` | **Sev 2** | Memory Leaks, Handle Leaks, Unbounded Recursion Denial of Service, Division by Zero, and Input Validation | `src/proc-db (Batch 61: seashell.c, sketch.c, specimen.c, sphflake.c, spltest.c)` | `FIXED` | In BRL-CAD proc-db Batch 61 (seashell.c, sketch.c, specimen.c, sphflake.c, spltest.c, 2,106 lines): in seashell.c, guarded superformula against n1 == 0 with ZERO() to prevent division by zero in pow(); guarded argv[0] before bu_setprogname; added clean exit 0 on -h, -?, --help; replaced atof and atoi with bu_sscanf with range validation on --turns, --expand, and --res; eliminated persistent wmember list node leaks across combinations by calling mk_freemembers(&all_hd.l); and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to fix struct rt_wdb handle leak; in sketch.c, guarded argv[0] before bu_setprogname; removed dead option parsing block that caused unconditional abort on any argument; supported clean exit 0 on -h, -?, --help; checked outfp returned by wdb_fopen against NULL; freed all_head wmembers with mk_freemembers; and replaced db_close(outfp->dbip) with wdb_close(outfp); in specimen.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; replaced atof with bu_sscanf and validated spacing >= 100.0; freed reg_hd wmembers after every specimen shelf region and freed gnd_hd, lt_hd, and all_hd wmembers in main to eliminate widespread heap leaks; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in sphflake.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; clamped recursion depth to [0, 5] using bu_sscanf to eliminate denial of service from exponential tree explosion; checked fp returned by wdb_fopen against NULL; eliminated massive memory leak by freeing all wmemberArray entries with mk_freemembers before bu_free; removed undefined behavior fflush(stdin) calls; replaced unsafe sprintf and sscanf with snprintf and bu_sscanf; and replaced db_close(fp->dbip) with wdb_close(fp); in spltest.c, guarded argv[0] before bu_setprogname; supported clean exit 0 on -h, -?, --help; guarded make_face against NULL pointers and unsupported order; checked srf returned by nmg_nurb_new_snurb; and replaced db_close(fp->dbip) with wdb_close(fp). |
-| `SEC-0304` | **Sev 2** | Use-After-Free, Infinite Loops, Memory Leaks, File Descriptor Leak, Handle Leaks, and Missing Input Bounds Checks | `src/proc-db (Batch 62: surfaceintersect.cpp, surfaceintersect.h, tea.c, tea.h, tea_nmg.c)` | `FIXED` | In BRL-CAD proc-db Batch 62 (surfaceintersect.cpp, surfaceintersect.h, tea.c, tea.h, tea_nmg.c, 2,014 lines): in surfaceintersect.cpp, corrected inverted SI_MIN macro; guarded against division by zero in Step when normal cross product magnitude is zero; eliminated unbounded memory leaks and fixed typo in CurveCurveIntersect by properly deleting split curve objects left1/right1/left2/right2 and intersecting right1 with right2; updated SetCurveCurveIntersectionDir to use reference parameter so intersection direction updates are not discarded on copy, enabled the negative dot product branch (dot < 0), fixed typo that wrote m_dirB[0] twice, and made curve parameters const; fixed arguments to SetCurveCurveIntersectionDir in Get_ON_X_Events; capped Jiggle iteration loops in WalkIntersection and GetStartPointsInternal to prevent infinite loop denial of service; in GetStartPointsInternal, eliminated 12 heap-allocated ON_Surface leaks per recursion node and corrected return value accumulator from &= to |=; cleaned up dynamically allocated curves in BrepBrepIntersect before returning; in main(), guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?/-help, checked wdb_fopen return, freed all wmembers with mk_freemembers, and replaced db_close(db_fp->dbip) with wdb_close(db_fp) to fix struct rt_wdb handle leak; in tea.h, marked ducks and patches as static const to prevent multiple-definition linker collisions and inadvertent table modification; in tea.c, guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?, checked wdb_fopen return, added NULL check in dump_patch, added array bounds checks on patch indices before accessing ducks[], and replaced db_close(outfp->dbip) with wdb_close(outfp); in tea_nmg.c, fixed critical CWE-416 Use-After-Free vulnerability where nmg_m_to_vlist accessed model m after mk_nmg/wdb_export had already freed it by generating the vlist prior to exporting, fixed file descriptor leak by calling fclose(fp) on the plot3 file, freed vlist nodes with BV_FREE_VLIST, guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?, checked wdb_fopen return, checked nmg_mm() return, added bounds checks on patch indices, and replaced db_close(outfp->dbip) with wdb_close(outfp). |
-| `SEC-0305` | **Sev 2** | Memory Leaks, Handle Leaks, Combination List Corruption, File Descriptor Leaks, and Missing Input Bounds Checks | `src/proc-db (Batch 63: terragen.c, torii.c, tube.c, twistedcube.cpp, twistedcube.h)` | `FIXED` | In BRL-CAD proc-db Batch 63 (terragen.c, torii.c, tube.c, twistedcube.cpp, twistedcube.h, 1,474 lines): in terragen.c, guarded av[0] before bu_setprogname, supported clean exit 0 on -h/-?/--help, replaced atoi and atof with bu_sscanf, added cleanup freeing hf and grid and calling wdb_close on sidecar write failure, freed combination members after terrain.r, water.r, sky.r, and all combs with mk_freemembers, and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in torii.c, guarded av[0] before bu_setprogname, supported clean exit 0 on -h/-?/--help, replaced atoi and atof with bu_sscanf, validated rows and cols (clamped 1..200) and major/minor radii to prevent denial-of-service memory/disk exhaustion, freed all_hd wmembers with mk_freemembers on error paths and normal completion, and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in tube.c, guarded argv[0] before bu_setprogname, supported clean exit 0 on -h/-?/--help, checked outfp returned by wdb_fopen against NULL, closed pos_fp with fclose, eliminated combination list corruption and memory leaks across frames by freeing head.l after bg.r and both head.l and ghead.l on every frame iteration with mk_freemembers, freed head.l in build_cyl with mk_freemembers, checked npts <= 0 and bp in build_spline, added bounds check on nsamples (< 1022) to prevent sample array overflow and replaced sscanf with bu_sscanf in read_frame, replaced fscanf with bu_fgets and bu_sscanf in read_pos, guarded against division by zero in xfinddir with ZERO(denom), and replaced db_close(outfp->dbip) with wdb_close(outfp); in twistedcube.cpp, added array bounds checks on from and to vertex indices against brep.m_V.Count() in MakeTwistedCubeEdge, validated face.m_si and checked surface pointer in MakeTwistedCubeTrimmingLoop, checked edge index ei against brep.m_E.Count(), and added NULL check on bi in printPoints; in twistedcube.h, reviewed clean. |
-| `SEC-0306` | **Sev 2** | Memory Leaks, Handle Leaks, Combination List Corruption, Allocator Mismatches, Double Free, and Uninitialized Macro Member | `src/proc-db (Batch 64: vegetation.c, vegetation.h, voxelize.c, wavy.c, wdb_example.c)` | `FIXED` | In BRL-CAD proc-db Batch 64 (vegetation.c, vegetation.h, voxelize.c, wavy.c, wdb_example.c, 1,995 lines): completing all 55 files of src/proc-db (100% complete): in vegetation.h, fixed uninitialized branchMaxVariation bug in INIT_CHARACTERISTIC_T macro caused by setting dirMaxVariation twice; replaced unsafe sprintf with bu_strlcpy in INIT_OUTPUTCOUNTER_T; in vegetation.c, fixed memory leak of bigList on error in findIntersectors; replaced system free with bu_free on bu_calloc/BU_ALLOC buffers (segList, excluded, included, plant, and structure allocations) to eliminate allocator mismatch; fixed persistent leaks of included and excluded segment lists during growth retries; implemented recursive freeStructure helper to eliminate memory leaks of deeply nested substructures, branches, and segments in destroyPlant; freed oc->combination.l and oc->region.l wmembers with mk_freemembers; guarded argv[0] before bu_setprogname; supported clean exit 0 on -h/-?/--help; replaced atoi, atof, and atol with bu_sscanf with range validation and clamped age [1, 200] to prevent memory/CPU exhaustion; checked fp from wdb_fopen against NULL; and replaced db_close(fp->dbip) with wdb_close(fp); in voxelize.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h/-?/--help; replaced atoi with bu_sscanf; freed voldata and ebmdata buffers and closed db_fp on sidecar write and primitive creation failures; freed region_hd.l, ebm_hd.l, and all_hd.l wmembers with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp); in wavy.c, guarded argv[0] before bu_setprogname; fixed option parsing so -h and -? exit 0 cleanly with usage; replaced atof with bu_sscanf; checked outfp returned by wdb_fopen; documented ownership transfer where mk_bspline/wdb_export takes ownership and frees surfaces via rt_nurb_ifree, avoiding double free; and replaced db_close(outfp->dbip) with wdb_close(outfp); in wdb_example.c, guarded av[0] before bu_setprogname; supported clean exit 0 on -h/-?/--help; eliminated combination member leak by freeing wm_hd.l with mk_freemembers; and replaced db_close(db_fp->dbip) with wdb_close(db_fp). |
-| `SEC-0307` | **Sev 2** | Allocator Mismatch, Memory Leaks, Uninitialized Pointers, and NULL Pointer Dereferences | `src/qged (Batch 65: QgEdApp.cpp, QgEdApp.h, QgEdFilter.cpp, QgEdFilter.h, QgEdMainWindow.cpp, QgEdMainWindow.h)` | `FIXED` | In BRL-CAD qged Batch 65 (QgEdApp.cpp, QgEdApp.h, QgEdFilter.cpp, QgEdFilter.h, QgEdMainWindow.cpp, QgEdMainWindow.h, 1,604 lines): in QgEdApp.cpp, fixed allocator mismatch (CWE-762) by replacing C++ delete on bu_strdup strings with bu_free; fixed memory leak of argv array av allocated with bu_calloc in QgEdApp::run_cmd; added cleanup loop in destructor to free pending tmp_av strings; added NULL pointer checks on p->gedp, p->gedp->ged_io_data, ca->w, and ca->w->console before dereferencing in io handlers; guarded w and w->CurrentView() in run_cmd; guarded el, el->controls, and w->CurrentDisplay() in element_selected; added NULL guards in raytrace callbacks; in QgEdApp.h, audited clean; in QgEdFilter.cpp, added NULL pointer checks on event e and application model pointer c->mdl before accessing interaction_mode; in QgEdFilter.h, audited clean; in QgEdMainWindow.h, removed duplicate QgView.h include, and initialized pointer members console, cad_open, cad_save_settings, and cad_exit to NULL to prevent uninitialized memory reads (CWE-457); in QgEdMainWindow.cpp, added NULL pointer guards on c4 across isValid3D, isDisplayActive, CurrentDisplay, CurrentView, DisplayCheckpoint, DisplayDiff, QuadDisplay, SingleDisplay, and constructor mode switching; added NULL guards on vcw in IndicateRaytraceStart and IndicateRaytraceDone; added NULL guards on w and qApp in widget_active; and added NULL guards on ap->mdl and ap->mdl->gedp in CreateWidgets, ConnectWidgets, and do_dm_init. |
-| `SEC-0308` | **Sev 2** | Memory Leaks, Uninitialized Pointers, Out-of-bounds Array / Buffer Access, and NULL Pointer Dereferences | `src/qged (Batch 66: QgEdPalette.cpp, QgEdPalette.h, fbserv.cpp, fbserv.h, main.cpp)` | `FIXED` | In BRL-CAD qged Batch 66 (QgEdPalette.cpp, QgEdPalette.h, fbserv.cpp, fbserv.h, main.cpp, 881 lines): in QgEdPalette.cpp, initialized filenames pointer to NULL before bu_file_list and guarded bu_argv_free, added NULL checks on cmd, cmd->i, cmd->i->tool_create, and returned tool element el before inserting into c_map and calling addElement, and guarded selected->button before setStyleSheet; in QgEdPalette.h, audited clean; in fbserv.h, initialized pointer and index members (s = nullptr, ind = -1, fbsp = nullptr) in QFBSocket and fbsp in QFBServer to prevent uninitialized memory access (CWE-457); in fbserv.cpp, guarded fbsp, s, ind bounds, and pkc in QFBSocket::client_handler, checked realloc return before updating pkc_inbuf to prevent NULL dereference on allocation failure, guarded buffer length and bounds (pkc_inend >= 0 && pkc_inend < pkc_inlen) before copying remaining data; in QFBServer::on_Connect, guarded nextPendingConnection return, fbsp, and validated socket descriptor fd >= 0 before pkg_adopt_socket; in qdm_is_listening and qdm_listen_on_port, checked fbsp against NULL; in qdm_open_server_handler and qdm_close_server_handler, guarded fbsp and listener channel nl, and cleared fbsl_chan and fbsl_fd to avoid dangling pointers; in qdm_open_client_handler and qdm_open_sw_client_handler, added client index bounds checks (0 <= i < fbs_max_clients) and guarded data, s->s, and fbsp->fbs_fbp; in qdm_close_client_handler, guarded client index and cleared fbsc_chan to NULL; in QFBIPCSocket::ipc_handler, guarded fbsp, ind bounds, notifier, and fbsc_pkg before client processing; in qdm_open_ipc_client_handler, qdm_open_ipc_sw_client_handler, and qdm_close_ipc_client_handler, added client index bounds checks and guarded fbsp->fbs_fbp; in main.cpp, guarded argc < 1, argv, and argv[0] before bu_setprogname to prevent NULL pointer dereference crashes on empty argument vectors, guarded argv[i] in option scanning loop, eliminated memory leaks of bu_vls msg on error paths and prior to QApplication launch by adding bu_vls_free(&msg). |
-| `SEC-0309` | **Sev 2** | Illegal Free of Non-Heap Member, Double Free, Memory Leaks, Uninitialized Pointers, Model Invariant Violations, and NULL Pointer Dereferences | `src/qged (Batch 67: plugin.h, QEll.cpp, QEll.h, ell_tool.cpp, CADViewModel.cpp, CADViewModel.h, view_info.cpp)` | `FIXED` | In BRL-CAD qged Batch 67 (plugin.h, QEll.cpp, QEll.h, ell_tool.cpp, CADViewModel.cpp, CADViewModel.h, view_info.cpp, 777 lines): in plugin.h, audited clean; in QEll.h, initialized all pointer member variables to nullptr to prevent uninitialized pointer reads (CWE-457); in QEll.cpp, cleared struct rt_ell_internal ell with memset(&ell, 0, sizeof(ell)) in constructor; connected write_edit and reset_values buttons to their write_to_db and read_from_db slots; in destructor, set p = NULL after bv_obj_put(p); in read_from_db, guarded qApp against NULL and checked ellp against NULL before RT_ELL_CK_MAGIC; in write_to_db, fixed illegal free of non-heap C++ object member &ell (CWE-763/CWE-590) and subsequent double free (CWE-415) by dynamically allocating ellp via BU_ALLOC and relying on rt_db_put_internal's internal deallocation without redundant and dangerous rt_db_free_internal calls; in update_obj_wireframe, guarded qApp, gedp->dbip, p from bv_obj_get, wdbp from wdb_dbopen, child scene object s, and pl[i].str against NULL pointer dereferences; in update_viewobj_name, guarded qApp, gedp->dbip, p, and ell_name against NULL dereferences; in eventFilter, added NULL guard on event pointer e; in ell_tool.cpp, converted heap-allocated QIcon to stack allocation to eliminate memory leak (CWE-401); in CADViewModel.h, audited clean; in CADViewModel.cpp, guarded qApp and bview pointer v against NULL in refresh, and invoked beginResetModel before deleting m_root to preserve Qt model invariants and avoid use-after-free by attached views; set m_root = NULL in destructor; in view_info.cpp, converted heap-allocated QIcon to stack allocation and parented CADViewModel to vview to eliminate memory leaks (CWE-401). |
-| `SEC-0310` | **Sev 2** | Memory Leaks, Uninitialized Pointers, Argument Indexing Corruption, and NULL Pointer Dereferences | `src/qged (Batch 68: CADViewMeasure.cpp, CADViewMeasure.h, measure.cpp, CADViewSelector.cpp, CADViewSelector.h, select.cpp, CADViewSettings.cpp, CADViewSettings.h, view_settings.cpp)` | `FIXED` | In BRL-CAD qged Batch 68 (CADViewMeasure.cpp, CADViewMeasure.h, measure.cpp, CADViewSelector.cpp, CADViewSelector.h, select.cpp, CADViewSettings.cpp, CADViewSettings.h, view_settings.cpp, 1,374 lines): in CADViewMeasure.h, removed duplicate QLineEdit include and initialized pointer members to nullptr to avoid uninitialized memory reads (CWE-457); in CADViewMeasure.cpp, freed f2d and f3d filters in destructor to fix memory leak (CWE-401); in adjust_text, eliminated persistent memory leak of QLabel on every event by reusing ma_label instead of repeatedly reallocating new QLabel instances; guarded qApp, gedp->ged_gvp, gedp->dbip, mf, and reports against NULL dereferences; in update_color and eventFilter, guarded mf, measure_3d, color_3d, color_2d, and filters; in measure.cpp, converted heap-allocated QIcon to stack allocation to prevent memory leak (CWE-401); in CADViewSelector.h, initialized all pointer members (including filter pointers pf, bf, rf) to nullptr; in CADViewSelector.cpp, freed pf, bf, and rf in destructor to fix memory leak (CWE-401); in select_objs and deselect_objs, guarded gedp, dbi_state, cf, and scene object s against NULL; in erase_objs, fixed indexing bug in av array where NULL scene objects created holes in the argv vector passed to ged_exec_erase, and checked scnt > 1 before execution; in do_draw_selections, do_erase_selections, and do_view_update, guarded dbis->pathstr return before calling bu_strdup and constructing std::string; in eventFilter, added NULL guards on event e, qApp, filters, and checkboxes; in select.cpp, converted heap-allocated QIcon to stack allocation to prevent memory leak (CWE-401); in CADViewSettings.h, initialized all pointer members to nullptr; in CADViewSettings.cpp, added NULL checks on cb in set_ckbx and ckbx_val; in checkbox_refresh and view_refresh, guarded qApp, gedp, bview v, v->gv_s, and fb_mode_combo against NULL pointer dereferences; in view_settings.cpp, converted heap-allocated QIcon to stack allocation to eliminate memory leak (CWE-401). |
-| `SEC-0311` | **Sev 2** | Memory Leaks, Uninitialized Pointers, and NULL Pointer Dereferences | `src/qged (Batch 69: QPolyCreate.cpp, QPolyCreate.h, QPolySettings.cpp, QPolySettings.h, polygon_tool.cpp)` | `FIXED` | In BRL-CAD qged Batch 69 (QPolyCreate.cpp, QPolyCreate.h, QPolySettings.cpp, QPolySettings.h, polygon_tool.cpp, 1,239 lines): in QPolySettings.h, initialized all pointer member variables to nullptr to eliminate uninitialized pointer access (CWE-457); in QPolySettings.cpp, added explicit QWidget parent to constructor, fixed severe memory leak in uniq_obj_name where ovname and vname were leaked on both collision early exit and success paths (CWE-401), guarded sketch_sync and sketch_name against NULL in sketch_sync_toggled, checked line_snapping and grid_snapping in signal handlers, and guarded p, p->s_i_data, and all UI controls against NULL in settings_sync; in polygon_tool.cpp, stack-allocated QIcon objects in polygon_tool_create and polygon_tool_modify to eliminate heap allocation leaks (CWE-401); in QPolyCreate.h, initialized all pointer member variables to nullptr (CWE-457); in QPolyCreate.cpp, added explicit QWidget parent to constructor, freed pcf in destructor to prevent filter memory leak (CWE-401), guarded qApp, gedp, gedp->dbip, p->s_i_data, and sketch widgets in finalize, guarded qApp, gedp, gedp->ged_gvp, and ps in do_vpoly_copy, guarded qApp, gedp, gedp->dbip, and ps in do_import_sketch, guarded gedp->dbip and sketch controls in sketch_sync to prevent NULL pointer dereferences on uninitialized databases, guarded v->gv_s and scene objects in toggle_line_snapping, toggle_grid_snapping, and checkbox_refresh, and in eventFilter guarded event pointer e, qApp, gedp, pcf, p->s_i_data, and ps settings controls. |
-| `SEC-0312` | **Sev 2** | Memory Leaks, Uninitialized Pointers, and NULL Pointer Dereferences | `src/qged (Batch 70: QPolyMod.cpp, QPolyMod.h)` | `FIXED` | In BRL-CAD qged Batch 70 (QPolyMod.cpp, QPolyMod.h, 1,124 lines): completing all 34 files of src/qged (100% complete): in QPolyMod.h, initialized all pointer member variables to nullptr (ps, mod_names, select_mode, move_mode, update_mode, general_mode_opts, close_general_poly, append_pnt, select_pnt, csg_modes, apply_bool, viewsnap_poly, remove_poly, p, cf, puf, psf, ppf, pmf) to eliminate uninitialized pointer access (CWE-457); in QPolyMod.cpp, added explicit QWidget parent to constructor, freed mouse filter objects puf, psf, ppf, and pmf in destructor to eliminate memory leaks (CWE-401), guarded qApp and mod_names in mod_names_reset, guarded ip and all UI controls in poly_type_settings, guarded qApp, p, p->s_i_data, and ps settings controls in polygon_update_props, guarded qApp and gedp->ged_gvp in toplevel_config, guarded p and p->s_i_data in clear_pnt_selection, guarded qApp, gedp->ged_gvp, and ps in select, guarded p, p->s_i_data, close_general_poly, and boolean operation objects in toggle_closed_poly, guarded qApp, p, p->s_i_data, gedp->ged_gvp, and csg_modes in apply_bool_op, guarded qApp, p, p->s_i_data, and gedp->ged_gvp in align_to_poly, guarded qApp, p, p->s_i_data, and mod_names in delete_poly, guarded gedp->dbip and sketch controls in sketch_name_edit, checked existing sketch collision and guarded gedp->dbip in sketch_name_update, guarded qApp and ps in view_name_edit and view_name_update, guarded v->gv_s in toggle_line_snapping, toggle_grid_snapping, and checkbox_refresh, and in eventFilter guarded event pointer e, qApp, gedp, filters, p->s_i_data, and UI controls. |
-| `SEC-0313` | **Sev 2** | Memory Leaks, Uninitialized Pointers, Off-by-one, Missing Header Guard, and NULL Pointer Dereferences | `libqtcad & include/qtcad (Batch 71: 14 files)` | `FIXED` | In BRL-CAD libqtcad Batch 71 (14 files, 1,563 lines): in defines.h, wrapped QTCAD_SLOT and QTCAD_EVENT macro definitions in do-while(0) blocks for safe statement syntax and guarded slot_name and event_name against NULL; in QgSignalFlags.h, added missing #define QGSIGNALFLAGS_H include guard; in QgAccordion.h, made constructors explicit with default nullptr and initialized all pointer members to nullptr; in QgAccordion.cpp, reparented objscrollarea to this, guarded addObject against null pointers and prevented duplicate insertion and redundant signal-slot connections, and guarded against null objects in accordion display loop; in QgAppExecDialog.h, added explicit constructor and destructor declarations and initialized logfile, console, proc, and buttonBox to nullptr; in QgAppExecDialog.cpp, implemented destructor closing and deleting logfile to eliminate persistent memory leaks (CWE-401), deleted logfile on open failure, and guarded proc, console, and buttonBox in read_stdout, read_stderr, process_abort, and process_done to prevent NULL pointer dereferences (CWE-476); in QgAttributesModel.h, modernized constructors and initialized pointers; in QgAttributesModel.cpp, deleted m_root in destructor and prior to allocating a new root in update and do_dbi_update to eliminate severe memory leaks (CWE-401), replaced unsafe bu_avs_remove loop during iteration with canonical bu_avs_free and bu_avs_init_empty, fixed off-by-one error in beginInsertRows (inclusive cnt - 1 bound), guarded against out-of-bounds access in add_Children when color attribute has fewer than 3 components (CWE-125), guarded against NULL strings and nodes, properly nested data updates between beginResetModel and endResetModel, and validated QModelIndex in refresh; in QgColorRGB.h, removed unused dead member d and initialized pointers to nullptr; in QgColorRGB.cpp, reparented child widgets to this, zeroed bu_color structure, used bu_color_from_rgb_chars for direct color synchronization, and guarded against NULL text and button pointers; in QgDockWidget.h, initialized m to nullptr and made constructor explicit; in QgDockWidget.cpp, removed unused map and set headers, guarded event pointer against NULL in event() to prevent crash, and replaced C-style cast with static_cast; in QgFlowLayout.h, initialized spacing members; in QgFlowLayout.cpp, guarded addItem, minimumSize, and doLayout against NULL items, checked widget and style pointers before layoutSpacing to prevent NULL pointer dereference crashes (CWE-476), clamped negative spacing, and returned nullptr in takeAt. |
-| `SEC-0314` | **Sev 2** | Memory Leaks, Division by Zero, Syntax / Declaration Errors, Missing Header Guards, and NULL Pointer Dereferences | `libqtcad & include/qtcad (Batch 72: 9 files)` | `FIXED` | In BRL-CAD libqtcad Batch 72 (9 files, 1,422 lines): in QgKeyVal.h, initialized pointer members (m_root, parent) to nullptr, added explicit constructors, and added override specifiers; in QgKeyVal.cpp, initialized m_root to nullptr in model constructor to prevent undefined pointer dereferences (CWE-457), guarded curr_node against NULL in data and setData, ordered model reset correctly by calling beginResetModel before updating m_root in setRootNode, checked row bounds against child count before accessing children in index to prevent out-of-bounds reads (CWE-125), guarded node and parent pointers in parent, rowCount, NodeIndex, and NodeRow to prevent NULL pointer dereferences (CWE-476), and guarded string pointers in add_pair; in QgUtil.h, formatted header guard comment; in QgUtil.cpp, eliminated critical memory leak of bu_attribute_value_set in QgCombType by calling bu_avs_free before returning on all paths (CWE-401), guarded dp and dbip in get_arb_type, db_find_subregion, db_find_region, and QgCombType against NULL pointer dereferences, initialized intern structure with RT_DB_INTERNAL_INIT, replaced bu_bomb in db_find_subregion default case with non-fatal logging to prevent application crash on malformed CSG trees (CWE-755), and guarded comb pointer in db_find_region; in bindings.h, added standard QTCAD_BINDINGS_H header guard; in bindings.cpp, guarded against NULL event pointer in CADkeyPressEvent, CADmousePressEvent, CADmouseReleaseEvent, CADmouseMoveEvent, and CADwheelEvent, checked v->gv_s before accessing axes and ADC draw flags to prevent crash on uninitialized views (CWE-476), and prevented division by zero in CADmouseMoveEvent scaling calculation by clamping v->gv_height to a positive value (CWE-369); in QgConsoleListener.h, added standard QGCONSOLELISTENER_H header guard and initialized process, callback, data, and notifier members to nullptr; in QgConsoleListener.cpp, guarded process, process->gedp, and result string against NULL before checking string length or reading results, prevented unsigned integer underflow (CWE-191) on string length subtraction by verifying s2 > s1, safely disabled and disconnected notifier in destructor, and initialized members in constructor initialization list; in QgEdit.h, resolved syntax errors by adding missing semicolons to class declarations, corrected class name consistency (QgVectEdit), closed unclosed comment, made constructors explicit, and initialized pointer members (vx, vy, vz, dbip) to nullptr. |
-| `SEC-0315` | **Sev 2** | Memory Leaks, Out-of-Bounds Access, Division by Zero, and NULL Pointer Dereferences | `libqtcad & include/qtcad (Batch 73: 8 files)` | `FIXED` | In BRL-CAD libqtcad Batch 73 (QgConsole.h, QgConsole.cpp, QgToolPalette.h, QgToolPalette.cpp, QgTreeSelectionModel.h, QgTreeSelectionModel.cpp, QgTreeView.h, QgTreeView.cpp, 2,342 lines): in QgConsole.h, initialized gedp pointer to nullptr; in QgConsole.cpp, eliminated memory leak of ct and av in GEDShellCompleter when gedp or dbip is null (CWE-401), replaced unsafe C-style cast on parent() with qobject_cast, bounded completionModel indexing, fixed out-of-bounds history indexing in consolidateHistory (CWE-125), eliminated dangling pointer read from temporary toLocal8Bit buffer in historyAt using toStdString (CWE-416), guarded Completer popup against NULL in keyPressEvent, selectCompletion, and updateCompleter, added NULL checks on clipboard and mimeData before text extraction, bounded CommandPosition on Key_Up and Key_Down, guarded CommandHistory against empty back() access in commandBuffer, fixed off-by-one word replacement in insertCompletion, prevented listener memory leak in destructor and listen() (CWE-401), and clamped cursor offsets to document bounds in printStringBeforePrompt; in QgToolPalette.h, initialized all pointer and layout members to nullptr; in QgToolPalette.cpp, guarded iicon in QgToolPaletteButton constructor and setter to prevent NULL dereference crashes (CWE-476), guarded controls in QgToolPaletteElement constructor and setter, implemented destructor in QgToolPalette to delete palette elements and prevent memory leaks (CWE-401), eliminated division by zero in button_layout_resize when width is smaller than icon width (CWE-369), fixed typo in setIconWidth where icon_height was assigned to button width, guarded empty elements set in setAlwaysSelected and deleteElement to prevent out-of-bounds / end-iterator dereference crashes (CWE-125/CWE-476), and guarded controls, scrollbars, and buttons in palette_displayElement; in QgTreeSelectionModel.h, initialized treeview to nullptr; in QgTreeSelectionModel.cpp, added NULL pointer checks on treeview, m, gedp, and dbi_state in clear_all and select slots, checked sv[0] bounds, eliminated heap allocation memory leak of QModelIndexList on every selection event by using stack allocation (CWE-401), and guarded snode against NULL before accessing path_hash and path_items (CWE-476); in QgTreeView.h, initialized model and delegate pointers to nullptr; in QgTreeView.cpp, guarded painter and invalid QModelIndex in gObjDelegate::paint, clamped icon height to prevent invalid image scaling, parented draw_action and erase_action to QMenu in context_menu to eliminate action memory leaks on menu deletion (CWE-401), guarded index, cnode, gedp, and view states in do_draw_toggle, guarded against empty path_hashes before back() and pop_back(), guarded m and items in redo_expansions and redo_highlights, and added NULL checks on model m before emitting layoutChanged. |
-| `SEC-0316` | **Sev 2** | Memory Leaks, Uninitialized Pointers, Out-of-Bounds Access, and NULL Pointer Dereferences | `libqtcad & include/qtcad (Batch 74: 10 files)` | `FIXED` | In BRL-CAD libqtcad Batch 74 (QgView.h, QgView.cpp, QgViewCtrl.h, QgViewCtrl.cpp, QgGL.h, QgGL.cpp, QgSW.h, QgSW.cpp, QgQuadView.h, QgQuadView.cpp, 2,910 lines): in QgView.h, audited clean; in QgView.cpp, replaced return in switch default with break, set canvas_gl and canvas_sw to NULL after deletion in destructor, guarded add_event_filter against NULL, and in clear_event_filter properly updated filters vector and curr_event_filter while ensuring event filters are removed from both GL and SW canvases; in QgViewCtrl.h, initialized QAction pointer members (sca, rot, tra, center, raytrace, fb_mode, fb_clear) to nullptr; in QgViewCtrl.cpp, guarded gedp in fbclear_cmd, fb_mode_cmd, do_view_update, and raytrace_cmd, checked v->gv_s in fb_mode_cmd and do_view_update to prevent NULL pointer dereferences (CWE-476), guarded callback context vctrl in rt_cmd_start and rt_cmd_done, and guarded raytrace before setIcon in raytrace_start and raytrace_done; in QgGL.h, audited clean; in QgGL.cpp, fixed critical memory leak in destructor by calling bv_free on local_v prior to deallocation and corrected struct name in BU_PUT from struct bv to struct bview (CWE-401), set pointers to NULL upon destruction, guarded fb_get_platform_specific return against NULL before dereferencing fbps->data, guarded dm_bg1 and dm_bg2 before dm_set_bg, checked dmp in mouseReleaseEvent before calling dm_set_dirty, guarded v before bv_hash in stash_hashes and diff_hashes, and checked for null QImage in save_image; in QgSW.h, audited clean; in QgSW.cpp, fixed memory leak in destructor by calling bv_free(local_v) and corrected BU_PUT struct name (CWE-401), guarded dmp against NULL in need_update and paintEvent before calling dm_set_dirty, checked width and height bounds before painting and image allocation, guarded fbps return before setup, guarded dm_bg1 and dm_bg2, checked dm_image against NULL in paintEvent and save_image, checked dmp in mouseReleaseEvent, guarded v before bv_hash in stash_hashes and diff_hashes, and guarded dmp and dm_image in save_image and get_viewport_image; in QgQuadView.h, initialized currentView and gedp to nullptr; in QgQuadView.cpp, guarded gedp and view pointers in constructor, createView, changeToSingleFrame, and changeToQuadFrame, clamped index bounds in createView to prevent out-of-bounds reads on VIEW_NAMES array (CWE-125), guarded chained pointers v->gv_s in changeToQuadFrame, guarded view objects in autoview and draw_scene loops, deleted old layout before creating a new one in createLayout to prevent layout leaks and Qt warnings, guarded currentView in view() and do_view_changed, eliminated unsafe parent geometry lookup in get(QPoint) by using widget-local rect and mapFromGlobal, guarded event e in get(QEvent), and guarded quadrant_id and spacer pointers in select. |
-| `SEC-0317` | **Sev 2** | Memory Leaks, NaN Domain Errors, Use-After-Free, Division by Zero, and NULL Pointer Dereferences | `libqtcad & include/qtcad (Batch 75: 8 files)` | `FIXED` | In BRL-CAD libqtcad Batch 75 (QgMeasureFilter.h, QgMeasureFilter.cpp, QgPolyFilter.h, QgPolyFilter.cpp, QgSelectFilter.h, QgSelectFilter.cpp, QgSketchFilter.h, QgSketchFilter.cpp, 2,899 lines): in QgMeasureFilter.h, declared virtual destructor in QgMeasureFilter; in QgMeasureFilter.cpp, implemented destructor releasing scene object s, fixed critical logic inversion bug in QgMeasureFilter::angle(bool radians) where radians and degrees were swapped, clamped dot product to [-1.0, 1.0] before acos to prevent NaN domain errors, guarded vector unitization against division by zero with ZERO(mag), added null checks on s after bv_obj_get and cleared s = NULL on reset to prevent use-after-free and null dereferences, guarded v in QMeasure2DFilter::get_point, implemented QMeasure3DFilter destructor to clean and free rt_resource, rtip, and application structures eliminating severe memory leaks (CWE-401), cleaned prior raytrace resources before allocating new ones on prep, guarded ray direction magnitude, and cleaned resources on tree loading failure; in QgPolyFilter.h and QgPolyFilter.cpp, added virtual destructors to base QgPolyFilter and derived classes (QPolyCreateFilter, QPolyUpdateFilter, QPolyMoveFilter) to free bu_ptbl containers bool_objs and move_objs eliminating memory leaks (CWE-401), guarded wp, checked contour existence before indexing contour 0, cleared wp->s_i_data = NULL on freeing unclosed polygon, and guarded bv_create_polygon return, wp->s_v, and wp->s_i_data across event handlers; in QgSelectFilter.h and QgSelectFilter.cpp, declared and implemented virtual destructor in QgSelectFilter to free selected_set with bu_ptbl_free (CWE-401), guarded sset and v in closest_obj_bbox and guarded ray direction unitization against division by zero, guarded v and v->gv_s in QgSelectBoxFilter::eventFilter and prevented division by zero when viewport dimensions are zero, removed debug logging spam, and ensured rt_clean_resource is called before destroying rtip and freeing resp/ap on all paths in QgSelectRayFilter; in QgSketchFilter.h and QgSketchFilter.cpp, added virtual destructor to base QgSketchFilter, guarded output parameters and verified sketch magic in screen_to_uv and snap_vertex_uv, guarded v and es against null in all event filters, verified valid ft_set_edit_mode function pointer before invocation, added bounds check on seg_idx against curve count and deg against RT_EDIT_MAXPARA in sketch_seg_sample, bounded all vertex indices against vert_count, guarded arc direction length against zero in sketch_arc_center_uv, bounded curr_seg and full-circle cs->end in QgSketchArcRadiusFilter, guarded event pointer in QgSketchCursorTracker, and safely extracted curr_seg without null dereference in QgSketchSetTangencyFilter. |
-
-
-
-| `SEC-0318` | **Sev 2** | Memory Leaks, Uninitialized Pointers, Division by Zero, Model Invariant Violations, and NULL Pointer Dereferences | `libqtcad & include/qtcad (Batch 76: 7 files)` | `FIXED` | In BRL-CAD libqtcad Batch 76 (QgGeomImport.h, QgModel.h, QgGeomImport.cpp, QgModel.cpp, tests/qgmodel.cpp, tests/qgview.cpp, tests/qsketch.cpp, 1,323 lines): in QgModel.h, initialized rootItem to NULL to prevent uninitialized pointer dereference (CWE-457); in QgModel.cpp, fixed severe memory leak in destructor by iterating through and deleting all QgItem allocations in items before deleting container, freed empty_gvp, and safely deleted gedp->dbi_state before calling ged_close (CWE-401), deleted existing rootItem and cleared items on g_update reset, guarded mdl, gedp, and dbi_state in QgItem_cmp to prevent SIGSEGV crashes during sorting, added comprehensive null checks in QgItem constructor and path_hash, guarded mdl, gedp, dbi_state, and dp in update callbacks, guarded node and index in NodeRow, canFetchMore, and fetchMore, guarded qi, gedp, dbi_state, and ged_gvp in data(), validated argc and argv in run_cmd, verified sender QAction cast and guarded cnode in draw/erase actions, and added bounds and null checks in item expand/collapse handlers; in QgGeomImport.h and QgGeomImport.cpp, explicitly marked constructors and initialized all pointer members to NULL across ASCImportDialog, RhinoImportDialog, and STEPImportDialog (CWE-457), reparented dialog widgets to this for proper Qt memory ownership, deleted out_win in exec_console_app_in_window to prevent persistent dialog leaks (CWE-401), guarded bu_dir return before QString construction, added null checks on dialog UI controls in options(), and fixed critical logic flaw in gfile() where canceling an import dialog still executed the converter by checking dialog.exec() != QDialog::Accepted; in tests/qgmodel.cpp, tests/qgview.cpp, and tests/qsketch.cpp, guarded path_hashes against empty underflow and validated argc/argv with clean help handling in qgmodel, validated argc/argv with clean help handling and corrected argv[1] model path in qgview, and in qsketch validated argc/argv, added clean db_close on error exit paths, guarded nteeth <= 0 in sketch_create_gear to prevent division by zero (CWE-369), verified dp and dbip in QSketchEditWindow constructor, and guarded vertex/segment arrays and view in table population and screenshot methods. |
-| `SEC-0319` | **Sev 2** | Stack Out-of-Bounds Read, Memory Leaks, Resource Leaks, Uninitialized Memory, Path Detection Bugs, and NULL Pointer Dereferences | `libtclcad & include/tclcad (Batch 77: 15 files)` | `FIXED` | In BRL-CAD libtclcad Batch 77 (include/tclcad.h, include/tclcad/defines.h, include/tclcad/draw.h, include/tclcad/misc.h, include/tclcad/setup.h, tclcad_private.h, auto_path.c, cmdhist.c, command_io.cpp, eval.c, global.c, init.c, tests/check_itcl.cpp, tests/check_multi_interp.cpp, tests/check_tclcad_cmds.cpp, 3,267 lines): in include/tclcad/draw.h, corrected header guard comment from TCLCAD_MISC_H to TCLCAD_DRAW_H; in auto_path.c, fixed critical path detection bugs where ITCL_LIBRARY and ITK_LIBRARY overrides appended filename (itcl.tcl/itk.tcl) and inserted file path instead of directory into auto_path, breaking subsequent file existence checks, fixed itk_set flag never being set to 1, eliminated capturing Tcl error message into paths when tcl_library is unset by replacing unchecked Tcl_Eval with Tcl_GetVar, and added _insert_unique_path helper to deduplicate path entries; in cmdhist.c, fixed severe memory leak of str on all exit paths of tclcad_cmdhist_history (CWE-401), closed fp before error returns to prevent file descriptor leaks, guarded against NULL argv and argv[0], guarded chop and argv[2] in tclcad_cmdhist_add, guarded chop, cho_curr, and BU_LIST boundaries in tclcad_cmdhist_prev/curr/next, guarded chop->cho_curr in cho_cmd before dereferencing, replaced redundant nested BU_LIST_NEXT calls with standard while (BU_LIST_WHILE(...)) dequeue loop in cho_deleteProc, and guarded objects and interp in cho_open/cho_open_tcl; in command_io.cpp, initialized interp to NULL and io_mode to 0 in tclcad_create_io_data eliminating uninitialized struct members (CWE-457), and guarded p->p in tclcad_delete_io_handler to prevent NULL pointer dereference in bu_process_fileno (CWE-476); in eval.c, validated interp and command, guarded args against NULL, and ensured individual argument strings are non-null in tclcad_eval and tclcad_eval_noresult; in global.c, guarded clientData against NULL in tclcad_interp_objects_delete, guarded interp and key in tclcad_interp_objects, and guarded state in tclcad_current_top; in init.c, guarded clientData, interp, and cmds in tclcad_init_state_delete, tclcad_init_state, and tclcad_register_cmds, guarded ctp and ct_func in wrapper_func, guarded filename in tclcad_source_file, verified non-null state in tclcad_init, and fixed critical out-of-bounds stack read (CWE-125) in tclcad_set_argv where !argv caused cast of a single-char stack variable to (const char **) passed into Tcl_Merge, handling empty/non-positive argc cleanly without invalid memory access; in tests/check_itcl.cpp, tests/check_multi_interp.cpp, and tests/check_tclcad_cmds.cpp, validated argv and argv[0] before bu_setprogname/Tcl_FindExecutable and added standard -h/-?/--help usage output with clean exit 0. |
-| `SEC-0320` | **Sev 2** | Memory Leaks, Stack Out-of-Bounds Reads, Uninitialized Memory, Missing Include Guards, and NULL Pointer Dereferences | `src/libtclcad/view (Batch 78: 10 files)` | `FIXED` | In BRL-CAD libtclcad Batch 78 (view.h, arrows.c, autoview.c, axes.c, draw.c, faceplate.c, labels.c, lines.c, refresh.c, util.c, 2,912 lines): in view.h, added include guards, C++ extern C wrappers, and extern specifier on to_data_lines; in util.c, guarded gdvp, gdvp->dmp, current_top, and current_top->to_interp in to_is_viewable (CWE-476), initialized result_int to 0 (CWE-457), and prevented Tcl_Obj reference count memory leak on evaluation error by restoring and decrementing saved_result before early return (CWE-401); in autoview.c, fixed out-of-bounds argv[1] read in to_autoview by validating argc < 2 || argc > 3 (CWE-125), guarded tvd, tvd->gedp, current_top, and interp in to_autoview_view, and guarded top, top->to_gedp, and views in to_autoview_all_views; in arrows.c, fixed severe memory leak in points parsing where odd point count returned BRLCAD_ERROR without calling Tcl_Free((char *)av) (CWE-401), guarded current_top->to_gedp->u_data before disabling refresh_on, guarded gedp, gdvp, argv, and interp across go_data_arrows, to_data_arrows, and to_data_arrows_func, and added negative bounds validation on line_width, tip_length, and tip_width; in axes.c, guarded to_axes against argc < 3, NULL gedp, gdvp, gasp, and argv[2], validated non-negative values for axes_size, line_width, tick_interval, tick_length, tick_major_length, and ticks_per_major, guarded current_top, gdvp, and interp across go_data_axes and to_data_axes, and guarded gdvp->gv_s in to_model_axes, go_view_axes, and to_view_axes preventing NULL pointer crashes on uninitialized views (CWE-476); in draw.c, guarded hash table, udata, s_fpath, and dbip in key_matches_paths, guarded tvd->gedp, gedp->u_data, gedp->dbip, and sp->s_os in go_draw_solid, guarded gedp, ged_dl, and sp->s_os in go_draw_dlist, checked gdvp->dmp in go_draw, and in to_edit_redraw guarded dbip, ged_dl, verified !BU_LIST_IS_HEAD before dereferencing sp->s_os, and ensured last_gdlp is not head before dequeue and insert; in faceplate.c, guarded gedp, gdvp, and gdvp->gv_s in to_faceplate, and added RGB color range validation [0, 255] across center_dot, prim_labels, view_params, and view_scale; in labels.c, implemented _free_data_labels helper to safely free all allocated label strings and point buffers on Tcl_SplitList parsing failure, eliminating memory leaks on malformed input lists (CWE-401), guarded current_top, gedp, gdvp, and interp in go_data_labels, to_data_labels, and to_data_labels_func, validated non-negative label size, and in to_prim_label guarded current_top, gedp, and argv, prevented negative list size corruption on argc == 0, and safely reset list when argc == 1; in lines.c, guarded current_top, gedp, gdvp, and argv across go_data_lines and to_data_lines; in refresh.c, guarded gedp, gdvp, dbip, gdvp->gv_s, and current_top in go_refresh_draw, eliminated duplicate dm_draw_viewobjs call, guarded gdvp->u_data and dmp in go_refresh, guarded gdvp, top, and views in to_refresh_view and to_refresh_all_views, guarded gedp and current_top in to_refresh, to_refresh_all, and to_refresh_on, and added NULL checks in to_handle_refresh and to_refresh_handler. |
-| `SEC-0321` | **Sev 2** | Type Confusion, Double Free, Premature Object Deallocation, Memory Leaks, Heap Buffer Underflow, Division by Zero, and NULL Pointer Dereferences | `src/libtclcad (Batch 79: bu.c, fbserv.c, rt.c, tkImgFmtPIX.c, wrapper.c)` | `FIXED` | In BRL-CAD libtclcad Batch 79 (bu.c, fbserv.c, rt.c, tkImgFmtPIX.c, wrapper.c, 2,388 lines): in tkImgFmtPIX.c, fixed critical type confusion vulnerability in FileWritePIX where Tcl_Obj * format was passed directly into Tcl_AppendResult (which expects const char * strings), causing illegal pointer dereferences and application crashes (CWE-843), guarded format against NULL in FileReadPIX to prevent NULL pointer dereference in Tcl_GetStringFromObj (CWE-476), checked widthPtr and heightPtr before writing in FileMatchPIX, validated image dimensions and pixelSize in FileWritePIX, added integer overflow protection on fileWidth * pixelSize pitch calculation, bounded srcX and srcY, and matched bu_malloc/bu_free allocation labels; in rt.c, eliminated critical double-free / premature object deallocation bugs in tcl_obj_to_int_array and tcl_obj_to_fastf_array where Tcl_DecrRefCount was erroneously called on list elements returned by Tcl_ListObjGetElements (corrupting Tcl object refcounts and causing use-after-free and crash when lists are accessed or freed, CWE-416/CWE-415), fixed severe memory leaks in tcl_list_to_int_array and tcl_list_to_fastf_array by properly incrementing and decrementing the temporary Tcl_Obj wrapper (CWE-401), eliminated division by zero in tclcad_rt_parse_ray by verifying direction vector magnitude with ZERO() macro before unitizing (CWE-369), guarded against array out-of-bounds reads on xyz in tclcad_rt_pr_cutter, replaced undefined variable rayp with NULL in RT_HIT_NORMAL, replaced sprintf/sscanf/atoi with snprintf/bu_sscanf across all command wrappers, and added comprehensive NULL checks on clientData, interp, and argv; in wrapper.c, fixed heap buffer underflow (CWE-125) in to_more_args_func where trimming an empty first element decremented ac_more to 0, causing avmp[ac_more-1] to access avmp[-1], eliminated memory leaks in to_view_func_common and to_dm_func by allocating av only after argument validation, help checks, and view lookup, guarded gdvp->gv_s and gdvp->dmp before accessing view state and setting perspective, guarded tgd and current_top->to_interp, and replaced bu_vls_addr with bu_vls_cstr; in fbserv.c, guarded clientData, fbslp, fbsp, and string pointers in comm_error and new_client_handler, added index bounds checks (0 <= i/sub < MAX_CLIENTS) in open/close client handlers and Windows IPC handlers, validated port range [0, 65535], and replaced unsafe sprintf with snprintf; in bu.c, guarded ctp and ct_func in lwrapper_func, guarded interp and argv in tcl_bu_get_value_by_keyword, prevented string truncation underflow on short lists, replaced raw sscanf with bu_sscanf in color converters, guarded dirkey in _tclcad_bu_dir_print, checked conv_factor with ZERO() macro in tcl_bu_units_conversion, and replaced all bu_vls_addr calls with bu_vls_cstr. |
-| `SEC-0322` | **Sev 2** | Out-of-Bounds Reads, Memory Leaks, Parameter Swaps, Division by Zero, Integer Overflow / Dimension Guards, and NULL Pointer Dereferences | `src/libtclcad (Batch 80: bn.c, fb.c)` | `FIXED` | In BRL-CAD libtclcad Batch 80 (bn.c, fb.c, 2,535 lines): in fb.c, fixed critical out-of-bounds argument vector read in fbo_clear_tcl where argc == 3 erroneously accessed argv[6] instead of argv[2], causing invalid memory reads and segmentation crashes (CWE-125); added integer overflow protection and dimension clamping (<= 32768) in fbo_cell_tcl and fbo_rect_tcl preventing excessive memory allocation and heap buffer overflow (CWE-190/CWE-789); validated rectangle bounds against framebuffer dimensions (xmin + width <= fb_w and ymin + height <= fb_h) in fbo_cell_tcl and fbo_rect_tcl preventing memory corruption outside framebuffer bounds (CWE-125/CWE-787); validated port range (<= 65535) in fbo_listen_tcl and to_listen; corrected return code mapping in fbo_cmd from raw BRLCAD_ERROR to TCL_ERROR; added comprehensive NULL guards on gdvp, tvd, fbop, fbp, interp, gedp, and argv across fbo_coords_ok, fbo_deleteProc, fbo_close_tcl, fbo_clear_tcl, fbo_cursor_tcl, fbo_getcursor_tcl, fbo_refresh_tcl, fbo_listen_tcl, fbo_pixel_tcl, fbo_cell_tcl, fbo_flush_tcl, fbo_getheight_tcl, fbo_getwidth_tcl, fbo_getsize_tcl, fbo_rect_tcl, fbo_configure_tcl, to_fbs_callback, to_close_fbs, to_open_fbs, to_set_fb_mode, and to_listen; replaced unsafe sscanf with bu_sscanf and bu_vls_addr with bu_vls_cstr; in bn.c, fixed swapped parameter bug in tclcad_bn_eigen2x2 where matrix element b was parsed into c and c into b; prevented division by zero in tclcad_bn_mat_lookat by verifying hypot_xy with ZERO() macro before passing to bn_mat_lookat (CWE-369); corrected broken logic in bn_cmd_noise_slice which misread argv indices, discarded loop computations, and fell through to invalid noise types, replacing it with proper index reading, dimension validation (<= 4096), and returning the formatted noise list; fixed memory leak in tclcad_bn_mat_arb_rot on double conversion failure by routing to error label (CWE-401); added missing error messages on bn_decode_vect failures in vector functions; replaced unsafe atof with Tcl_GetDouble in bn_cmd_noise_perlin and bn_cmd_noise; replaced sscanf with bu_sscanf; guarded snprintf buffer sizes; and added comprehensive NULL checks on interp, argv, and clientData across all 35 math command wrappers. |
-| `SEC-0323` | **Sev 2** | Use-After-Free, Memory Leaks, Buffer Underflow / Out-of-Bounds Reads, Wrong Argument Indexing, Port Range Validation, and NULL Pointer Dereferences | `src/libtclcad (Batch 81: polygons.c, dm.c)` | `FIXED` | In BRL-CAD libtclcad Batch 81 (polygons.c and dm.c, 4,781 lines): in dm.c, fixed critical use-after-free vulnerability in fb_cmd_common_file_size where dynamic string zerr was passed to Tcl_SetResult with TCL_STATIC and immediately freed with bu_free, leaving Tcl pointing to freed heap memory (CWE-416); fixed critical out-of-bounds argument vector read in dmo_logfile_tcl where argc == 3 erroneously accessed argv[3] instead of argv[2] (CWE-125); guarded out-of-bounds vector reads in error and help handlers across 28 display manager command callbacks; guarded vector index decodes in dmo_parseAxesArgs, dmo_parseDataAxesArgs, and dmo_parseModelAxesArgs; added port range validation (<= 65535) in dmo_listen_tcl; mapped return codes in dmo_cmd from BRLCAD_OK to TCL_OK/TCL_ERROR; replaced sprintf with snprintf; replaced raw atof/atoi with sscanf/bu_sscanf; replaced all bu_vls_addr calls with bu_vls_cstr; added comprehensive NULL checks on dmop, interp, dmo_dmp, and dmo_dmp->i across all 38 display manager routines; in polygons.c, implemented _free_partial_poly and _free_partial_polygon_state cleanup helpers to eliminate severe memory leaks on parse/split failures (CWE-401); freed contour_av on replace_poly success; freed allocated bg_polygon in import; fixed off-by-one out-of-bounds indexing in target_poly (CWE-125); prevented size_t underflow in clip when num_polygons == 0 and state corruption when num_polygons < 2; checked bg_clip_polygon result for NULL; guarded gdvp->dmp, current_top->to_gedp->u_data, current_top->to_interp, and gv_s across all polygon commands; and replaced bu_vls_addr with bu_vls_cstr. |
-| `SEC-0324` | **Sev 2** | Memory Leaks, Uncomputed Model Coordinates Logic Bug, Buffer Overflow / Missing NULL-terminator, Division by Zero, Uninitialized Pointers, and NULL Pointer Dereferences | `src/libtclcad (Batch 82: mouse.c)` | `FIXED` | In BRL-CAD libtclcad Batch 82 (mouse.c, 3,594 lines): fixed critical logic bug in to_mouse_otranslate where model point was declared with VINIT_ZERO and never transformed by the inverse rotation matrix before printing into tran_x_vls, tran_y_vls, tran_z_vls and passing to ged_exec_otranslate (which caused all mouse translations to pass 0, 0, 0); eliminated persistent memory leaks of brep_name and bindings bu_vls on failure paths in to_mouse_brep_selection_append and to_mouse_brep_selection_translate (CWE-401); eliminated memory leaks of joint_name and bindings bu_vls on failure paths in to_mouse_joint_select and to_mouse_joint_selection_translate (CWE-401); fixed buffer allocation and missing NULL terminator in to_mouse_move_bot_pnts where allocating ac elements resulted in av[ac-1] being overwritten by the loop and leaving no NULL termination (CWE-125/CWE-787), allocating ac + 1 and properly terminating; fixed uninitialized gedp->ged_gvp pointer dereference and wrong view rotation matrix inversion in to_mouse_brep_selection_append, to_mouse_joint_select, to_mouse_poly_circ_func, to_mouse_poly_ell_func, to_mouse_poly_rect_func, and to_data_scale (CWE-476); prevented division by zero across to_mouse_constrain_trans, to_mouse_move_arb_edge, to_mouse_move_arb_face, to_mouse_move_bot_pnt, to_mouse_move_bot_pnts, to_mouse_move_pnt_common, to_mouse_oscale, to_mouse_otranslate, TO_COMMON_MOUSE_SCALE, to_mouse_pscale, to_mouse_ptranslate, and to_mouse_trans by clamping width <= 0 to 1 before calculating inv_width (CWE-369); corrected error messages in to_mouse_constrain_rot and to_mouse_constrain_trans on invalid axis; guarded wdbp returned from wdb_dbopen in to_mouse_move_bot_pnt; guarded gdvp->dmp in to_mouse_rect before calling dm_get_height; guarded current_top, current_top->to_interp, current_top->to_gedp, and u_data across all callback executions and polygon functions; and modernized all (~38) bu_vls_addr calls to bu_vls_cstr. |
-| `SEC-0325` | **Sev 2** | Inverted Logic / Crasher, Resource Leaks, Buffer Overflow / Unchecked sprintf, Division by Zero, Type Confusion, Memory Leaks, and NULL Pointer Dereferences | `src/libtclcad (Batch 83: commands.c)` | `FIXED` | In BRL-CAD libtclcad Batch 83 (commands.c, 6,748 lines): completing all 31 files of src/libtclcad (100% complete): fixed critical inverted logic bug in to_pix where dm_make_current returning BRLCAD_OK (0) was treated as failure via !make_ret and aborted; fixed persistent resource leaks of PNG write structures in to_png on error and exit paths by properly invoking png_destroy_write_struct; fixed memory leak of callback_cmd bu_vls in to_rt_end_callback_internal; fixed severe buffer overflow vulnerability and memory leak in to_dplot where fixed stack buffer av[256] lacked bounds check on split list length, had an off-by-one indexing error on NULL terminator, and leaked memory on Tcl_Eval failure; fixed type confusion bug in free_path_edit_params by using correct struct dm_path_edit_params; fixed division-by-zero vulnerabilities in to_bounds, to_data_move_func, to_data_pick_func, to_view2screen, and to_vslew by validating clip boundaries and clamping non-positive width/height before computing scale factors and aspect ratios; prevented negative array indexing in to_make, to_mirror, to_bot_edge_split, and to_bot_face_split by enforcing argument count bounds; preserved ged_exec command output in to_bot_edge_split and to_bot_face_split before invoking redraw; replaced unchecked sprintf with snprintf in to_vmake; added NULL pointer guards across all commands validating gedp, gdvp, dmp, dbip, current_top, to_gedp, and to_interp; and modernized all (~60) bu_vls_addr calls to bu_vls_cstr. |
-| `SEC-0326` | **Sev 2** | Division by Zero, Premature Dereference / NULL Pointer Crashes, Integer Overflow on Dimensions & Buffers, Out-of-Bounds Reads, and Unhandled Floating-Point NaNs | `src/libicv (Batch 84: 11 files)` | `FIXED` | In BRL-CAD libicv Batch 84 (asciiart.cpp, bw.c, color_space.c, crop.c, dpix.c, encoding.c, icv_private.h, operations.c, pix.c, ppm.c, stat.c, 2,400 lines): in stat.c, fixed critical premature NULL dereference in icv_hist where img->width and img->data were accessed prior to the ICV_IMAGE_VAL_PTR(img) check (CWE-476); eliminated multiple division-by-zero vulnerabilities in icv_mean, icv_var, and icv_skew when image width/height are zero (CWE-369); guarded against NULL bins, zero n_bins, and zero channels across all statistical routines; prevented out-of-bounds reads and NaN propagation in icv_max, icv_min, and icv_sum; in operations.c, fixed premature NULL dereference in icv_add_val by checking ICV_IMAGE_VAL_INT before accessing img->data; prevented division-by-zero crashes in icv_divide_val and icv_divide; fixed multi-channel desynchronization / out-of-bounds corruption in icv_saturate by advancing by img->channels instead of hardcoded 3; guarded img dimensions and scale factors against division by zero in icv_fit; in crop.c, fixed division-by-zero crash in icv_crop when img->channels is zero; added integer overflow checks on row byte calculations in icv_crop_rect and icv_crop (CWE-190); in color_space.c, guarded against out-of-bounds reads in icv_rgb2gray when channels < 3 (CWE-125); added integer overflow protection on dimensions and buffer allocations in icv_gray2rgb and icv_rgb2gray; in encoding.c, guarded against NULL data and integer overflows in icv_uchar2double and icv_data2uchar, and prevented division-by-zero and domain errors on negative or zero gamma; in dpix.c, safely handled NaNs/Infs during normalization to prevent divide-by-zero and infinite loops, replaced raw POSIX read/write with stdio fread/fwrite to eliminate short-read and buffering bugs, and added integer overflow validation on sample counts; in pix.c and bw.c, guarded against NULL data conversion pointers, checked dimensions against size_t overflow, eliminated truncation from int casts, and checked realloc limits on stream reads; in ppm.c, clamped RGB float values before lrint to avoid undefined integer conversions, replaced sprintf with snprintf for PPM headers (CWE-120), guarded against numeric overflow in parse_ppm_int, and validated buffer limits in ppm_read_mem; in asciiart.cpp, validated image pointer, data, channels, dimensions, and brightness multiplier; and in icv_private.h, properly positioned include guards. |
-| `SEC-0327` | **Sev 2** | Division by Zero, Resource & Memory Leaks, NULL Pointer Dereference, Setjmp/Longjmp Undefined Behavior, Integer Overflow on Dimensions & Buffers, and Out-of-Bounds Access | `src/libicv (Batch 85: 6 files)` | `FIXED` | In BRL-CAD libicv Batch 85 (fileformat.c, filter.c, jpeg.c, pixcii.hpp, rot.c, size.c, 2,925 lines): in fileformat.c, fixed memory leak of ofilename on validation failure and fopen error paths in icv_write (CWE-401); prevented closing stdin on unsupported format; guarded against NULL bif->data, 0 width/height/channels, and integer overflows in icv_write, icv_write_mem, icv_writeline, and icv_writepixel; added NULL data check in icv_zero and invalidated magic in icv_destroy to prevent use-after-free; in jpeg.c, declared setjmp-lived pointers volatile to eliminate undefined behavior across longjmp; checked icv_data2uchar return values against NULL before scanline processing; eliminated memory leak of libjpeg buffer mem_buf on write failure; guarded dimensions against 0/invalid sizes and checked double-converted buffer allocations in jpeg_read and jpeg_read_mem; in rot.c, guarded argc/argv before calling bu_setprogname; validated pixel size, square size, and width/height options with strtol; set stdout to binary mode for piping binary image streams on Windows; added integer overflow checks on scanline bytes and buffer allocations in arbrot and icv_rot; hardened arbrot coordinates to size_t; supported negative rotation angles via !ZERO(angle); in size.c, guarded icv_image_size against NULL widthp/heightp and zero unit conversions; guarded shrink_image and under_sample against NULL image data, 0 channels, and integer overflows on realloc; removed truncating int casts on dimensions; prevented division by zero in resize_output_valid; in filter.c, validated kernel and offset pointers in get_kernel and get_kernel3; guarded icv_filter, icv_filter3, and icv_fade against NULL data, 0 channels/dimensions, NaN fraction multipliers, and integer overflows; and in pixcii.hpp, guarded against empty ascii character maps, handled NaN brightness boosts, converted signed int pixel indexing to size_t with overflow guards, and clamped double pixel color values safely. |
-| `SEC-0328` | **Sev 2** | Division by Zero, Setjmp/Longjmp Undefined Behavior, Resource & Memory Leaks, Buffer Bounds & Out-of-Bounds Reads, Integer Overflow on Dimensions & Buffers, and Undefined Float-to-Int Conversions | `src/libicv (Batch 86: 5 files)` | `FIXED` | In BRL-CAD libicv Batch 86 (PImgHash.cpp, PImgHash.h, diff.cpp, diff_approx.cpp, png.cpp, 2,233 lines): in png.cpp, validated bif pointer, bif->data, dimensions, and channels in png_write and png_write_mem; declared setjmp-spanning local pointers volatile to prevent undefined behavior across longjmp (CWE-398); eliminated memory leak of converted pixel buffer data on write errors and used icv_destroy in setjmp handlers to prevent leaks of bif->render_info (CWE-401); prevented integer overflow in user_read_data bounds calculation (CWE-190); validated rowbytes against width * 3 in png_read to prevent heap out-of-bounds writes (CWE-122); validated rowbytes and buffer allocations in png_read and png_read_mem; in diff.cpp, guarded write_nirt_shots_for_ri against division by zero on aspect, width, height, and viewsize (CWE-369); guarded icv_diff_nirt_shots against NULL data, mismatched channel counts (< 3), and buffer allocation overflow; prevented heap out-of-bounds reads in icv_diff by indexing per-image channel counts instead of hardcoded 3 and guarded against signed integer overflow on off_by_many; validated 3-channel input, integer overflow on dimensions, and clean buffer freeing in icv_diffimg; in diff_approx.cpp, made load_icv static, guarded against NULL data, unsigned underflow when rows == 0, and integer overflow; validated image pointers and dimensions in pdiff_dct; guarded ssim_calc against NULL data, zero dimensions/channels, and sanitized non-finite NaN/Inf pixel values; in PImgHash.cpp and PImgHash.h, clamped float pixel values to [0.0, 1.0] with NaN check in convert_pix to prevent undefined float-to-int cast conversions (CWE-190/CWE-681); guarded DCTHasher::apply against zero dimensions; prevented out-of-bounds vector writes in tile_size when b == 0 or j >= b; guarded Preprocess::start and Preprocess::stop against division by zero and out-of-bounds histogram access; prevented NULL pointer dereferences and integer overflows in Image class; and guarded resize_row, resize, and add_row against division by zero on tile size. |
-| `SEC-0329` | **Sev 2** | Integer Overflow on Dimensions & Buffers, Unsigned Underflow, Heap Buffer Overflows & Overreads, CPU Exhaustion DoS, Undefined Float Conversions, and NULL Pointer Dereferences | `src/libicv (Batch 87: anim.cpp, apngmini.hpp, rle.cpp, rle.hpp)` | `FIXED` | In BRL-CAD libicv Batch 87 (anim.cpp, apngmini.hpp, rle.cpp, rle.hpp, 3,778 lines): in anim.cpp, validated bif pointer, bif->data, dimensions, and channels in icv_to_apng preventing heap out-of-bounds reads on unexpected channel layouts (CWE-125); clamped float pixel values in float_to_u8 with std::isfinite check to prevent undefined float-to-uint8 cast conversions (CWE-190/CWE-681); guarded read_mjpeg_avi against chunk size underflow and unbounded memory allocation (CWE-191/CWE-400); guarded write_mjpeg_avi against 32-bit integer arithmetic overflows on data rate, frame bytes, and index blocks; validated image pointers and non-empty dimensions across icv_anim_write, icv_anim_add_frame, icv_anim_insert_frame, icv_anim_replace_frame, and icv_anim_get_frame; in apngmini.hpp, enforced maximum pixel limits, non-zero dimensions, and rowbytes buffer bounds in LibpngBackend decode/encode routines; guarded write_chunk against size_t overflow; ensured valid pixel bounds and buffer sizes before cropping and over-compositing; eliminated unsigned underflow and heap buffer corruption during background disposal in Animation::compose when frame.x_offset >= canvas_width (CWE-191/CWE-122); guarded chunk peeking against integer overflow and enforced minimum 4-byte length on fdAT chunks; capped maximum file read size to 512MB in read_file; in rle.cpp, sanitized double-to-uint8 conversions in dbl_to_u8 against non-finite NaN/Inf values; validated image data and dimensions in rle_write and rle_write_mem; guarded memory stream buffer allocation; in rle.hpp, implemented a per-row opcode counter in Decoder::read to prevent CPU exhaustion DoS attacks (CWE-400); clamped scanline and pixel skips to image boundaries to prevent unsigned integer wrap-around and out-of-bounds buffer writes (CWE-122/CWE-190); validated image buffer capacity before colormap transformations; ensured non-null buffer and positive dimensions in write_rgb; and prevented integer overflow in MemReadStream::tell. |
-| `SEC-0330` | **Sev 2** | Memory Management Mismatch, Unchecked Vector & Buffer Bounds, Temporary File Leaks, Unbounded Allocation & Integer Overflows, Division by Zero, and NULL Pointer Dereferences | `src/libicv (Batch 88: tests/apngmini.cpp, tests/demo.c, tests/fileformat.c, tests/icv_diff_test.c, tests/icv_png_json_test.cpp, tests/pimghash.cpp, tests/rle.cpp, tests/robustness.c)` | `FIXED` | In BRL-CAD libicv Batch 88 (tests/apngmini.cpp, tests/demo.c, tests/fileformat.c, tests/icv_diff_test.c, tests/icv_png_json_test.cpp, tests/pimghash.cpp, tests/rle.cpp, tests/robustness.c, 4,882 lines, completing src/libicv to 100%): in rle.cpp, resolved allocator mismatch (CWE-762) by changing create_test_image from libc calloc to bu_calloc to match bu_free in free_test_image; guarded against arithmetic overflow in image data size calculation; added null data checks in pixels_match; ensured temporary test files in rle_roundtrip, test_write_invalid_channels, and test_write_oversized_dimensions are deleted on error and completion; and exercised null file stream handling in test_invalid_file; in apngmini.cpp, validated frame dimensions in make_frame to prevent integer overflow and excessive allocation; verified vector bounds before indexing composed frame pixels to prevent out-of-bounds reads (CWE-125); and ensured roundtrip temporary files are deleted via RAII cleanup; in demo.c, validated image creation and buffer allocations in demo_rgb and prevented division by zero when dimensions sum to zero; guarded against dimension overflow and null pointers in clone_image; added null checks across demo_memory_io, demo_file_io, demo_crop_filter_ascii, and demo_diffs; and ensured temporary animation test files are cleaned up unconditionally; in fileformat.c, validated image data allocation in make_pixel and guarded path parameter in write_auto_pix; in icv_diff_test.c, validated dimensions and arithmetic overflow in make_solid; added null data checks in test_icv_diff_counts and test_icv_diffimg_colors; and validated render_info pointers before dereferencing in test_png_metadata_roundtrip, test_diff_render_info, and test_nirt_shots; in icv_png_json_test.cpp, validated dimensions and data pointers in make_solid; capped maximum file read size to 100MB in png_read_text_chunk; guarded chunk parsing against 32-bit integer overflow; and verified render_info allocations before dereferencing; in pimghash.cpp, sanitized floating-point comparisons with std::isfinite in nearly_equal; and checked vector size before indexing hash bytes in test_hashing; in robustness.c, validated dimensions and memory allocations across all make_* helper functions; prevented division by zero in make_unit_rgb; checked statistics pointers (minv, maxv, sumv, meanv, bins, mode, median, var, skew) for null before access in test_crop_filters_and_stats; and guarded metadata and frame allocations in test_ascii_render_info_and_diff and test_animation_frame_management; and across all test harnesses, safely validated argc > 0 && argv && argv[0] before calling bu_setprogname. |
-| `SEC-0331` | **Sev 2** | Buffer Overlapping Undefined Behavior, Stack & Heap Buffer Truncation / Overflow, Division by Zero, Unsigned Integer Underflow, Memory Leaks, Dangling / Unchecked Pointers, and NULL Pointer Dereferences | `src/libnmg (Batch 89: bool.c, ck.c)` | `FIXED` | In BRL-CAD libnmg Batch 89 (bool.c, ck.c, 2,801 lines): in ck.c, resolved critical undefined behavior (UB) and buffer corruption across all topological consistency check routines (nmg_ck_e, nmg_ck_vu, nmg_ck_eu, nmg_ck_lg, nmg_ck_l, nmg_ck_lu, nmg_ck_fg, nmg_ck_f, nmg_ck_fu) by replacing unsafe fixed-length heap allocations and overlapping snprintf calls (where the destination buffer was also passed as the %s source argument) with dynamically sized struct bu_vls formatting; fixed CWE-369 division-by-zero vulnerability in nmg_ck_eg_verts by guarding edge direction magnitude against zero before calling VUNITIZE; eliminated NULL pointer dereferences when logging or checking without parent strings by guarding string pointers; in nmg_ck_lueu, fixed backward/forward edge logging mismatch bug, corrected routine name typo in logs, and guarded circular list navigation against empty list heads; hardened all 17 nmg_v* validator routines (nmg_vvg, nmg_vvertex, nmg_vvua, nmg_vvu, nmg_veg, nmg_vedge, nmg_veu, nmg_vlg, nmg_vloop, nmg_vlu, nmg_vfg, nmg_vface, nmg_vfu, nmg_vsshell, nmg_vshell, nmg_vregion, nmg_vmodel) with comprehensive NULL checks, magic identification guards, and coordinate validation; in nmg_eu_2s_orient_bad, guarded radial and mate pointers during circular traversal; in nmg_ck_closed_surf and nmg_ck_closed_region, checked pointer validity before recursive verification; in nmg_ck_v_in_2fus and nmg_ck_vs_in_region, ensured vertex geometry and model pointers are valid and sanitized visited array allocation against negative or zero maxindex; in bool.c, guarded nmg_plot_open_edges against NULL magic, checked vertex coordinate pointers, and ensured plot_file_name bu_vls is unconditionally freed at exit; validated model and shell pointers in nmg_has_dangling_faces; eliminated unsigned integer underflow vulnerability in nmg_kill_anti_loops during loop deletion; safely bounded buffer formatting in nmg_show_each_loop; guarded edgeuse mate pointers in nmg_classify_shared_edges_verts; removed obsolete #if 0 dead code block; ensured bounding boxes exist before disjoint tests in nmg_bool; and guarded model maxindex against non-positive sizes before calloc/memcpy in boolean evaluation. |
-| `SEC-0332` | **Sev 2** | Off-by-One Heap Buffer Overflows, Union Type Confusion, Division by Zero, Broken Radial Circular Loops, Dead Code Blocks, and NULL Pointer Dereferences | `src/libnmg (Batch 90: class.c, copy.c)` | `FIXED` | In BRL-CAD libnmg Batch 90 (class.c, copy.c, 3,392 lines): in copy.c, resolved critical off-by-one heap buffer overflow in nmg_clone_model by allocating maxelem = original->maxindex > 0 ? (size_t)original->maxindex + 1 : 1 instead of original->maxindex, preventing out-of-bounds writes and corruptions when elements with index == maxindex are cloned; introduced safe index-checked structArray accessor helpers get_struct and set_struct validating index >= 0 && (size_t)index < maxelem; fixed union type confusion in nmg_construct_face where case NMG_FACE_G_SNURB_MAGIC accessed original->g.plane_p->index instead of original->g.snurb_p->index; hardened all 20 structure constructors (nmg_construct_region_a, nmg_construct_region, nmg_construct_face_g_plane, nmg_construct_face_g_snurb, nmg_construct_face, nmg_construct_vertex_g, nmg_construct_vertex, nmg_construct_vertexuse_a_plane, nmg_construct_vertexuse_a_cnurb, nmg_construct_vertexuse, nmg_construct_edge, nmg_construct_edge_g_lseg, nmg_construct_edge_g_cnurb, nmg_construct_edgeuse, nmg_construct_loop_a, nmg_construct_loop, nmg_construct_loopuse, nmg_construct_faceuse, nmg_construct_shell_a, nmg_construct_shell) with input NULL checks, safe structArray index bounds validation, and non-null child insertion guards; validated knot vector sizes (u.k_size, v.k_size, k_size) and ctl_points array allocations before copying in SNURB and CNURB constructors; removed dead unused tolerance variable in nmg_clone_model; in class.c, fixed CWE-369 division-by-zero vulnerability in nmg_class_pnt_e by checking MAGSQ(ptvec) < SMALL_FASTF before calling VUNITIZE; eliminated off-by-one heap underallocations in nmg_class_pnt_e debug plot bits buffer, nmg_class_pnt_s faces_seen array, and class_lu_vs_s b buffer by allocating (size_t)maxindex + 1; replaced unsafe sprintf calls with snprintf across debug plot generators; deleted two large obsolete #if 0 dead code blocks (~200 lines: nmg_class_lu_fu and nmg_get_interior_pnt); guarded against NULL shell attributes (s->sa_p) before bounding box dereferences in nmg_class_pnt_s, class_eu_vs_s, and nmg_classify_s_vs_s by ensuring attributes via nmg_shell_a; hardened radial and mate pointer cycles against NULL dereference and infinite loops in class_eu_vs_s, class_shared_lu, and class_lu_vs_s; and prevented crashes and type confusion on empty or vertex loops in class_shared_lu and nmg_classify_s_vs_s by validating list emptiness, checking child magic, and ensuring vertex geometry pointers are non-null. |
-| `SEC-0333` | **Sev 2** | Heap Buffer Overflows / OOB Writes, Memory Leaks, Copy-Paste Edge Intersection Defects, Denial of Service / Aborts, and NULL Pointer Dereferences | `src/libnmg (Batch 91: eval.c, extrude.c)` | `FIXED` | In BRL-CAD libnmg Batch 91 (eval.c, extrude.c, 2,024 lines): in extrude.c, resolved critical Cat 1 heap buffer overflow / OOB write vulnerabilities (CWE-122 / CWE-787) in nmg_hollow_shell and nmg_extrude_shell by allocating maxelem = (m->maxindex > 0) ? (size_t)m->maxindex + 1 : 1 instead of m->maxindex, preventing memory corruption when elements with index == maxindex are processed by NMG_INDEX_TEST_AND_SET; fixed critical copy-paste bug in nmg_fix_overlapping_loops where edge splitting on intersection endpoints incorrectly referenced eu2 instead of eu1 on dist[0] == 1.0, and nmg_esplit was erroneously confined to the interior-only else branch, leaving crossing edges completely unsplit when touching existing vertex endpoints; fixed multiple persistent memory leaks: loop_tab allocations in nmg_fix_overlapping_loops when tables were empty, outfaces in nmg_extrude_face on early error returns, and the verts table in nmg_extrude_shell when vertex recalculation failed before out: (CWE-401); replaced fatal bu_bomb abort in nmg_extrude_face on parallel extrusion with graceful error return (-1) and moved angle calculation before nmg_dup_face to prevent orphaned/leaked duplicated geometry; added loop bounds and magic number validation in nmg_start_new_loop to guard against infinite loops and type confusion; hardened verts_in_nmg_loop, verts_in_nmg_face, nmg_translate_face, nmg_find_vertex_in_lu, nmg_break_crossed_loops, and nmg_extrude_cleanup with comprehensive NULL checks, empty loop guards, and coordinate validation; in eval.c, hardened nmg_eval_action with classification table bounds checking (bs_maxindex) to prevent negative array indexing or heap out-of-bounds reads (CWE-125); added NULL guards, parent magic verification, and planar face geometry checks in nmg_ck_lu_orientation to avoid illegal dereferences on non-faceuse parents or SNURB faces; hardened nmg_eval_shell against crashing on empty loops or malformed wire edgeuse parents in BACTION_KILL; replaced unsafe sprintf with snprintf in debug plot file naming; and replaced fatal bu_bomb on plot file write failure with a non-fatal bu_log warning. |
-| `SEC-0334` | **Sev 2** | Stack & Heap Uninitialized Memory / Sizeof Pointer, Persistent Memory Leaks, Division by Zero, Unsigned Underflow, Dead Code Elimination, and NULL Pointer Dereferences | `src/libnmg (Batch 92: fcut.c)` | `FIXED` | In BRL-CAD libnmg Batch 92 (fcut.c, 3,809 lines): in nmg_face_rs_init, resolved critical Cat 1 sizeof-pointer memory initialization defect (CWE-467) where memset((char *)rs, 0, sizeof(rs)) only zeroed 8 bytes (pointer size) leaving the remaining 90% of the nmg_ray_state structure filled with uninitialized stack memory; resolved multiple persistent memory leaks (CWE-401) in find_loop_to_cut and nmg_fcut_face where dynamically allocated struct loop_cuts objects in the cuts table were removed via bu_ptbl_rm or left in cuts when freeing the table without ever calling bu_free; fixed CWE-369 division-by-zero vulnerabilities across VUNITIZE calls on rs->left in nmg_face_rs_init, x_dir and y_dir in find_loop_to_cut, and x_dir and y_dir in nmg_eu_angle by guarding vector magnitude against zero before normalization; fixed CWE-191 unsigned integer underflow and infinite loop vulnerability in ptbl_vsort bubble sort loop bounds by using safe i + 1 < b->end comparison; eliminated type confusion crashes on lone vertex loops in find_best_vu by verifying parent magic (*vu->up.magic_p == NMG_EDGEUSE_MAGIC) before treating parents as edgeuses; eliminated out-of-bounds pointer reads and potential null dereferences in nmg_fcut_face traversal loops (prior_start, prior_end, next_end) by enforcing array bounds against rs->nvu; guarded ptbl_vsort against division by zero on dist_tol <= 0; added retry iteration limits and safe return paths in nmg_ck_vu_ptbl and nmg_face_cutjoin to prevent infinite loops; restored active exported implementations of nmg_sanitize_fu and nmg_wedge_class from dead code blocks; replaced fatal bu_bomb aborts across active routines with error logging and graceful failure returns; and eliminated ~2,500 lines of obsolete #if 0 dead code blocks from 1993/2017. |
-| `SEC-0335` | **Sev 2** | Persistent Memory Leaks, Division by Zero, Control Point Misalignment, Infinite Loops, Denial of Service / Aborts, and NULL Pointer Dereferences | `src/libnmg (Batch 93: fuse.c)` | `FIXED` | In BRL-CAD libnmg Batch 93 (fuse.c, 3,468 lines): resolved multiple persistent memory leaks (CWE-401) by freeing dynamic sort_idx_xyp allocation in nmg_edge_g_fuse which was previously never deallocated, freeing etab table on zero-count exit in nmg_edge_g_fuse, and freeing tmp table on empty-length exits in nmg_vertex_fuse and nmg_edge_fuse; fixed control points stride misalignment and buffer bounds defects in nmg_cnurb_is_linear (CWE-125 / CWE-129) where ctl_points was indexed by i instead of i * coords and compared using 3D VEQUAL instead of dimension-aware coords comparisons with EQUAL macro, as well as fixing the loop upper bound to cnrb->c_size - 1; fixed multiple CWE-369 division-by-zero vulnerabilities: guarded rise-over-run slopes (dx and dy) in nmg_edge_g_fuse across XY, XZ, and YZ planes, guarded srf->s_size[0] * srf->s_size[1] <= 0 and plane normal magnitude MAGSQ(pl) <= SMALL_FASTF in nmg_snurb_is_planar, and guarded rational weights (xyz1[coords-1] and uvw[coords-1]) in nmg_eval_linear_trim_curve and nmg_eval_trim_curve; fixed potential infinite loop hangs (CWE-835) in nmg_radial_implement_decisions and nmg_do_radial_join by adding pass progress tracking (progress++) to prevent infinite looping when skipped elements make no forward progress; eliminated 43 fatal bu_bomb aborts (CWE-400 / DoS) across topological fusing, crack classification, and radial edge joining (nmg_region_v_unique, nmg_vertex_fuse, nmg_snurb_is_planar, nmg_split_trim, nmg_cnurb_lseg_coincident, nmg_cnurb_is_on_crv, nmg_edge_fuse, nmg_ck_fu_verts, nmg_break_all_es_on_v, nmg_radial_verify_pointers, nmg_radial_verify_monotone, nmg_radial_build_list, nmg_is_crack_outie, nmg_find_radial_eu, nmg_radial_mark_cracks, nmg_radial_find_an_original, nmg_radial_mark_flips, nmg_radial_join_eu_NEW), replacing them with informative error/debug logging and graceful non-fatal fallback returns; and hardened against NULL pointer dereferences and out-of-bounds reads (CWE-476 / CWE-125) in nmg_edge_fuse, nmg_edge_g_fuse, nmg_break_all_es_on_v, nmg_break_e_on_v, and radial utilities with comprehensive parameter validation and geometry checks. |
-
-
-
-
-

audit/audit_tool.py

@@ -1,158 +0,0 @@
-#!/usr/bin/env python3
-import os
-import sys
-import json
-import time
-import argparse
-
-REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
-AUDIT_DIR = os.path.join(REPO_ROOT, "audit")
-FILES_LEDGER = os.path.join(AUDIT_DIR, "files_ledger.json")
-ISSUES_LEDGER = os.path.join(AUDIT_DIR, "issues_ledger.json")
-
-def load_files():
-    if not os.path.exists(FILES_LEDGER):
-        return {"files": []}
-    with open(FILES_LEDGER, "r", encoding="utf-8") as f:
-        return json.load(f)
-
-def save_files(data):
-    with open(FILES_LEDGER, "w", encoding="utf-8") as f:
-        json.dump(data, f, indent=2)
-
-def load_issues():
-    if not os.path.exists(ISSUES_LEDGER):
-        return {"issues": []}
-    with open(ISSUES_LEDGER, "r", encoding="utf-8") as f:
-        return json.load(f)
-
-def save_issues(data):
-    with open(ISSUES_LEDGER, "w", encoding="utf-8") as f:
-        json.dump(data, f, indent=2)
-
-def mark_reviewed(file_paths):
-    fdata = load_files()
-    path_map = {f["path"]: f for f in fdata.get("files", [])}
-    ts = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-    updated = 0
-    for p in file_paths:
-        norm_p = os.path.relpath(os.path.join(REPO_ROOT, p), REPO_ROOT)
-        if norm_p in path_map:
-            path_map[norm_p]["status"] = "REVIEWED"
-            path_map[norm_p]["reviewed_at"] = ts
-            updated += 1
-        else:
-            print(f"Warning: file not found in ledger: {norm_p}")
-    save_files(fdata)
-    print(f"Marked {updated} file(s) as REVIEWED.")
-
-def log_issue(file_path, line_range, severity, category, description):
-    fdata = load_files()
-    idata = load_issues()
-    issues = idata.get("issues", [])
-    next_id_num = len(issues) + 1
-    issue_id = f"SEC-{next_id_num:04d}"
-    
-    norm_p = os.path.relpath(os.path.join(REPO_ROOT, file_path), REPO_ROOT)
-    
-    new_issue = {
-        "id": issue_id,
-        "file": norm_p,
-        "lines": line_range,
-        "severity": int(severity),
-        "category": category,
-        "description": description,
-        "verification_status": "PENDING",
-        "verification_test": None,
-        "test_result": None,
-        "fix_status": "UNFIXED",
-        "fix_description": None,
-        "commit_hash": None,
-        "commit_message": None,
-        "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-    }
-    issues.append(new_issue)
-    idata["issues"] = issues
-    save_issues(idata)
-
-    # Link to file in files_ledger
-    path_map = {f["path"]: f for f in fdata.get("files", [])}
-    if norm_p in path_map:
-        path_map[norm_p]["issues_count"] = path_map[norm_p].get("issues_count", 0) + 1
-        if "issue_ids" not in path_map[norm_p]:
-            path_map[norm_p]["issue_ids"] = []
-        path_map[norm_p]["issue_ids"].append(issue_id)
-        save_files(fdata)
-
-    print(f"Logged issue {issue_id}: [{category}] Severity {severity} in {norm_p}:{line_range}")
-    return issue_id
-
-def verify_issue(issue_id, status, test_desc, test_result):
-    idata = load_issues()
-    for issue in idata.get("issues", []):
-        if issue["id"] == issue_id:
-            issue["verification_status"] = status
-            issue["verification_test"] = test_desc
-            issue["test_result"] = test_result
-            issue["verified_at"] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-            save_issues(idata)
-            print(f"Updated {issue_id} verification status: {status}")
-            return
-    print(f"Error: Issue {issue_id} not found.")
-
-def record_fix(issue_id, fix_desc, commit_msg, commit_hash=None):
-    idata = load_issues()
-    for issue in idata.get("issues", []):
-        if issue["id"] == issue_id:
-            issue["fix_status"] = "FIXED" if commit_hash else "PENDING_COMMIT"
-            issue["fix_description"] = fix_desc
-            issue["commit_message"] = commit_msg
-            issue["commit_hash"] = commit_hash
-            issue["fixed_at"] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-            save_issues(idata)
-            print(f"Updated {issue_id} fix status: {issue['fix_status']}")
-            return
-    print(f"Error: Issue {issue_id} not found.")
-
-def main():
-    parser = argparse.ArgumentParser(description="Audit Ledger Management Tool")
-    subparsers = parser.add_subparsers(dest="action", required=True)
-
-    # mark-reviewed
-    rev_parser = subparsers.add_parser("mark-reviewed")
-    rev_parser.add_argument("files", nargs="+", help="Files to mark as reviewed")
-
-    # log-issue
-    log_parser = subparsers.add_parser("log-issue")
-    log_parser.add_argument("--file", required=True, help="File path")
-    log_parser.add_argument("--lines", required=True, help="Line range (e.g. 88-94)")
-    log_parser.add_argument("--severity", required=True, type=int, choices=[1, 2, 3], help="Severity 1-3")
-    log_parser.add_argument("--category", required=True, help="Vulnerability category")
-    log_parser.add_argument("--description", required=True, help="1-sentence description")
-
-    # verify-issue
-    ver_parser = subparsers.add_parser("verify-issue")
-    ver_parser.add_argument("--id", required=True, help="Issue ID (e.g. SEC-0001)")
-    ver_parser.add_argument("--status", required=True, choices=["CONFIRMED", "DISPROVEN", "PENDING"], help="Status")
-    ver_parser.add_argument("--test-desc", required=True, help="Test description")
-    ver_parser.add_argument("--test-result", required=True, help="Test outcome summary")
-
-    # record-fix
-    fix_parser = subparsers.add_parser("record-fix")
-    fix_parser.add_argument("--id", required=True, help="Issue ID (e.g. SEC-0001)")
-    fix_parser.add_argument("--fix-desc", required=True, help="Description of the fix")
-    fix_parser.add_argument("--commit-msg", required=True, help="Proposed lowercase commit message")
-    fix_parser.add_argument("--commit-hash", default=None, help="Commit hash if committed")
-
-    args = parser.parse_args()
-    if args.action == "mark-reviewed":
-        mark_reviewed(args.files)
-    elif args.action == "log-issue":
-        log_issue(args.file, args.lines, args.severity, args.category, args.description)
-    elif args.action == "verify-issue":
-        verify_issue(args.id, args.status, args.test_desc, args.test_result)
-    elif args.action == "record-fix":
-        record_fix(args.id, args.fix_desc, args.commit_msg, args.commit_hash)
-
-if __name__ == "__main__":
-    main()

audit/dashboard.py

@@ -1,148 +0,0 @@
-#!/usr/bin/env python3
-import os
-import json
-import time
-from collections import defaultdict
-
-REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
-AUDIT_DIR = os.path.join(REPO_ROOT, "audit")
-FILES_LEDGER = os.path.join(AUDIT_DIR, "files_ledger.json")
-ISSUES_LEDGER = os.path.join(AUDIT_DIR, "issues_ledger.json")
-DASHBOARD_MD = os.path.join(AUDIT_DIR, "DASHBOARD.md")
-AUDIT_LEDGER_MD = os.path.join(AUDIT_DIR, "AUDIT_LEDGER.md")
-
-def load_json(filepath, default):
-    if not os.path.exists(filepath):
-        return default
-    with open(filepath, "r", encoding="utf-8") as f:
-        return json.load(f)
-
-def generate_dashboard():
-    fdata = load_json(FILES_LEDGER, {"files": []})
-    idata = load_json(ISSUES_LEDGER, {"issues": []})
-
-    files = fdata.get("files", [])
-    issues = idata.get("issues", [])
-
-    total_files = len(files)
-    reviewed_files = sum(1 for f in files if f.get("status", "").startswith("REVIEWED"))
-    pending_files = total_files - reviewed_files
-    pct_complete = (reviewed_files / total_files * 100) if total_files > 0 else 0.0
-
-    # Issues breakdown
-    sev_counts = {1: 0, 2: 0, 3: 0}
-    status_counts = {"PENDING": 0, "CONFIRMED": 0, "DISPROVEN": 0, "FIXED": 0}
-    cat_counts = defaultdict(int)
-
-    for iss in issues:
-        sev = iss.get("severity", 1)
-        sev_counts[sev] = sev_counts.get(sev, 0) + 1
-        
-        vstat = iss.get("verification_status", "PENDING")
-        fstat = iss.get("fix_status", "UNFIXED")
-        if fstat == "FIXED":
-            status_counts["FIXED"] += 1
-        else:
-            status_counts[vstat] = status_counts.get(vstat, 0) + 1
-
-        cat = iss.get("category", "Unknown")
-        cat_counts[cat] += 1
-
-    # Subsystem breakdown
-    subsys_stats = defaultdict(lambda: {"total": 0, "reviewed": 0, "issues": 0})
-    for f in files:
-        ss = f.get("subsystem", "other")
-        subsys_stats[ss]["total"] += 1
-        if f.get("status", "").startswith("REVIEWED"):
-            subsys_stats[ss]["reviewed"] += 1
-        subsys_stats[ss]["issues"] += f.get("issues_count", 0)
-
-    # Render Markdown Dashboard
-    now_str = time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime())
-    md_lines = [
-        "# BRL-CAD RMF/STIG Cat 1 Security Audit Dashboard",
-        f"**Last Updated:** {now_str}",
-        "",
-        "## Overall Progress",
-        f"- **Total C/C++ Files:** {total_files}",
-        f"- **Files Reviewed:** {reviewed_files} ({pct_complete:.1f}%)",
-        f"- **Files Pending Review:** {pending_files}",
-        f"- **Total Issues Identified:** {len(issues)}",
-        "",
-        "### Issues by Severity Potential",
-        "| Severity Level | Count | Description |",
-        "|:---:|:---:|:---|",
-        f"| **3 (High)** | {sev_counts[3]} | Likely exploit or crash potential; widespread/library exposure |",
-        f"| **2 (Medium)** | {sev_counts[2]} | Possible exploit or crash under specific circumstances |",
-        f"| **1 (Low)** | {sev_counts[1]} | Localized / low-impact vulnerability |",
-        "",
-        "### Issues by Verification Status",
-        f"- **Confirmed:** {status_counts.get('CONFIRMED', 0)}",
-        f"- **Fixed (Committed):** {status_counts.get('FIXED', 0)}",
-        f"- **Pending Verification:** {status_counts.get('PENDING', 0)}",
-        f"- **Disproven:** {status_counts.get('DISPROVEN', 0)}",
-        "",
-        "## Subsystem Review Progress",
-        "| Subsystem | Total Files | Reviewed | Progress | Issues Found |",
-        "|:---|:---:|:---:|:---:|:---:|"
-    ]
-
-    for ss in sorted(subsys_stats.keys()):
-        stats = subsys_stats[ss]
-        pct = (stats["reviewed"] / stats["total"] * 100) if stats["total"] > 0 else 0
-        md_lines.append(f"| `{ss}` | {stats['total']} | {stats['reviewed']} | {pct:.1f}% | {stats['issues']} |")
-
-    if issues:
-        md_lines.extend([
-            "",
-            "## Identified Issues Summary",
-            "| ID | Severity | Category | File & Location | Verification | Nature of Issue |",
-            "|:---|:---:|:---|:---|:---:|:---|"
-        ])
-        for iss in issues:
-            v_badge = iss.get("verification_status", "PENDING")
-            if iss.get("fix_status") == "FIXED":
-                v_badge = "FIXED"
-            md_lines.append(
-                f"| `{iss['id']}` | **Sev {iss['severity']}** | {iss['category']} | `{iss['file']}:{iss['lines']}` | `{v_badge}` | {iss['description']} |"
-            )
-
-    md_content = "\n".join(md_lines) + "\n"
-    with open(DASHBOARD_MD, "w", encoding="utf-8") as f:
-        f.write(md_content)
-
-    # Render Markdown Ledger
-    ledger_lines = [
-        "# BRL-CAD RMF/STIG Cat 1 Vulnerability Tracking Ledger",
-        f"**Last Synchronized:** {now_str}",
-        "",
-        "| Issue ID | File | Lines | Cat 1 Type | Sev | Verification | Fix Status | 1-Sentence Nature of Issue |",
-        "|:---|:---|:---:|:---|:---:|:---:|:---:|:---|"
-    ]
-    for iss in issues:
-        v_badge = iss.get("verification_status", "PENDING")
-        fix_badge = iss.get("fix_status", "UNFIXED")
-        ledger_lines.append(
-            f"| `{iss['id']}` | `{iss['file']}` | `{iss['lines']}` | {iss['category']} | {iss['severity']} | `{v_badge}` | `{fix_badge}` | {iss['description']} |"
-        )
-    
-    with open(AUDIT_LEDGER_MD, "w", encoding="utf-8") as f:
-        f.write("\n".join(ledger_lines) + "\n")
-
-    # Terminal Output
-    print("=" * 68)
-    print(" BRL-CAD RMF/STIG Cat 1 Security Audit Dashboard")
-    print("=" * 68)
-    print(f" Total C/C++ Files:    {total_files}")
-    print(f" Files Reviewed:       {reviewed_files} / {total_files} ({pct_complete:.1f}%)")
-    print(f" Files Pending:        {pending_files}")
-    print(f" Total Issues:         {len(issues)}")
-    print(f" Severity Breakdown:   High (3): {sev_counts[3]} | Med (2): {sev_counts[2]} | Low (1): {sev_counts[1]}")
-    print(f" Verification Status:  Confirmed: {status_counts.get('CONFIRMED', 0)} | Fixed: {status_counts.get('FIXED', 0)} | Pending: {status_counts.get('PENDING', 0)} | Disproven: {status_counts.get('DISPROVEN', 0)}")
-    print("=" * 68)
-    print(f" Updated dashboard: {DASHBOARD_MD}")
-    print(f" Updated ledger:    {AUDIT_LEDGER_MD}")
-    print("=" * 68)
-
-if __name__ == "__main__":
-    generate_dashboard()

audit/inventory.py

@@ -1,91 +0,0 @@
-#!/usr/bin/env python3
-import os
-import json
-import time
-
-REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
-AUDIT_DIR = os.path.join(REPO_ROOT, "audit")
-FILES_LEDGER = os.path.join(AUDIT_DIR, "files_ledger.json")
-
-EXTENSIONS = {".c", ".cpp", ".cxx", ".cc", ".h", ".hpp", ".hxx", ".hh"}
-EXCLUDE_DIRS = {".git", "build", "audit", ".github"}
-
-def get_subsystem(rel_path):
-    parts = rel_path.split(os.sep)
-    if len(parts) > 1 and parts[0] == "src":
-        if parts[1] == "conv" and len(parts) > 2:
-            return f"src/conv/{parts[2]}"
-        return f"src/{parts[1]}"
-    elif len(parts) > 1 and parts[0] == "include":
-        return "include"
-    elif len(parts) > 1:
-        return parts[0]
-    return "root"
-
-def count_lines(filepath):
-    try:
-        with open(filepath, "r", encoding="utf-8", errors="ignore") as f:
-            return sum(1 for _ in f)
-    except Exception:
-        return 0
-
-def main():
-    existing_ledger = {}
-    if os.path.exists(FILES_LEDGER):
-        try:
-            with open(FILES_LEDGER, "r", encoding="utf-8") as f:
-                data = json.load(f)
-                for item in data.get("files", []):
-                    existing_ledger[item["path"]] = item
-        except Exception as e:
-            print(f"Warning: could not load existing ledger: {e}")
-
-    files = []
-    for root, dirs, filenames in os.walk(REPO_ROOT):
-        dirs[:] = [d for d in dirs if d not in EXCLUDE_DIRS and not d.startswith("build")]
-        for fn in filenames:
-            ext = os.path.splitext(fn)[1].lower()
-            if ext in EXTENSIONS:
-                full_path = os.path.join(root, fn)
-                rel_path = os.path.relpath(full_path, REPO_ROOT)
-                files.append(rel_path)
-
-    files.sort()
-
-    ledger_entries = []
-    for idx, rel_path in enumerate(files, 1):
-        if rel_path in existing_ledger:
-            entry = existing_ledger[rel_path]
-            entry["id"] = idx
-            ledger_entries.append(entry)
-        else:
-            full_path = os.path.join(REPO_ROOT, rel_path)
-            lines = count_lines(full_path)
-            subsystem = get_subsystem(rel_path)
-            ledger_entries.append({
-                "id": idx,
-                "path": rel_path,
-                "subsystem": subsystem,
-                "lines": lines,
-                "status": "PENDING",
-                "reviewed_at": None,
-                "issues_count": 0,
-                "issue_ids": []
-            })
-
-    output_data = {
-        "metadata": {
-            "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-            "total_files": len(ledger_entries),
-            "extensions": sorted(list(EXTENSIONS))
-        },
-        "files": ledger_entries
-    }
-
-    with open(FILES_LEDGER, "w", encoding="utf-8") as f:
-        json.dump(output_data, f, indent=2)
-
-    print(f"Successfully indexed {len(ledger_entries)} C/C++ files into {FILES_LEDGER}")
-
-if __name__ == "__main__":
-    main()

bench/CMakeLists.txt

@@ -1,102 +1,87 @@
 add_subdirectory(ref)
 
+include_directories(${BU_INCLUDE_DIRS})
+
 add_definitions(-DCONSOLE)
 
-brlcad_addexec(pixcmp pixcmp.c libbu)
-brlcad_add_test(
-  NAME bench_pixcmp_tolerance
-  COMMAND
-    ${CMAKE_COMMAND} "-DPIXCMP=$<TARGET_FILE:pixcmp>" "-DTEST_DIR=${CMAKE_CURRENT_BINARY_DIR}"
-    -P "${CMAKE_CURRENT_SOURCE_DIR}/pixcmp_test.cmake"
+BRLCAD_ADDEXEC(pixcmp pixcmp.c libbu)
+set(BARK_SOURCES
+  benchmark.c
+  compute.c
+  run.c
+  clean.c
 )
-set(BARK_SOURCES benchmark.c compute.c run.c clean.c)
-brlcad_addexec(bark "${BARK_SOURCES}" "libbu;${M_LIBRARY}" NO_STRICT NO_INSTALL TEST_USESDATA)
+BRLCAD_ADDEXEC(bark "${BARK_SOURCES}" libbu NO_STRICT NO_INSTALL TEST_USESDATA)
 
-if(BUILD_TESTING)
-  configure_file(run.sh "${CMAKE_CURRENT_BINARY_DIR}/benchmark" COPYONLY)
-  install(PROGRAMS "${CMAKE_CURRENT_BINARY_DIR}/benchmark" DESTINATION ${BIN_DIR})
-endif(BUILD_TESTING)
-distclean("${CMAKE_CURRENT_BINARY_DIR}/benchmark")
+configure_file(run.sh "${CMAKE_CURRENT_BINARY_DIR}/benchmark" COPYONLY)
+install(PROGRAMS "${CMAKE_CURRENT_BINARY_DIR}/benchmark" DESTINATION ${BIN_DIR})
+DISTCLEAN("${CMAKE_CURRENT_BINARY_DIR}/benchmark")
 
-if(BUILD_TESTING)
-  add_custom_command(
-    OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/benchmark-done
-    COMMAND "${CMAKE_COMMAND}" -E copy_if_different ${CMAKE_CURRENT_SOURCE_DIR}/run.sh $<TARGET_FILE_DIR:bark>/benchmark
-    COMMAND "${CMAKE_COMMAND}" -E touch ${CMAKE_CURRENT_BINARY_DIR}/benchmark-done
-    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/run.sh
+# TODO - with CMake 3.20, add_custom_command supports generator expressions in
+# OUTPUT, so once we can require that version we should look at retiring this
+# use of CMAKE_CFG_INTDIR
+add_custom_command(
+  OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/benchmark-${CMAKE_CFG_INTDIR}-done
+  COMMAND "${CMAKE_COMMAND}" -E copy_if_different ${CMAKE_CURRENT_SOURCE_DIR}/run.sh $<TARGET_FILE_DIR:bark>/benchmark
+  COMMAND "${CMAKE_COMMAND}" -E touch  ${CMAKE_CURRENT_BINARY_DIR}/benchmark-${CMAKE_CFG_INTDIR}-done
+  DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/run.sh
   )
-  add_custom_target(benchmark_cp ALL DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/benchmark-done)
-  set_target_properties(benchmark_cp PROPERTIES FOLDER "Benchmark")
-endif(BUILD_TESTING)
-distclean(${CMAKE_BINARY_DIR}/${BIN_DIR}/benchmark)
+add_custom_target(benchmark_cp ALL DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/benchmark-${CMAKE_CFG_INTDIR}-done)
+set_target_properties(benchmark_cp PROPERTIES FOLDER "Benchmark")
+if(CMAKE_CONFIGURATION_TYPES)
+  foreach(CFG_TYPE ${CMAKE_CONFIGURATION_TYPES})
+    string(TOUPPER "${CFG_TYPE}" CFG_TYPE_UPPER)
+    DISTCLEAN(${CMAKE_BINARY_DIR_${CFG_TYPE_UPPER}}/${BIN_DIR}/benchmark)
+  endforeach(CFG_TYPE ${CMAKE_CONFIGURATION_TYPES})
+else(CMAKE_CONFIGURATION_TYPES)
+  DISTCLEAN(${CMAKE_BINARY_DIR}/${BIN_DIR}/benchmark)
+endif(CMAKE_CONFIGURATION_TYPES)
 
-file(WRITE "${CMAKE_BINARY_DIR}/CMakeTmp/benchmsg.cmake" "message(\"---\")\n")
-file(
-  APPEND
-  "${CMAKE_BINARY_DIR}/CMakeTmp/benchmsg.cmake"
-  "message(\"Run 'make benchmark-clean' in the bench directory to delete the logic\")\n"
-)
-file(
-  APPEND
-  "${CMAKE_BINARY_DIR}/CMakeTmp/benchmsg.cmake"
-  "message(\"and image files generated during the benchmark analysis.\")\n"
-)
+file(WRITE  "${CMAKE_BINARY_DIR}/CMakeTmp/benchmsg.cmake" "message(\"---\")\n")
+file(APPEND "${CMAKE_BINARY_DIR}/CMakeTmp/benchmsg.cmake" "message(\"Run 'make benchmark-clean' in the bench directory to delete the logic\")\n")
+file(APPEND "${CMAKE_BINARY_DIR}/CMakeTmp/benchmsg.cmake" "message(\"and image files generated during the benchmark analysis.\")\n")
 
-cmakefiles(
+CMAKEFILES(
   CMakeLists.txt
-  pixcmp_test.cmake
+  lgt.sh
   run.sh
   try.sh
   viewdiff.sh
-)
+  )
 
-if(SH_EXEC AND TARGET m35.g AND BUILD_TESTING)
+if(SH_EXEC AND TARGET m35.g)
   # CTest enabled short run of the benchmark suite
-  brlcad_add_test(NAME benchmark COMMAND ${SH_EXEC} "$<TARGET_FILE_DIR:bark>/benchmark" run TIMEFRAME=1)
+  BRLCAD_ADD_TEST(NAME benchmark COMMAND ${SH_EXEC} "$<TARGET_FILE_DIR:bark>/benchmark" run TIMEFRAME=1)
   set_tests_properties(benchmark PROPERTIES LABELS "Benchmark")
-  add_custom_target(
-    benchmark-check
+  add_custom_target(benchmark-check
     COMMAND ${CMAKE_CTEST_COMMAND} -L Benchmark --output-on-failure
     DEPENDS rt pixcmp BENCHMARK_PIX_cp PIX_LOG_cp benchmark_cp
-  )
-  add_dependencies(
-    benchmark-check
-    bldg391.g
-    m35.g
-    moss.g
-    sphflake.g
-    star.g
-    world.g
-  )
+    )
+  add_dependencies(benchmark-check bldg391.g m35.g moss.g sphflake.g star.g world.g)
   set_target_properties(benchmark-check PROPERTIES FOLDER "Benchmark")
   if(TARGET check)
     add_dependencies(check benchmark-check)
   endif(TARGET check)
 
   # Full run of the benchmark suite
-  add_custom_target(
-    benchmark
+  add_custom_target(benchmark
     COMMAND ${SH_EXEC} $<TARGET_FILE_DIR:bark>/benchmark run
     COMMAND ${CMAKE_COMMAND} -P "${CMAKE_BINARY_DIR}/CMakeTmp/benchmsg.cmake"
     DEPENDS rt pixcmp BENCHMARK_PIX_cp PIX_LOG_cp benchmark_cp
-  )
-  add_dependencies(
-    benchmark
-    bldg391.g
-    m35.g
-    moss.g
-    sphflake.g
-    star.g
-    world.g
-  )
+    )
+  add_dependencies(benchmark bldg391.g m35.g moss.g sphflake.g star.g world.g)
   set_target_properties(benchmark PROPERTIES FOLDER "Benchmark")
 
   # benchmark cleanup targets
-  add_custom_target(benchmark-clean ${SH_EXEC} ${CMAKE_BINARY_DIR}/bin/benchmark clean)
+  add_custom_target(benchmark-clean
+    ${SH_EXEC} ${CMAKE_BINARY_DIR}/bin/benchmark clean
+    )
   set_target_properties(benchmark-clean PROPERTIES FOLDER "Benchmark")
-  add_custom_target(benchmark-clobber ${SH_EXEC} ${CMAKE_BINARY_DIR}/bin/benchmark clobber)
+  add_custom_target(benchmark-clobber
+    ${SH_EXEC} ${CMAKE_BINARY_DIR}/bin/benchmark clobber
+    )
   set_target_properties(benchmark-clobber PROPERTIES FOLDER "Benchmark")
-endif(SH_EXEC AND TARGET m35.g AND BUILD_TESTING)
+endif(SH_EXEC AND TARGET m35.g)
 
 # Local Variables:
 # tab-width: 8

bench/benchmark.c

@@ -1,7 +1,7 @@
 /*                     B E N C H M A R K . C
  * BRL-CAD
  *
- * Copyright (c) 2011-2026 United States Government as represented by
+ * Copyright (c) 2011-2024 United States Government as represented by
  * the U.S. Army Research Laboratory.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -67,7 +67,7 @@
 int bu_exec(const char *program, void *data, struct bu_vls *out, struct bu_vls *err) {if (!program || !out || !err || !data) return 1; return 0;}
 int bu_grep(const char *pattern, const char *input, int(*callback)(const char *line, void *data), void *data) {if (!pattern || !input || !data) return 1; if (!callback) bu_log("TODO: need default callback!!!\n"); return 0;}
 int bu_file_glob(const char *pattern, char **paths) {if (!pattern || !paths) return 1; return 0;}
-const char *format_elapsed(double elapsed) {if (elapsed > 0) return "0 1 2"; return "-0 -1 -2";}
+char *format_elapsed(double elapsed) {if (elapsed > 0) return "0 1 2"; return "-0 -1 -2";}
 int perf(const struct bu_vls *vp, const char *items, const char *args[]) {if (!vp || !items || !args) return -1; return 0;}
 double calculate_vgr(const struct bu_vls *summary) {if (!summary) return -0.0; return 0.0;}
 extern int bench(const char *cmd);
@@ -94,15 +94,13 @@ record(const char *fmt, ...)
     bu_vls_vprintf(&str, fmt, ap);
     va_end(ap);
 
-    if (!BU_STR_EMPTY(LOGFILE)) {
+    if (!BU_STR_EQUAL(LOGFILE, "")) {
 	FILE *fp = fopen(LOGFILE, "a");
-	if (fp) {
-	    fprintf(fp, "%s", bu_vls_cstr(&str));
-	    fclose(fp);
-	}
+	fprintf(fp, "%s", bu_vls_addr(&str));
+	fclose(fp);
     }
     if (bu_str_false(QUIET)) {
-	bu_log("%s", bu_vls_cstr(&str));
+	bu_log("%s", bu_vls_addr(&str));
     }
 
     bu_vls_free(&str);
@@ -239,7 +237,7 @@ set_if_unset(void (*echo)(const char *, ...), void (*verbose)(const char *, ...)
     }
 
     setval = getenv(var);
-    echo("Using [%s] for %s\n", setval ? setval : "", var);
+    echo("Using [%s] for %s\n", setval, var);
 }
 
 
@@ -286,15 +284,10 @@ main(int ac, char *av[])
     void (*verbose_echo)(const char *, ...) = sink;
     void (*echo)(const char *, ...) = record;
 
-    if (ac > 0 && av && av[0]) {
-	bu_setprogname(av[0]);
-    } else {
-	bu_setprogname("benchmark");
-    }
+    bu_setprogname(av[0]);
 
     /* process the argument list for commands */
     for (arg=1; arg<ac; arg++) {
-	char *eq;
 	if (BU_STR_EQUAL(av[arg], "clean")) {
 	    bu_setenv("CLEAN", "1", 1);
 	    continue;
@@ -312,7 +305,7 @@ main(int ac, char *av[])
 	    bu_setenv("HELP", "1", 1);
 	    continue;
 	}
-	if (bu_strncasecmp(av[arg], "instruct", 8) == 0) {
+	if (bu_strncasecmp(av[arg], "instruct", 8)) {
 	    bu_setenv("INSTRUCTIONS", "1", 1);
 	    continue;
 	}
@@ -331,12 +324,13 @@ main(int ac, char *av[])
 	    bu_setenv("RUN", "1", 1);
 	    continue;
 	}
-	eq = strchr(av[arg], '=');
-	if (eq) {
+	if (strchr(av[arg], '=')) {
+	    /* TODO: !!! make sure this still works */
 	    char *var = bu_strdup(av[arg]);
-	    char *eq_in_var = var + (eq - av[arg]);
-	    *eq_in_var = '\0';
-	    bu_setenv(var, eq_in_var + 1, 1);
+	    char *val = strtok(var, "=");
+	    if (var && val) {
+		bu_setenv(var, val, 1);
+	    }
 	    bu_free(var, "strdup av[arg]");
 	    continue;
 	}
@@ -349,7 +343,7 @@ main(int ac, char *av[])
      * handle help before main processing
      ***/
     if (bu_str_true(getenv("HELP"))) {
-	bu_log("Usage: %s [command(s)] [OPTION=value] [RT_OPTIONS]\n", bu_getprogname());
+	bu_log("Usage: %s [command(s)] [OPTION=value] [RT_OPTIONS]\n", av[0]);
 	bu_log("\n");
 	bu_log("Available commands:\n");
 	bu_log("  clean\n");
@@ -384,10 +378,7 @@ main(int ac, char *av[])
 	bu_log("BRL-CAD is a powerful cross-platform open source solid modeling system.\n");
 	bu_log("For more information about BRL-CAD, see http://brlcad.org\n");
 	bu_log("\n");
-	bu_log("Run '%s instructions' or see the manpage for additional information.\n", bu_getprogname());
-	bu_vls_free(&rtargs);
-	bu_vls_free(&vp);
-	bu_vls_free(&str);
+	bu_log("Run '%s instructions' or see the manpage for additional information.\n", av[0]);
 	bu_exit(1, NULL);
     }
 
@@ -452,9 +443,6 @@ main(int ac, char *av[])
 	bu_log("The manual page has even more information and specific usage examples.\n");
 	bu_log("Run 'brlman benchmark'.\n");
 	bu_log("\n");
-	bu_vls_free(&rtargs);
-	bu_vls_free(&vp);
-	bu_vls_free(&str);
 	bu_exit(0, NULL);
     }
 
@@ -478,7 +466,7 @@ main(int ac, char *av[])
 	    sleep(5);
 	} else {
 	    bu_log("Deleting most benchmark images and log files in %s\n", bu_getcwd(cwd, MAXPATHLEN));
-	    bu_log("Running '%s clobber' will remove run logs.\n", bu_getprogname());
+	    bu_log("Running '%s clobber' will remove run logs.\n", av[0]);
 	}
 	bu_log("\n");
 
@@ -558,9 +546,6 @@ main(int ac, char *av[])
 	} else {
 	    bu_log("\nBenchmark clean complete.\n");
 	}
-	bu_vls_free(&rtargs);
-	bu_vls_free(&vp);
-	bu_vls_free(&str);
 	bu_exit(0, NULL);
     }
 
@@ -570,19 +555,15 @@ main(int ac, char *av[])
      ***/
 
     if (bu_str_false(getenv("RUN"))) {
-	bu_vls_free(&rtargs);
-	bu_vls_free(&vp);
-	bu_vls_free(&str);
-	bu_exit(1, "Type '%s help' for usage.\n", bu_getprogname());
+	bu_exit(1, "Type '%s help' for usage.\n", av[0]);
     }
 
     /* where to write results */
     {
 	int fd;
 	const char *logfile;
-	bu_vls_trunc(&str, 0);
-	bu_vls_printf(&str, "run-%d-benchmark.log", bu_pid());
-	logfile = bu_vls_cstr(&str);
+	bu_vls_printf(&str, "run-%d-benchmark.log", bu_process_id());
+	logfile = bu_vls_addr(&str);
 	bu_setenv("LOGFILE", logfile, 1);
 	fd = open(logfile, O_WRONLY|O_CREAT, S_IRUSR | S_IWUSR);
 	if (fd < 0 || !bu_file_writable(logfile)) {
@@ -592,9 +573,6 @@ main(int ac, char *av[])
 	    /* FIXME: not valid logfile on windows, use 'nul' */
 	    bu_setenv("LOGFILE", "/dev/null", 1);
 	}
-	if (fd >= 0) {
-	    close(fd);
-	}
     }
 
     if (bu_str_true(getenv("QUIET"))) {
@@ -611,7 +589,6 @@ main(int ac, char *av[])
     {
 	struct bu_vls v = BU_VLS_INIT_ZERO;
 	char rfc2822[1024] = {0};
-	const char *logfile = getenv("LOGFILE");
 #ifdef HAVE_SYS_UTSNAME_H
 	struct utsname n;
 	time_t t = time(NULL);
@@ -626,10 +603,9 @@ main(int ac, char *av[])
 
 	echo("B R L - C A D   B E N C H M A R K\n");
 	echo("=================================\n");
-	echo("Running %s on %s\n", bu_getprogname(), rfc2822);
-	echo("Logging output to %s\n", logfile ? logfile : "disabled");
-	echo("%s\n\n", bu_vls_cstr(&v));
-	bu_vls_free(&v);
+	echo("Running %s on %s\n", av[0], rfc2822);
+	echo("Logging output to %s\n", getenv("LOGFILE"));
+	echo("%s\n\n", bu_vls_addr(&v));
     }
 
 
@@ -677,7 +653,6 @@ main(int ac, char *av[])
 	bu_setenv("PIX", bu_path_dirname(getenv("PIX")), 1);
     }
 
-    const char *pix_env = getenv("PIX");
     bu_vls_printf(&vp,
 		  "%s "
 		  "%s "
@@ -686,7 +661,7 @@ main(int ac, char *av[])
 		  "%s/../../pix "
 		  "%s/../../../pix "
 		  "./pix",
-		  pix_env ? pix_env : "", pix, thisp, thisp, thisp, thisp);
+		  getenv("PIX"), pix, thisp, thisp, thisp, thisp);
     bu_argv_from_string(argv, 32, bu_vls_addr(&vp));
     look_for(verbose_echo, directory, "a benchmark reference log directory", "LOG", (const char **)argv);
     bu_vls_trunc(&vp, 0);
@@ -836,7 +811,6 @@ main(int ac, char *av[])
 	    estimate = maxtime;
 
 	echo("Estimated time is %s\n", format_elapsed(estimate));
-	bu_vls_free(&elapsed);
     }
 
     /************************
@@ -854,7 +828,7 @@ main(int ac, char *av[])
     ret += bench("sphflake");
 
     echo("\n... Done.\n");
-    echo("Total testing time elapsed: %s\n", format_elapsed(bu_gettime() - start));
+    echo("Total testing time elapsed: %.2lfs\n", format_elapsed(bu_gettime() - start));
 
     if (ret != 0) {
 	echo("\n");
@@ -867,11 +841,8 @@ main(int ac, char *av[])
 	echo("please report your configuration information to benchmark@brlcad.org\n");
 	echo("\n");
 	echo("Output was saved to %s from %s\n", LOG, bu_dir(NULL, 0, BU_DIR_CURR, NULL));
-	echo("Run '%s clean' to remove generated pix files.\n", bu_getprogname());
+	echo("Run '%s clean' to remove generated pix files.\n", av[0]);
 	echo("Benchmark testing failed.\n");
-	bu_vls_free(&rtargs);
-	bu_vls_free(&vp);
-	bu_vls_free(&str);
 	return 2;
     }
 
@@ -894,7 +865,7 @@ main(int ac, char *av[])
 	echo("  *.pix.* ... pix image files for previous frames and raytrace tests\n");
 	echo("  summary ... performance results summary, 2 lines per run\n");
 	echo("\n");
-	echo("Run '%s clean' to remove generated pix files.\n", bu_getprogname());
+	echo("Run '%s clean' to remove generated pix files.\n", av[0]);
 	echo("\n");
 
 	echo("Summary:\n");
@@ -927,7 +898,6 @@ main(int ac, char *av[])
 		echo("\n");
 	    }
 	}
-	bu_vls_free(&performance);
     }
 
     {
@@ -966,9 +936,6 @@ main(int ac, char *av[])
     echo("Output was saved to %s from %s\n", LOG, bu_dir(NULL, 0, BU_DIR_CURR, NULL));
     echo("Benchmark testing complete.\n");
 
-    bu_vls_free(&vp);
-    bu_vls_free(&str);
-
     return 0;
 }
 

bench/clean.c

@@ -1,7 +1,7 @@
 /*                         C L E A N . C
  * BRL-CAD
  *
- * Copyright (c) 2011-2026 United States Government as represented by
+ * Copyright (c) 2011-2024 United States Government as represented by
  * the U.S. Army Research Laboratory.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -70,21 +70,18 @@ clean_obstacles(const char *base_filename, int id)
 	if (bu_file_exists(bu_vls_cstr(&vpid), NULL)) {
 	    bu_file_delete(bu_vls_cstr(&vp));
 	}
+	//bu_file_move(bu_vls_cstr(&vp), bu_vls_cstr(&vpid));
     }
 
     /* look for a log file */
-    bu_vls_trunc(&vp, 0);
-    bu_vls_trunc(&vpid, 0);
     bu_vls_printf(&vp, "%s.log", base_filename);
     if (bu_file_exists(bu_vls_cstr(&vp), NULL)) {
 	bu_vls_printf(&vpid, "%s-%d.log", base_filename, id);
 	if (bu_file_exists(bu_vls_cstr(&vpid), NULL)) {
 	    bu_file_delete(bu_vls_cstr(&vp));
 	}
+	//bu_file_move(bu_vls_cstr(&vp), bu_vls_cstr(&vpid));
     }
-
-    bu_vls_free(&vpid);
-    bu_vls_free(&vp);
 }
 
 

bench/compute.c

@@ -1,7 +1,7 @@
 /*                       C O M P U T E . C
  * BRL-CAD
  *
- * Copyright (c) 2011-2026 United States Government as represented by
+ * Copyright (c) 2011-2024 United States Government as represented by
  * the U.S. Army Research Laboratory.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -50,15 +50,14 @@ double
 average(int ac, double av[])
 {
     double total = 0.0;
-    int count = ac;
 
-    if (ac < 1 || !av)
-	return 0.0;
+    if (ac < 1)
+	return -0.0;
 
     while (ac-- > 0) {
 	total += av[ac];
     }
-    return total / (double)count;
+    return total / ac;
 }
 
 
@@ -69,8 +68,8 @@ variance(int ac, double av[])
     double err = 0.0;
     double num = ac;
 
-    if (ac < 1 || !av)
-	return 0.0;
+    if (ac < 1)
+	return -0.0;
     else if (ac == 1)
 	return 0.0;
 
@@ -82,7 +81,7 @@ variance(int ac, double av[])
     }
 
     /* return the sample variance */
-    return err / (num - 1.0);
+    return err / (num - 1);
 }
 
 

bench/lgt.sh

@@ -0,0 +1,198 @@
+#!/bin/sh
+#                          L G T . S H
+# BRL-CAD
+#
+# Copyright (c) 2004-2024 United States Government as represented by
+# the U.S. Army Research Laboratory.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1. Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following
+# disclaimer in the documentation and/or other materials provided
+# with the distribution.
+#
+# 3. The name of the author may not be used to endorse or promote
+# products derived from this software without specific prior written
+# permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
+# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+# GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+###
+# A Shell script to test LGT
+#  @(#)$Header$ (BRL)
+
+# Ensure /bin/sh
+export PATH || (echo "This isn't sh."; sh $0 $*; kill $$)
+path_to_lgt_sh=`dirname $0`
+
+expected="$path_to_lgt_sh/../src/lgt/lgt"
+if ! test -f "$expected" ; then
+    echo "Can't find LGT"
+    exit 1
+fi
+
+# force locale setting to C so things like date output as expected
+LC_ALL=C
+
+LGT="$expected"
+DB="$path_to_lgt_sh/../db"
+
+CMP="$path_to_lgt_sh/pixcmp"
+if test ! -f $CMP ; then
+    cake pixcmp
+fi
+
+# Alliant NFS hack
+if test x${MACHINE} = xfx ; then
+    cp ${LGT} /tmp/lgt
+    cp ${CMP} /tmp/pixcmp
+    LGT=/tmp/lgt
+    CMP=/tmp/pixcmp
+fi
+
+# This test of LGT assumes a "live" framebuffer here.
+if test x$FB_FILE = x ; then
+    echo "Environment variable FB_FILE must be set to a real framebuffer"
+    echo "for this test of LGT to operate correctly."
+    exit 1
+fi
+
+# Run the first set of tests
+
+${LGT} ${DB}/lgt-test.g all.g << EOF
+# read light source data base
+v ../db/lgt-test.ldb
+# read material data base
+w ../db/lgt-test.mdb
+# force display window to be 512x512 pixels, should cause 8-to-1 zoom
+T 512
+# clear frame buffer
+E
+# set maximum bounces to 20
+K 20
+# turn hidden-line drawing off
+k 0
+# configure grid: 64 rays across
+G 64 0 0 0.0
+# turn perspective off
+p 0
+# change background to mauve
+b 111 66 66
+# read key frame
+j ../db/lgt-test.key
+# display view #3
+R
+# save image in file
+H lgt3a.pix
+# change frame buffer to disk file
+o lgt3b.pix
+# save a script of previous commands, to produce the "b" version.
+S script3
+# disable reading of key frame file
+j
+# change frame buffer back to default
+o
+# configure grid: 2.45 mm cells, centered about model origin, view size 225 mm
+G 2.45 1 1 225.0
+# change background to firebrick
+b 142 35 35
+# force frame buffer size to be 455 pixels across, should cause 4-to-1 zoom
+T 455
+# set automatic perspective at 0.25
+p 0.25
+# set anti-aliasing over-sampling factor to 2
+A 2
+# set maximum bounces to 20
+K 20
+# display view #1
+R
+# save image in file
+H lgt1a.pix
+# change frame buffer to disk file
+o lgt1b.pix
+# save a script
+S script1
+# change frame buffer back to default
+o
+# turn off anti-aliasing
+A 1
+# revert to auto-sizing of frame buffer
+T 0
+# set automatic perspective at 0.25
+p 0.25
+# select hidden-line drawing, reverse video
+k 2
+# configure grid: 128 rays across, centered at model RPP, view size 225mm
+G 128 0 0 225.0
+# display view #2
+R
+# save image in file
+H lgt2a.pix
+# change frame buffer to disk file
+o lgt2b.pix
+# save a script
+S script2
+# change frame buffer back to default
+o
+# bye
+q
+EOF
+if test $? = 0 ; then
+    :
+else
+    echo "Abnormal lgt exit"
+    exit 1
+fi
+
+# Run the second set of tests.  The scripts were created above.
+./script1 < /dev/null &&
+./script2 < /dev/null &&
+./script3 < /dev/null || { echo "Script test failed."; exit 1; }
+
+FAIL=0
+for i in 1 2 3 ; do
+    if ${CMP} "$path_to_lgt_sh/../pix/lgt${i}.pix" lgt${i}a.pix ; then
+	:
+    else
+	echo "Test $i A failed."
+	FAIL=1
+    fi
+    if ${CMP} "$path_to_lgt_sh/../pix/lgt${i}.pix" lgt${i}b.pix
+	then
+	:
+    else
+	echo "Test $i B failed."
+	FAIL=1
+    fi
+done
+if test "$FAIL" -eq 0 ; then
+    echo "LGT Tested OK."
+    exit 0
+fi
+echo "*** LGT does NOT work on this platform ***"
+exit 2
+
+# Local Variables:
+# mode: sh
+# tab-width: 8
+# sh-indentation: 4
+# sh-basic-offset: 4
+# indent-tabs-mode: t
+# End:
+# ex: shiftwidth=4 tabstop=8

bench/pixcmp.c

@@ -1,7 +1,7 @@
 /*                        P I X C M P . C
  * BRL-CAD
  *
- * Copyright (c) 2004-2026 United States Government as represented by
+ * Copyright (c) 2004-2024 United States Government as represented by
  * the U.S. Army Research Laboratory.
  *
  * This program is free software; you can redistribute it and/or
@@ -36,15 +36,6 @@
 #endif
 #include "bio.h"
 
-// TODO - replace with std::filesystem::is_fifo
-#ifndef S_ISFIFO
-#  ifdef S_IFIFO
-#    define S_ISFIFO(mode) (((mode) & S_IFMT) == S_IFIFO)
-#  else
-#    define S_ISFIFO(mode) (0)
-#  endif
-#endif
-
 #include <errno.h>
 #include "bu/app.h"
 #include "bu/getopt.h"
@@ -160,38 +151,44 @@ compare_rgb(int r1, int g1, int b1, int r2, int g2, int b2, size_t *matching, si
 	&& (b1 == b2 && b1 != -1))
     {
 	result = MATCHING;
+	(*matching)++;
     } else if (r1 == -1 || r2 == -1 || g1 == -1 || g2 == -1 || b1 == -1 || b2 == -1) {
 	/* image sizes don't match (or other I/O error) */
 	result = MISSING;
-    } else {
-	/* at least this */
-	result = OFF_BY_ONE;
-
-	/* but maybe more */
+	(*missing)++;
+    } else if (((r1 != r2) && (g1 == g2) && (b1 == b2))
+	       || ((r1 == r2) && (g1 != g2) && (b1 == b2))
+	       || ((r1 == r2) && (g1 == g2) && (b1 != b2)))
+    {
+	/* off by one channel */
 	if (r1 != r2) {
 	    if ((r1 > r2 ? r1 - r2 : r2 - r1) > 1) {
 		result = OFF_BY_MANY;
+		(*offmany)++;
+	    } else {
+		result = OFF_BY_ONE;
+		(*off1)++;
 	    }
-	}
-	if (g1 != g2) {
+	} else if (g1 != g2) {
 	    if ((g1 > g2 ? g1 - g2 : g2 - g1) > 1) {
 		result = OFF_BY_MANY;
+		(*offmany)++;
+	    } else {
+		result = OFF_BY_ONE;
+		(*off1)++;
 	    }
-	}
-	if (b1 != b2) {
+	} else if (b1 != b2) {
 	    if ((b1 > b2 ? b1 - b2 : b2 - b1) > 1) {
 		result = OFF_BY_MANY;
+		(*offmany)++;
+	    } else {
+		result = OFF_BY_ONE;
+		(*off1)++;
 	    }
 	}
-    }
-    if (result == OFF_BY_ONE) {
-	(*off1)++;
-    } else if (result == OFF_BY_MANY) {
-	(*offmany)++;
-    } else if (result == MATCHING) {
-	(*matching)++;
     } else {
-	(*missing)++;
+	result = OFF_BY_MANY;
+	(*offmany)++;
     }
 
     return result;
@@ -201,7 +198,7 @@ compare_rgb(int r1, int g1, int b1, int r2, int g2, int b2, size_t *matching, si
 int
 main(int argc, char *argv[])
 {
-    const char *argv0 = (argc > 0 && argv && argv[0]) ? argv[0] : "pixcmp";
+    const char *argv0 = argv[0];
 
     FILE *f1 = NULL;
     FILE *f2 = NULL;
@@ -227,9 +224,7 @@ main(int argc, char *argv[])
     size_t f2_skip = 0;
     size_t stop_after = 0;
 
-    if (argc > 0 && argv && argv[0]) {
-	bu_setprogname(argv[0]);
-    }
+    bu_setprogname(argv[0]);
 
     /* process opts */
     while ((c = bu_getopt(argc, argv, "sdbi:n:q?")) != -1) {
@@ -322,8 +317,6 @@ main(int argc, char *argv[])
 	f2 = stdin;
     } else if ((f2 = fopen(argv[1], "rb")) == NULL) {
 	perror(argv[1]);
-	if (f1 != stdin)
-	    fclose(f1);
 	exit(FILE_ERROR);
     }
 
@@ -332,8 +325,6 @@ main(int argc, char *argv[])
     /* setmode(fileno(stdout), O_BINARY); */
 
     if (f1_skip != f2_skip && f1 == stdin && f2 == stdin) {
-	if (f1 != stdin) fclose(f1);
-	if (f2 != stdin) fclose(f2);
 	bu_exit(OPTS_ERROR, "ERROR: cannot skip the same input stream by different amounts\n");
     }
 
@@ -346,35 +337,29 @@ main(int argc, char *argv[])
 	bu_log("Warning - f2 fstat failed: %s\n", strerror(errno));
     }
 
-    /* bu_log("FILE1_size(%zu) FILE1_skip(%zu) FILE2_size(%zu) FILE2_skip(%zu)\n", (size_t)sf1.st_size, f1_skip, (size_t)sf2.st_size, f2_skip); */
+    bu_log("FILE1_size(%zu) FILE1_skip(%zu) FILE2_size(%zu) FILE2_skip(%zu)\n", (size_t)sf1.st_size, f1_skip, (size_t)sf2.st_size, f2_skip);
 
-    {
-	size_t s1_eff = (sf1.st_size > (off_t)f1_skip) ? ((size_t)sf1.st_size - f1_skip) : 0;
-	size_t s2_eff = (sf2.st_size > (off_t)f2_skip) ? ((size_t)sf2.st_size - f2_skip) : 0;
-	const char *f2_name = (argc > 1 ? argv[1] : "-");
-
-	if (!quiet && (s1_eff != s2_eff)) {
-	    bu_log("WARNING: Different image sizes detected\n");
-	    if (print_bytes) {
-		bu_log("\t%s: %7zu bytes (%8zu bytes, skipping %7zu)\n",
-		       argv[0], s1_eff, (size_t)sf1.st_size, f1_skip);
-		bu_log("\t%s: %7zu bytes (%8zu bytes, skipping %7zu)\n",
-		       f2_name, s2_eff, (size_t)sf2.st_size, f2_skip);
-	    } else {
-		bu_log("\t%s: %7zu pixels (%8zu bytes, skipping %7zu)\n",
-		       argv[0], s1_eff/3, (size_t)sf1.st_size, f1_skip);
-		bu_log("\t%s: %7zu pixels (%8zu bytes, skipping %7zu)\n",
-		       f2_name, s2_eff/3, (size_t)sf2.st_size, f2_skip);
-	    }
+    if (!quiet && ((sf1.st_size - f1_skip) != (sf2.st_size - f2_skip))) {
+	bu_log("WARNING: Different image sizes detected\n");
+	if (print_bytes) {
+	    bu_log("\t%s: %7zu bytes (%8zu bytes, skipping %7zu)\n",
+		   argv[0], (size_t)sf1.st_size - f1_skip, (size_t)sf1.st_size, f1_skip);
+	    bu_log("\t%s: %7zu bytes (%8zu bytes, skipping %7zu)\n",
+		   argv[1], (size_t)sf2.st_size - f2_skip, (size_t)sf2.st_size, f2_skip);
+	} else {
+	    bu_log("\t%s: %7zu pixels (%8zu bytes, skipping %7zu)\n",
+		   argv[0], ((size_t)sf1.st_size - f1_skip)/3, (size_t)sf1.st_size, f1_skip);
+	    bu_log("\t%s: %7zu pixels (%8zu bytes, skipping %7zu)\n",
+		   argv[1], ((size_t)sf2.st_size - f2_skip)/3, (size_t)sf2.st_size, f2_skip);
 	}
+    }
 
-	/* make sure we read all bytes */
-	if (stop_after == 0) {
-	    stop_after = FMAX(s1_eff, s2_eff);
-	    if (f1 == stdin && f2 == stdin) {
-		/* dual stdin is interleaved */
-		stop_after = (stop_after+1)/2;
-	    }
+    /* make sure we read all bytes */
+    if (stop_after == 0) {
+	stop_after = FMAX((sf1.st_size - f1_skip), (sf2.st_size - f2_skip));
+	if (f1 == stdin && f2 == stdin) {
+	    /* dual stdin is interleaved */
+	    stop_after = (stop_after+1)/2;
 	}
     }
 

bench/pixcmp_test.cmake

@@ -1,80 +0,0 @@
-# Exercise pixcmp's pixel tolerance and exit-status contract with small,
-# deliberately readable byte streams.
-
-if(NOT PIXCMP OR NOT TEST_DIR)
-  message(FATAL_ERROR "PIXCMP and TEST_DIR are required")
-endif()
-
-function(check_pixcmp name input1 input2 expected_status expected_summary)
-  set(file1 "${TEST_DIR}/pixcmp_${name}_1.pix")
-  set(file2 "${TEST_DIR}/pixcmp_${name}_2.pix")
-
-  file(WRITE "${file1}" "${input1}")
-  file(WRITE "${file2}" "${input2}")
-
-  execute_process(
-    COMMAND "${PIXCMP}" ${ARGN} "${file1}" "${file2}"
-    OUTPUT_VARIABLE output
-    ERROR_VARIABLE errors
-    RESULT_VARIABLE status
-  )
-
-  file(REMOVE "${file1}" "${file2}")
-
-  if(NOT "${status}" STREQUAL "${expected_status}")
-    message(
-      FATAL_ERROR
-      "${name}: pixcmp returned ${status}, expected ${expected_status}\nstdout: ${output}\nstderr: ${errors}"
-    )
-  endif()
-
-  string(REGEX REPLACE "[ \t\r\n]+" " " normalized_output "${output}")
-  string(STRIP "${normalized_output}" normalized_output)
-  string(FIND "${normalized_output}" "${expected_summary}" summary_position)
-  if(summary_position EQUAL -1)
-    message(
-      FATAL_ERROR
-      "${name}: expected summary '${expected_summary}'\nactual stdout: ${output}\nstderr: ${errors}"
-    )
-  endif()
-endfunction()
-
-set(exact_pixel "pixcmp pixels: 1 matching, 0 off by 1, 0 off by many")
-set(tolerated_pixel "pixcmp pixels: 0 matching, 1 off by 1, 0 off by many")
-set(rejected_pixel "pixcmp pixels: 0 matching, 0 off by 1, 1 off by many")
-
-check_pixcmp(exact "ABC" "ABC" 0 "${exact_pixel}")
-check_pixcmp(one_channel_within_tolerance "ABC" "BBC" 1 "${tolerated_pixel}")
-check_pixcmp(two_channels_within_tolerance "ABC" "BCC" 1 "${tolerated_pixel}")
-check_pixcmp(three_channels_within_tolerance "ABC" "@CB" 1 "${tolerated_pixel}")
-
-# Keep the tolerated channel first in two cases to catch short-circuiting that
-# would fail to inspect a later channel outside the tolerance.
-check_pixcmp(red_outside_tolerance "ABC" "CCD" 2 "${rejected_pixel}")
-check_pixcmp(green_outside_tolerance "ABC" "BDD" 2 "${rejected_pixel}")
-check_pixcmp(blue_outside_tolerance "ABC" "BCE" 2 "${rejected_pixel}")
-
-check_pixcmp(
-  missing_pixel
-  "ABC"
-  "ABCDEF"
-  2
-  "pixcmp pixels: 1 matching, 0 off by 1, 0 off by many, 1 missing"
-)
-
-check_pixcmp(
-  byte_within_tolerance
-  "A"
-  "B"
-  1
-  "pixcmp bytes: 0 matching, 1 off by 1, 0 off by many"
-  -b
-)
-check_pixcmp(
-  byte_outside_tolerance
-  "A"
-  "C"
-  2
-  "pixcmp bytes: 0 matching, 0 off by 1, 1 off by many"
-  -b
-)

bench/ref/CMakeLists.txt

@@ -1,29 +1,28 @@
-set(
-  BENCHMARK_PIX
+set(BENCHMARK_PIX
   bldg391.pix
   m35.pix
   moss.pix
   sphflake.pix
   star.pix
   world.pix
-)
+  )
 
-set(
-  PIX_LOG
+
+set(PIX_LOG
   bldg391.log
   m35.log
   moss.log
   sphflake.log
   star.log
   world.log
-)
+  )
 
-brlcad_adddata(BENCHMARK_PIX pix)
-brlcad_adddata(PIX_LOG pix)
+BRLCAD_ADDDATA(BENCHMARK_PIX pix)
+BRLCAD_ADDDATA(PIX_LOG pix)
 
-cmakefiles(${BENCHMARK_PIX})
-cmakefiles(${PIX_LOG})
-cmakefiles(CMakeLists.txt)
+CMAKEFILES(${BENCHMARK_PIX})
+CMAKEFILES(${PIX_LOG})
+CMAKEFILES(CMakeLists.txt)
 
 # Local Variables:
 # tab-width: 8

bench/run.c

@@ -1,7 +1,7 @@
 /*                           R U N . C
  * BRL-CAD
  *
- * Copyright (c) 2011-2026 United States Government as represented by
+ * Copyright (c) 2011-2024 United States Government as represented by
  * the U.S. Army Research Laboratory.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -64,32 +64,21 @@ int
 run(int ac, char *av[])
 {
     int retval;
-    const char *run_geomname;
-    const char *run_geometry;
-    const char *run_target;
-    long int hypersample;
-
-    if (ac < 3 || !av || !av[0] || !av[1] || !av[2])
-	return -1;
-
-    run_geomname = av[0];
-    run_geometry = av[1];
-    hypersample = strtol(av[2], NULL, 10);
+    const char *run_geomname = av[0];
+    const char *run_geometry = av[1];
+    long int hypersample = strtod(av[2], NULL);
     av += 3;
     ac -= 3;
 
-    run_target = (ac > 0 && av && av[0]) ? av[0] : "";
-
     {
 	struct bu_vls args = bu_argv_to_string(ac, (const char **)av);
-	echo("DEBUG: Running %s -B -M -s512 -H%ld -J0 %s -o %s.pix %s/%s.g %s\n",
-	     run_target, hypersample, bu_vls_cstr(&args), run_geomname, run_geomname, run_geometry);
+	echo("DEBUG: Running %s -B -M -s512 -H%ld -J0 %s -o %s.pix %s/%s.g %s\n", av[0], hypersample, args, run_geomname, run_geomname, run_geometry);
 	bu_vls_free(&args);
     }
 
     /* pipe(stdin_for_bu_exec); */
     retval = bu_exec("program", NULL, NULL, NULL);
-    echo("DEBUG: Running %s returned %d\n", run_target, retval);
+    echo("DEBUG: Running %s returned %d\n", av[0], retval);
 
     return retval;
 }

bench/run.sh

@@ -2,7 +2,7 @@
 #                          R U N . S H
 # BRL-CAD
 #
-# Copyright (c) 2004-2026 United States Government as represented by
+# Copyright (c) 2004-2024 United States Government as represented by
 # the U.S. Army Research Laboratory.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -105,13 +105,6 @@ case `echo "testing\c"; echo 1,2,3`,`echo -n testing; echo 1,2,3` in
     *)       ECHO_N= ECHO_C='\c' ECHO_T= ;;
 esac
 
-# Use a local cache
-BU_DIR_CACHE="`pwd`/cache-$$-benchmark"
-rm -rf $BU_DIR_CACHE && mkdir $BU_DIR_CACHE
-export BU_DIR_CACHE
-LIBRT_CACHE="`pwd`/rtcache-$$-benchmark"
-rm -rf $LIBRT_CACHE && mkdir $LIBRT_CACHE
-export LIBRT_CACHE
 
 #######################
 # log to tty and file #
@@ -750,9 +743,9 @@ run ( ) {
 	\"${DB}/${run_geomname}.g\" ${run_geometry} 1>&2 <<EOF
 $run_view
 EOF
-    run_retval=$?
-    $VERBOSE_ECHO "DEBUG: Running $RT returned $run_retval"
-    return $run_retval
+    retval=$?
+    $VERBOSE_ECHO "DEBUG: Running $RT returned $retval"
+    return $retval
 }
 
 
@@ -986,7 +979,6 @@ bench ( ) {
     bench_frame=0
     bench_rtfms=""
     bench_percent=100
-    bench_retval=0
     bench_start_time="`date '+%H %M %S'`"
     bench_overall_elapsed=-1
 
@@ -1010,10 +1002,7 @@ $bench_view
 start $bench_frame;
 end;
 EOF
-	    bench_raytrace_retval=$?
-	    if test $bench_raytrace_retval != 0 ; then
-		bench_retval=$bench_raytrace_retval
-	    fi
+	    retval=$?
 
 	    if test $bench_frame -ne 0 ; then
 		if test -f ${bench_testname}.pix.$bench_frame ; then
@@ -1087,7 +1076,7 @@ EOF
 	    fi
 
 	    # did we fail?
-	    if test $bench_raytrace_retval != 0 ; then
+	    if test $retval != 0 ; then
 		$ECHO "RAYTRACE ERROR"
 		break
 	    fi
@@ -1152,34 +1141,27 @@ EOF
 	ls -la *.pix*
     fi
     $VERBOSE_ECHO "DEBUG: $CMP $PIX/${bench_testname}.pix ${bench_testname}.pix"
-    cmp_result="`eval \\\"${CMP}\\\" \\\"${PIX}/${bench_testname}.pix\\\" ${bench_testname}.pix 2>&1`"
-    bench_cmp_retval=$?
+    cmp_result="`eval \\\"${CMP}\\\" \\\"${PIX}/${bench_testname}.pix\\\" ${bench_testname}.pix 2>&1 | grep pixels`"
+    ret=$?
 
-    pixels_result="`echo \\\"$cmp_result\\\" | grep pixels`"
-    if test "x$pixels_result" = "x" ; then
-	$ECHO "$cmp_result"
-    else
-	$ECHO "$pixels_result"
-    fi
+    $ECHO "$cmp_result"
 
-    if test $bench_cmp_retval = 0 ; then
+    if test $ret = 0 ; then
 	# perfect match
 	$ECHO ${bench_testname}.pix:  answers are RIGHT
-    elif test $bench_cmp_retval = 1 ; then
+    elif test $ret = 1 ; then
 	# off by one, acceptable
 	$ECHO ${bench_testname}.pix:  answers are RIGHT
-    elif test $bench_cmp_retval = 2 ; then
+    elif test $ret = 2 ; then
 	# off by many, unacceptable
 	$ECHO ${bench_testname}.pix:  WRONG WRONG WRONG WRONG WRONG WRONG
-	bench_retval=$bench_cmp_retval
     else
 	# some other failure
 	$ECHO ${bench_testname}.pix:  BENCHMARK COMPARISON FAILURE
-	bench_retval=$bench_cmp_retval
     fi
 
     $VERBOSE_ECHO "DEBUG: Done benchmark testing on $bench_testname"
-    return $bench_retval
+    return $retval
 }
 
 
@@ -1327,7 +1309,7 @@ perf ( ) {
 start="`date '+%H %M %S'`"
 $ECHO "Running the BRL-CAD Benchmark tests... please wait ..."
 $ECHO
-benchmark_retval=0
+ret=0
 
 bench moss all.g $RTARGS << EOF
 viewsize 1.572026215e+02;
@@ -1337,7 +1319,7 @@ viewrot -5.735764503e-01 8.191520572e-01 0.000000000e+00 0.000000000e+00
 	7.424039245e-01 5.198368430e-01 4.226182699e-01 0.000000000e+00
 	0.000000000e+00 0.000000000e+00 0.000000000e+00 1.000000000e+00 ;
 EOF
-benchmark_retval=`expr $benchmark_retval + $?`
+ret=`expr $ret + $?`
 
 bench world all.g $RTARGS << EOF
 viewsize 1.572026215e+02;
@@ -1347,7 +1329,7 @@ viewrot -5.735764503e-01 8.191520572e-01 0.000000000e+00 0.000000000e+00
 	7.424039245e-01 5.198368430e-01 4.226182699e-01 0.000000000e+00
 	0.000000000e+00 0.000000000e+00 0.000000000e+00 1.000000000e+00 ;
 EOF
-benchmark_retval=`expr $benchmark_retval + $?`
+ret=`expr $ret + $?`
 
 bench star all $RTARGS << EOF
 viewsize 2.500000000e+05;
@@ -1357,7 +1339,7 @@ viewrot -6.733560560e-01 6.130643360e-01 4.132114880e-01 0.000000000e+00
 	4.896120540e-01 7.885590550e-01 -3.720948210e-01 0.000000000e+00
 	0.000000000e+00 0.000000000e+00 0.000000000e+00 1.000000000e+00 ;
 EOF
-benchmark_retval=`expr $benchmark_retval + $?`
+ret=`expr $ret + $?`
 
 bench bldg391 all.g $RTARGS << EOF
 viewsize 1.800000000e+03;
@@ -1367,7 +1349,7 @@ viewrot -5.735764503e-01 8.191520572e-01 0.000000000e+00 0.000000000e+00
 	7.424039245e-01 5.198368430e-01 4.226182699e-01 0.000000000e+00
 	0.000000000e+00 0.000000000e+00 0.000000000e+00 1.000000000e+00;
 EOF
-benchmark_retval=`expr $benchmark_retval + $?`
+ret=`expr $ret + $?`
 
 bench m35 all.g $RTARGS <<EOF
 viewsize 6.787387985e+03;
@@ -1377,14 +1359,14 @@ viewrot -5.527838919e-01 8.332423558e-01 1.171090926e-02 0.000000000e+00
 	6.800964482e-01 4.429747496e-01 5.841593895e-01 0.000000000e+00
 	0.000000000e+00 0.000000000e+00 0.000000000e+00 1.000000000e+00 ;
 EOF
-benchmark_retval=`expr $benchmark_retval + $?`
+ret=`expr $ret + $?`
 
 bench sphflake scene.r $RTARGS <<EOF
 viewsize 2.556283261452611e+04;
 orientation 4.406810841785839e-01 4.005093234738861e-01 5.226451688385938e-01 6.101102288499644e-01;
 eye_pt 2.418500583758302e+04 -3.328563644344796e+03 8.489926952850350e+03;
 EOF
-benchmark_retval=`expr $benchmark_retval + $?`
+ret=`expr $ret + $?`
 
 $ECHO
 $ECHO "... Done."
@@ -1392,7 +1374,7 @@ $ECHO
 $ECHO "Total testing time elapsed: `eval \\\"$ELP\\\" $start`"
 
 # see if we fail
-if test ! "x$benchmark_retval" = "x0" ; then
+if test ! "x$ret" = "x0" ; then
     $ECHO
     $ECHO "THE BENCHMARK ANALYSIS DID NOT COMPLETE SUCCESSFULLY."
     $ECHO
@@ -1633,10 +1615,6 @@ else
 fi
 $ECHO
 
-# Cleanup
-rm -rf "$BU_DIR_CACHE"
-rm -rf "$LIBRT_CACHE"
-
 $ECHO "Output was saved to $LOGFILE from `pwd`"
 $ECHO "Benchmark testing complete."
 

bench/try.sh

@@ -2,7 +2,7 @@
 #                          T R Y . S H
 # BRL-CAD
 #
-# Copyright (c) 2004-2026 United States Government as represented by
+# Copyright (c) 2004-2024 United States Government as represented by
 # the U.S. Army Research Laboratory.
 #
 # Redistribution and use in source and binary forms, with or without

bench/viewdiff.sh

@@ -2,7 +2,7 @@
 #                    V I E W D I F F . S H
 # BRL-CAD
 #
-# Copyright (c) 2004-2026 United States Government as represented by
+# Copyright (c) 2004-2024 United States Government as represented by
 # the U.S. Army Research Laboratory.
 #
 # Redistribution and use in source and binary forms, with or without

configure

@@ -0,0 +1,173 @@
+#!/bin/sh
+#
+# This is a simple script to translate autotools style
+# configure options into CMake variables.  The resulting
+# translation is then run as a CMake configure.
+
+srcpath=$(dirname $0)
+options="$srcpath"
+while [ "$1" != "" ]
+do
+   case $1
+   in
+     --enable-all)                options="$options -DBRLCAD_BUNDLED_LIBS=BUNDLED";
+                                  shift;;
+     --disable-all)                options="$options -DBRLCAD_BUNDLED_LIBS=SYSTEM";
+                                  shift;;
+     --enable-opengl)                options="$options -DBRLCAD_ENABLE_OPENGL=ON";
+                                  shift;;
+     --disable-opengl)                options="$options -DBRLCAD_ENABLE_OPENGL=OFF";
+                                  shift;;
+     --enable-runtime-debug)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=ON";
+                                  shift;;
+     --disable-runtime-debug)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=OFF";
+                                  shift;;
+     --enable-run-time-debug)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=ON";
+                                  shift;;
+     --disable-run-time-debug)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=OFF";
+                                  shift;;
+     --enable-runtime-debugging)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=ON";
+                                  shift;;
+     --disable-runtime-debugging)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=OFF";
+                                  shift;;
+     --enable-run-time-debugging)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=ON";
+                                  shift;;
+     --disable-run-time-debugging)                options="$options -DBRLCAD_ENABLE_RUNTIME_DEBUG=OFF";
+                                  shift;;
+     --enable-debug)                options="$options -DBRLCAD_DEBUGGING=ON";
+                                  shift;;
+     --disable-debug)                options="$options -DBRLCAD_DEBUGGING=OFF";
+                                  shift;;
+     --enable-flags-debug)                options="$options -DBRLCAD_DEBUGGING=ON";
+                                  shift;;
+     --disable-flags-debug)                options="$options -DBRLCAD_DEBUGGING=OFF";
+                                  shift;;
+     --enable-debug-flags)                options="$options -DBRLCAD_DEBUGGING=ON";
+                                  shift;;
+     --disable-debug-flags)                options="$options -DBRLCAD_DEBUGGING=OFF";
+                                  shift;;
+     --brlcad-flags-debug)                options="$options -DBRLCAD_DEBUGGING=ON";
+                                  shift;;
+     --brlcad-flags-debug)                options="$options -DBRLCAD_DEBUGGING=OFF";
+                                  shift;;
+     --enable-warnings)                options="$options -DBRLCAD_WARNINGS=ON";
+                                  shift;;
+     --disable-warnings)                options="$options -DBRLCAD_WARNINGS=OFF";
+                                  shift;;
+     --enable-compiler-warnings)                options="$options -DBRLCAD_WARNINGS=ON";
+                                  shift;;
+     --disable-compiler-warnings)                options="$options -DBRLCAD_WARNINGS=OFF";
+                                  shift;;
+     --brlcad-enable-compiler-warnings)                options="$options -DBRLCAD_WARNINGS=ON";
+                                  shift;;
+     --brlcad-disable-compiler-warnings)                options="$options -DBRLCAD_WARNINGS=OFF";
+                                  shift;;
+     --enable-strict)                options="$options -DBRLCAD_ENABLE_STRICT=ON";
+                                  shift;;
+     --disable-strict)                options="$options -DBRLCAD_ENABLE_STRICT=OFF";
+                                  shift;;
+     --enable-strict-compile)                options="$options -DBRLCAD_ENABLE_STRICT=ON";
+                                  shift;;
+     --disable-strict-compile)                options="$options -DBRLCAD_ENABLE_STRICT=OFF";
+                                  shift;;
+     --enable-strict-compile-flags)                options="$options -DBRLCAD_ENABLE_STRICT=ON";
+                                  shift;;
+     --disable-strict-compile-flags)                options="$options -DBRLCAD_ENABLE_STRICT=OFF";
+                                  shift;;
+     --enable-all-cxx)                options="$options -DENABLE_ALL_CXX_COMPILE=ON";
+                                  shift;;
+     --disable-all-cxx)                options="$options -DENABLE_ALL_CXX_COMPILE=OFF";
+                                  shift;;
+     --enable-docs)                options="$options -DBRLCAD_EXTRADOCS=ON";
+                                  shift;;
+     --disable-docs)                options="$options -DBRLCAD_EXTRADOCS=OFF";
+                                  shift;;
+     --enable-extra-docs)                options="$options -DBRLCAD_EXTRADOCS=ON";
+                                  shift;;
+     --disable-extra-docs)                options="$options -DBRLCAD_EXTRADOCS=OFF";
+                                  shift;;
+     --enable-docbook)                options="$options -DBRLCAD_EXTRADOCS=ON";
+                                  shift;;
+     --disable-docbook)                options="$options -DBRLCAD_EXTRADOCS=OFF";
+                                  shift;;
+     --enable-astyle)                options="$options -DBRLCAD_ASTYLE=BUNDLED";
+                                  shift;;
+     --disable-astyle)                options="$options -DBRLCAD_ASTYLE=SYSTEM";
+                                  shift;;
+     --enable-xsltproc)                options="$options -DBRLCAD_XSLTPROC=BUNDLED";
+                                  shift;;
+     --disable-xsltproc)                options="$options -DBRLCAD_XSLTPROC=SYSTEM";
+                                  shift;;
+     --enable-xmllint)                options="$options -DBRLCAD_XMLLINT=BUNDLED";
+                                  shift;;
+     --disable-xmllint)                options="$options -DBRLCAD_XMLLINT=SYSTEM";
+                                  shift;;
+     --enable-zlib)                options="$options -DBRLCAD_ZLIB=BUNDLED";
+                                  shift;;
+     --disable-zlib)                options="$options -DBRLCAD_ZLIB=SYSTEM";
+                                  shift;;
+     --enable-libz)                options="$options -DBRLCAD_ZLIB=BUNDLED";
+                                  shift;;
+     --disable-libz)                options="$options -DBRLCAD_ZLIB=SYSTEM";
+                                  shift;;
+     --enable-regex)                options="$options -DBRLCAD_REGEX=BUNDLED";
+                                  shift;;
+     --disable-regex)                options="$options -DBRLCAD_REGEX=SYSTEM";
+                                  shift;;
+     --enable-netpbm)                options="$options -DBRLCAD_NETPBM=BUNDLED";
+                                  shift;;
+     --disable-netpbm)                options="$options -DBRLCAD_NETPBM=SYSTEM";
+                                  shift;;
+     --enable-png)                options="$options -DBRLCAD_PNG=BUNDLED";
+                                  shift;;
+     --disable-png)                options="$options -DBRLCAD_PNG=SYSTEM";
+                                  shift;;
+     --enable-scl)                options="$options -DBRLCAD_SC=BUNDLED";
+                                  shift;;
+     --disable-scl)                options="$options -DBRLCAD_SC=SYSTEM";
+                                  shift;;
+     --enable-step)                options="$options -DBRLCAD_SC=BUNDLED";
+                                  shift;;
+     --disable-step)                options="$options -DBRLCAD_SC=SYSTEM";
+                                  shift;;
+     --enable-step-class-libraries)                options="$options -DBRLCAD_SC=BUNDLED";
+                                  shift;;
+     --disable-step-class-libraries)                options="$options -DBRLCAD_SC=SYSTEM";
+                                  shift;;
+     --enable-sqlite3)                options="$options -DBRLCAD_SQLITE3=BUNDLED";
+                                  shift;;
+     --disable-sqlite3)                options="$options -DBRLCAD_SQLITE3=SYSTEM";
+                                  shift;;
+     --enable-sqlite3)                options="$options -DBRLCAD_SQLITE3=BUNDLED";
+                                  shift;;
+     --disable-sqlite3)                options="$options -DBRLCAD_SQLITE3=SYSTEM";
+                                  shift;;
+     --enable-proj)                options="$options -DBRLCAD_PROJ=BUNDLED";
+                                  shift;;
+     --disable-proj)                options="$options -DBRLCAD_PROJ=SYSTEM";
+                                  shift;;
+     --enable-gdal)                options="$options -DBRLCAD_GDAL=BUNDLED";
+                                  shift;;
+     --disable-gdal)                options="$options -DBRLCAD_GDAL=SYSTEM";
+                                  shift;;
+     --enable-assetimport)                options="$options -DBRLCAD_ASSETIMPORT=BUNDLED";
+                                  shift;;
+     --disable-assetimport)                options="$options -DBRLCAD_ASSETIMPORT=SYSTEM";
+                                  shift;;
+     --enable-openmesh)                options="$options -DBRLCAD_OPENMESH=BUNDLED";
+                                  shift;;
+     --disable-openmesh)                options="$options -DBRLCAD_OPENMESH=SYSTEM";
+                                  shift;;
+     --enable-tcl)                options="$options -DBRLCAD_TCL=BUNDLED";
+                                  shift;;
+     --disable-tcl)                options="$options -DBRLCAD_TCL=SYSTEM";
+                                  shift;;
+     --prefix=*)   	          inputstr=$1;
+				  options="$options -DCMAKE_INSTALL_PREFIX=${inputstr#--prefix=}";
+				  shift;;
+     *) 	   	          echo "Warning: unknown option $1";
+				  shift;;
+   esac
+done
+echo cmake $options
+cmake $options

db/CMakeLists.txt

@@ -1,18 +1,28 @@
-function(G_TARGET in_model folder)
+# There is quite a bit of shared logic for the various converters when it comes
+# to building .g outputs, so we use a single function to manage the process and
+# handle format-specific bits internally.  TODO - we probably need to add
+# optional argument support here later to support (say) specifying a specific
+# COMGEOM or STEP format version...
+
+function(ADD_G_TARGET in_model folder)
+
   # Initialize
   set(MODEL_TYPE "UNKNOWN")
-  set(CONV_SUCCESS_CODES 0)
 
-  # Regardless of what we decide, let CMake know about the file
-  cmakefiles(${CMAKE_CURRENT_SOURCE_DIR}/${in_model})
+  # Get our root path
+  if(CMAKE_CONFIGURATION_TYPES)
+    set(bin_root "${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}")
+  else(CMAKE_CONFIGURATION_TYPES)
+    set(bin_root "${CMAKE_BINARY_DIR}")
+  endif(CMAKE_CONFIGURATION_TYPES)
 
   # Find our conversion type
   set(model_types "3dm;asc;comgeom;fg4;stp")
   foreach(mt ${model_types})
     if("${MODEL_TYPE}" STREQUAL "UNKNOWN")
       if("${in_model}" MATCHES ".${mt}$")
-        set(MODEL_TYPE "${mt}")
-        string(REGEX REPLACE "([0-9a-z]*).${mt}" "\\1" in_model_root "${in_model}")
+	set(MODEL_TYPE "${mt}")
+	string(REGEX REPLACE "([0-9a-z]*).${mt}" "\\1" in_model_root "${in_model}")
       endif("${in_model}" MATCHES ".${mt}$")
     endif("${MODEL_TYPE}" STREQUAL "UNKNOWN")
   endforeach(mt ${model_types})
@@ -20,169 +30,110 @@ function(G_TARGET in_model folder)
     message(FATAL_ERROR "Unable to identify input model type for file ${in_model}")
   endif("${MODEL_TYPE}" STREQUAL "UNKNOWN")
 
-  # Make sure variables are set up for configure_file
-  set(in_model_root "${in_model_root}")
-
   # Find our output file and path
   string(REPLACE "${CMAKE_SOURCE_DIR}/" "" rel_dir "${CMAKE_CURRENT_SOURCE_DIR}")
   set(output_file ${DATA_DIR}/${rel_dir}/${in_model_root}.g)
-  set(CONV_OUTPUT_PATH "${CMAKE_BINARY_DIR}/${output_file}")
   set(log_file ${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.log)
 
-  # Make sure the output db target directory is there
-  file(MAKE_DIRECTORY "${CMAKE_BINARY_DIR}/${DATA_DIR}/${rel_dir}")
+  # Make sure the output db target directories are there
+  if(CMAKE_CONFIGURATION_TYPES)
+    foreach(CFG_TYPE ${CMAKE_CONFIGURATION_TYPES})
+      file(MAKE_DIRECTORY "${CMAKE_BINARY_DIR}/${CFG_TYPE}/${DATA_DIR}/${rel_dir}")
+    endforeach(CFG_TYPE ${CMAKE_CONFIGURATION_TYPES})
+  else(CMAKE_CONFIGURATION_TYPES)
+    file(MAKE_DIRECTORY "${CMAKE_BINARY_DIR}/${DATA_DIR}/${rel_dir}")
+  endif(CMAKE_CONFIGURATION_TYPES)
 
-  # Rhino 3DM file
+  #############################################################################
+  #                            Build logic
+  #############################################################################
+
+  # The 3DM conversion is rather different than the general pattern at the
+  # moment (However, the 3dm approach is probably the "wave of the future" in
+  # the sense that it uses libgcv...)
   if(${MODEL_TYPE} STREQUAL "3dm")
-    if(NOT TARGET 3dm-g)
-      return()
-    endif(NOT TARGET 3dm-g)
-    set(CONV_ARGS "-o \"${CMAKE_BINARY_DIR}/${output_file}\" \"${CMAKE_CURRENT_SOURCE_DIR}/${in_model}\"")
-    configure_file("${CMAKE_SOURCE_DIR}/db/to_g.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake" @ONLY)
-    distclean("${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake")
-    # Custom command to generate the output
+
+    set(INPUT_FILE "${CMAKE_CURRENT_SOURCE_DIR}/${in_model}")
+    set(OUTPUT_FILE "${output_file}")
+    # Use the model name for the script, since the output file is specific to this input
+    configure_file("${CMAKE_SOURCE_DIR}/db/conv_run.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake" @ONLY)
+    DISTCLEAN("${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake")
+
+    # Define the target
     add_custom_command(
-      OUTPUT ${CMAKE_BINARY_DIR}/${output_file}
-      COMMAND ${CMAKE_COMMAND} -E remove "${CMAKE_BINARY_DIR}/${output_file}"
+      OUTPUT ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+      COMMAND ${CMAKE_COMMAND} -E remove "${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}"
       COMMAND ${CMAKE_COMMAND} -DEXEC=$<TARGET_FILE:3dm-g> -P "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake"
       DEPENDS 3dm-g ${CMAKE_CURRENT_SOURCE_DIR}/${in_model}
-    )
+      )
+
   endif(${MODEL_TYPE} STREQUAL "3dm")
 
-  # BRL-CAD ASCII database
+  # The rest of the conversions follow the simpler/older pattern:
+
   if(${MODEL_TYPE} STREQUAL "asc")
-    set(CONV_ARGS "\"${CMAKE_CURRENT_SOURCE_DIR}/${in_model}\" \"${CMAKE_BINARY_DIR}/${output_file}\"")
-    configure_file("${CMAKE_SOURCE_DIR}/db/to_g.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake" @ONLY)
-    distclean("${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake")
-    if(BRLCAD_ENABLE_TCL)
-      if(NOT TARGET asc2g)
-        return()
-      endif(NOT TARGET asc2g)
-      # Custom command to generate the output
+    if (BRLCAD_ENABLE_TCL)
       add_custom_command(
-        OUTPUT ${CMAKE_BINARY_DIR}/${output_file}
-        COMMAND ${CMAKE_COMMAND} -E remove ${CMAKE_BINARY_DIR}/${output_file}
-        COMMAND ${CMAKE_COMMAND} -DEXEC=$<TARGET_FILE:asc2g> -P "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake"
-        DEPENDS asc2g "${CMAKE_CURRENT_SOURCE_DIR}/${in_model}"
-      )
-    else(BRLCAD_ENABLE_TCL)
-      if(NOT TARGET gcv)
-        return()
-      endif(NOT TARGET gcv)
-      # Custom command to generate the output
+	OUTPUT ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+	COMMAND asc2g "${CMAKE_CURRENT_SOURCE_DIR}/${in_model}" ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+	DEPENDS asc2g "${CMAKE_CURRENT_SOURCE_DIR}/${in_model}"
+	)
+    else (BRLCAD_ENABLE_TCL)
       add_custom_command(
-        OUTPUT ${CMAKE_BINARY_DIR}/${output_file}
-        COMMAND ${CMAKE_COMMAND} -E remove ${CMAKE_BINARY_DIR}/${output_file}
-        COMMAND ${CMAKE_COMMAND} -DEXEC=$<TARGET_FILE:gcv> -P "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake"
-        DEPENDS gcv "${CMAKE_CURRENT_SOURCE_DIR}/${in_model}"
-      )
-    endif(BRLCAD_ENABLE_TCL)
+	OUTPUT ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+	COMMAND ${CMAKE_COMMAND} -E remove ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+	COMMAND gcv "${CMAKE_CURRENT_SOURCE_DIR}/${in_model}" ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+	DEPENDS gcv "${CMAKE_CURRENT_SOURCE_DIR}/${in_model}"
+	)
+    endif (BRLCAD_ENABLE_TCL)
   endif(${MODEL_TYPE} STREQUAL "asc")
 
-  # COMGEOM (pre BRL-CAD Geometry Information For Targets (GIFT) files)
   if(${MODEL_TYPE} STREQUAL "comgeom")
-    if(NOT TARGET comgeom-g)
-      return()
-    endif(NOT TARGET comgeom-g)
-    set(CONV_ARGS "-v 5 \"${CMAKE_CURRENT_SOURCE_DIR}/${in_model}\" \"${CMAKE_BINARY_DIR}/${output_file}\"")
-    configure_file("${CMAKE_SOURCE_DIR}/db/to_g.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake" @ONLY)
-    distclean("${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake")
-    # Custom command to generate the output
     add_custom_command(
-      OUTPUT ${CMAKE_BINARY_DIR}/${output_file}
-      COMMAND ${CMAKE_COMMAND} -E remove "${CMAKE_BINARY_DIR}/${output_file}"
-      COMMAND ${CMAKE_COMMAND} -DEXEC=$<TARGET_FILE:comgeom-g> -P "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake"
+      OUTPUT ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+      COMMAND ${CMAKE_COMMAND} -E remove ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+      COMMAND comgeom-g -v 5 ${CMAKE_CURRENT_SOURCE_DIR}/${in_model} ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file} > ${log_file} 2>&1
       DEPENDS comgeom-g ${CMAKE_CURRENT_SOURCE_DIR}/${in_model}
-    )
+      )
   endif(${MODEL_TYPE} STREQUAL "comgeom")
 
-  # FASTGEN 4
   if(${MODEL_TYPE} STREQUAL "fg4")
-    if(NOT TARGET fast4-g)
-      return()
-    endif(NOT TARGET fast4-g)
-    set(CONV_ARGS "\"${CMAKE_CURRENT_SOURCE_DIR}/${in_model}\" \"${CMAKE_BINARY_DIR}/${output_file}\"")
-    configure_file("${CMAKE_SOURCE_DIR}/db/to_g.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake" @ONLY)
-    distclean("${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake")
     add_custom_command(
-      OUTPUT ${CMAKE_BINARY_DIR}/${output_file}
-      COMMAND ${CMAKE_COMMAND} -E remove "${CMAKE_BINARY_DIR}/${output_file}"
-      COMMAND ${CMAKE_COMMAND} -DEXEC=$<TARGET_FILE:fast4-g> -P "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake"
+      OUTPUT ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+      COMMAND fast4-g ${CMAKE_CURRENT_SOURCE_DIR}/${in_model} ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file} > ${log_file} 2>&1
       DEPENDS fast4-g ${CMAKE_CURRENT_SOURCE_DIR}/${in_model}
-    )
+      )
   endif(${MODEL_TYPE} STREQUAL "fg4")
 
-  # STEP AP203
   if(${MODEL_TYPE} STREQUAL "stp")
-    if(NOT TARGET step-g)
-      return()
-    endif(NOT TARGET step-g)
-    set(CONV_ARGS "-O \"${CMAKE_BINARY_DIR}/${output_file}\" \"${CMAKE_CURRENT_SOURCE_DIR}/${in_model}\"")
-    # step-g uses status 1 for useful, deliberately published partial output.
-    # Installed sample databases should retain that geometry; statuses 2 and
-    # above, or a missing output file, remain build failures.
-    set(CONV_SUCCESS_CODES "0;1")
-    configure_file("${CMAKE_SOURCE_DIR}/db/to_g.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake" @ONLY)
-    distclean("${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake")
-    # Custom command to generate the output
-    add_custom_command(
-      OUTPUT ${CMAKE_BINARY_DIR}/${output_file}
-      COMMAND ${CMAKE_COMMAND} -E remove "${CMAKE_BINARY_DIR}/${output_file}"
-      COMMAND ${CMAKE_COMMAND} -DEXEC=$<TARGET_FILE:step-g> -P "${CMAKE_CURRENT_BINARY_DIR}/${in_model_root}.cmake"
-      DEPENDS step-g ${CMAKE_CURRENT_SOURCE_DIR}/${in_model}
-    )
+    if (BRLCAD_ENABLE_STEP)
+      add_custom_command(
+	OUTPUT ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file}
+	COMMAND step-g -O ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file} ${CMAKE_CURRENT_SOURCE_DIR}/${in_model} > ${log_file} 2>&1
+	DEPENDS step-g ${CMAKE_CURRENT_SOURCE_DIR}/${in_model}
+	)
+    else (BRLCAD_ENABLE_STEP)
+      CMAKEFILES(${CMAKE_CURRENT_SOURCE_DIR}/${in_model})
+    endif (BRLCAD_ENABLE_STEP)
   endif(${MODEL_TYPE} STREQUAL "stp")
 
-  # If we got this far, do the target, install and clean-up rules
-  add_custom_target(${in_model_root}.g ALL DEPENDS ${CMAKE_BINARY_DIR}/${output_file})
-  set_target_properties(${in_model_root}.g PROPERTIES FOLDER "${folder}")
+  if(NOT ${MODEL_TYPE} STREQUAL "stp" OR BRLCAD_ENABLE_STEP)
+    add_custom_target(${in_model_root}.g ALL DEPENDS ${CMAKE_CURRENT_BUILD_DIR_SCRIPT}/${output_file})
+    set_target_properties(${in_model_root}.g PROPERTIES FOLDER "${folder}")
 
-  if(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
-    install(FILES ${CMAKE_BINARY_DIR}/${output_file} DESTINATION ${DATA_DIR}/${rel_dir})
-  endif(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
+    # Install logic
+    if(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
+      install(FILES ${CMAKE_CURRENT_BUILD_DIR_INSTALL}/${output_file} DESTINATION ${DATA_DIR}/${rel_dir})
+    endif(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
 
-  set_property(DIRECTORY APPEND PROPERTY ADDITIONAL_MAKE_CLEAN_FILES "${log_file}")
-  distclean("${log_file}")
-endfunction(G_TARGET in_model folder)
+    # Clean-up
+    set_property(DIRECTORY APPEND PROPERTY ADDITIONAL_MAKE_CLEAN_FILES "${log_file}")
+    DISTCLEAN("${log_file}")
+  endif(NOT ${MODEL_TYPE} STREQUAL "stp" OR BRLCAD_ENABLE_STEP)
 
-function(PIX_TARGET in_image folder)
-  if(NOT TARGET png-pix)
-    return()
-  endif(NOT TARGET png-pix)
+endfunction(ADD_G_TARGET in_model folder)
 
-  cmakefiles(${CMAKE_CURRENT_SOURCE_DIR}/${in_image})
-  get_filename_component(in_image_root "${in_image}" NAME_WE)
-  string(REPLACE "${CMAKE_SOURCE_DIR}/" "" rel_dir "${CMAKE_CURRENT_SOURCE_DIR}")
-  set(output_file ${DATA_DIR}/${rel_dir}/${in_image_root}.pix)
-  set(output_path "${CMAKE_BINARY_DIR}/${output_file}")
-  set(conversion_file "${CMAKE_CURRENT_BINARY_DIR}/${in_image_root}_pix.cmake")
-
-  set(PIX_INPUT "${CMAKE_CURRENT_SOURCE_DIR}/${in_image}")
-  set(PIX_OUTPUT "${output_path}")
-  set(PIX_LABEL "${in_image_root}.pix")
-
-  file(MAKE_DIRECTORY "${CMAKE_BINARY_DIR}/${DATA_DIR}/${rel_dir}")
-  configure_file("${CMAKE_SOURCE_DIR}/db/to_pix.cmake.in" "${conversion_file}" @ONLY)
-  distclean("${conversion_file}")
-
-  add_custom_command(
-    OUTPUT ${output_path}
-    COMMAND ${CMAKE_COMMAND} -E remove "${output_path}"
-    COMMAND ${CMAKE_COMMAND} -DEXEC=$<TARGET_FILE:png-pix> -P "${conversion_file}"
-    DEPENDS png-pix "${PIX_INPUT}"
-  )
-  add_custom_target(${in_image_root}.pix ALL DEPENDS ${output_path})
-  set_target_properties(${in_image_root}.pix PROPERTIES FOLDER "${folder}")
-
-  if(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
-    install(FILES ${output_path} DESTINATION ${DATA_DIR}/${rel_dir})
-  endif(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
-
-  distclean("${output_path}")
-endfunction(PIX_TARGET in_image folder)
-
-set(
-  G_BENCHMARK_MODELS
+set(G_BENCHMARK_MODELS
   bldg391.asc
   m35.asc
   moss.asc
@@ -191,14 +142,11 @@ set(
   world.asc
 )
 
-set(
-  G_SAMPLE_MODELS
+set(G_SAMPLE_MODELS
   aet.asc
-  arb8_showcase.asc
   annual_gift_man.asc
   axis.asc
   bearing.asc
-  bicycle_wheel.asc
   boolean-ops.asc
   castle.asc
   cornell.asc
@@ -208,8 +156,6 @@ set(
   cube.asc
   demo.asc
   die.asc
-  earth.asc
-  gaia.asc
   galileo.asc
   goliath.asc
   havoc.asc
@@ -217,10 +163,8 @@ set(
   ktank.asc
   lgt-test.asc
   operators.asc
-  photo_holder.asc
   pic.asc
   pinewood.asc
-  primitives.asc
   prim.asc
   radialgrid.asc
   rounds.asc
@@ -239,115 +183,83 @@ add_subdirectory(comgeom)
 add_subdirectory(nist)
 add_subdirectory(faa)
 
-pix_target(earth.png "BRL-CAD Geometry Models/Sample")
-
-if(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
-  brlcad_adddata(earth.png db)
-endif(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
-
 foreach(g_input ${G_BENCHMARK_MODELS})
-  g_target(${g_input} "BRL-CAD Geometry Models/Benchmark")
+  ADD_G_TARGET(${g_input} "BRL-CAD Geometry Models/Benchmark")
 endforeach(g_input ${G_BENCHMARK_MODELS})
 
 foreach(g_input ${G_SAMPLE_MODELS})
-  g_target(${g_input} "BRL-CAD Geometry Models/Sample")
+  ADD_G_TARGET(${g_input} "BRL-CAD Geometry Models/Sample")
 endforeach(g_input ${G_SAMPLE_MODELS})
 
-if(BRLCAD_INSTALL_EXAMPLE_GEOMETRY AND TARGET gcv)
-  brlcad_adddata(1647260.dsp db)
-  brlcad_adddata(ebm_logo.bw db)
-  brlcad_adddata(terra.bin db)
-  brlcad_adddata(vol_data.bw db)
-endif(BRLCAD_INSTALL_EXAMPLE_GEOMETRY AND TARGET gcv)
+if(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
+   BRLCAD_ADDDATA(terra.bin db)
+endif(BRLCAD_INSTALL_EXAMPLE_GEOMETRY)
 
 if(SH_EXEC)
-  if(TARGET mged OR TARGET gcv)
-    set(conversion_g_files)
-    set(conversion_g_files_fp)
-    set(conversion_deps_list)
+  set(conversion_g_files)
+  set(conversion_g_files_fp)
+  set(conversion_deps_list)
 
-    macro(Sh_Conversion_Test gfile depends_list)
-      if(TARGET mged)
-        add_custom_target(
-          convert-${gfile}
-          COMMAND
-            ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:mged>
-            ${CMAKE_BINARY_DIR}/${DATA_DIR}/db/${gfile}
-        )
-      else()
-        add_custom_target(
-          convert-${gfile}
-          COMMAND
-            ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:gcv>
-            ${CMAKE_BINARY_DIR}/${DATA_DIR}/db/${gfile}
-        )
-      endif(TARGET mged)
-      set_target_properties(convert-${gfile} PROPERTIES EXCLUDE_FROM_DEFAULT_BUILD 1)
-      set_target_properties(convert-${gfile} PROPERTIES FOLDER "BRL-CAD Conversion Tests")
-      set(conversion_g_files ${conversion_g_files} ${gfile})
-      if(NOT "${depends_list}" STREQUAL "")
-        add_dependencies(convert-${gfile} ${depends_list})
-        set(conversion_deps_list ${conversion_deps_list} ${depends_list})
-      endif(NOT "${depends_list}" STREQUAL "")
-    endmacro(Sh_Conversion_Test)
+  macro(Sh_Conversion_Test gfile depends_list)
+    if (TARGET mged)
+      add_custom_target(convert-${gfile} COMMAND ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:mged> ${CMAKE_BINARY_DIR}/${DATA_DIR}/db/${gfile})
+    else ()
+      add_custom_target(convert-${gfile} COMMAND ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:gcv> ${CMAKE_BINARY_DIR}/${DATA_DIR}/db/${gfile})
+    endif (TARGET mged)
+    set_target_properties(convert-${gfile} PROPERTIES EXCLUDE_FROM_DEFAULT_BUILD 1)
+    set_target_properties(convert-${gfile} PROPERTIES FOLDER "BRL-CAD Conversion Tests")
+    set(conversion_g_files ${conversion_g_files} ${gfile})
+    if(NOT "${depends_list}" STREQUAL "")
+      add_dependencies(convert-${gfile} ${depends_list})
+      set(conversion_deps_list ${conversion_deps_list} ${depends_list})
+    endif(NOT "${depends_list}" STREQUAL "")
+  endmacro(Sh_Conversion_Test)
 
-    foreach(g_input ${G_BENCHMARK_MODELS})
-      get_filename_component(GROOT "${g_input}" NAME_WE)
-      if(TARGET mged)
-        sh_conversion_test(${GROOT}.g "mged")
-      else()
-        sh_conversion_test(${GROOT}.g "gcv")
-      endif(TARGET mged)
-    endforeach(g_input ${G_BENCHMARK_MODELS})
-    foreach(g_input ${G_SAMPLE_MODELS})
-      get_filename_component(GROOT "${g_input}" NAME_WE)
-      if(TARGET mged)
-        sh_conversion_test(${GROOT}.g "mged")
-      else()
-        sh_conversion_test(${GROOT}.g "gcv")
-      endif(TARGET mged)
-    endforeach(g_input ${G_SAMPLE_MODELS})
+  foreach(g_input ${G_BENCHMARK_MODELS})
+    get_filename_component(GROOT "${g_input}" NAME_WE)
+    if (TARGET mged)
+      Sh_Conversion_Test(${GROOT}.g "mged")
+    else ()
+      Sh_Conversion_Test(${GROOT}.g "gcv")
+    endif (TARGET mged)
+  endforeach(g_input ${G_BENCHMARK_MODELS})
+  foreach(g_input ${G_SAMPLE_MODELS})
+    get_filename_component(GROOT "${g_input}" NAME_WE)
+    if (TARGET mged)
+      Sh_Conversion_Test(${GROOT}.g "mged")
+    else ()
+      Sh_Conversion_Test(${GROOT}.g "gcv")
+    endif (TARGET mged)
+  endforeach(g_input ${G_SAMPLE_MODELS})
 
-    list(REMOVE_DUPLICATES conversion_deps_list)
-    foreach(gfile ${conversion_g_files})
-      set(conversion_g_files_fp ${conversion_g_files_fp} "${CMAKE_BINARY_DIR}/${DATA_DIR}/db/${gfile}")
-    endforeach(gfile ${conversion_g_files})
-    if(TARGET mged)
-      add_custom_target(
-        convert
-        COMMAND ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:mged> ${conversion_g_files_fp}
-      )
-    else()
-      add_custom_target(
-        convert
-        COMMAND ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:gcv> ${conversion_g_files_fp}
-      )
-    endif(TARGET mged)
-    set_target_properties(convert PROPERTIES EXCLUDE_FROM_DEFAULT_BUILD 1)
-    set_target_properties(convert PROPERTIES FOLDER "BRL-CAD Conversion Tests")
-    add_dependencies(convert ${conversion_deps_list})
-  endif(TARGET mged OR TARGET gcv)
+  list(REMOVE_DUPLICATES conversion_deps_list)
+  foreach(gfile ${conversion_g_files})
+    set(conversion_g_files_fp ${conversion_g_files_fp} "${CMAKE_BINARY_DIR}/${DATA_DIR}/db/${gfile}")
+  endforeach(gfile ${conversion_g_files})
+  if (TARGET mged)
+    add_custom_target(convert COMMAND ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:mged> ${conversion_g_files_fp})
+  else ()
+    add_custom_target(convert COMMAND ${SH_EXEC} ${CMAKE_SOURCE_DIR}/sh/conversion.sh GED=$<TARGET_FILE:gcv> ${conversion_g_files_fp})
+  endif (TARGET mged)
+  set_target_properties(convert PROPERTIES EXCLUDE_FROM_DEFAULT_BUILD 1)
+  set_target_properties(convert PROPERTIES FOLDER "BRL-CAD Conversion Tests")
+  add_dependencies(convert ${conversion_deps_list})
 endif(SH_EXEC)
 
-cmakefiles(
+CMAKEFILES(
   ${G_BENCHMARK_MODELS}
   ${G_SAMPLE_MODELS}
-  1647260.dsp
   CMakeLists.txt
   aet.rt
+  conv_run.cmake.in
   cornell.rt
   cube.rt
+  traffic_light.rt
   db.php
-  ebm_logo.bw
-  earth.png
   include/ctype.inc
   include/debug.inc
   terra.bin
-  to_g.cmake.in
-  to_pix.cmake.in
-  traffic_light.rt
-  vol_data.bw
-)
+  )
 
 # Local Variables:
 # tab-width: 8

db/arb8_showcase.asc

@@ -1,205 +0,0 @@
-title {ARB8 Unit Test Showcase}
-units mm
-attr set {_GLOBAL}
-
-put {SpanningUnitCube} arb8 V1 {-1 -1 -1}  V2 {1 -1 -1}  V3 {1 1 -1}  V4 {-1 1 -1}  V5 {-1 -1 1}  V6 {1 -1 1}  V7 {1 1 1}  V8 {-1 1 1}
-put {SpanningUnitCube.r} comb region yes tree {l SpanningUnitCube}
-attr set {SpanningUnitCube.r} {region} {R} {region_id} {8400} {material_id} {1} {los} {100} {rgb} {250/245/180} {oshader} {plastic}
-
-put {UnitCube_Q1} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0 1 0}  V5 {0 0 1}  V6 {1 0 1}  V7 {1 1 1}  V8 {0 1 1}
-put {UnitCube_Q1.r} comb region yes tree {l UnitCube_Q1}
-attr set {UnitCube_Q1.r} {region} {R} {region_id} {8401} {material_id} {1} {los} {100} {rgb} {255/106/106} {oshader} {plastic}
-
-put {UnitCube_Q2} arb8 V1 {-1 0 0}  V2 {0 0 0}  V3 {0 1 0}  V4 {-1 1 0}  V5 {-1 0 1}  V6 {0 0 1}  V7 {0 1 1}  V8 {-1 1 1}
-put {UnitCube_Q2.r} comb region yes tree {l UnitCube_Q2}
-attr set {UnitCube_Q2.r} {region} {R} {region_id} {8402} {material_id} {1} {los} {100} {rgb} {255/170/92} {oshader} {plastic}
-
-put {UnitCube_Q3} arb8 V1 {-1 -1 0}  V2 {0 -1 0}  V3 {0 0 0}  V4 {-1 0 0}  V5 {-1 -1 1}  V6 {0 -1 1}  V7 {0 0 1}  V8 {-1 0 1}
-put {UnitCube_Q3.r} comb region yes tree {l UnitCube_Q3}
-attr set {UnitCube_Q3.r} {region} {R} {region_id} {8403} {material_id} {1} {los} {100} {rgb} {255/224/102} {oshader} {plastic}
-
-put {UnitCube_Q4} arb8 V1 {0 -1 0}  V2 {1 -1 0}  V3 {1 0 0}  V4 {0 0 0}  V5 {0 -1 1}  V6 {1 -1 1}  V7 {1 0 1}  V8 {0 0 1}
-put {UnitCube_Q4.r} comb region yes tree {l UnitCube_Q4}
-attr set {UnitCube_Q4.r} {region} {R} {region_id} {8404} {material_id} {1} {los} {100} {rgb} {191/224/64} {oshader} {plastic}
-
-put {UnitCube_Q5} arb8 V1 {0 0 -1}  V2 {1 0 -1}  V3 {1 1 -1}  V4 {0 1 -1}  V5 {0 0 0}  V6 {1 0 0}  V7 {1 1 0}  V8 {0 1 0}
-put {UnitCube_Q5.r} comb region yes tree {l UnitCube_Q5}
-attr set {UnitCube_Q5.r} {region} {R} {region_id} {8405} {material_id} {1} {los} {100} {rgb} {105/206/107} {oshader} {plastic}
-
-put {UnitCube_Q6} arb8 V1 {-1 0 -1}  V2 {0 0 -1}  V3 {0 1 -1}  V4 {-1 1 -1}  V5 {-1 0 0}  V6 {0 0 0}  V7 {0 1 0}  V8 {-1 1 0}
-put {UnitCube_Q6.r} comb region yes tree {l UnitCube_Q6}
-attr set {UnitCube_Q6.r} {region} {R} {region_id} {8406} {material_id} {1} {los} {100} {rgb} {82/197/194} {oshader} {plastic}
-
-put {UnitCube_Q7} arb8 V1 {-1 -1 -1}  V2 {0 -1 -1}  V3 {0 0 -1}  V4 {-1 0 -1}  V5 {-1 -1 0}  V6 {0 -1 0}  V7 {0 0 0}  V8 {-1 0 0}
-put {UnitCube_Q7.r} comb region yes tree {l UnitCube_Q7}
-attr set {UnitCube_Q7.r} {region} {R} {region_id} {8407} {material_id} {1} {los} {100} {rgb} {92/146/255} {oshader} {plastic}
-
-put {UnitCube_Q8} arb8 V1 {0 -1 -1}  V2 {1 -1 -1}  V3 {1 0 -1}  V4 {0 0 -1}  V5 {0 -1 0}  V6 {1 -1 0}  V7 {1 0 0}  V8 {0 0 0}
-put {UnitCube_Q8.r} comb region yes tree {l UnitCube_Q8}
-attr set {UnitCube_Q8.r} {region} {R} {region_id} {8408} {material_id} {1} {los} {100} {rgb} {165/122/255} {oshader} {plastic}
-
-put {Elongated_X1} arb8 V1 {-1 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {-1 1 0}  V5 {-1 0 1}  V6 {1 0 1}  V7 {1 1 1}  V8 {-1 1 1}
-put {Elongated_X1.r} comb region yes tree {l Elongated_X1}
-attr set {Elongated_X1.r} {region} {R} {region_id} {8409} {material_id} {1} {los} {100} {rgb} {255/120/120} {oshader} {plastic}
-
-put {Elongated_X2} arb8 V1 {-1 -1 0}  V2 {1 -1 0}  V3 {1 0 0}  V4 {-1 0 0}  V5 {-1 -1 1}  V6 {1 -1 1}  V7 {1 0 1}  V8 {-1 0 1}
-put {Elongated_X2.r} comb region yes tree {l Elongated_X2}
-attr set {Elongated_X2.r} {region} {R} {region_id} {8410} {material_id} {1} {los} {100} {rgb} {214/72/72} {oshader} {plastic}
-
-put {Elongated_Y1} arb8 V1 {0 -1 0}  V2 {1 -1 0}  V3 {1 1 0}  V4 {0 1 0}  V5 {0 -1 1}  V6 {1 -1 1}  V7 {1 1 1}  V8 {0 1 1}
-put {Elongated_Y1.r} comb region yes tree {l Elongated_Y1}
-attr set {Elongated_Y1.r} {region} {R} {region_id} {8411} {material_id} {1} {los} {100} {rgb} {255/191/94} {oshader} {plastic}
-
-put {Elongated_Y2} arb8 V1 {-1 -1 0}  V2 {0 -1 0}  V3 {0 1 0}  V4 {-1 1 0}  V5 {-1 -1 1}  V6 {0 -1 1}  V7 {0 1 1}  V8 {-1 1 1}
-put {Elongated_Y2.r} comb region yes tree {l Elongated_Y2}
-attr set {Elongated_Y2.r} {region} {R} {region_id} {8412} {material_id} {1} {los} {100} {rgb} {214/150/60} {oshader} {plastic}
-
-put {Elongated_Z1} arb8 V1 {0 0 -1}  V2 {1 0 -1}  V3 {1 1 -1}  V4 {0 1 -1}  V5 {0 0 1}  V6 {1 0 1}  V7 {1 1 1}  V8 {0 1 1}
-put {Elongated_Z1.r} comb region yes tree {l Elongated_Z1}
-attr set {Elongated_Z1.r} {region} {R} {region_id} {8413} {material_id} {1} {los} {100} {rgb} {114/210/255} {oshader} {plastic}
-
-put {Elongated_Z2} arb8 V1 {-1 0 -1}  V2 {0 0 -1}  V3 {0 1 -1}  V4 {-1 1 -1}  V5 {-1 0 1}  V6 {0 0 1}  V7 {0 1 1}  V8 {-1 1 1}
-put {Elongated_Z2.r} comb region yes tree {l Elongated_Z2}
-attr set {Elongated_Z2.r} {region} {R} {region_id} {8414} {material_id} {1} {los} {100} {rgb} {63/152/214} {oshader} {plastic}
-
-put {ReverseUnitCube} arb8 V1 {0 0 0}  V2 {0 1 0}  V3 {1 1 0}  V4 {1 0 0}  V5 {0 0 1}  V6 {0 1 1}  V7 {1 1 1}  V8 {1 0 1}
-put {ReverseUnitCube.r} comb region yes tree {l ReverseUnitCube}
-attr set {ReverseUnitCube.r} {region} {R} {region_id} {8415} {material_id} {1} {los} {100} {rgb} {230/230/230} {oshader} {plastic}
-
-put {TopSlanted} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0 1 0}  V5 {0.2 0.2 1}  V6 {1.2 0.2 1}  V7 {1.2 1.2 1}  V8 {0.2 1.2 1}
-put {TopSlanted.r} comb region yes tree {l TopSlanted}
-attr set {TopSlanted.r} {region} {R} {region_id} {8416} {material_id} {1} {los} {100} {rgb} {255/164/132} {oshader} {plastic}
-
-put {UnevenSlanted} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0 1 0}  V5 {0.1 0.3 1}  V6 {1.1 0.3 1}  V7 {1.3 1.3 1}  V8 {0.1 1.3 1}
-put {UnevenSlanted.r} comb region yes tree {l UnevenSlanted}
-attr set {UnevenSlanted.r} {region} {R} {region_id} {8417} {material_id} {1} {los} {100} {rgb} {255/132/178} {oshader} {plastic}
-
-put {OppositeSlanted} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0 1 0}  V5 {-0.2 0.2 1}  V6 {0.8 0.2 1}  V7 {0.8 1.2 1}  V8 {-0.2 1.2 1}
-put {OppositeSlanted.r} comb region yes tree {l OppositeSlanted}
-attr set {OppositeSlanted.r} {region} {R} {region_id} {8418} {material_id} {1} {los} {100} {rgb} {210/132/255} {oshader} {plastic}
-
-put {PlanarARB6} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0.5 0.5 0}  V5 {0 0 1}  V6 {1 0 1}  V7 {1 1 1}  V8 {0.5 0.5 1}
-put {PlanarARB6.r} comb region yes tree {l PlanarARB6}
-attr set {PlanarARB6.r} {region} {R} {region_id} {8419} {material_id} {1} {los} {100} {rgb} {165/152/255} {oshader} {plastic}
-
-put {ConcavePlanar} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0.6 0.4 0}  V5 {0 0 1}  V6 {1 0 1}  V7 {1 1 1}  V8 {0.6 0.4 1}
-put {ConcavePlanar.r} comb region yes tree {l ConcavePlanar}
-attr set {ConcavePlanar.r} {region} {R} {region_id} {8420} {material_id} {1} {los} {100} {rgb} {124/219/168} {oshader} {plastic}
-
-put {MoreConcavePlanar} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {0.3 0.3 0}  V4 {0 1 0}  V5 {0 0 1}  V6 {1 0 1}  V7 {0.3 0.3 1}  V8 {0 1 1}
-put {MoreConcavePlanar.r} comb region yes tree {l MoreConcavePlanar}
-attr set {MoreConcavePlanar.r} {region} {R} {region_id} {8421} {material_id} {1} {los} {100} {rgb} {61/184/132} {oshader} {plastic}
-
-put {TwistedCubeNonPlanar} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0 1 0}  V5 {-0.183 0.317 1}  V6 {0.683 -0.183 1}  V7 {1.183 0.683 1}  V8 {0.317 1.183 1}
-put {TwistedCubeNonPlanar.r} comb region yes tree {l TwistedCubeNonPlanar}
-attr set {TwistedCubeNonPlanar.r} {region} {R} {region_id} {8422} {material_id} {1} {los} {100} {rgb} {120/233/255} {oshader} {plastic}
-
-put {LongConvexPlanar} arb8 V1 {4281 -119 1531}  V2 {4281 78 1531}  V3 {3322 78 1475}  V4 {3322 -119 1475}  V5 {4275 -119 1629}  V6 {4275 78 1649}  V7 {3315 78 1593}  V8 {3315 -119 1573}
-put {LongConvexPlanar.r} comb region yes tree {l LongConvexPlanar}
-attr set {LongConvexPlanar.r} {region} {R} {region_id} {8423} {material_id} {1} {los} {100} {rgb} {255/216/128} {oshader} {plastic}
-
-put {TaperedConvexPlanar} arb8 V1 {122.749 2.4 40.725}  V2 {122.749 -7.4 40.725}  V3 {122.611 -5 43.244}  V4 {122.611 0 43.244}  V5 {105.434 2.4 39.708}  V6 {105.434 -7.4 39.708}  V7 {105.295 -5 42.228}  V8 {105.295 0 42.228}
-put {TaperedConvexPlanar.r} comb region yes tree {l TaperedConvexPlanar}
-attr set {TaperedConvexPlanar.r} {region} {R} {region_id} {8424} {material_id} {1} {los} {100} {rgb} {255/172/104} {oshader} {plastic}
-
-put {BigConcavePlanar} arb8 V1 {500 -500 -500}  V2 {500 500 -500}  V3 {500 -169.922 -304.688}  V4 {500 -500 500}  V5 {400 -500 -500}  V6 {400 500 -500}  V7 {400 -169.922 -304.688}  V8 {400 -500 500}
-put {BigConcavePlanar.r} comb region yes tree {l BigConcavePlanar}
-attr set {BigConcavePlanar.r} {region} {R} {region_id} {8425} {material_id} {1} {los} {100} {rgb} {255/115/87} {oshader} {plastic}
-
-put {WarpedNonPlanar} arb8 V1 {0 0 0}  V2 {1 0 0.1}  V3 {1.1 1 0}  V4 {0 1.1 -0.1}  V5 {0.1 0 1}  V6 {1 0.1 1.1}  V7 {1.1 1.1 0.9}  V8 {0 1 1}
-put {WarpedNonPlanar.r} comb region yes tree {l WarpedNonPlanar}
-attr set {WarpedNonPlanar.r} {region} {R} {region_id} {8426} {material_id} {1} {los} {100} {rgb} {255/99/156} {oshader} {plastic}
-
-put {TwistedTopNonPlanar} arb8 V1 {0 0 0}  V2 {1 0 -0.1}  V3 {1.1 1.1 0}  V4 {0 1.2 0.1}  V5 {0.2 0 0.9}  V6 {1 0.1 1.2}  V7 {1.2 1.2 0.8}  V8 {0 1 1}
-put {TwistedTopNonPlanar.r} comb region yes tree {l TwistedTopNonPlanar}
-attr set {TwistedTopNonPlanar.r} {region} {R} {region_id} {8427} {material_id} {1} {los} {100} {rgb} {216/118/255} {oshader} {plastic}
-
-put {ComplexNonPlanar} arb8 V1 {0 0 0}  V2 {0.8 0 0.1}  V3 {1.1 0.9 0.2}  V4 {0.1 1.1 -0.2}  V5 {0.2 -0.2 0.8}  V6 {1 0 1.1}  V7 {1.1 0.9 0.9}  V8 {0 1 0.9}
-put {ComplexNonPlanar.r} comb region yes tree {l ComplexNonPlanar}
-attr set {ComplexNonPlanar.r} {region} {R} {region_id} {8428} {material_id} {1} {los} {100} {rgb} {139/132/255} {oshader} {plastic}
-
-put {ConcaveNonPlanar} arb8 V1 {0 0 0}  V2 {1 0 0}  V3 {1 1 0}  V4 {0 1 0}  V5 {0 0 1}  V6 {0.4 0.4 1}  V7 {1 1 1}  V8 {0 1 1}
-put {ConcaveNonPlanar.r} comb region yes tree {l ConcaveNonPlanar}
-attr set {ConcaveNonPlanar.r} {region} {R} {region_id} {8429} {material_id} {1} {los} {100} {rgb} {110/207/255} {oshader} {plastic}
-
-put {MoreConcaveNonPlanar} arb8 V1 {0 0 0}  V2 {1 0 -0.05}  V3 {1 1 0.03}  V4 {0.7 0.3 0.32}  V5 {0 0 1}  V6 {1 0 1.1}  V7 {1 1 0.92}  V8 {0.7 0.3 0.7}
-put {MoreConcaveNonPlanar.r} comb region yes tree {l MoreConcaveNonPlanar}
-attr set {MoreConcaveNonPlanar.r} {region} {R} {region_id} {8430} {material_id} {1} {los} {100} {rgb} {89/188/197} {oshader} {plastic}
-
-put {MostConcaveNonPlanar} arb8 V1 {0.2 0 0}  V2 {1 0.3 0.1}  V3 {1.1 1 -0.25}  V4 {0.4 0.6 0}  V5 {0 0.2 1}  V6 {0.9 0 1.25}  V7 {1 0.8 0.6}  V8 {0.4 0.3 0.8}
-put {MostConcaveNonPlanar.r} comb region yes tree {l MostConcaveNonPlanar}
-attr set {MostConcaveNonPlanar.r} {region} {R} {region_id} {8431} {material_id} {1} {los} {100} {rgb} {71/226/179} {oshader} {plastic}
-
-put {LargeSaddlePlanar} arb8 V1 {1000 -1000 -1000}  V2 {1000 1000 -900}  V3 {1000 1000 1100}  V4 {1000 -1000 1000}  V5 {-1000 -1000 -900}  V6 {-1000 1000 -1000}  V7 {-1000 1000 1000}  V8 {-1000 -1000 1100}
-put {LargeSaddlePlanar.r} comb region yes tree {l LargeSaddlePlanar}
-attr set {LargeSaddlePlanar.r} {region} {R} {region_id} {8432} {material_id} {1} {los} {100} {rgb} {198/242/117} {oshader} {plastic}
-
-put {groundplane} arb8 V1 {-1100 -800 -190}  V2 {1100 -800 -190}  V3 {1100 800 -190}  V4 {-1100 800 -190}  V5 {-1100 -800 -170}  V6 {1100 -800 -170}  V7 {1100 800 -170}  V8 {-1100 800 -170}
-put {groundplane.r} comb region yes tree {l groundplane}
-attr set {groundplane.r} {region} {R} {region_id} {8433} {material_id} {1} {los} {100} {rgb} {240/240/240} {oshader} {stack {{checker {b {190 190 190} s 20}} {plastic {di .85 sp .15}}}}
-
-put {lightpanel} arb8 V1 {-260 -160 1640}  V2 {260 -160 1640}  V3 {260 160 1640}  V4 {-260 160 1640}  V5 {-260 -160 1660}  V6 {260 -160 1660}  V7 {260 160 1660}  V8 {-260 160 1660}
-put {light.r} comb region yes tree {l lightpanel}
-attr set {light.r} {region} {R} {region_id} {8434} {material_id} {1} {los} {100} {rgb} {255/255/245} {oshader} {light {s 32 v 0}} {shader} {light {s 32 v 0}}
-
-put {SpanningUnitCube.place} comb region no tree {l SpanningUnitCube.r {49.4183462128 -6.50277282681 33.3997156149 -520 16.0569940398 56.3810489085 -12.7808554638 340 -30 19.4651295794 48.177886322 20 0 0 0 1}}
-put {UnitCube_Q1.place} comb region no tree {l UnitCube_Q1.r {95.3783673293 -58.1118549187 43.8859814008 -372.171276719 66.7846517861 98.6327164348 -14.5395163089 396.483654405 -29.030627472 35.9805442786 110.736728785 16.1566772042 0 0 0 1}}
-put {UnitCube_Q2.place} comb region no tree {l UnitCube_Q2.r {-95.3783673293 -58.1118549187 43.8859814008 -748.981217092 66.7846517861 -98.6327164348 14.5395163089 547.361506317 29.030627472 35.9805442786 110.736728785 16.1566772042 0 0 0 1}}
-put {UnitCube_Q3.place} comb region no tree {l UnitCube_Q3.r {-95.3783673293 72.8090108537 1.34721346343 -720.363255156 -66.7846517861 -88.341657059 46.2121403301 107.408195052 29.030627472 35.9805442786 110.736728785 52.1372214828 0 0 0 1}}
-put {UnitCube_Q4.place} comb region no tree {l UnitCube_Q4.r {95.3783673293 72.8090108537 1.34721346343 -343.553314783 -66.7846517861 88.341657059 -46.2121403301 308.746644227 -29.030627472 35.9805442786 110.736728785 52.1372214828 0 0 0 1}}
-put {UnitCube_Q5.place} comb region no tree {l UnitCube_Q5.r {39.8232820043 -110.312342921 -25.402622104 -418.792147629 109.413568075 30.603715996 38.6274991197 505.434410305 -29.030627472 -35.9805442786 110.736728785 52.8739502678 0 0 0 1}}
-put {UnitCube_Q6.place} comb region no tree {l UnitCube_Q6.r {-39.8232820043 -110.312342921 -25.402622104 -576.121413559 109.413568075 -30.603715996 -38.6274991197 606.824195257 29.030627472 -35.9805442786 110.736728785 52.8739502678 0 0 0 1}}
-put {UnitCube_Q7.place} comb region no tree {l UnitCube_Q7.r {-39.8232820043 104.175846754 44.2888153308 -544.343942924 -109.413568075 -47.4636006473 13.2618903102 52.063058013 29.030627472 -35.9805442786 110.736728785 16.8934059891 0 0 0 1}}
-put {UnitCube_Q8.place} comb region no tree {l UnitCube_Q8.r {39.8232820043 104.175846754 44.2888153308 -387.014676995 -109.413568075 47.4636006473 -13.2618903102 195.678336425 -29.030627472 -35.9805442786 110.736728785 16.8934059891 0 0 0 1}}
-
-put {Elongated_X1.place} comb region no tree {l Elongated_X1.r {52.9768555715 8.7044814766 26.7896393402 702.252939592 0 57.0633909777 -18.5410196625 320.738814342 -28.1682937672 16.3707486802 50.3839837041 6.62263380786 0 0 0 1}}
-put {Elongated_X2.place} comb region no tree {l Elongated_X2.r {-53.927642778 8.12784805209 -25.0149441426 336.571396097 0 -57.0633909777 -18.5410196625 320.738814342 -26.3022688073 -16.664558085 51.2882360724 -53.9763970787 0 0 0 1}}
-put {Elongated_Y1.place} comb region no tree {l Elongated_Y1.r {24.8029823249 -45.5382654557 30.1840760513 592.506470812 53.190167245 27.696794106 -1.92190132524 487.570947797 -12.4747014491 27.5527489651 51.8191841717 -29.6722413613 0 0 0 1}}
-put {Elongated_Y2.place} comb region no tree {l Elongated_Y2.r {-24.8029823249 50.4884080186 -20.8742119261 418.035614801 -53.190167245 -17.0811791223 21.8869693709 129.256350935 12.4747014491 27.5527489651 51.8191841717 10.3277586387 0 0 0 1}}
-put {Elongated_Z1.place} comb region no tree {l Elongated_Z1.r {-28.1907786236 -48.449629644 21.3989109057 458.320204134 48.827860881 -14.3810251633 31.7651714468 495.981662898 -20.5212085995 32.3391326817 46.1850678792 29.0910379589 0 0 0 1}}
-put {Elongated_Z2.place} comb region no tree {l Elongated_Z2.r {28.5316954889 37.2470428028 37.3978629734 615.642326343 -49.4183462128 33.7844747485 4.0541735977 125.193508762 -18.5410196625 -32.7302164431 46.7435933735 -7.9054016097 0 0 0 1}}
-
-put {ReverseUnitCube.place} comb region no tree {l ReverseUnitCube.r {103.433991196 -60.555851917 5.86500332073 -784.3715713 48.2320622081 88.6693278124 64.8954426786 -345.89841635 -37.082039325 -53.5792786803 100.767967408 14.9466752985 0 0 0 1}}
-put {TopSlanted.place} comb region no tree {l TopSlanted.r {96.3287340793 15.3039561576 -22.0581938655 -655.950517209 -20.4753045059 95.0207291039 -23.4909119866 -277.981798765 17.3648177667 27.1449805028 94.6657970834 -64.0387775034 0 0 0 1}}
-put {UnevenSlanted.place} comb region no tree {l UnevenSlanted.r {88.2050542109 -14.8789457562 22.785860616 -499.054900804 21.9919900071 84.4965683945 -29.9565078782 -299.239309022 -16.0290625539 34.053736387 84.2859552411 -35.8590156121 0 0 0 1}}
-put {OppositeSlanted.place} comb region no tree {l OppositeSlanted.r {82.3639103546 42.0405555876 -38.0628159361 -319.138489526 -47.5528258148 87.7679736664 -5.95915728267 -275.660075233 30.9016994375 23.0081395245 92.2806073208 -60.3058671501 0 0 0 1}}
-put {PlanarARB6.place} comb region no tree {l PlanarARB6.r {115.594480895 8.17480470115 31.1622937968 -837.465789697 20.3824258028 71.3324119214 -94.3199010171 -433.697468354 -24.9494028981 96.1501928109 67.3250898065 -79.2629398596 0 0 0 1}}
-put {ConcavePlanar.place} comb region no tree {l ConcavePlanar.r {107.244094838 -4.19493374266 53.6759411037 -678.362551099 -34.8457187174 85.7908832775 76.3262748569 -498.635719709 -41.0424171991 -83.7993250412 75.4532511765 6.69424553188 0 0 0 1}}
-put {MoreConcavePlanar.place} comb region no tree {l MoreConcavePlanar.r {98.2385703033 -68.8300310449 3.40736424785 -456.407951753 52.2343743832 70.4997088106 -81.8618420903 -455.436120552 44.9527912099 68.4997655761 87.6757017563 -114.564129271 0 0 0 1}}
-put {TwistedCubeNonPlanar.place} comb region no tree {l TwistedCubeNonPlanar.r {58.6764988003 -36.5971430924 54.1750992397 -318.127227474 52.8325568251 69.4213241451 -10.3259123031 -490.963984334 -38.5099104061 39.4785086222 68.3787827407 -18.6736904784 0 0 0 1}}
-
-put {WarpedNonPlanar.place} comb region no tree {l WarpedNonPlanar.r {85.9669900169 48.3491658661 16.4934771193 257.879375705 -34.7329185229 78.9947205011 -50.5317573791 -244.078112398 -37.4606593416 37.7119648521 84.7024598739 -20.4894479677 0 0 0 1}}
-put {TwistedTopNonPlanar.place} comb region no tree {l TwistedTopNonPlanar.r {83.4930920481 -37.5301552898 11.8785977012 485.889009209 27.1285501058 75.0409121486 46.407039684 -331.825549179 -28.5246456346 -38.4845294501 78.9049785729 30.8077668357 0 0 0 1}}
-put {ComplexNonPlanar.place} comb region no tree {l ComplexNonPlanar.r {68.2221969569 -62.1661301805 -1.34690754179 691.058658649 49.5663274432 55.5767314233 -54.5446254664 -272.725927774 37.5449208993 39.589256647 74.4565627193 -51.9703252094 0 0 0 1}}
-put {ConcaveNonPlanar.place} comb region no tree {l ConcaveNonPlanar.r {99.563920506 36.7265877365 56.0194920247 243.844999866 -52.9390755862 104.63063394 25.4928365894 -473.592197472 -41.0424171991 -45.8648906522 103.014231036 -8.05346159232 0 0 0 1}}
-put {MoreConcaveNonPlanar.place} comb region no tree {l MoreConcaveNonPlanar.r {91.7377293852 -5.0835848262 49.4652906758 450.703650116 19.4994563335 99.1649372544 -25.9722011215 -480.696791205 -45.7430761867 32.0771132385 88.131144304 -21.4358692855 0 0 0 1}}
-put {MostConcaveNonPlanar.place} comb region no tree {l MostConcaveNonPlanar.r {58.9095344445 52.9796505277 11.0825710686 635.568645257 -49.4309686252 45.9860647701 42.9169102771 -452.26445478 22.0509884654 -38.4504678375 66.5981638694 5.79810832812 0 0 0 1}}
-
-put {LongConvexPlanar.place} comb region no tree {l LongConvexPlanar.r {0.115561944047 0.0319553637337 0.0324930028006 -639.003248908 -0.0245634494865 0.1182771118 -0.0289597166373 280.951739329 -0.0383872042702 0.0205154324115 0.116348798857 4.47834436767 0 0 0 1}}
-put {TaperedConvexPlanar.place} comb region no tree {l TaperedConvexPlanar.r {5.7378157661 -3.26643327706 1.91741052485 -591.929831404 2.55464017008 5.90709171549 2.41840036102 -236.823025558 -2.7964018087 -1.30585617557 6.14357028226 90.775965566 0 0 0 1}}
-put {BigConcavePlanar.place} comb region no tree {l BigConcavePlanar.r {0.0998972458041 0.0482115762187 -0.0457841042204 -194.953760612 -0.0576757017563 0.103947290059 -0.0163851858765 -114.04593421 0.033076482698 0.0356455440104 0.109705703974 -4.88441721412 0 0 0 1}}
-put {LargeSaddlePlanar.place} comb region no tree {l LargeSaddlePlanar.r {0.0470204253358 -0.0323394992732 0.0029227573361 149.853862133 0.0293816227061 0.0445634112955 0.0203992338904 -141.019961695 -0.01382410832 -0.0152828427629 0.0532976065944 41.3351196703 0 0 0 1}}
-
-put {arb8_quadrants.c} comb region no tree {u {u {u {u {u {u {u {u {l SpanningUnitCube.place} {l UnitCube_Q1.place}} {l UnitCube_Q2.place}} {l UnitCube_Q3.place}} {l UnitCube_Q4.place}} {l UnitCube_Q5.place}} {l UnitCube_Q6.place}} {l UnitCube_Q7.place}} {l UnitCube_Q8.place}}
-attr set {arb8_quadrants.c} {inherit} {1}
-
-put {arb8_axes.c} comb region no tree {u {u {u {u {u {l Elongated_X1.place} {l Elongated_X2.place}} {l Elongated_Y1.place}} {l Elongated_Y2.place}} {l Elongated_Z1.place}} {l Elongated_Z2.place}}
-attr set {arb8_axes.c} {inherit} {1}
-
-put {arb8_planar.c} comb region no tree {u {u {u {u {u {u {u {l ReverseUnitCube.place} {l TopSlanted.place}} {l UnevenSlanted.place}} {l OppositeSlanted.place}} {l PlanarARB6.place}} {l ConcavePlanar.place}} {l MoreConcavePlanar.place}} {l TwistedCubeNonPlanar.place}}
-attr set {arb8_planar.c} {inherit} {1}
-
-put {arb8_nonplanar.c} comb region no tree {u {u {u {u {u {l WarpedNonPlanar.place} {l TwistedTopNonPlanar.place}} {l ComplexNonPlanar.place}} {l ConcaveNonPlanar.place}} {l MoreConcaveNonPlanar.place}} {l MostConcaveNonPlanar.place}}
-attr set {arb8_nonplanar.c} {inherit} {1}
-
-put {arb8_large_planars.c} comb region no tree {u {u {u {l LongConvexPlanar.place} {l TaperedConvexPlanar.place}} {l BigConcavePlanar.place}} {l LargeSaddlePlanar.place}}
-attr set {arb8_large_planars.c} {inherit} {1}
-
-put {arb8_small_gallery.c} comb region no tree {u {u {u {l arb8_quadrants.c} {l arb8_axes.c}} {l arb8_planar.c}} {l arb8_nonplanar.c}}
-attr set {arb8_small_gallery.c} {inherit} {1}
-
-put {arb8_large_gallery.c} comb region no tree {l arb8_large_planars.c}
-attr set {arb8_large_gallery.c} {inherit} {1}
-
-put {arb8_showcase} comb region no tree {u {u {u {l arb8_small_gallery.c} {l arb8_large_gallery.c}} {l groundplane.r}} {l light.r}}
-attr set {arb8_showcase} {inherit} {1}

db/bicycle_wheel.asc

@@ -1,350 +0,0 @@
-title {Small bicycle wheel by lbutler}
-units in
-put {rcastooth.s28_1_1_29} comb region no tree {l rcastooth.s {1 0 0 53.4214  0 1 0 -37.1824  0 0 1 0  0 0 0 1}}
-put {rcastooth.s18_1_1_19} comb region no tree {l rcastooth.s {1 0 0 34.6765  0 1 0 -25.1939  0 0 1 0  0 0 0 1}}
-put {rcastooth.s27_1_1_28} comb region no tree {l rcastooth.s {1 0 0 44.8431  0 1 0 -47.175  0 0 1 0  0 0 0 1}}
-put {rcastooth.s17_1_1_18} comb region no tree {l rcastooth.s {1 0 0 25.1939  0 1 0 -34.6765  0 0 1 0  0 0 0 1}}
-put {rcastooth.s26_1_1_27} comb region no tree {l rcastooth.s {1 0 0 55.6095  0 1 0 -13.1797  0 0 1 0  0 0 0 1}}
-put {rcastooth.s16_1_1_17} comb region no tree {l rcastooth.s {1 0 0 34.0469  0 1 0 -13.1898  0 0 1 0  0 0 0 1}}
-put {rcastooth.s25_1_1_26} comb region no tree {l rcastooth.s {1 0 0 51.0711  0 1 0 -25.6489  0 0 1 0  0 0 0 1}}
-put {rcastooth.s15_1_1_16} comb region no tree {l rcastooth.s {1 0 0 26.9831  0 1 0 -24.5983  0 0 1 0  0 0 0 1}}
-put {rcastooth.s24_1_1_25} comb region no tree {l rcastooth.s {1 0 0 43.7794  0 1 0 -36.7353  0 0 1 0  0 0 0 1}}
-put {rcastooth.s29_1_1_30} comb region no tree {l rcastooth.s {1 0 0 59.8127  0 1 0 -25.6676  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_18} comb region no tree {l rhspkh2 {1 0 0 1.18e-05  0 1 0 -7.67456  0 0 1 0  0 0 0 1}}
-put {rcastooth.s14_1_1_15} comb region no tree {l rcastooth.s {1 0 0 29.8752  0 1 0 -13.3013  0 0 1 0  0 0 0 1}}
-put {rcastooth.s23_1_1_24} comb region no tree {l rcastooth.s {1 0 0 34.1276  0 1 0 -45.8413  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_17} comb region no tree {l rhspkh2 {1 0 0 -2.62489  0 1 0 -14.8863  0 0 1 0  0 0 0 1}}
-put {rcastooth.s19_1_1_20} comb region no tree {l rcastooth.s {1 0 0 40.7647  0 1 0 -13.2452  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_16} comb region no tree {l rhspkh2 {1 0 0 -7.55799  0 1 0 -20.7653  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_15} comb region no tree {l rhspkh2 {1 0 0 -14.2043  0 1 0 -24.6026  0 0 1 0  0 0 0 1}}
-put {rcastooth.s13_1_1_14} comb region no tree {l rcastooth.s {1 0 0 21.8822  0 1 0 -24.3027  0 0 1 0  0 0 0 1}}
-put {rcastooth.s22_1_1_23} comb region no tree {l rcastooth.s {1 0 0 47.3876  0 1 0 -13.2774  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_14} comb region no tree {l rhspkh2 {1 0 0 -21.7623  0 1 0 -25.9353  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_13} comb region no tree {l rhspkh2 {1 0 0 -29.3202  0 1 0 -24.6026  0 0 1 0  0 0 0 1}}
-put {rcastooth.s12_1_1_13} comb region no tree {l rcastooth.s {1 0 0 25.5268  0 1 0 -13.3975  0 0 1 0  0 0 0 1}}
-put {rcastooth.s21_1_1_22} comb region no tree {l rcastooth.s {1 0 0 42.0481  0 1 0 -25.57  0 0 1 0  0 0 0 1}}
-put {rcastooth.s30_1_1_31} comb region no tree {l rcastooth.s {1 0 0 63.7552  0 1 0 -13.102  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_12} comb region no tree {l rhspkh2 {1 0 0 -35.9666  0 1 0 -20.7654  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_11} comb region no tree {l rhspkh2 {1 0 0 -40.8997  0 1 0 -14.8863  0 0 1 0  0 0 0 1}}
-put {rcastooth.s11_1_1_12} comb region no tree {l rcastooth.s {1 0 0 16.3767  0 1 0 -23.7258  0 0 1 0  0 0 0 1}}
-put {rcastooth.s20_1_1_21} comb region no tree {l rcastooth.s {1 0 0 33.5901  0 1 0 -35.9663  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_10} comb region no tree {l rhspkh2 {1 0 0 -43.5246  0 1 0 -7.67456  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_1_11} comb region no tree {l rcastooth.s {1 0 0 20.8336  0 1 0 -13.389  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_9} comb region no tree {l rhspkh2 {1 0 0 -43.5246  0 1 0 4e-07  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_8} comb region no tree {l rhspkh2 {1 0 0 -40.8997  0 1 0 7.21172  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_7} comb region no tree {l rhspkh2 {1 0 0 -35.9666  0 1 0 13.0907  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_6} comb region no tree {l rhspkh2 {1 0 0 -29.3202  0 1 0 16.928  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_5} comb region no tree {l rhspkh2 {1 0 0 -21.7623  0 1 0 18.2607  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_4} comb region no tree {l rhspkh2 {1 0 0 -14.2043  0 1 0 16.928  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_3} comb region no tree {l rhspkh2 {1 0 0 -7.55799  0 1 0 13.0908  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_2} comb region no tree {l rhspkh2 {1 0 0 -2.62489  0 1 0 7.21172  0 0 1 0  0 0 0 1}}
-put {rhspkh2_1_1_1} comb region no tree {l rhspkh2 {1 0 0 1.18e-05  0 1 0 4e-07  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_18} comb region no tree {l rhspkh {1 0 0 -1.3327  0 1 0 -7.55796  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_17} comb region no tree {l rhspkh {1 0 0 -5.1699  0 1 0 -14.2043  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_16} comb region no tree {l rhspkh {1 0 0 -11.049  0 1 0 -19.1374  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_15} comb region no tree {l rhspkh {1 0 0 -18.2607  0 1 0 -21.7623  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_14} comb region no tree {l rhspkh {1 0 0 -25.9353  0 1 0 -21.7623  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_13} comb region no tree {l rhspkh {1 0 0 -33.147  0 1 0 -19.1374  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_12} comb region no tree {l rhspkh {1 0 0 -39.0261  0 1 0 -14.2043  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_11} comb region no tree {l rhspkh {1 0 0 -42.8633  0 1 0 -7.55796  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_10} comb region no tree {l rhspkh {1 0 0 -44.196  0 1 0 -4.57038e-12  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1_1_10} comb region no tree {l rcastooth.s {1 0 0 18.4941  0 1 0 -13.4368  0 0 1 0  0 0 0 1}}
-put {rcastooth.s} tgc V {0 0 -0.3755760995733843365940174}  H {0 0 2.57364612783325474865137}  A {0 -4.762499999999999289457264 0}  B {4.762499999999999289457264 0 0}  C {0 -4.762499999999999289457264 0}  D {4.762499999999999289457264 0 0} 
-put {rcassette.r} comb region yes tree {u {u {u {u {l rcas11t.c1} {l rcas12t.c1}} {u {l rcas14t.c1} {l rcas16t.c1}}} {u {u {l rcas18t.c1} {l rcas21t.c1}} {u {l rcas24t.c1} {l rcas28t.c1}}}} {u {l rcas32t.c1} {l rcas.s2}}}
-attr set {rcassette.r} {region} {R} {region_id} {1002} {material_id} {1} {los} {100}
-put {rhspkh_1_1_9} comb region no tree {l rhspkh {1 0 0 -42.8633  0 1 0 7.55796  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_8} comb region no tree {l rhspkh {1 0 0 -39.0261  0 1 0 14.2043  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_7} comb region no tree {l rhspkh {1 0 0 -33.147  0 1 0 19.1374  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_6} comb region no tree {l rhspkh {1 0 0 -25.9353  0 1 0 21.7623  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_5} comb region no tree {l rhspkh {1 0 0 -18.2607  0 1 0 21.7623  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_4} comb region no tree {l rhspkh {1 0 0 -11.049  0 1 0 19.1374  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_3} comb region no tree {l rhspkh {1 0 0 -5.1699  0 1 0 14.2043  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_2} comb region no tree {l rhspkh {1 0 0 -1.3327  0 1 0 7.55796  0 0 1 0  0 0 0 1}}
-put {rhspkh_1_1_1} comb region no tree {l rhspkh}
-put {rcastooth.s8_1_1_9} comb region no tree {l rcastooth.s {1 0 0 7.06413  0 1 0 -21.7412  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1_1_8} comb region no tree {l rcastooth.s {1 0 0 -7.06413  0 1 0 -21.7412  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1_1_7} comb region no tree {l rcastooth.s {1 0 0 -18.4941  0 1 0 -13.4368  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1_1_6} comb region no tree {l rcastooth.s {1 0 0 -22.86  0 1 0 -4.72798e-12  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1_1_5} comb region no tree {l rcastooth.s {1 0 0 -18.4941  0 1 0 13.4368  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1_1_4} comb region no tree {l rcastooth.s {1 0 0 -7.06413  0 1 0 21.7412  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1_1_3} comb region no tree {l rcastooth.s {1 0 0 7.06413  0 1 0 21.7412  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1_1_2} comb region no tree {l rcastooth.s {1 0 0 18.4941  0 1 0 13.4368  0 0 1 0  0 0 0 1}}
-put {rcas28t.s1-1} comb region no tree {u {u {u {u {u {l rcastooth.s_1_1_8} {l rcastooth.s1_1__7}} {u {l rcastooth.s2_1__7} {l rcastooth.s3_1__7}}} {u {u {l rcastooth.s4_1__7} {l rcastooth.s5_1__7}} {u {l rcastooth.s6_1__7} {l rcastooth.s7_1__7}}}} {u {u {u {l rcastooth.s8_1__7} {l rcastooth.s9_1__7}} {u {l rcastooth.s10_1_6} {l rcastooth.s11_1_5}}} {u {u {l rcastooth.s12_1_5} {l rcastooth.s13_1_4}} {u {l rcastooth.s14_1_4} {l rcastooth.s15_1_3}}}}} {u {u {u {u {l rcastooth.s16_1_3} {l rcastooth.s17_1_2}} {u {l rcastooth.s18_1_2} {l rcastooth.s19_1_2}}} {u {u {l rcastooth.s20_1_1} {l rcastooth.s21_1_1}} {u {l rcastooth.s22_1_1} {l rcastooth.s23_1_1_24}}}} {u {u {l rcastooth.s24_1_1_25} {l rcastooth.s25_1_1_26}} {l rcastooth.s26_1_1_27}}}}
-put {rcas18t.s1-1} comb region no tree {u {u {u {u {u {l rcastooth.s_1_1_5} {l rcastooth.s1_1__4}} {u {l rcastooth.s2_1__4} {l rcastooth.s3_1__4}}} {u {u {l rcastooth.s4_1__4} {l rcastooth.s5_1__4}} {u {l rcastooth.s6_1__4} {l rcastooth.s7_1__4}}}} {u {u {u {l rcastooth.s8_1__4} {l rcastooth.s9_1__4}} {u {l rcastooth.s10_1_3} {l rcastooth.s11_1_2}}} {u {u {l rcastooth.s12_1_2} {l rcastooth.s13_1_1}} {u {l rcastooth.s14_1_1} {l rcastooth.s15_1_1_16}}}}} {l rcastooth.s16_1_1_17}}
-put {rcas16t.s1-1} comb region no tree {u {u {u {u {l rcastooth.s_1_1_4} {l rcastooth.s1_1__3}} {u {l rcastooth.s2_1__3} {l rcastooth.s3_1__3}}} {u {u {l rcastooth.s4_1__3} {l rcastooth.s5_1__3}} {u {l rcastooth.s6_1__3} {l rcastooth.s7_1__3}}}} {u {u {u {l rcastooth.s8_1__3} {l rcastooth.s9_1__3}} {u {l rcastooth.s10_1_2} {l rcastooth.s11_1_1}}} {u {u {l rcastooth.s12_1_1} {l rcastooth.s13_1_1_14}} {l rcastooth.s14_1_1_15}}}}
-put {rcas24t.s1-1} comb region no tree {u {u {u {u {u {l rcastooth.s_1_1_7} {l rcastooth.s1_1__6}} {u {l rcastooth.s2_1__6} {l rcastooth.s3_1__6}}} {u {u {l rcastooth.s4_1__6} {l rcastooth.s5_1__6}} {u {l rcastooth.s6_1__6} {l rcastooth.s7_1__6}}}} {u {u {u {l rcastooth.s8_1__6} {l rcastooth.s9_1__6}} {u {l rcastooth.s10_1_5} {l rcastooth.s11_1_4}}} {u {u {l rcastooth.s12_1_4} {l rcastooth.s13_1_3}} {u {l rcastooth.s14_1_3} {l rcastooth.s15_1_2}}}}} {u {u {u {l rcastooth.s16_1_2} {l rcastooth.s17_1_1}} {u {l rcastooth.s18_1_1} {l rcastooth.s19_1_1}}} {u {u {l rcastooth.s20_1_1_21} {l rcastooth.s21_1_1_22}} {l rcastooth.s22_1_1_23}}}}
-put {rcas14t.s1-1} comb region no tree {u {u {u {u {l rcastooth.s_1_1_3} {l rcastooth.s1_1__2}} {u {l rcastooth.s2_1__2} {l rcastooth.s3_1__2}}} {u {u {l rcastooth.s4_1__2} {l rcastooth.s5_1__2}} {u {l rcastooth.s6_1__2} {l rcastooth.s7_1__2}}}} {u {u {u {l rcastooth.s8_1__2} {l rcastooth.s9_1__2}} {u {l rcastooth.s10_1_1} {l rcastooth.s11_1_1_12}}} {l rcastooth.s12_1_1_13}}}
-put {rcas32t.s1-1} comb region no tree {u {u {u {u {u {l rcastooth.s_1_1_9} {l rcastooth.s1_1__8}} {u {l rcastooth.s2_1__8} {l rcastooth.s3_1__8}}} {u {u {l rcastooth.s4_1__8} {l rcastooth.s5_1__8}} {u {l rcastooth.s6_1__8} {l rcastooth.s7_1__8}}}} {u {u {u {l rcastooth.s8_1__8} {l rcastooth.s9_1__8}} {u {l rcastooth.s10_1_7} {l rcastooth.s11_1_6}}} {u {u {l rcastooth.s12_1_6} {l rcastooth.s13_1_5}} {u {l rcastooth.s14_1_5} {l rcastooth.s15_1_4}}}}} {u {u {u {u {l rcastooth.s16_1_4} {l rcastooth.s17_1_3}} {u {l rcastooth.s18_1_3} {l rcastooth.s19_1_3}}} {u {u {l rcastooth.s20_1_2} {l rcastooth.s21_1_2}} {u {l rcastooth.s22_1_2} {l rcastooth.s23_1_1}}}} {u {u {u {l rcastooth.s24_1_1} {l rcastooth.s25_1_1}} {u {l rcastooth.s26_1_1} {l rcastooth.s27_1_1_28}}} {u {u {l rcastooth.s28_1_1_29} {l rcastooth.s29_1_1_30}} {l rcastooth.s30_1_1_31}}}}}
-put {rcas12t.s1-1} comb region no tree {u {u {u {u {l rcastooth.s_1_1_2} {l rcastooth.s1_1__1}} {u {l rcastooth.s2_1__1} {l rcastooth.s3_1__1}}} {u {u {l rcastooth.s4_1__1} {l rcastooth.s5_1__1}} {u {l rcastooth.s6_1__1} {l rcastooth.s7_1__1}}}} {u {u {l rcastooth.s8_1__1} {l rcastooth.s9_1__1}} {l rcastooth.s10_1_1_11}}}
-put {rcas21t.s1-1} comb region no tree {u {u {u {u {u {l rcastooth.s_1_1_6} {l rcastooth.s1_1__5}} {u {l rcastooth.s2_1__5} {l rcastooth.s3_1__5}}} {u {u {l rcastooth.s4_1__5} {l rcastooth.s5_1__5}} {u {l rcastooth.s6_1__5} {l rcastooth.s7_1__5}}}} {u {u {u {l rcastooth.s8_1__5} {l rcastooth.s9_1__5}} {u {l rcastooth.s10_1_4} {l rcastooth.s11_1_3}}} {u {u {l rcastooth.s12_1_3} {l rcastooth.s13_1_2}} {u {l rcastooth.s14_1_2} {l rcastooth.s15_1_1}}}}} {u {u {l rcastooth.s16_1_1} {l rcastooth.s17_1_1_18}} {u {l rcastooth.s18_1_1_19} {l rcastooth.s19_1_1_20}}}}
-put {rcas11t.s1-1} comb region no tree {u {u {u {u {l rcastooth.s_1_1_1} {l rcastooth.s1_1_1_2}} {u {l rcastooth.s2_1_1_3} {l rcastooth.s3_1_1_4}}} {u {u {l rcastooth.s4_1_1_5} {l rcastooth.s5_1_1_6}} {u {l rcastooth.s6_1_1_7} {l rcastooth.s7_1_1_8}}}} {u {l rcastooth.s8_1_1_9} {l rcastooth.s9_1_1_10}}}
-put {rcastooth.s9_1__8} comb region no tree {l rcastooth.s {1 0 0 -16.3143  0 1 0 63.0097  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__8} comb region no tree {l rcastooth.s {1 0 0 -3.29663  0 1 0 65.004  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1__7} comb region no tree {l rcastooth.s {1 0 0 -28.575  0 1 0 49.4934  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__8} comb region no tree {l rcastooth.s {1 0 0 9.85606  0 1 0 64.3369  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__7} comb region no tree {l rcastooth.s {1 0 0 -16.3908  0 1 0 54.7491  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1__6} comb region no tree {l rcastooth.s {1 0 0 -38.1747  0 1 0 31.0574  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__8} comb region no tree {l rcastooth.s {1 0 0 22.6052  0 1 0 61.0359  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__7} comb region no tree {l rcastooth.s {1 0 0 -3.32298  0 1 0 57.0533  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__6} comb region no tree {l rcastooth.s {1 0 0 -28.3799  0 1 0 40.2051  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__8} comb region no tree {l rcastooth.s {1 0 0 34.4289  0 1 0 55.2361  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1__5} comb region no tree {l rcastooth.s {1 0 0 -40.7647  0 1 0 13.2452  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__7} comb region no tree {l rcastooth.s {1 0 0 9.92399  0 1 0 56.2818  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__6} comb region no tree {l rcastooth.s {1 0 0 -16.4803  0 1 0 46.371  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__8} comb region no tree {l rcastooth.s {1 0 0 44.8431  0 1 0 47.175  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__5} comb region no tree {l rcastooth.s {1 0 0 -34.6765  0 1 0 25.1939  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__7} comb region no tree {l rcastooth.s {1 0 0 22.636  0 1 0 52.4761  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1__4} comb region no tree {l rcastooth.s {1 0 0 -35.8908  0 1 0 -6.70915  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__6} comb region no tree {l rcastooth.s {1 0 0 -3.35838  0 1 0 49.0978  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__8} comb region no tree {l rcastooth.s {1 0 0 53.4214  0 1 0 37.1824  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__5} comb region no tree {l rcastooth.s {1 0 0 -25.1939  0 1 0 34.6765  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__7} comb region no tree {l rcastooth.s {1 0 0 34.1276  0 1 0 45.8413  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__4} comb region no tree {l rcastooth.s {1 0 0 -35.8908  0 1 0 6.70915  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__6} comb region no tree {l rcastooth.s {1 0 0 10.0126  0 1 0 48.1832  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__8} comb region no tree {l rcastooth.s {1 0 0 59.8127  0 1 0 25.6676  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1__3} comb region no tree {l rcastooth.s {1 0 0 -26.4569  0 1 0 -19.222  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__5} comb region no tree {l rcastooth.s {1 0 0 -13.2452  0 1 0 40.7647  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__7} comb region no tree {l rcastooth.s {1 0 0 43.7794  0 1 0 36.7353  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__4} comb region no tree {l rcastooth.s {1 0 0 -31.0436  0 1 0 19.2214  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__6} comb region no tree {l rcastooth.s {1 0 0 22.641  0 1 0 43.6951  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__8} comb region no tree {l rcastooth.s {1 0 0 63.7552  0 1 0 13.102  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__3} comb region no tree {l rcastooth.s {1 0 0 -31.9879  0 1 0 -6.79923  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__5} comb region no tree {l rcastooth.s {1 0 0 -2.18745e-10  0 1 0 42.8625  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__7} comb region no tree {l rcastooth.s {1 0 0 51.0711  0 1 0 25.6489  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1__2} comb region no tree {l rcastooth.s {1 0 0 -10.2229  0 1 0 -26.9556  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__4} comb region no tree {l rcastooth.s {1 0 0 -22.0037  0 1 0 29.1376  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__6} comb region no tree {l rcastooth.s {1 0 0 33.5901  0 1 0 35.9663  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__3} comb region no tree {l rcastooth.s {1 0 0 -31.9879  0 1 0 6.79923  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__5} comb region no tree {l rcastooth.s {1 0 0 13.2452  0 1 0 40.7647  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__7} comb region no tree {l rcastooth.s {1 0 0 55.6095  0 1 0 13.1797  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__2} comb region no tree {l rcastooth.s {1 0 0 -21.5788  0 1 0 -19.1172  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__4} comb region no tree {l rcastooth.s {1 0 0 -9.99212  0 1 0 35.1187  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__6} comb region no tree {l rcastooth.s {1 0 0 42.0481  0 1 0 25.57  0 0 1 0  0 0 0 1}}
-put {rcastooth.s9_1__1} comb region no tree {l rcastooth.s {1 0 0 10.2878  0 1 0 -22.527  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__3} comb region no tree {l rcastooth.s {1 0 0 -26.4569  0 1 0 19.222  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__5} comb region no tree {l rcastooth.s {1 0 0 25.1939  0 1 0 34.6765  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__2} comb region no tree {l rcastooth.s {1 0 0 -27.9913  0 1 0 -6.89923  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__4} comb region no tree {l rcastooth.s {1 0 0 3.36895  0 1 0 36.3567  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__6} comb region no tree {l rcastooth.s {1 0 0 47.3876  0 1 0 13.2774  0 0 1 0  0 0 0 1}}
-put {rcastooth.s8_1__1} comb region no tree {l rcastooth.s {1 0 0 -3.52443  0 1 0 -24.5129  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__3} comb region no tree {l rcastooth.s {1 0 0 -16.3513  0 1 0 28.3212  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__5} comb region no tree {l rcastooth.s {1 0 0 34.6765  0 1 0 25.1939  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__2} comb region no tree {l rcastooth.s {1 0 0 -27.9913  0 1 0 6.89923  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__4} comb region no tree {l rcastooth.s {1 0 0 16.275  0 1 0 32.6846  0 0 1 0  0 0 0 1}}
-put {rcastooth.s7_1__1} comb region no tree {l rcastooth.s {1 0 0 -16.2176  0 1 0 -18.7161  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__3} comb region no tree {l rcastooth.s {1 0 0 -3.41834  0 1 0 32.5234  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__5} comb region no tree {l rcastooth.s {1 0 0 40.7647  0 1 0 13.2452  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__2} comb region no tree {l rcastooth.s {1 0 0 -21.5788  0 1 0 19.1172  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__4} comb region no tree {l rcastooth.s {1 0 0 26.9831  0 1 0 24.5983  0 0 1 0  0 0 0 1}}
-put {rcastooth.s6_1__1} comb region no tree {l rcastooth.s {1 0 0 -23.7618  0 1 0 -6.97711  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__3} comb region no tree {l rcastooth.s {1 0 0 10.1056  0 1 0 31.1019  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__2} comb region no tree {l rcastooth.s {1 0 0 -10.2229  0 1 0 26.9556  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__4} comb region no tree {l rcastooth.s {1 0 0 34.0469  0 1 0 13.1898  0 0 1 0  0 0 0 1}}
-put {rcastooth.s5_1__1} comb region no tree {l rcastooth.s {1 0 0 -23.7618  0 1 0 6.97711  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__3} comb region no tree {l rcastooth.s {1 0 0 21.8822  0 1 0 24.3027  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_9} comb region no tree {l rcastooth.s {1 0 0 65.0875  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__2} comb region no tree {l rcastooth.s {1 0 0 3.47495  0 1 0 28.6188  0 0 1 0  0 0 0 1}}
-put {rcastooth.s4_1__1} comb region no tree {l rcastooth.s {1 0 0 -16.2176  0 1 0 18.7161  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__3} comb region no tree {l rcastooth.s {1 0 0 29.8752  0 1 0 13.3013  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__2} comb region no tree {l rcastooth.s {1 0 0 16.3767  0 1 0 23.7258  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_8} comb region no tree {l rcastooth.s {1 0 0 57.15  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s3_1__1} comb region no tree {l rcastooth.s {1 0 0 -3.52443  0 1 0 24.5129  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__2} comb region no tree {l rcastooth.s {1 0 0 25.5268  0 1 0 13.3975  0 0 1 0  0 0 0 1}}
-put {rcastooth.s2_1__1} comb region no tree {l rcastooth.s {1 0 0 10.2878  0 1 0 22.527  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_7} comb region no tree {l rcastooth.s {1 0 0 49.2125  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s1_1__1} comb region no tree {l rcastooth.s {1 0 0 20.8336  0 1 0 13.389  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_6} comb region no tree {l rcastooth.s {1 0 0 42.8625  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_5} comb region no tree {l rcastooth.s {1 0 0 36.5125  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_4} comb region no tree {l rcastooth.s {1 0 0 32.7025  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_3} comb region no tree {l rcastooth.s {1 0 0 28.829  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_2} comb region no tree {l rcastooth.s {1 0 0 24.765  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s_1_1_1} comb region no tree {l rcastooth.s {1 0 0 22.86  0 1 0 0  0 0 1 0  0 0 0 1}}
-put {rcas28t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -57.14999999999999857891453 0}  B {57.14999999999999857891453 0 0}  C {0 -57.14999999999999857891453 0}  D {57.14999999999999857891453 0 0} 
-put {rcas18t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -36.51249999999999573674359 0}  B {36.51249999999999573674359 0 0}  C {0 -36.51249999999999573674359 0}  D {36.51249999999999573674359 0 0} 
-put {spkl_1_1_9} comb region no tree {l spkl {0.766044 0.642788 0 0  -0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_9} comb region no tree {l spkk {0.766044 0.642788 0 0  -0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {rcas16t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -32.70250000000000056843419 0}  B {32.70250000000000056843419 0 0}  C {0 -32.70250000000000056843419 0}  D {32.70250000000000056843419 0 0} 
-put {spkj_1_1_9} comb region no tree {l spkj {0.766044 0.642788 0 0  -0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {spkl_1_1_8} comb region no tree {l spkl {0.173648 0.984808 0 0  -0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {spki_1_1_9} comb region no tree {l spki {0.766044 0.642788 0 0  -0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {rcas24t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -49.21249999999999857891453 0}  B {49.21249999999999857891453 0 0}  C {0 -49.21249999999999857891453 0}  D {49.21249999999999857891453 0 0} 
-put {spkk_1_1_8} comb region no tree {l spkk {0.173648 0.984808 0 0  -0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {spkj_1_1_8} comb region no tree {l spkj {0.173648 0.984808 0 0  -0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {rcas14t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -28.82899999999999707256393 0}  B {28.82899999999999707256393 0 0}  C {0 -28.82899999999999707256393 0}  D {28.82899999999999707256393 0 0} 
-put {spkl_1_1_7} comb region no tree {l spkl {-0.5 0.866025 0 0  -0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {rcas32t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -65.08749999999999147348717 0}  B {65.08749999999999147348717 0 0}  C {0 -65.08749999999999147348717 0}  D {65.08749999999999147348717 0 0} 
-put {spki_1_1_8} comb region no tree {l spki {0.173648 0.984808 0 0  -0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_7} comb region no tree {l spkk {-0.5 0.866025 0 0  -0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {spkj_1_1_7} comb region no tree {l spkj {-0.5 0.866025 0 0  -0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {spkl_1_1_6} comb region no tree {l spkl {-0.939693 0.34202 0 0  -0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {rcas12t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -24.76499999999999701572051 0}  B {24.76499999999999701572051 0 0}  C {0 -24.76499999999999701572051 0}  D {24.76499999999999701572051 0 0} 
-put {rcas21t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -42.86249999999999715782906 0}  B {42.86249999999999715782906 0 0}  C {0 -42.86249999999999715782906 0}  D {42.86249999999999715782906 0 0} 
-put {spki_1_1_7} comb region no tree {l spki {-0.5 0.866025 0 0  -0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_6} comb region no tree {l spkk {-0.939693 0.34202 0 0  -0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {rcas11t.s1} tgc V {0 0 0}  H {0 0 1.651000000000000023092639}  A {0 -22.85999999999999943156581 0}  B {22.85999999999999943156581 0 0}  C {0 -22.85999999999999943156581 0}  D {22.85999999999999943156581 0 0} 
-put {spkj_1_1_6} comb region no tree {l spkj {-0.939693 0.34202 0 0  -0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {spkl_1_1_5} comb region no tree {l spkl {-0.939693 -0.34202 0 0  0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {spki_1_1_6} comb region no tree {l spki {-0.939693 0.34202 0 0  -0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_5} comb region no tree {l spkk {-0.939693 -0.34202 0 0  0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {spkj_1_1_5} comb region no tree {l spkj {-0.939693 -0.34202 0 0  0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {spkl_1_1_4} comb region no tree {l spkl {-0.5 -0.866025 0 0  0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {spki_1_1_5} comb region no tree {l spki {-0.939693 -0.34202 0 0  0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_4} comb region no tree {l spkk {-0.5 -0.866025 0 0  0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {spkj_1_1_4} comb region no tree {l spkj {-0.5 -0.866025 0 0  0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {spkl_1_1_3} comb region no tree {l spkl {0.173648 -0.984808 0 0  0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {spki_1_1_4} comb region no tree {l spki {-0.5 -0.866025 0 0  0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_3} comb region no tree {l spkk {0.173648 -0.984808 0 0  0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {spkj_1_1_3} comb region no tree {l spkj {0.173648 -0.984808 0 0  0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {spkl_1_1_2} comb region no tree {l spkl {0.766044 -0.642788 0 0  0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {spki_1_1_3} comb region no tree {l spki {0.173648 -0.984808 0 0  0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_2} comb region no tree {l spkk {0.766044 -0.642788 0 0  0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {spkj_1_1_2} comb region no tree {l spkj {0.766044 -0.642788 0 0  0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {rcastooth.s19_1_3} comb region no tree {l rcastooth.s {1 0 0 -49.3857  0 1 0 -42.3962  0 0 1 0  0 0 0 1}}
-put {spkl_1_1_1} comb region no tree {l spkl}
-put {spki_1_1_2} comb region no tree {l spki {0.766044 -0.642788 0 0  0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {spkk_1_1_1} comb region no tree {l spkk}
-put {spkj_1_1_1} comb region no tree {l spkj}
-put {spki_1_1_1} comb region no tree {l spki}
-put {rcastooth.s18_1_3} comb region no tree {l rcastooth.s {1 0 0 -56.909  0 1 0 -31.5871  0 0 1 0  0 0 0 1}}
-put {rcastooth.s19_1_2} comb region no tree {l rcastooth.s {1 0 0 -16.3908  0 1 0 -54.7491  0 0 1 0  0 0 0 1}}
-put {rcastooth.s16_1_4} comb region no tree {l rcastooth.s {1 0 0 -64.7536  0 1 0 -6.58479  0 0 1 0  0 0 0 1}}
-put {rcastooth.s17_1_3} comb region no tree {l rcastooth.s {1 0 0 -62.1025  0 1 0 -19.4848  0 0 1 0  0 0 0 1}}
-put {rcastooth.s18_1_2} comb region no tree {l rcastooth.s {1 0 0 -28.575  0 1 0 -49.4934  0 0 1 0  0 0 0 1}}
-put {rcastooth.s14_1_5} comb region no tree {l rcastooth.s {1 0 0 -62.1025  0 1 0 19.4848  0 0 1 0  0 0 0 1}}
-put {rcastooth.s19_1_1} comb region no tree {l rcastooth.s {1 0 0 22.641  0 1 0 -43.6951  0 0 1 0  0 0 0 1}}
-put {rcastooth.s15_1_4} comb region no tree {l rcastooth.s {1 0 0 -64.7536  0 1 0 6.58479  0 0 1 0  0 0 0 1}}
-put {rcastooth.s16_1_3} comb region no tree {l rcastooth.s {1 0 0 -47.7481  0 1 0 -31.4044  0 0 1 0  0 0 0 1}}
-put {rcastooth.s12_1_6} comb region no tree {l rcastooth.s {1 0 0 -49.3857  0 1 0 42.3962  0 0 1 0  0 0 0 1}}
-put {rcastooth.s17_1_2} comb region no tree {l rcastooth.s {1 0 0 -39.2187  0 1 0 -41.5694  0 0 1 0  0 0 0 1}}
-put {rcastooth.s13_1_5} comb region no tree {l rcastooth.s {1 0 0 -56.909  0 1 0 31.5871  0 0 1 0  0 0 0 1}}
-put {rcastooth.s18_1_1} comb region no tree {l rcastooth.s {1 0 0 10.0126  0 1 0 -48.1832  0 0 1 0  0 0 0 1}}
-put {rcastooth.s14_1_4} comb region no tree {l rcastooth.s {1 0 0 -56.7636  0 1 0 -6.63471  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_7} comb region no tree {l rcastooth.s {1 0 0 -28.6642  0 1 0 58.4359  0 0 1 0  0 0 0 1}}
-put {rrim.s1sh} tgc V {177.7999999999999829469743 0 11.81099999999999994315658}  H {38.09999999999999431565811 0 0}  A {0 0 -2.285999999999999587885213}  B {0 2.285999999999999587885213 0}  C {0 0 -2.285999999999999587885213}  D {0 2.285999999999999587885213 0} 
-put {rcastooth.s15_1_3} comb region no tree {l rcastooth.s {1 0 0 -53.7034  0 1 0 -19.5465  0 0 1 0  0 0 0 1}}
-put {rcastooth.s11_1_6} comb region no tree {l rcastooth.s {1 0 0 -39.8404  0 1 0 51.4696  0 0 1 0  0 0 0 1}}
-put {rcas28t.c1} comb region no tree {- {l rcas28t.s1 {1 0 0 0  0 1 0 0  0 0 1 31.892875  0 0 0 1}} {l rcas28t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 31.892875  0 0 0 1}}}
-put {rcastooth.s16_1_2} comb region no tree {l rcastooth.s {1 0 0 -16.4803  0 1 0 -46.371  0 0 1 0  0 0 0 1}}
-put {rcastooth.s12_1_5} comb region no tree {l rcastooth.s {1 0 0 -53.7034  0 1 0 19.5465  0 0 1 0  0 0 0 1}}
-put {rcas18t.c1} comb region no tree {- {l rcas18t.s1 {1 0 0 0  0 1 0 0  0 0 1 18.2245  0 0 0 1}} {l rcas18t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 18.2245  0 0 0 1}}}
-put {rcastooth.s17_1_1} comb region no tree {l rcastooth.s {1 0 0 -3.35838  0 1 0 -49.0978  0 0 1 0  0 0 0 1}}
-put {rcastooth.s26_1_1} comb region no tree {l rcastooth.s {1 0 0 34.4289  0 1 0 -55.2361  0 0 1 0  0 0 0 1}}
-put {rcastooth.s13_1_4} comb region no tree {l rcastooth.s {1 0 0 -56.7636  0 1 0 6.63471  0 0 1 0  0 0 0 1}}
-put {rcastooth.s14_1_3} comb region no tree {l rcastooth.s {1 0 0 -38.1747  0 1 0 -31.0574  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_6} comb region no tree {l rcastooth.s {1 0 0 -39.2187  0 1 0 41.5694  0 0 1 0  0 0 0 1}}
-put {rcastooth.s15_1_2} comb region no tree {l rcastooth.s {1 0 0 -28.3799  0 1 0 -40.2051  0 0 1 0  0 0 0 1}}
-put {rcastooth.s11_1_5} comb region no tree {l rcastooth.s {1 0 0 -47.7481  0 1 0 31.4044  0 0 1 0  0 0 0 1}}
-put {rcas16t.c1} comb region no tree {- {l rcas16t.s1 {1 0 0 0  0 1 0 0  0 0 1 13.668375  0 0 0 1}} {l rcas16t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 13.668375  0 0 0 1}}}
-put {rcastooth.s16_1_1} comb region no tree {l rcastooth.s {1 0 0 13.2452  0 1 0 -40.7647  0 0 1 0  0 0 0 1}}
-put {rcastooth.s25_1_1} comb region no tree {l rcastooth.s {1 0 0 22.6052  0 1 0 -61.0359  0 0 1 0  0 0 0 1}}
-put {rcastooth.s12_1_4} comb region no tree {l rcastooth.s {1 0 0 -48.7541  0 1 0 -6.7011  0 0 1 0  0 0 0 1}}
-put {rcas24t.c1} comb region no tree {- {l rcas24t.s1 {1 0 0 0  0 1 0 0  0 0 1 27.33675  0 0 0 1}} {l rcas24t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 27.33675  0 0 0 1}}}
-put {rcastooth.s13_1_3} comb region no tree {l rcastooth.s {1 0 0 -45.1383  0 1 0 -19.6063  0 0 1 0  0 0 0 1}}
-put {rcastooth.s14_1_2} comb region no tree {l rcastooth.s {1 0 0 -13.2452  0 1 0 -40.7647  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_5} comb region no tree {l rcastooth.s {1 0 0 -45.1383  0 1 0 19.6063  0 0 1 0  0 0 0 1}}
-put {rcas14t.c1} comb region no tree {- {l rcas14t.s1 {1 0 0 0  0 1 0 0  0 0 1 9.11225  0 0 0 1}} {l rcas14t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 9.11225  0 0 0 1}}}
-put {rcas32t.c1} comb region no tree {- {l rcas32t.s1 {1 0 0 0  0 1 0 0  0 0 1 36.449  0 0 0 1}} {l rcas32t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 36.449  0 0 0 1}}}
-put {rcastooth.s15_1_1} comb region no tree {l rcastooth.s {1 0 0 2.2761e-10  0 1 0 -42.8625  0 0 1 0  0 0 0 1}}
-put {rcastooth.s24_1_1} comb region no tree {l rcastooth.s {1 0 0 9.85606  0 1 0 -64.3369  0 0 1 0  0 0 0 1}}
-put {rcastooth.s11_1_4} comb region no tree {l rcastooth.s {1 0 0 -48.7541  0 1 0 6.7011  0 0 1 0  0 0 0 1}}
-put {rcastooth.s12_1_3} comb region no tree {l rcastooth.s {1 0 0 -34.6765  0 1 0 -25.1939  0 0 1 0  0 0 0 1}}
-put {rcastooth.s13_1_2} comb region no tree {l rcastooth.s {1 0 0 -25.1939  0 1 0 -34.6765  0 0 1 0  0 0 0 1}}
-put {rcas12t.c1} comb region no tree {- {l rcas12t.s1 {1 0 0 0  0 1 0 0  0 0 1 4.556125  0 0 0 1}} {l rcas12t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 4.556125  0 0 0 1}}}
-put {rcastooth.s22_1_2} comb region no tree {l rcastooth.s {1 0 0 -16.3143  0 1 0 -63.0097  0 0 1 0  0 0 0 1}}
-put {rcas21t.c1} comb region no tree {- {l rcas21t.s1 {1 0 0 0  0 1 0 0  0 0 1 22.780625  0 0 0 1}} {l rcas21t.s1-1 {1 0 0 0  0 1 0 0  0 0 1 22.780625  0 0 0 1}}}
-put {rcastooth.s14_1_1} comb region no tree {l rcastooth.s {1 0 0 16.275  0 1 0 -32.6846  0 0 1 0  0 0 0 1}}
-put {rcastooth.s23_1_1} comb region no tree {l rcastooth.s {1 0 0 -3.29663  0 1 0 -65.004  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_4} comb region no tree {l rcastooth.s {1 0 0 -42.8625  0 1 0 -8.86496e-12  0 0 1 0  0 0 0 1}}
-put {rcas11t.c1} comb region no tree {- {l rcas11t.s1} {l rcas11t.s1-1}}
-put {rcastooth.s11_1_3} comb region no tree {l rcastooth.s {1 0 0 -40.7647  0 1 0 -13.2452  0 0 1 0  0 0 0 1}}
-put {rcastooth.s12_1_2} comb region no tree {l rcastooth.s {1 0 0 -9.99212  0 1 0 -35.1187  0 0 1 0  0 0 0 1}}
-put {rcastooth.s21_1_2} comb region no tree {l rcastooth.s {1 0 0 -28.6642  0 1 0 -58.4359  0 0 1 0  0 0 0 1}}
-put {rcastooth.s13_1_1} comb region no tree {l rcastooth.s {1 0 0 3.36895  0 1 0 -36.3567  0 0 1 0  0 0 0 1}}
-put {rcastooth.s22_1_1} comb region no tree {l rcastooth.s {1 0 0 22.636  0 1 0 -52.4761  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_3} comb region no tree {l rcastooth.s {1 0 0 -31.0436  0 1 0 -19.2214  0 0 1 0  0 0 0 1}}
-put {rcastooth.s11_1_2} comb region no tree {l rcastooth.s {1 0 0 -22.0037  0 1 0 -29.1376  0 0 1 0  0 0 0 1}}
-put {rcastooth.s20_1_2} comb region no tree {l rcastooth.s {1 0 0 -39.8404  0 1 0 -51.4696  0 0 1 0  0 0 0 1}}
-put {rcastooth.s12_1_1} comb region no tree {l rcastooth.s {1 0 0 10.1056  0 1 0 -31.1019  0 0 1 0  0 0 0 1}}
-put {rcastooth.s21_1_1} comb region no tree {l rcastooth.s {1 0 0 9.92399  0 1 0 -56.2818  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_2} comb region no tree {l rcastooth.s {1 0 0 -16.3512  0 1 0 -28.3212  0 0 1 0  0 0 0 1}}
-put {rcastooth.s11_1_1} comb region no tree {l rcastooth.s {1 0 0 -3.41834  0 1 0 -32.5234  0 0 1 0  0 0 0 1}}
-put {rcastooth.s20_1_1} comb region no tree {l rcastooth.s {1 0 0 -3.32298  0 1 0 -57.0533  0 0 1 0  0 0 0 1}}
-put {rcastooth.s10_1_1} comb region no tree {l rcastooth.s {1 0 0 3.47495  0 1 0 -28.6188  0 0 1 0  0 0 0 1}}
-put {rtire.s1-1} eto V {0 0 11.81099999999999994315658}  N {0 0 25.39999999999999857891453}  C {15.87499999999999822364316 0 0}  r 222.25 r_d 14.28749999999999964472863
-put {spokes.r} comb region yes tree {u {u {l spoke_A} {l spoke_b}} {u {l spoke_c} {l spoke_d}}}
-attr set {spokes.r} {region} {R} {region_id} {1000} {material_id} {1} {los} {100}
-put {rrim.s29sh_1_1_29} comb region no tree {l rrim.s1sh {0.173648 0.984808 0 0  -0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s19sh_1_1_19} comb region no tree {l rrim.s1sh {-1 -9.79318e-12 0 0  9.79318e-12 -1 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s28sh_1_1_28} comb region no tree {l rrim.s1sh {-1.46898e-11 1 0 0  -1 -1.46898e-11 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s18sh_1_1_18} comb region no tree {l rrim.s1sh {-0.984808 -0.173648 0 0  0.173648 -0.984808 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s27sh_1_1_27} comb region no tree {l rrim.s1sh {-0.173648 0.984808 0 0  -0.984808 -0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s36sh_1_1_36} comb region no tree {l rrim.s1sh {0.984808 0.173648 0 0  -0.173648 0.984808 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s17sh_1_1_17} comb region no tree {l rrim.s1sh {-0.939693 -0.34202 0 0  0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s26sh_1_1_26} comb region no tree {l rrim.s1sh {-0.34202 0.939693 0 0  -0.939693 -0.34202 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s35sh_1_1_35} comb region no tree {l rrim.s1sh {0.939693 0.34202 0 0  -0.34202 0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s16sh_1_1_16} comb region no tree {l rrim.s1sh {-0.866025 -0.5 0 0  0.5 -0.866025 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s25sh_1_1_25} comb region no tree {l rrim.s1sh {-0.5 0.866025 0 0  -0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s34sh_1_1_34} comb region no tree {l rrim.s1sh {0.866025 0.5 0 0  -0.5 0.866025 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s15sh_1_1_15} comb region no tree {l rrim.s1sh {-0.766044 -0.642788 0 0  0.642788 -0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s24sh_1_1_24} comb region no tree {l rrim.s1sh {-0.642788 0.766044 0 0  -0.766044 -0.642788 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s33sh_1_1_33} comb region no tree {l rrim.s1sh {0.766044 0.642788 0 0  -0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s14sh_1_1_14} comb region no tree {l rrim.s1sh {-0.642788 -0.766044 0 0  0.766044 -0.642788 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s23sh_1_1_23} comb region no tree {l rrim.s1sh {-0.766044 0.642788 0 0  -0.642788 -0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s32sh_1_1_32} comb region no tree {l rrim.s1sh {0.642788 0.766044 0 0  -0.766044 0.642788 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s13sh_1_1_13} comb region no tree {l rrim.s1sh {-0.5 -0.866025 0 0  0.866025 -0.5 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s22sh_1_1_22} comb region no tree {l rrim.s1sh {-0.866025 0.5 0 0  -0.5 -0.866025 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s31sh_1_1_31} comb region no tree {l rrim.s1sh {0.5 0.866025 0 0  -0.866025 0.5 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s12sh_1_1_12} comb region no tree {l rrim.s1sh {-0.34202 -0.939693 0 0  0.939693 -0.34202 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s21sh_1_1_21} comb region no tree {l rrim.s1sh {-0.939693 0.34202 0 0  -0.34202 -0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s30sh_1_1_30} comb region no tree {l rrim.s1sh {0.34202 0.939693 0 0  -0.939693 0.34202 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s11sh_1_1_11} comb region no tree {l rrim.s1sh {-0.173648 -0.984808 0 0  0.984808 -0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s20sh_1_1_20} comb region no tree {l rrim.s1sh {-0.984808 0.173648 0 0  -0.173648 -0.984808 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s10sh_1_1_10} comb region no tree {l rrim.s1sh {4.89659e-12 -1 0 0  1 4.89659e-12 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s1-4} comb region no tree {- {l rrii} {l rri}}
-put {rrim.s1-3} comb region no tree {u {u {u {u {u {u {l rrim.s1sh_1_1_1} {l rrim.s2sh_1_1_2}} {u {l rrim.s3sh_1_1_3} {l rrim.s4sh_1_1_4}}} {u {u {l rrim.s5sh_1_1_5} {l rrim.s6sh_1_1_6}} {u {l rrim.s7sh_1_1_7} {l rrim.s8sh_1_1_8}}}} {u {u {u {l rrim.s9sh_1_1_9} {l rrim.s10sh_1_1_10}} {u {l rrim.s11sh_1_1_11} {l rrim.s12sh_1_1_12}}} {u {u {l rrim.s13sh_1_1_13} {l rrim.s14sh_1_1_14}} {u {l rrim.s15sh_1_1_15} {l rrim.s16sh_1_1_16}}}}} {u {u {u {u {l rrim.s17sh_1_1_17} {l rrim.s18sh_1_1_18}} {u {l rrim.s19sh_1_1_19} {l rrim.s20sh_1_1_20}}} {u {u {l rrim.s21sh_1_1_21} {l rrim.s22sh_1_1_22}} {u {l rrim.s23sh_1_1_23} {l rrim.s24sh_1_1_24}}}} {u {u {u {l rrim.s25sh_1_1_25} {l rrim.s26sh_1_1_26}} {u {l rrim.s27sh_1_1_27} {l rrim.s28sh_1_1_28}}} {u {u {l rrim.s29sh_1_1_29} {l rrim.s30sh_1_1_30}} {u {l rrim.s31sh_1_1_31} {l rrim.s32sh_1_1_32}}}}}} {u {u {l rrim.s33sh_1_1_33} {l rrim.s34sh_1_1_34}} {u {l rrim.s35sh_1_1_35} {l rrim.s36sh_1_1_36}}}}
-put {rrim.s1-2} tgc V {0 0 25.19983160980545022766819}  H {0 0 -13.38883160980544850815477}  A {0 197.3801853527571950053243 0}  B {197.3801853527571950053243 0 0}  C {0 192.8812499999999943156581 0}  D {192.8812499999999943156581 0 0} 
-put {rrim.s1-1} tgc V {0 0 -1.453479018435659853025754}  H {0 0 14.75836748475629534027576}  A {0 -197.3384002078076662201056 0}  B {197.3384002078076662201056 0 0}  C {0 -192.3792713486825789459544 0}  D {192.3792713486825789459544 0 0} 
-put {rhub.s5-1} comb region no tree {u {u {u {u {u {l rhspkh_1_1_1} {l rhspkh_1_1_2}} {u {l rhspkh_1_1_3} {l rhspkh_1_1_4}}} {u {u {l rhspkh_1_1_5} {l rhspkh_1_1_6}} {u {l rhspkh_1_1_7} {l rhspkh_1_1_8}}}} {u {u {u {l rhspkh_1_1_9} {l rhspkh_1_1_10}} {u {l rhspkh_1_1_11} {l rhspkh_1_1_12}}} {u {u {l rhspkh_1_1_13} {l rhspkh_1_1_14}} {u {l rhspkh_1_1_15} {l rhspkh_1_1_16}}}}} {u {l rhspkh_1_1_17} {l rhspkh_1_1_18}}}
-put {rhub.s3-1} comb region no tree {u {u {u {u {u {l rhspkh2_1_1_1} {l rhspkh2_1_1_2}} {u {l rhspkh2_1_1_3} {l rhspkh2_1_1_4}}} {u {u {l rhspkh2_1_1_5} {l rhspkh2_1_1_6}} {u {l rhspkh2_1_1_7} {l rhspkh2_1_1_8}}}} {u {u {u {l rhspkh2_1_1_9} {l rhspkh2_1_1_10}} {u {l rhspkh2_1_1_11} {l rhspkh2_1_1_12}}} {u {u {l rhspkh2_1_1_13} {l rhspkh2_1_1_14}} {u {l rhspkh2_1_1_15} {l rhspkh2_1_1_16}}}}} {u {l rhspkh2_1_1_17} {l rhspkh2_1_1_18}}}
-put {rhub.s1-1} tgc V {0 0 -1.587500000000000133226763}  H {0 0 149.2249999999999943156581}  A {0 -2.540000000000000035527137 0}  B {2.540000000000000035527137 0 0}  C {0 -2.540000000000000035527137 0}  D {2.540000000000000035527137 0 0} 
-put {rrimi.s2} tgc V {0 0 1.016000000000000014210855}  H {0 0 21.59000000000000341060513}  A {0 -208.5339999999999633928383 0}  B {208.5339999999999633928383 0 0}  C {0 -208.5339999999999633928383 0}  D {208.5339999999999633928383 0 0} 
-put {rtire.s1} eto V {0 0 11.81099999999999994315658}  N {0 0 25.39999999999999857891453}  C {17.46249999999999857891453 0 0}  r 222.25 r_d 15.875
-put {rrimi.s1} tgc V {0 0 2.032000000000000028421709}  H {0 0 19.55799999999999982946974}  A {0 -211.1374999999999602096068 0}  B {211.1374999999999602096068 0 0}  C {0 -211.1374999999999602096068 0}  D {211.1374999999999602096068 0 0} 
-put {rtire.r1} comb region yes tree {- {- {l rtire.s1 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}} {l rrim.s1 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}}} {l rtire.s1-1 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}}}
-attr set {rtire.r1} {color} {33/33/33} {shader} {stack {{fbmbump {o 4 s 5 a 30}} {plastic {}}}} {region} {R} {region_id} {1002} {material_id} {1} {los} {100}
-put {spoke_d} comb region no tree {u {u {u {u {l spkj_1_1_1} {l spkj_1_1_2}} {u {l spkj_1_1_3} {l spkj_1_1_4}}} {u {u {l spkj_1_1_5} {l spkj_1_1_6}} {u {l spkj_1_1_7} {l spkj_1_1_8}}}} {l spkj_1_1_9}}
-put {spoke_c} comb region no tree {u {u {u {u {l spki_1_1_1} {l spki_1_1_2}} {u {l spki_1_1_3} {l spki_1_1_4}}} {u {u {l spki_1_1_5} {l spki_1_1_6}} {u {l spki_1_1_7} {l spki_1_1_8}}}} {l spki_1_1_9}}
-put {spoke_b} comb region no tree {u {u {u {u {l spkl_1_1_1} {l spkl_1_1_2}} {u {l spkl_1_1_3} {l spkl_1_1_4}}} {u {u {l spkl_1_1_5} {l spkl_1_1_6}} {u {l spkl_1_1_7} {l spkl_1_1_8}}}} {l spkl_1_1_9}}
-put {spoke_A} comb region no tree {u {u {u {u {l spkk_1_1_1} {l spkk_1_1_2}} {u {l spkk_1_1_3} {l spkk_1_1_4}}} {u {u {l spkk_1_1_5} {l spkk_1_1_6}} {u {l spkk_1_1_7} {l spkk_1_1_8}}}} {l spkk_1_1_9}}
-put {rhspkh2} tgc V {21.7622817260637724245953 3.83727743008382748968188 35.05199999999999249666871}  H {0 0 3.809999999999999609201495}  A {0.2756664820462519926991263 -1.563382307906880042125408 0}  B {1.563382307906880042125408 0.2756664820462519926991263 0}  C {0.2756664820462519926991263 -1.563382307906880042125408 0}  D {1.563382307906880042125408 0.2756664820462519926991263 0} 
-put {rrim.s1} tgc V {0 0 0}  H {0 0 23.62199999999999988631316}  A {0 -209.5499999999999829469743 0}  B {209.5499999999999829469743 0 0}  C {0 -209.5499999999999829469743 0}  D {209.5499999999999829469743 0 0} 
-put {rhub.s5} tgc V {0 0 91.5669999999999930651029}  H {0 0 3.174999999999999822364316}  A {0 -26.86049999999999826627572 0}  B {26.8605000000000018189894 0 0}  C {0 -26.86049999999999826627572 0}  D {26.8605000000000018189894 0 0} 
-put {rrim.r1} comb region yes tree {- {- {- {- {l rrim.s1 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}} {l rrim.s1-1 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}}} {l rrim.s1-2 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}}} {l rrim.s1-3 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}}} {l rrim.s1-4 {1 0 0 0  0 1 0 0  0 0 1 61.214  0 0 0 1}}}
-attr set {rrim.r1} {region} {R} {region_id} {1001} {material_id} {1} {los} {100}
-put {rhub.s4} tgc V {0 0 38.73499999999999232613845}  H {0 0 52.83200000000000073896445}  A {0 -15.04950000000000009947598 0}  B {15.04950000000000009947598 0 0}  C {0 -15.04950000000000009947598 0}  D {15.04950000000000009947598 0 0} 
-put {rhub.s3} tgc V {0 0 35.5599999999999951683094}  H {0 0 3.174999999999999822364316}  A {0 -26.86049999999999826627572 0}  B {26.8605000000000018189894 0 0}  C {0 -26.86049999999999826627572 0}  D {26.8605000000000018189894 0 0} 
-put {rhub.s2} tgc V {0 0 12.69999999999999928945726}  H {0 0 22.85999999999999943156581}  A {0 -6.349999999999999644728632 0}  B {6.349999999999999644728632 0 0}  C {0 -11.42999999999999971578291 0}  D {11.42999999999999971578291 0 0} 
-put {rcas.s2} tgc V {0 0 0}  H {0 0 38.09999999999999431565811}  A {0 -17.7799999999999975841547 0}  B {17.7799999999999975841547 0 0}  C {0 -17.7799999999999975841547 0}  D {17.7799999999999975841547 0 0} 
-put {rhub.s1} tgc V {0 0 0}  H {0 0 146.0499999999999829469743}  A {0 -4.889499999999999957367436 0}  B {4.889499999999999957367436 0 0}  C {0 -4.889499999999999957367436 0}  D {4.889499999999999957367436 0 0} 
-put {rhub.r1} comb region yes tree {u {u {u {u {- {l rhub.s1} {l rhub.s1-1}} {l rhub.s2}} {- {l rhub.s3} {l rhub.s3-1}}} {l rhub.s4}} {- {l rhub.s5} {l rhub.s5-1}}}
-attr set {rhub.r1} {color} {35/35/35} {shader} {plastic} {region} {R} {region_id} {1001} {material_id} {1} {los} {100}
-put {rhspkh} tgc V {22.09799999999999897681846 0 91.43999999999999772626325}  H {0 0 3.809999999999999609201495}  A {0 -1.587499999999999911182158 0}  B {1.587499999999999911182158 0 0}  C {0 -1.587499999999999911182158 0}  D {1.587499999999999911182158 0 0} 
-put {rwheel} comb region no tree {u {u {u {l rcassette.r {1 0 0 0  0 -1 0 0  0 0 -1 139.7  0 0 0 1}} {l rhub.r1}} {u {l rrim.r1} {l rtire.r1}}} {l spokes.r}}
-put {rri.s3} tor V {0 0 23.62199999999999988631316}  H {0 0 0.9999999999999998889776975}  r_a 196.8499999999999943156581 r_h 6.349999999999999644728632
-put {rri.s2} tor V {0 0 0}  H {0 0 0.9999999999999998889776975}  r_a 196.8499999999999943156581 r_h 6.349999999999999644728632
-put {rri.s1} tgc V {0 0 5.080000000000000071054274}  H {0 0 13.97000000000000063948846}  A {0 -196.8499999999999658939487 0}  B {196.8499999999999943156581 0 0}  C {0 -196.8499999999999658939487 0}  D {196.8499999999999943156581 0 0} 
-put {rrim.s9sh_1_1_9} comb region no tree {l rrim.s1sh {0.173648 -0.984808 0 0  0.984808 0.173648 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s8sh_1_1_8} comb region no tree {l rrim.s1sh {0.34202 -0.939693 0 0  0.939693 0.34202 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s7sh_1_1_7} comb region no tree {l rrim.s1sh {0.5 -0.866025 0 0  0.866025 0.5 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s6sh_1_1_6} comb region no tree {l rrim.s1sh {0.642788 -0.766044 0 0  0.766044 0.642788 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s5sh_1_1_5} comb region no tree {l rrim.s1sh {0.766044 -0.642788 0 0  0.642788 0.766044 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s4sh_1_1_4} comb region no tree {l rrim.s1sh {0.866025 -0.5 0 0  0.5 0.866025 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s3sh_1_1_3} comb region no tree {l rrim.s1sh {0.939693 -0.34202 0 0  0.34202 0.939693 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s2sh_1_1_2} comb region no tree {l rrim.s1sh {0.984808 -0.173648 0 0  0.173648 0.984808 0 0  0 0 1 0  0 0 0 1}}
-put {rrim.s1sh_1_1_1} comb region no tree {l rrim.s1sh}
-put {spkl} pipe V0 { 20.76709480285642683838887 7.551670837402355118683772 90.65737819671632280460472 } O0 1.337557689563829255163796 I0 -0 R0 1.778000000000000024868996 V1 { 20.77675991058347904072434 7.551670837402345348721155 91.2437280654907425514466 } O1 3.550397189753127680234002 I1 -0 R1 1.778000000000000024868996 V2 { 20.76548395156863691113358 7.551670837402342684185896 92.05237541198734163572226 } O2 1.778000000000000024868996 I2 -0 R2 1.778000000000000024868996 V3 { 20.76709480285642328567519 7.551670837402365776824809 97.27797698974610796085472 } O3 1.778000000000000024868996 I3 -0 R3 1.778000000000000024868996 V4 { 96.65107727050778407829057 -168.714120483398488659077 72.89613189697269035605132 } O4 1.778000000000000024868996 I4 -0 R4 1.778000000000000024868996
-put {spkk} pipe V0 { 22.11288281250000409272616 0.01288681030274606807706217 95.60269165039063921085472 } O0 1.785138282554655120293319 I0 -0 R0 6.598046874999998756550212 V1 { 22.11288281250000409272616 0.01288681030274606807706217 95.03567199707032386868377 } O1 4.070271197360822768018807 I1 -0 R1 6.598046874999998756550212 V2 { 22.11288281250001475086719 0.01288681030274606807706217 93.65678329467775142802566 } O2 1.778000000000000024868996 I2 -0 R2 6.598046874999998756550212 V3 { 22.10339501953125207478479 0.08911623464794377058595387 90.33015632036135400539933 } O3 1.778000000000000024868996 I3 -0 R3 2.496955272208652765186798 V4 { 33.55725402832030823674359 192.3227569580077442878974 73.30678124999998601651896 } O4 1.778000000000000024868996 I4 -0 R4 6.598046874999998756550212
-put {spkj} pipe V0 { 19.1582472419363760707256 10.97847094045843441278976 39.25328368547360469165142 } O0 1.074875597385660741522884 I0 -0 R0 1.778000000000000024868996 V1 { 19.15824724193638672886664 10.97847094045843441278976 38.81835383775631953540142 } O1 3.552089230759687854543927 I1 -0 R1 1.778000000000000024868996 V2 { 19.15824724193635120172985 10.97847094045843441278976 38.33187674882810114240783 } O2 1.778000000000000024868996 I2 -0 R2 1.778000000000000024868996 V3 { 19.15824724193635830715721 10.97847094045843441278976 32.88719939592282770490783 } O3 1.778000000000000024868996 I3 -0 R3 1.778000000000000024868996 V4 { 124.1515304565429431704615 -148.5849227905274005934189 73.63529357316897971941216 } O4 1.778000000000000024868996 I4 -0 R4 1.778000000000000024868996
-put {spki} pipe V0 { 21.85159059520787394603758 3.839178032743594037867751 34.56892814042966932674972 } O0 1.778000000000000024868996 I0 -0 R0 1.778000000000000024868996 V1 { 21.85159059520787749875126 3.839178032743594037867751 34.81377753618162529392066 } O1 3.311175825425637153642811 I1 -0 R1 1.778000000000000024868996 V2 { 21.85159059520787749875126 3.839178032743594037867751 35.07151374223631279392066 } O2 1.777999999999999802824391 I2 -0 R2 1.778000000000000024868996 V3 { 21.85159059520787394603758 3.848843140470644463846384 39.34188050630491062520377 } O3 1.777999999999999802824391 I3 -0 R3 1.778000000000000024868996 V4 { 0 192.9928710937499261035555 72.84086766820408342937299 } O4 1.777999999999999802824391 I4 -0 R4 1.778000000000000024868996
-put {rrii} comb region no tree {u {l rrimi.s1} {l rrimi.s2}}
-put {rri} comb region no tree {u {u {l rri.s1} {l rri.s2}} {l rri.s3}}

db/chess/CMakeLists.txt

@@ -1,5 +1,4 @@
-set(
-  CHESS_PARTS
+set(CHESS_PARTS
   bishop.asc
   chessboard.asc
   king.asc
@@ -7,16 +6,16 @@ set(
   pawn.asc
   queen.asc
   rook.asc
-)
+  )
 
 foreach(piece ${CHESS_PARTS})
-  g_target(${piece} "BRL-CAD Geometry Models/Sample/Chess")
+  ADD_G_TARGET(${piece} "BRL-CAD Geometry Models/Sample/Chess")
 endforeach(piece ${CHESS_PARTS})
 
-cmakefiles(
+CMAKEFILES(
   ${CHESS_PARTS}
   CMakeLists.txt
-)
+  )
 
 # Local Variables:
 # tab-width: 8

db/comgeom/CMakeLists.txt

@@ -1,10 +1,12 @@
-set(COMGEOM_V5_MODELS ADA073408.comgeom)
+set(COMGEOM_V5_MODELS
+  ADA073408.comgeom
+)
 
 foreach(comgeom_input ${COMGEOM_V5_MODELS})
-  g_target(${comgeom_input} "BRL-CAD Geometry Models/Sample")
+  ADD_G_TARGET(${comgeom_input} "BRL-CAD Geometry Models/Sample")
 endforeach(comgeom_input ${COMGEOM_V5_MODELS})
 
-cmakefiles(
+CMAKEFILES(
   ${COMGEOM_V5_MODELS}
   CMakeLists.txt
   README_ADA073408

db/conv_run.cmake.in

@@ -0,0 +1,41 @@
+string(REPLACE "\\" "" GCV_EXEC "${EXEC}")
+set(INPUT_FILE "@INPUT_FILE@")
+set(OUTPUT_FILE "@OUTPUT_FILE@")
+set(BIN_DIR "@BIN_DIR@")
+
+# NOTE: OUTPUT_FILE needs to be defined in terms of a path relative to the root
+# of the build diretory, not as an absolute path.  Since that root may change
+# at runtime in multiconfig builds, the full output path cannot be encoded
+# directly into the generated script.
+get_filename_component(OF_ABS "${OUTPUT_FILE}" ABSOLUTE)
+if ("${OF_ABS}" STREQUAL "${OUTPUT_FILE}")
+  message(FATAL_ERROR "Absoute output file path \"${OUTPUT_FILE}\" supplied for conversion of \"${INPUT_FILE}\" - path must be relative.")
+endif ("${OF_ABS}" STREQUAL "${OUTPUT_FILE}")
+
+# Because the build directory changes at runtime in multiconfig builds, we
+# need to deduce its current value from GCV_EXEC.
+get_filename_component(CBDIR "${GCV_EXEC}" DIRECTORY)
+string(REGEX REPLACE "${BIN_DIR}$" "" CROOT "${CBDIR}")
+
+# BRLCAD_ROOT is the hammer that makes certain we are running
+# things found in the build directory.
+set(ENV{BRLCAD_ROOT} "${CROOT}")
+
+# Now that we know the root, finalize the full path output file location
+set(OUTPUT_FILE "${CROOT}/${OUTPUT_FILE}")
+
+execute_process(
+  COMMAND "${GCV_EXEC}" -o "${OUTPUT_FILE}" "${INPUT_FILE}"
+  RESULT_VARIABLE conv_result OUTPUT_VARIABLE conv_log ERROR_VARIABLE conv_log
+  )
+
+if(conv_result)
+  message(FATAL_ERROR "[geometry conversion] Failure: ${conv_result}\n${GCV_EXEC} -o \"${OUTPUT_FILE}\" \"${INPUT_FILE}\"\n\n${conv_log}")
+endif(conv_result)
+
+# Local Variables:
+# tab-width: 8
+# mode: cmake
+# indent-tabs-mode: t
+# End:
+# ex: shiftwidth=2 tabstop=8

db/cube.rt

@@ -2,7 +2,7 @@
 #                         C U B E . R T
 # BRL-CAD
 #
-# Copyright (c) 2004-2026 United States Government as represented by
+# Copyright (c) 2004-2024 United States Government as represented by
 # the U.S. Army Research Laboratory.
 #
 # Redistribution and use in source and binary forms, with or without

db/db.php

@@ -2,7 +2,7 @@
 /*                         D B . P H P
  * BRL-CAD
  *
- * Copyright (c) 2004-2026 United States Government as represented by
+ * Copyright (c) 2004-2024 United States Government as represented by
  * the U.S. Army Research Laboratory.
  *
  * This library is free software; you can redistribute it and/or

db/earth.asc

@@ -1,39 +0,0 @@
-title {Earth Model v1.1 by starseeker}
-units km
-put {mesosphere.s} ell V {0 0 0}  A {6468100000 0 0}  B {0 6468100000 0}  C {0 0 6446800000} 
-put {mesosphere.c} comb region no tree {- {l mesosphere.s} {l stratosphere.s}}
-attr set {mesosphere.c} {shader} {glass {tr 0.85}}
-put {atmosphere.c} comb region no tree {u {u {- {l mesosphere.c} {l slice-earth-2.s}} {- {l stratosphere.c} {l slice-earth-2.s}}} {- {l troposphere.c} {l slice-earth-2.s}}}
-put {outer-core.s} ell V {0 0 0}  A {-2394906651.625486850738525 1382699999.999999523162842 0}  B {-1382699999.999999523162842 -2394906651.625486850738525 0}  C {0 0 2750000000} 
-put {inner-core.s} ell V {0 0 0}  A {-1047890738.579170942306519 604999999.9999997615814209 0}  B {-604999999.9999997615814209 -1047890738.579170942306519 0}  C {0 0 1210000000} 
-put {inner-core.r} comb region yes tree {n {l inner-core.s} {l slice-earth-2.s}}
-attr set {inner-core.r} {color} {255/255/255} {shader} {plastic {sp 0.9 di 0.1}} {region} {R} {region_id} {1003} {material_id} {1} {los} {100}
-put {lower-mantle-core-subtract.c} comb region no tree {u {l outer-core.s} {l inner-core.s}}
-put {upper-mantle-core-subtract.c} comb region no tree {u {u {l lower-mantle.s} {l outer-core.s}} {l inner-core.s}}
-put {slice-earth-outcore.s} arb8 V1 {1000000 1000000 1000000}  V2 {1500000000 11550000000 1500000000}  V3 {11550000000 1500000000 1500000000}  V4 {1000000 1000000 1000000}  V5 {1500000000 1500000000 11550000000}  V6 {1500000000 1500000000 11550000000}  V7 {1500000000 1500000000 11550000000}  V8 {1500000000 1500000000 11550000000} 
-put {crust-core-subtract.c} comb region no tree {u {u {l upper-mantle.s} {l lower-mantle.s}} {u {l outer-core.s} {l inner-core.s}}}
-put {outer-core-display.r} comb region yes tree {- {n {l outer-core.s} {l slice-earth-2.s}} {l inner-core.s}}
-attr set {outer-core-display.r} {color} {254/255/178} {shader} {plastic} {region} {R} {region_id} {1002} {material_id} {1} {los} {100}
-put {slice-earth-lowman.s} arb8 V1 {1000000 1000000 1000000}  V2 {1000000000 11550000000 1000000000}  V3 {11550000000 1000000000 1000000000}  V4 {1000000 1000000 1000000}  V5 {1000000000 1000000000 11550000000}  V6 {1000000000 1000000000 11550000000}  V7 {1000000000 1000000000 11550000000}  V8 {1000000000 1000000000 11550000000} 
-put {earth-cutaway.c} comb region no tree {- {l earth-crust.c} {l slice-earth.s}}
-put {earth-display.c} comb region no tree {u {u {u {u {u {l earth-cutaway.c} {l cutout-earth-backdrop.c}} {- {l upper-mantle-display.r} {l slice-earth-upman.s}}} {- {l lower-mantle-display.r} {l slice-earth-lowman.s}}} {- {l outer-core-display.r} {l slice-earth-outcore.s}}} {l inner-core.r}}
-put {stratosphere.s} ell V {0 0 0}  A {6428100000 0 0}  B {0 6428100000 0}  C {0 0 6406800000} 
-put {stratosphere.c} comb region no tree {- {l stratosphere.s} {l troposphere.s}}
-attr set {stratosphere.c} {shader} {glass {tr 0.8}}
-put {cutout-earth-backdrop.c} comb region no tree {n {l cutout-earth.c} {l earth-crust.s}}
-put {lower-mantle.s} ell V {0 0 0}  A {-4900404747.314247131347656 2829249999.999999046325684 0}  B {-2829249999.999999046325684 -4900404747.314247131347656 0}  C {0 0 5640000000} 
-put {upper-mantle.s} ell V {0 0 0}  A {-5474406384.942572593688965 3160649999.999999046325684 0}  B {-3160649999.999999046325684 -5474406384.942572593688965 0}  C {0 0 6300000000} 
-put {slice-earth-2.s} arb8 V1 {1000000 1000000 1000000}  V2 {1000000 11550000000 1000000}  V3 {11550000000 1000000 1000000}  V4 {1000000 1000000 1000000}  V5 {1000000 1000000 11550000000}  V6 {1000000 1000000 11550000000}  V7 {1000000 1000000 11550000000}  V8 {1000000 1000000 11550000000} 
-put {slice-earth-upman.s} arb8 V1 {1000000 1000000 1000000}  V2 {500000000 11550000000 500000000}  V3 {11550000000 500000000 500000000}  V4 {1000000 1000000 1000000}  V5 {500000000 500000000 11550000000}  V6 {500000000 500000000 11550000000}  V7 {500000000 500000000 11550000000}  V8 {500000000 500000000 11550000000} 
-put {cutout-earth.c} comb region no tree {- {l slice-earth.s} {l slice-earth-2.s}}
-put {troposphere.s} ell V {0 0 0}  A {6396100000 0 0}  B {0 6396100000 0}  C {0 0 6374800000} 
-put {earth-crust.s} ell V {0 0 0}  A {-5523596627.877529144287109 3189049999.999999046325684 0}  B {-3189049999.999999046325684 -5523596627.877529144287109 0}  C {0 0 6356800000} 
-put {troposphere.c} comb region no tree {- {l troposphere.s} {l earth-crust.s}}
-attr set {troposphere.c} {shader} {stack {{cloud {}} {glass {tr 0.65}}}}
-put {earth-crust.c} comb region no tree {- {l earth-crust.s} {l crust-core-subtract.c}}
-attr set {earth-crust.c} {shader} {texture {file earth.pix w 2048 n 1024}}
-put {slice-earth.s} arb8 V1 {0 0 0}  V2 {0 11500000000 0}  V3 {11500000000 0 0}  V4 {0 0 0}  V5 {0 0 11500000000}  V6 {0 0 11500000000}  V7 {0 0 11500000000}  V8 {0 0 11500000000} 
-put {lower-mantle-display.r} comb region yes tree {- {n {l lower-mantle.s} {l slice-earth-2.s}} {l lower-mantle-core-subtract.c}}
-attr set {lower-mantle-display.r} {color} {255/255/0} {shader} {plastic} {region} {R} {region_id} {1001} {material_id} {1} {los} {100}
-put {upper-mantle-display.r} comb region yes tree {- {n {l upper-mantle.s} {l slice-earth-2.s}} {l upper-mantle-core-subtract.c}}
-attr set {upper-mantle-display.r} {color} {254/160/60} {shader} {plastic} {region} {R} {region_id} {1000} {material_id} {1} {los} {100}

db/faa/CMakeLists.txt

@@ -1,14 +1,17 @@
-set(FAA_SAMPLE_MODELS Business_Jet.fg4 Generic_Twin.fg4)
+set(FAA_SAMPLE_MODELS
+  Business_Jet.fg4
+  Generic_Twin.fg4
+  )
 
 foreach(faa_input ${FAA_SAMPLE_MODELS})
-  g_target(${faa_input} "BRL-CAD Geometry Models/Sample")
+  ADD_G_TARGET(${faa_input} "BRL-CAD Geometry Models/Sample")
 endforeach(faa_input ${FAA_SAMPLE_MODELS})
 
-cmakefiles(
+CMAKEFILES(
   ${FAA_SAMPLE_MODELS}
   CMakeLists.txt
   README
-)
+  )
 
 # Local Variables:
 # tab-width: 8

db/nist/CMakeLists.txt

@@ -1,5 +1,4 @@
-set(
-  NIST_SAMPLE_MODELS
+set(NIST_SAMPLE_MODELS
   NIST_MBE_PMI_1.stp
   NIST_MBE_PMI_2.stp
   NIST_MBE_PMI_3.stp
@@ -11,10 +10,10 @@ set(
 )
 
 foreach(im ${NIST_SAMPLE_MODELS})
-  g_target(${im} "BRL-CAD Geometry Models/Sample")
+  ADD_G_TARGET(${im} "BRL-CAD Geometry Models/Sample")
 endforeach(im ${NIST_SAMPLE_MODELS})
 
-cmakefiles(
+CMAKEFILES(
   ${NIST_SAMPLE_MODELS}
   CMakeLists.txt
   README
@@ -30,7 +29,7 @@ cmakefiles(
   pdf/9.pdf
   pdf/10.pdf
   pdf/11.pdf
-)
+  )
 
 # Local Variables:
 # tab-width: 8

db/photo_holder.asc

@@ -1,27 +0,0 @@
-title {Photo holder by csanyi_pal}
-units mm
-put {keretgyurf.s} eto V {0 0 175}  N {0 0 0.9866229999999999167314968}  C {0 0 4.933115000000001693081231}  r 156 r_d 2.959869000000000749395213
-put {keretgyura.s} eto V {0 0 25}  N {0 0 0.9863332009625119800588777}  C {0 0 4.931666004812560011316691}  r 156 r_d 2.95899960288753804960038
-put {kartonekhk.s} tgc V {0 0 20}  H {0 0 160}  A {0 -162 0}  B {162 0 0}  C {0 -162 0}  D {162 0 0} 
-put {kartonekhb.s} tgc V {0 0 20}  H {0 0 160}  A {0 -161 0}  B {161 0 0}  C {0 -161 0}  D {161 0 0} 
-put {uvegszelo.s} arb8 V1 {0 0 0}  V2 {-273.2568000000004531102604 -199.463712010076335445774 0}  V3 {-273.2568000000004531102604 -199.4637120100763070240646 200}  V4 {-2.137306219959771470627159E-14 1.560125977964318386935442E-14 199.9999999999999715782906}  V5 {-273.2568000000009078576113 199.4637120100766765062872 0}  V6 {-273.2568000000009078576113 199.4637120100766765062872 0}  V7 {-273.2568000000009078576113 199.4637120100766765062872 200.0000000000001705302566}  V8 {-273.2568000000009078576113 199.4637120100766765062872 200.0000000000001705302566} 
-put {kereteehj.s} tgc V {-144.7437920000004965004337 58.16567399999996013093551 20}  H {0 0 160}  A {1.791839747726502229951961 4.667902132486008603962091 0}  B {-2.800741279491604895923729 1.075103848635900805064125 0}  C {1.791839747726502229951961 4.667902132486008603962091 0}  D {-2.800741279491604895923729 1.075103848635900805064125 0} 
-put {kereteehb.s} tgc V {-144.6299540000000831696525 -58.43016799999981714108799 20}  H {0 0 160}  A {1.873032967079560906498159 -4.635919272833937121447434 0}  B {2.781551563700361828779251 1.123819780247735433675871 0}  C {1.873032967079560906498159 -4.635919272833937121447434 0}  D {2.781551563700361828779251 1.123819780247735433675871 0} 
-put {kereteehjkicsi.s} tgc V {-144.736713000000236206688 58.16567399999982512781571 25}  H {0 0 150}  A {1.791839747726502229951961 4.667902132486008603962091 0}  B {-2.800741279491604895923729 1.075103848635900805064125 0}  C {1.791839747726502229951961 4.667902132486008603962091 0}  D {-2.800741279491604895923729 1.075103848635900805064125 0} 
-put {keptarto.c} comb region no tree {u {u {l uveglap.r} {l karton.r}} {l keret.r}}
-put {kereteehbkicsi.s} tgc V {-144.6299510000000339005055 -58.43016799999985266822478 25.00000000000002842170943}  H {0 0 150}  A {1.873032967079560906498159 -4.635919272833937121447434 0}  B {2.781551563700361828779251 1.123819780247735433675871 0}  C {1.873032967079560906498159 -4.635919272833937121447434 0}  D {2.781551563700361828779251 1.123819780247735433675871 0} 
-put {uvegekhk.s} tgc V {0 0 0}  H {0 0 200}  A {0 -160 0}  B {160 0 0}  C {0 -160 0}  D {160 0 0} 
-put {uvegekhb.s} tgc V {0 0 0}  H {0 0 200}  A {0 -156 0}  B {156 0 0}  C {0 -156 0}  D {156 0 0} 
-put {uveglap.r} comb region yes tree {n {- {l uvegekhk.s} {l uvegekhb.s}} {l uvegszelo.s}}
-attr set {uveglap.r} {color} {254/240/254} {shader} {glass} {region} {R} {region_id} {1000} {material_id} {1} {los} {100}
-put {kartonkozepenlyuk.s} ell V {-161.3665119999998296407284 9.880522794467734402637521E-15 100.0809629999999117444531}  A {7.347638122934263549268508E-16 12 0}  B {-12 7.347638122934263549268508E-16 0}  C {0 0 12} 
-put {karton.r} comb region yes tree {u {- {- {- {- {n {- {l kartonekhk.s} {l kartonekhb.s}} {l kartonszelok.s}} {l kartongmbab.s}} {l kartongmbaj.s}} {l kartongmbfk.s}} {l kartonkozepenlyuk.s}} {- {- {- {n {- {l kartonekhb.s} {l uvegekhk.s}} {l kartonszelok.s}} {l kartonszelob.s}} {l kartongmbab.s}} {l kartongmbaj.s}}}
-attr set {karton.r} {color} {255/255/255} {shader} {plastic} {region} {R} {region_id} {1003} {material_id} {1} {los} {100}
-put {keretszelokozepen.s} arb8 V1 {0 0 0}  V2 {-166.3083958664467161270295 -67.15610201701679216057528 0}  V3 {-166.3083958664467161270295 -67.15610201701677794972056 214.8175999999999135070539}  V4 {-1.578905978938171909047631E-16 1.426081241349886421227616E-14 214.8175999999999419287633}  V5 {-166.659954164212450677951 67.12896928889989567323937 0}  V6 {-166.659954164212450677951 67.12896928889989567323937 0}  V7 {-166.659954164212450677951 67.12896928889990988409409 214.8175999999999987721822}  V8 {-166.659954164212450677951 67.12896928889990988409409 214.8175999999999987721822} 
-put {keret.r} comb region yes tree {- {u {u {u {u {u {u {u {u {u {n {l keretgyura.s} {l kereteehb.s}} {l kereteehbkicsi.s}} {n {l keretgyura.s} {l kereteehj.s}}} {l kereteehjkicsi.s}} {n {l keretgyurf.s} {l kereteehb.s}}} {l kereteehbkicsi.s}} {n {l keretgyurf.s} {l kereteehj.s}}} {l kereteehjkicsi.s}} {n {l keretgyura.s} {l keretszelokozepen.s}}} {- {n {l keretgyurf.s} {l keretszelokozepen.s}} {l uveglap.r}}} {l uveglap.r}}
-attr set {keret.r} {color} {255/240/120} {shader} {plastic} {region} {R} {region_id} {1001} {material_id} {1} {los} {100}
-put {kartonszelok.s} arb8 V1 {0 0 0}  V2 {-168.0589500000000384716259 -71.77879269107120308035519 0}  V3 {-168.0589500000000384716259 -71.77879269107113202608161 224.0785999999999660303729}  V4 {-1.631395896368632521173223E-29 1.592174214692930869044001E-14 224.0786000000000228737917}  V5 {-168.0589500000001237367542 71.77879269107125992377405 0}  V6 {-168.0589500000001237367542 71.77879269107125992377405 0}  V7 {-168.0589500000001237367542 71.77879269107127413462877 224.0786000000000797172106}  V8 {-168.0589500000001237367542 71.77879269107127413462877 224.0786000000000797172106} 
-put {kartonszelob.s} arb8 V1 {0 0 0}  V2 {-166.4836399999998661769496 -63.37119199999997221084413 0}  V3 {-166.4836399999998661769496 -63.37119199999995799998942 214.8175999999999135070539}  V4 {-1.757644366536248560321584E-29 1.526370851934186986541124E-14 214.8175999999999419287633}  V5 {-166.4836399999998661769496 63.37119199999997221084413 0}  V6 {-166.4836399999998661769496 63.37119199999997221084413 0}  V7 {-166.4836399999998661769496 63.37119199999999352712621 214.8175999999999987721822}  V8 {-166.4836399999998661769496 63.37119199999999352712621 214.8175999999999987721822} 
-put {kartongmbfk.s} ell V {-161.2951809999994736699591 9.876155174676486577133334E-15 180.0822759999995525959093}  A {7.347638122934263549268508E-16 12 0}  B {-12 7.347638122934263549268508E-16 0}  C {0 0 12} 
-put {kartongmbaj.s} ell V {-148.5169369999997002196324 -63.37174099999977983088684 19.92848799999995890175342}  A {7.347638122934263549268508E-16 12 0}  B {-12 7.347638122934263549268508E-16 0}  C {0 0 12} 
-put {kartongmbab.s} ell V {-147.9239789999987806368154 63.24422300000000518593879 20.08229800000001219473234}  A {7.347638122934263549268508E-16 12 0}  B {-12 7.347638122934263549268508E-16 0}  C {0 0 12} 

db/to_g.cmake.in

@@ -1,58 +0,0 @@
-# Make sure the converter executable exists
-string(REPLACE "\\" "" CONV_EXEC "${EXEC}")
-if(NOT EXISTS "${CONV_EXEC}")
-  message(FATAL_ERROR "Invalid geometry converter executable specified: ${CONV_EXEC}")
-endif(NOT EXISTS "${CONV_EXEC}")
-
-# Use local cache directories for the conversion
-set(CBDIR "@CMAKE_CURRENT_BINARY_DIR@")
-set(CSDIR "@CMAKE_CURRENT_SOURCE_DIR@")
-set(BU_DIR_CACHE ${CBDIR}/cache_@in_model_root@)
-set(LIBRT_CACHE ${CBDIR}/rtcache_@in_model_root@)
-set(ENV{BU_DIR_CACHE} ${BU_DIR_CACHE})
-set(ENV{LIBRT_CACHE} ${LIBRT_CACHE})
-file(REMOVE_RECURSE "${BU_DIR_CACHE}")
-file(REMOVE_RECURSE "${LIBRT_CACHE}")
-file(MAKE_DIRECTORY "${BU_DIR_CACHE}")
-file(MAKE_DIRECTORY "${LIBRT_CACHE}")
-
-# Deduce the current BRLCAD_ROOT value from the conversion executable path.
-# Setting BRLCAD_ROOT is the hammer that makes certain we are running things
-# found in the build directory.
-get_filename_component(CEDIR "${CONV_EXEC}" DIRECTORY)
-set(BIN_DIR "@BIN_DIR@")
-string(REGEX REPLACE "${BIN_DIR}$" "" CROOT "${CEDIR}")
-file(TO_CMAKE_PATH "${CROOT}" CROOT)
-string(REGEX REPLACE "/$" "" CROOT "${CROOT}")
-set(ENV{BRLCAD_ROOT} "${CROOT}")
-
-# Now that we know the root, finalize the full path output file location and
-# run the conversion.
-execute_process(
-  COMMAND "${CONV_EXEC}" @CONV_ARGS@
-  RESULT_VARIABLE conv_result
-  OUTPUT_VARIABLE conv_log
-  ERROR_VARIABLE conv_log
-)
-
-set(conv_success_codes "@CONV_SUCCESS_CODES@")
-list(FIND conv_success_codes "${conv_result}" conv_result_index)
-if(conv_result_index EQUAL -1 OR NOT EXISTS "@CONV_OUTPUT_PATH@")
-  set(CARGS @CONV_ARGS@)
-  message(FATAL_ERROR "[@in_model_root@] Failure: ${conv_result}\n${CONV_EXEC} ${CARGS}\"\n\n${conv_log}")
-endif()
-
-# Cleanup
-execute_process(
-  COMMAND "@CMAKE_COMMAND@" -E rm -rf ${BU_DIR_CACHE}
-)
-execute_process(
-  COMMAND "@CMAKE_COMMAND@" -E rm -rf ${LIBRT_CACHE}
-)
-
-# Local Variables:
-# tab-width: 8
-# mode: cmake
-# indent-tabs-mode: t
-# End:
-# ex: shiftwidth=2 tabstop=8

db/to_pix.cmake.in

@@ -1,27 +0,0 @@
-# Make sure the converter executable exists.
-string(REPLACE "\\" "" CONV_EXEC "${EXEC}")
-if(NOT EXISTS "${CONV_EXEC}")
-  message(FATAL_ERROR "Invalid pix converter executable specified: ${CONV_EXEC}")
-endif(NOT EXISTS "${CONV_EXEC}")
-
-set(IN_FILE "@PIX_INPUT@")
-set(OUT_FILE "@PIX_OUTPUT@")
-set(CONV_LABEL "@PIX_LABEL@")
-
-execute_process(
-  COMMAND "${CONV_EXEC}" "${IN_FILE}"
-  RESULT_VARIABLE conv_result
-  OUTPUT_FILE "${OUT_FILE}"
-  ERROR_VARIABLE conv_log
-)
-
-if(conv_result)
-  message(FATAL_ERROR "[${CONV_LABEL}] Failure: ${conv_result}\n${CONV_EXEC} ${IN_FILE} > ${OUT_FILE}\n\n${conv_log}")
-endif(conv_result)
-
-# Local Variables:
-# tab-width: 8
-# mode: cmake
-# indent-tabs-mode: t
-# End:
-# ex: shiftwidth=2 tabstop=8

doc/BRL-CAD.bib

@@ -1298,7 +1298,7 @@
 
 @TECHREPORT{Ross92,
   author = {Ross, Adam},
-  title = {3D Geometric Target Analysis of The Advanced Field Artillery System (AFAS)},
+  title = {3D Geometric Target Analysis of The Advanced Field Artillary System (AFAS)},
   year = {1992},
   month = aug,
   publisher = {The U.S. Army Ballistic Research Laboratory},

doc/CMakeLists.txt

@@ -1,10 +1,8 @@
-verbose_add_subdirectory(doc asciidoc)
-verbose_add_subdirectory(doc changes)
+verbose_add_subdirectory(doc docbook)
 verbose_add_subdirectory(doc html)
 verbose_add_subdirectory(doc legal)
 
-set(
-  documentation_DATA
+set(documentation_DATA
   BRL-CAD.bib
   GITHUB
   IDEAS
@@ -13,9 +11,10 @@ set(
   README.MacOSX
   README.Windows
   README.BSD
+  README.Solaris
+  README.VAX
   checklist.txt
   description.txt
-  optimization_ideas.adoc
   notes/TODO.BREP
   notes/TODO.shaded_displays
   notes/apitrace.txt
@@ -27,15 +26,13 @@ set(
   notes/editors.txt
   notes/history.txt
   notes/hypot.txt
-  notes/itcl4_migration.txt
   notes/mater.txt
   notes/matrix.txt
   pre_BRL-CAD.bib
-)
-add_doc(documentation_DATA ".")
+  )
+ADD_DOC(documentation_DATA ".")
 
-set(
-  documentation_mged_old_DATA
+set(documentation_mged_old_DATA
   mged/a.tex
   mged/adc.ps
   mged/all.tex
@@ -205,20 +202,15 @@ set(
   notes/rounding.txt
   notes/tool_categories.txt
   old-mged.tr
-)
-add_doc(documentation_mged_old_DATA mged_old REQUIRED "mged")
+  )
+ADD_DOC(documentation_mged_old_DATA mged_old)
 
-if(TARGET mged)
-  configure_file(pad_file.xml.in "${CMAKE_CURRENT_BINARY_DIR}/pad_file.xml" @ONLY)
-  distclean("${CMAKE_CURRENT_BINARY_DIR}/pad_file.xml")
-  install(FILES "${CMAKE_CURRENT_BINARY_DIR}/pad_file.xml" DESTINATION ${DOC_DIR})
-endif(TARGET mged)
+configure_file(pad_file.xml.in "${CMAKE_CURRENT_BINARY_DIR}/pad_file.xml" @ONLY)
+DISTCLEAN("${CMAKE_CURRENT_BINARY_DIR}/pad_file.xml")
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/pad_file.xml" DESTINATION ${DOC_DIR})
 
-cmakefiles(
+CMAKEFILES(
   CMakeLists.txt
-  README.Solaris
-  README.VAX
-  README.adoc
   STARTERS
   STRATEGY
   git/bisect.txt
@@ -234,7 +226,6 @@ cmakefiles(
   git/merging.txt
   git/mime_types.txt
   git/usability.txt
-  inventory.adoc
   notes/bsd_semaphore_bug.txt
   notes/cmake_paths/CMakeLists.txt
   notes/cmake_paths/README.txt
@@ -244,12 +235,11 @@ cmakefiles(
   notes/csv_to_comgeom.txt
   notes/implicit_constraints.txt
   notes/lcov.txt
-  notes/struct_resource_removal.txt
   pad_file.xml.in
-)
+  )
 
 # Generic C/C++ examples
-cmakefiles(
+CMAKEFILES(
   notes/c_cxx_patterns/01_basic_C/CMakeLists.txt
   notes/c_cxx_patterns/01_basic_C/main.c
   notes/c_cxx_patterns/01_basic_C/nlib.c
@@ -272,10 +262,10 @@ cmakefiles(
   notes/c_cxx_patterns/05_PImpl_CXX/nlib.h
   notes/c_cxx_patterns/CMakeLists.txt
   notes/c_cxx_patterns/README
-)
+  )
 
 # Notes about parser generators
-cmakefiles(
+CMAKEFILES(
   notes/parsers/bison_to_lemon.txt
   notes/parsers/flex_to_re2c.txt
   notes/parsers/templates/CMakeLists.txt
@@ -284,7 +274,7 @@ cmakefiles(
   notes/parsers/templates/parser.lemon
   notes/parsers/templates/scanner.perplex
   notes/parsers/writing_perplex_lemon_parsers.txt
-)
+  )
 
 # Local Variables:
 # tab-width: 8

doc/README.Linux

@@ -64,10 +64,10 @@ you will be able to compile BRL-CAD.
 
 Following the build instructions in the INSTALL file.  You will need:
 
-gcc (8+, e.g. 8.0.3)
-g++ (8+, e.g. 8.0.3)
+gcc (6+, e.g. 6.0.3)
+g++ (6+, e.g. 6.0.3)
 make (e.g. gnu make 3.8.0)
-cmake (3.20 or newer)
+cmake (3.0.2 or newer)
 
 All three of those have implicit dependencies on other packages.
 

doc/README.MacOSX

@@ -81,7 +81,7 @@ online may prove fruitful.
 
 So far, if parallel building doesn't work due to the above issue a
 non-parallel build will still succeed.  Another workaround is to build
-just subdirectories (e.g. src, doc, etc.) individually and then
+just subdirectories (e.g. src/other, doc, etc.) individually and then
 do a toplevel make in non-parallel mode to finalize the build.
 
 

doc/README.Solaris

@@ -1,11 +1,11 @@
-*** ARCHIVED -- legacy platform, no longer supported (retained for
-*** historical reference). This document is not installed and is kept
-*** only to preserve the historical record.
-
 BRL-CAD on Solaris README
 =========================
-There have been a variety of Solaris-style operating systems that appeared
-following Sun's open-source release of OpenSolaris.
+In recent years, there have been a variety of Solaris-style operating
+systems that have appeared, following Sun's open-source release of
+OpenSolaris.  OpenSolaris itself doesn't seem to be especially active, but
+another derivative system called OpenIndiana has appeared, based on the
+illumos kernel - the Solaris file will be the place to add any notes
+needed to build on such derivative systems, as well as Solaris proper.
 
 Kitware does not provide a pre-compiled binary for CMake on Solaris
 type systems.  To bootstrap from the source code, try the following:
@@ -26,20 +26,22 @@ bin directory to your path:
 csh:  setenv PATH /home/user/cmake-install/bin:$PATH
 bash: export PATH=/home/user/cmake-install/bin:$PATH
 
-From there, you can proceed with building BRL-CAD.  The most recent tests
+From there, you should be good to build BRL-CAD.  The most recent tests
 of the Sun Studio compiler suggest that there are issues to resolve,
 so (unless you want to fix those issues, which would be welcome!) you
 probably want to use the GCC compiler suite to build BRL-CAD as well:
 
 CC=gcc CXX=g++ cmake ../brlcad
 
-If while compiling you encounter an error "Text relocation remains against
-symbol" along with some number of lines following, it usually means that the
-build has attempted to link a static system library into a shared library being
-compiled.  If this happens, it likely indicates a problem with the CMake build
-logic and should be reported as a bug - you may also need to install a shared
-version of the library.  Another possibility would be to add -mipure-text to
-the linker flags.
+If while compiling you encounter an error "Text relocation remains
+against symbol" along with some number of lines following, it usually
+means that the build has attempted to link a static system library
+into a shared library being compiled (e.g. attempting to link a system
+libz.a into the png library distributed in src/other/libpng being
+compiled as libpng.so).  If this happens, it likely indicates a problem
+with the CMake build logic and should be reported as a bug - you may also
+need to install a shared version of the library.  Another possibility
+would be to add -mipure-text to the linker flags.
 
 OpenIndiana
 -----------
@@ -53,7 +55,7 @@ pkg install pkg:/developer/versioning/subversion
 pkg install pkg:/system/header
 pkg install pkg:/developer/lexer/flex
 
-(Note that gcc-7 building doesn't work as of 2017-08-23 - the above install
-list is a starting point, but the repo currently doesn't build and isn't close
-to building.  UPDATE - as of 2024 a *much* newer compiler will be needed...
-C++17 support is now required.)
+(Note that gcc-7 building doesn't work as of 2017-08-23 - the above
+install list is a starting point, but the repo currently doesn't
+build and isn't close to building.  It may be an older gcc would
+have better luck...)

doc/README.VAX

@@ -1,7 +1,3 @@
-*** ARCHIVED -- legacy platform, no longer supported (retained for
-*** historical reference). This document is not installed and is kept
-*** only to preserve the historical record.
-
 BRL-CAD on VAX README
 =====================
 

doc/README.adoc

@@ -1,77 +0,0 @@
-= BRL-CAD: Open Source Solid Modeling
-:toc: macro
-:toc-title:
-:icons: font
-:experimental:
-
-// Attributes for easy maintenance
-:project-url: https://brlcad.org
-:docs-url: https://brl-cad.github.io/docs
-:repo-url: https://github.com/BRL-CAD/brlcad
-:chat-url: https://brlcad.zulipchat.com
-
-image:https://img.shields.io/badge/license-BSD/LGPL-blue.svg["License"]
-image:https://img.shields.io/badge/status-active-brightgreen.svg["Status"]
-
-BRL-CAD is a powerful open-source cross-platform solid modeling system that includes interactive geometry editing, high-performance ray-tracing for rendering and geometric analysis, image and signal-processing tools, a system performance analysis benchmark suite, and libraries for robust geometric manipulation.
-
-For more than 40 years, BRL-CAD has been a primary solid modeling system used by the U.S. military to model weapons systems for vulnerability and lethality analyses.
-
----
-
-toc::[]
-
-== Key Features
-
-* **CSG Modeling:** Constructive Solid Geometry (CSG) provides precise Boolean operations on primitives.
-* **High Performance:** Multi-threaded ray-tracing and a high-performance memory allocator.
-* **Hybrid Representation:** Supports both CSG and B-Rep (NURBS) geometry.
-* **Extensive Toolset:** Over 400 specialized command-line utilities for geometry processing.
-* **Legacy of Stability:** Proven in production environments since 1979.
-
-== Getting Started
-
-=== Prerequisites
-To build BRL-CAD from source, you will need:
-* **CMake** (3.26+)
-* **C/C++ Compiler** (GCC, Clang, or MSVC)
-* **Build Tools** (Make, Ninja, or Visual Studio)
-
-=== Quick Build (Unix/macOS)
-[source,bash]
-----
-mkdir build
-cd build
-cmake .. -DBRLCAD_BUNDLED_LIBS=ON -DCMAKE_BUILD_TYPE=Release
-make -j$(nproc)
-----
-
-[NOTE]
-====
-For detailed installation instructions across different platforms, please refer to our link:{docs-url}/install[Installation Guide].
-====
-
-== Documentation
-
-We have consolidated our extensive documentation (formerly a mix of DocBook/XML, MediaWiki, troff, plain text, and more) onto **AsciiDoc**, with the authoritative sources under `doc/asciidoc/`.
-
-* **Tutorials:** link:{docs-url}/tutorials[Browse the Manuals]
-* **Developer Guides:** link:{docs-url}/hacking and link:{repo-url}/blob/main/HACKING
-* **Wiki:** {project-url}/wiki[snapshot that is a little out of date]
-* **Etc:** link:{docs-url}[Not everything, but a lot]
-
-== Contributing
-
-BRL-CAD is a community-driven project. We welcome contributions in the form of bug reports, feature requests, code, and documentation.
-
-1. **Chat with Us:** Connect with us on Zulip link:{chat-url}.
-2. **Find Issues:** Check our link:{repo-url}/issues[Issue Tracker].
-3. **Submit a PR:** We follow a standard Fork-and-Pull Request workflow.
-
-[IMPORTANT]
-.Documentation Contributors
-We're prototyping the use of **AsciiDoc** for all project documentation in a separate "docs" repo.
-
-== License
-
-BRL-CAD is free and open-source software. Most components are licensed under the **BSD** or **LGPL** licenses. See the `COPYING` file for more details.

doc/STARTERS

@@ -32,7 +32,7 @@ Difficulty:
 Prerequisites:
  * Basic familiarity with C++ STL
 References:
- * https://github.com/BRL-CAD/stepcode
+ * src/other/step
  * src/conv/step
  * include
  * http://www.sgi.com/tech/stl/

doc/STRATEGY

@@ -7,7 +7,7 @@
 BRL-CAD Development Strategy
 
 This is a living document that defines and aims to help maintain a
-consistent development strategy for addressing BRL-CAD requirements.
+consistent develpment strategy for addressing BRL-CAD requirements.
 It recognizes areas of strategic importance, outlines projects to
 bolster those areas, and identifies specific actionable objectives.
 
@@ -234,7 +234,7 @@ bolster those areas, and identifies specific actionable objectives.
 **** TODO create data caching test cases (1)
 **** TODO implement libbu data caching (1)
 
-*** implement LIBRT object caching (4)
+*** implment LIBRT object caching (4)
 **** TODO serialize BoT prep data to cache (1)
 **** TODO serialize NURBS prep data to cache (1)
 **** TODO serialize tess/plot data to cache (2)

doc/asciidoc/CMakeLists.txt

@@ -1,22 +0,0 @@
-include(${BRLCAD_CMAKE_DIR}/AsciiDoc.cmake)
-
-verbose_add_subdirectory(asciidoc toplevel)
-verbose_add_subdirectory(asciidoc system)
-verbose_add_subdirectory(asciidoc articles)
-verbose_add_subdirectory(asciidoc books)
-verbose_add_subdirectory(asciidoc devguides)
-verbose_add_subdirectory(asciidoc lessons)
-verbose_add_subdirectory(asciidoc presentations)
-verbose_add_subdirectory(asciidoc specifications)
-
-cmakefiles(
-  CMakeLists.txt
-  README.adoc
-)
-
-# Local Variables:
-# tab-width: 8
-# mode: cmake
-# indent-tabs-mode: t
-# End:
-# ex: shiftwidth=2 tabstop=8

doc/asciidoc/README.adoc

@@ -1,58 +0,0 @@
-= BRL-CAD AsciiDoc Documentation
-:toc: left
-:toclevels: 2
-
-== Overview
-
-This directory contains BRL-CAD documentation in AsciiDoc format.  The `.adoc`
-files here are the authoritative documentation sources and are committed to
-version control.  The one-time conversion from the original DocBook 5 XML
-sources is complete, and those legacy XML sources have been removed; edit the
-`.adoc` files directly.
-
-The `.adoc` files are built into HTML and man-page outputs at compile time
-using **asciiquack**, BRL-CAD's self-contained AsciiDoc processor.
-
-== Directory Structure
-
-[source]
-----
-doc/asciidoc/
-├── articles/          General articles
-├── books/             Long-form books
-├── devguides/         Developer guides
-├── lessons/           Tutorial lessons
-├── presentations/     Presentation slides
-├── specifications/    Format specifications
-└── system/
-    ├── man1/          Section 1 man pages  (command-line tools)
-    ├── man3/          Section 3 man pages  (C library functions)
-    ├── man5/          Section 5 man pages  (file formats)
-    └── mann/          Section n man pages  (MGED commands)
-----
-
-== Build Outputs
-
-When `BRLCAD_EXTRADOCS=ON` is set at CMake configuration time:
-
-* Man pages (`system/man*/`) are built by asciiquack with `-b manpage` and
-  installed under `${MAN_DIR}/man*/`.
-* Articles, books, and other prose (`articles/`, `books/`, etc.) are built
-  with `-b html5` and installed under `${DOC_DIR}/html/asciidoc/`.
-
-The build logic is in `brlcad/misc/CMake/AsciiDoc.cmake`.
-
-== Authoritative Sources
-
-The `.adoc` files in this directory are the authoritative documentation
-sources.  The one-time conversion from the retired DocBook 5 XML sources is
-complete, so there is no conversion step to re-run: make all documentation
-changes by editing the `.adoc` files directly.
-
-[NOTE]
-====
-Documentation is built only when CMake is configured with
-`BRLCAD_EXTRADOCS=ON`.  With the default configuration the documentation
-targets are skipped, so remember to enable this option when working on or
-verifying documentation.
-====

doc/asciidoc/articles/CMakeLists.txt

@@ -1,488 +0,0 @@
-set(
-  articles_EN
-  TEMPLATE.adoc
-  about.adoc
-  adrt_pathtrace.adoc
-  build_pattern.adoc
-  build_region.adoc
-  camo_shader.adoc
-  ebm_primitive.adoc
-  gcv.adoc
-  ged.adoc
-  main_menu.adoc
-  mged.adoc
-  mgedrc.adoc
-  nirt.adoc
-  object_types.adoc
-  oed.adoc
-  overlap_tool.adoc
-  pipes.adoc
-  procedural_geometry.adoc
-  projection_shader.adoc
-  renderer_showcase.adoc
-  taxonomy.adoc
-  tire.adoc
-)
-
-if(BRLCAD_EXTRADOCS)
-  add_asciidoc("HTML" articles_EN "articles" "")
-endif(BRLCAD_EXTRADOCS)
-
-set(
-  articles_EN_IMAGES
-  images/Lee_tux.gif
-  images/build_pattern_fig01.png
-  images/build_pattern_fig02.png
-  images/build_pattern_fig03.png
-  images/build_pattern_fig04.png
-  images/build_pattern_fig05.png
-  images/build_pattern_fig06.png
-  images/build_pattern_fig07.png
-  images/build_region_fig01.png
-  images/build_region_fig02.png
-  images/build_region_fig03.png
-  images/build_region_fig04.png
-  images/ebm_primitive_fig01.png
-  images/ebm_primitive_fig02.png
-  images/ebm_primitive_fig03.png
-  images/gcv_architecture.png
-  images/gcv_unsupported_tessellation.png
-  images/gcv_using_gdiff.png
-  images/mgedrc_fig01.png
-  images/mgedrc_fig02.png
-  images/mgedrc_fig03.png
-  images/moss_ssm.gif
-  images/nirt_fig01.png
-  images/nirt_fig02.png
-  images/nirt_fig03.png
-  images/nirt_fig04.png
-  images/nirt_fig05.png
-  images/nirt_fig06.png
-  images/nirt_fig07.png
-  images/nirt_fig08.png
-  images/nirt_fig09.png
-  images/nirt_fig10.png
-  images/nirt_fig11.png
-  images/nirt_fig12.png
-  images/nirt_fig13.png
-  images/nirt_fig14.png
-  images/nirt_fig15.png
-  images/nirt_fig16.png
-  images/nirt_fig17.png
-  images/nirt_fig18.png
-  images/nirt_fig19.png
-  images/nirt_fig20.png
-  images/nirt_fig21.png
-  images/nirt_fig22.png
-  images/nirt_fig23.png
-  images/nirt_fig24.png
-  images/oed_fig01.png
-  images/oed_fig02.png
-  images/oed_fig03.png
-  images/oed_fig04.png
-  images/oed_fig05.png
-  images/oed_fig06.png
-  images/oed_fig07.png
-  images/oed_fig08.png
-  images/oed_fig09.png
-  images/oed_fig10.png
-  images/oed_fig11.png
-  images/oed_fig12.png
-  images/oed_fig13.png
-  images/overlap_tool_fig01.gif
-  images/overlap_tool_fig02.gif
-  images/overlap_tool_fig03.png
-  images/pipes_fig01.png
-  images/pipes_fig02.png
-  images/pipes_fig03.png
-  images/pipes_fig04.png
-  images/pipes_fig05.png
-  images/pipes_fig06.png
-  images/pipes_fig07.png
-  images/pipes_fig08.png
-  images/pipes_fig09.png
-  images/pipes_fig10.png
-  images/pipes_fig11.png
-  images/pipes_fig12.png
-  images/pipes_fig13.png
-  images/projection_shader_fig01.png
-  images/projection_shader_fig02.png
-  images/projection_shader_fig03.png
-  images/projection_shader_fig04.png
-  images/projection_shader_fig05.png
-  images/projection_shader_fig06.png
-  images/projection_shader_fig07.png
-  images/tire_fig01.png
-  images/tire_fig02.png
-  images/tire_fig03.png
-  images/tire_fig04.png
-  images/tire_fig05.png
-  images/tire_fig06.png
-  images/tire_fig07.png
-  images/tire_fig08.png
-  images/tire_fig09.png
-  images/tire_fig10.png
-  images/tire_fig11.png
-  images/tire_fig12.png
-  images/tire_fig13.png
-  images/tire_fig14.png
-  images/base.gif
-  images/bool.gif
-  images/coord-axes.gif
-  images/cup_and_mug.gif
-  images/cup_and_mug_small.gif
-  images/cup_out+in.gif
-  images/cup_outside.gif
-  images/cup_w_handle.gif
-  images/faceplate.gif
-  images/faceplate_menu.gif
-  images/faceplate_menu_sm.gif
-  images/faceplate_sm.gif
-  images/fillet.gif
-  images/fillet.jpg
-  images/handle.gif
-  images/handle.jpg
-  images/mug_camo.gif
-  images/mug_camo.jpg
-  images/mug_green.gif
-  images/mug_green.jpg
-  images/prims.gif
-  images/rim.gif
-  images/rim.jpg
-  images/gallery_terragen.png
-  images/gallery_voxelize.png
-  images/gallery_lattice.png
-  images/gallery_loftwing.png
-  images/gallery_loftwing_prop.png
-  images/gallery_gears.png
-  images/gallery_helicoil.png
-  images/gallery_specimen.png
-  images/gallery_seashell.png
-  images/gallery_seashell_nautilus.png
-  images/gallery_sphflake.png
-  images/gallery_donuts.png
-  images/gallery_menger.png
-  images/gallery_pyramid.png
-  images/gallery_torii.png
-  images/gallery_masonry_frame.png
-  images/gallery_masonry_sheetrock.png
-  images/gallery_masonry_brick.png
-  images/gallery_masonry_bm.png
-  images/gallery_brickwall.png
-  images/gallery_mkbuilding.png
-  images/gallery_cchannel.png
-  images/gallery_ringworld.png
-  images/gallery_vegetation.png
-  images/gallery_clutter.png
-  images/gallery_metaball.png
-  images/gallery_molecule.png
-  images/gallery_pdb-g.png
-  images/gallery_pipe.png
-  images/gallery_pipetest.png
-  images/gallery_tube.png
-  images/gallery_lens.png
-  images/gallery_brep_simple.png
-  images/gallery_brep_cube.png
-  images/gallery_brep_cobb.png
-  images/gallery_brep_surface.png
-  images/gallery_brep_trimmed.png
-  images/gallery_brep_invalid.png
-  images/gallery_breplicator.png
-  images/gallery_csgbrep.png
-  images/gallery_surfaceintersect.png
-  images/gallery_spltest.png
-  images/gallery_tea.png
-  images/gallery_wavy.png
-  images/gallery_kurt.png
-  images/gallery_sketch.png
-  images/gallery_wdb_example.png
-  images/gallery_globe.png
-  images/gallery_bottest.png
-  images/gallery_pix2g.png
-  images/gallery_bolt.png
-  images/gallery_coil.png
-  images/gallery_fence.png
-  images/gallery_gastank.png
-  images/gallery_handle.png
-  images/gallery_human.png
-  images/gallery_picket_fence.png
-  images/gallery_tire.png
-  images/gallery_window.png
-  images/gallery_window_frame.png
-  images/gallery_wire.png
-  images/renderer_gallery_rt_l0.png
-  images/renderer_gallery_rt_l1.png
-  images/renderer_gallery_rt_l2.png
-  images/renderer_gallery_rt_l3.png
-  images/renderer_gallery_rt_l4.png
-  images/renderer_gallery_rt_l5.png
-  images/renderer_gallery_rt_l6.png
-  images/renderer_gallery_rt_l7.png
-  images/renderer_gallery_rt_l8.png
-  images/renderer_gallery_rt_haze.png
-  images/renderer_gallery_rt_cutaway.png
-  images/renderer_gallery_rtedge_default.png
-  images/renderer_gallery_rtedge_colored.png
-  images/renderer_gallery_rtedge_regions.png
-  images/renderer_gallery_rthide.png
-  images/renderer_gallery_rtdepth.png
-  images/renderer_gallery_rtxray.png
-  images/adrt_castle_path.png
-  images/adrt_castle_rt.png
-  images/adrt_castle_rt_ao.png
-  images/adrt_chess_path.png
-  images/adrt_chess_rt.png
-  images/adrt_chess_rt_ao.png
-  images/adrt_cornell_path.png
-  images/adrt_cornell_phong.png
-  images/adrt_toyjeep_depth.png
-  images/adrt_toyjeep_normal.png
-  images/adrt_toyjeep_path.png
-  images/adrt_toyjeep_phong.png
-  images/adrt_toyjeep_rt.png
-  images/adrt_toyjeep_rt_ao.png
-  images/adrt_toyjeep_spall.png
-  images/objtype_arb8.png
-  images/objtype_arb8_variety.png
-  images/objtype_arbn.png
-  images/objtype_arbn_variety.png
-  images/objtype_ars.png
-  images/objtype_bot.png
-  images/objtype_bot_variety.png
-  images/objtype_brep.png
-  images/objtype_cline.png
-  images/objtype_comb_variety.png
-  images/objtype_dsp.png
-  images/objtype_ebm.png
-  images/objtype_ehy.png
-  images/objtype_ehy_variety.png
-  images/objtype_ell.png
-  images/objtype_ell_variety.png
-  images/objtype_epa.png
-  images/objtype_epa_variety.png
-  images/objtype_eto.png
-  images/objtype_eto_variety.png
-  images/objtype_extrude.png
-  images/objtype_half.png
-  images/objtype_hrt.png
-  images/objtype_hrt_variety.png
-  images/objtype_hyp.png
-  images/objtype_hyp_variety.png
-  images/objtype_metaball.png
-  images/objtype_metaball_variety.png
-  images/objtype_nmg.png
-  images/objtype_part.png
-  images/objtype_part_variety.png
-  images/objtype_pipe.png
-  images/objtype_pipe_variety.png
-  images/objtype_pnts.png
-  images/objtype_rcc.png
-  images/objtype_rec.png
-  images/objtype_revolve.png
-  images/objtype_rhc.png
-  images/objtype_rhc_variety.png
-  images/objtype_rpc.png
-  images/objtype_rpc_variety.png
-  images/objtype_sph.png
-  images/objtype_submodel.png
-  images/objtype_superell.png
-  images/objtype_superell_variety.png
-  images/objtype_tgc.png
-  images/objtype_tgc_variety.png
-  images/objtype_tor.png
-  images/objtype_tor_variety.png
-  images/objtype_trc.png
-  images/objtype_vol.png
-)
-if(TARGET mged OR TARGET qged OR TARGET archer)
-  if(BRLCAD_EXTRADOCS)
-    add_doc(articles_EN_IMAGES html/articles/images)
-    add_asciidoc("HTML" articles_EN articles articles_EN_IMAGES_cp)
-  endif(BRLCAD_EXTRADOCS)
-endif(TARGET mged OR TARGET qged OR TARGET archer)
-
-# Procedural geometry gallery -- opt-in regeneration of the committed snapshot.
-#
-# The .adoc article and the gallery_*.png images above are a committed snapshot
-# (consumed by the normal doc build like any other article).  This target
-# rebuilds that snapshot from the actual built tools via a pure-CMake generator
-# (no shell, python, or platform assumptions).  It is opt-in and excluded from
-# the default build; a developer regenerates, reviews the diff, and commits.
-option(BRLCAD_GENERATE_GALLERY "Regenerate the procedural geometry gallery snapshot" OFF)
-if(BRLCAD_GENERATE_GALLERY AND TARGET rt AND TARGET mged)
-  # Demo generator programs to build before regenerating (those that exist).
-  set(
-    GALLERY_DEMO_TARGETS
-    terragen voxelize lattice loftwing gears helicoil specimen seashell sphflake donuts
-    menger pyramid torii masonry brickwall mkbuilding cchannel ringworld
-    vegetation clutter metaball molecule pdb-g pipe pipetest tube lens
-    brep_simple brep_cube brep_cobb brep_surface brep_trimmed brep_invalid
-    breplicator csgbrep surfaceintersect spltest tea wavy kurt sketch
-    wdb_example globe bottest pix2g bolt coil fence gastank handle human
-    picket_fence tire window window_frame wire
-  )
-  set(gallery_deps rt mged)
-  foreach(t ${GALLERY_DEMO_TARGETS})
-    if(TARGET ${t})
-      list(APPEND gallery_deps ${t})
-    endif(TARGET ${t})
-  endforeach(t)
-
-  add_custom_target(
-    procedural-gallery-snapshot
-    COMMAND
-      ${CMAKE_COMMAND} -DRT=$<TARGET_FILE:rt> -DMGED=$<TARGET_FILE:mged>
-      -DBINDIR=$<TARGET_FILE_DIR:rt>
-      -DMANIFEST=${CMAKE_CURRENT_SOURCE_DIR}/gallery/gallery_manifest.cmake
-      -DIMGDIR=${CMAKE_CURRENT_SOURCE_DIR}/images
-      -DADOC=${CMAKE_CURRENT_SOURCE_DIR}/procedural_geometry.adoc
-      -DINPUTDIR=${CMAKE_CURRENT_SOURCE_DIR}/gallery/inputs
-      -DWORKDIR=${CMAKE_CURRENT_BINARY_DIR}/gallery_work -DSIZE=512
-      "-DTITLE=BRL-CAD Procedural Geometry Gallery"
-      -P ${CMAKE_CURRENT_SOURCE_DIR}/gallery/generate_gallery.cmake
-    DEPENDS ${gallery_deps}
-    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-    COMMENT "Regenerating procedural geometry gallery snapshot (images + adoc)"
-    VERBATIM
-    USES_TERMINAL
-  )
-  set_target_properties(procedural-gallery-snapshot PROPERTIES EXCLUDE_FROM_DEFAULT_BUILD 1)
-endif(BRLCAD_GENERATE_GALLERY AND TARGET rt AND TARGET mged)
-
-# Renderer showcase gallery -- opt-in regeneration of the committed snapshot.
-#
-# Like the procedural geometry gallery above, the .adoc article and
-# renderer_gallery_*.png images are normal committed documentation.  This target
-# refreshes those products from the built renderers and sample Cornell box so a
-# developer can review and commit the resulting diff.
-option(BRLCAD_GENERATE_RENDERER_GALLERY "Regenerate the renderer showcase gallery snapshot" OFF)
-if(
-  BRLCAD_GENERATE_RENDERER_GALLERY
-  AND TARGET rt
-  AND TARGET rtedge
-  AND TARGET rtdepth
-  AND TARGET rtxray
-  AND TARGET rthide
-  AND TARGET bw-png
-  AND TARGET fbclear
-  AND TARGET plot3-fb
-  AND TARGET fb-png
-  AND TARGET cornell.g
-)
-  add_custom_target(
-    renderer-gallery-snapshot
-    COMMAND
-      ${CMAKE_COMMAND}
-      -DRT=$<TARGET_FILE:rt>
-      -DRTEDGE=$<TARGET_FILE:rtedge>
-      -DRTDEPTH=$<TARGET_FILE:rtdepth>
-      -DRTXRAY=$<TARGET_FILE:rtxray>
-      -DRTHIDE=$<TARGET_FILE:rthide>
-      -DBWPNG=$<TARGET_FILE:bw-png>
-      -DFBCLEAR=$<TARGET_FILE:fbclear>
-      -DPLOT3FB=$<TARGET_FILE:plot3-fb>
-      -DFBPNG=$<TARGET_FILE:fb-png>
-      -DMANIFEST=${CMAKE_CURRENT_SOURCE_DIR}/renderer_gallery/renderer_gallery_manifest.cmake
-      -DIMGDIR=${CMAKE_CURRENT_SOURCE_DIR}/images
-      -DADOC=${CMAKE_CURRENT_SOURCE_DIR}/renderer_showcase.adoc
-      -DWORKDIR=${CMAKE_CURRENT_BINARY_DIR}/renderer_gallery_work
-      -DDB=${CMAKE_BINARY_DIR}/${DATA_DIR}/db/cornell.g
-      -DSIZE=512
-      "-DTITLE=BRL-CAD Renderer Showcase"
-      -P ${CMAKE_CURRENT_SOURCE_DIR}/renderer_gallery/generate_renderer_gallery.cmake
-    DEPENDS
-      rt
-      rtedge
-      rtdepth
-      rtxray
-      rthide
-      bw-png
-      fbclear
-      plot3-fb
-      fb-png
-      cornell.g
-    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-    COMMENT "Regenerating renderer showcase gallery snapshot (images + adoc)"
-    VERBATIM
-    USES_TERMINAL
-  )
-  set_target_properties(renderer-gallery-snapshot PROPERTIES EXCLUDE_FROM_DEFAULT_BUILD 1)
-endif()
-
-# ADRT path-tracing gallery -- opt-in regeneration of the committed snapshot.
-#
-# Like the galleries above, the adrt_pathtrace.adoc article is hand-written and
-# the adrt_*.png images are committed documentation.  This target refreshes the
-# images from the built `adrt`, `rt`, and `mged` tools and the sample databases
-# so a developer can review and commit the resulting diff.
-option(BRLCAD_GENERATE_ADRT_GALLERY "Regenerate the ADRT path-tracing snapshot" OFF)
-if(
-  BRLCAD_GENERATE_ADRT_GALLERY
-  AND TARGET adrt
-  AND TARGET rt
-  AND TARGET mged
-  AND TARGET toyjeep.g
-  AND TARGET castle.g
-  AND TARGET cornell-kunigami.g
-  AND TARGET chessboard.g
-)
-  add_custom_target(
-    adrt-pathtrace-snapshot
-    COMMAND
-      ${CMAKE_COMMAND}
-      -DADRT=$<TARGET_FILE:adrt>
-      -DRT=$<TARGET_FILE:rt>
-      -DMGED=$<TARGET_FILE:mged>
-      -DDB=${CMAKE_BINARY_DIR}/${DATA_DIR}/db
-      -DIMGDIR=${CMAKE_CURRENT_SOURCE_DIR}/images
-      -DWORKDIR=${CMAKE_CURRENT_BINARY_DIR}/adrt_gallery_work
-      -DSIZE=512
-      -P ${CMAKE_CURRENT_SOURCE_DIR}/adrt_gallery/generate_adrt_gallery.cmake
-    DEPENDS
-      adrt
-      rt
-      mged
-      toyjeep.g
-      castle.g
-      cornell-kunigami.g
-      chessboard.g
-    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-    COMMENT "Regenerating ADRT path-tracing snapshot (images)"
-    VERBATIM
-    USES_TERMINAL
-  )
-  set_target_properties(adrt-pathtrace-snapshot PROPERTIES EXCLUDE_FROM_DEFAULT_BUILD 1)
-endif()
-
-cmakefiles(
-  CMakeLists.txt
-  ${articles_EN}
-  ${articles_EN_IMAGES}
-  images/tire_fig12.svg
-  images/tire_fig13.svg
-  gallery/gallery_manifest.cmake
-  gallery/generate_gallery.cmake
-  renderer_gallery/renderer_gallery_manifest.cmake
-  renderer_gallery/generate_renderer_gallery.cmake
-  adrt_gallery/generate_adrt_gallery.cmake
-  gallery/inputs/pipe.stdin
-  gallery/inputs/wire.stdin
-  gallery/inputs/tube.stdin
-  gallery/inputs/moss64.pix
-  gallery/inputs/caffeine.pdb
-  gallery/inputs/mol-cube.dat
-  images/objtype_src/README.adoc
-  images/objtype_src/objtype_lib.py
-  images/objtype_src/gen_object_types.py
-)
-
-add_subdirectory(hy)
-add_subdirectory(it)
-add_subdirectory(ru)
-
-# Local Variables:
-# tab-width: 8
-# mode: cmake
-# indent-tabs-mode: t
-# End:
-# ex: shiftwidth=2 tabstop=8

doc/asciidoc/articles/TEMPLATE.adoc

@@ -1,83 +0,0 @@
-= Article Title
-Firstname Middlename Lastname <devs@brlcad.org>
-:doctype: article
-:toc:
-:toclevels: 3
-
-[[some-descriptive-tag]]
-First paragraph goes here.
-
-
-....
-
-      benchmark TIMEFRAME=1 run
-    
-....
-
-
-[NOTE]
-====
-The preceding _benchmark_ command example can get a lot more complex.
-
-====
-
-When you run the *benchmark* with the *help* option, you might see this output:
-
-
-....
-sean@gcc1-power7 bin]$benchmark help
-          Usage: ./benchmark [command(s)] [OPTION=value] [RT_OPTIONS]
-
-          Available commands:
-          clean
-          ...
-        
-....
-
-
-
-Another paragraph with embedded list is shown here. Each paragraph gets its own para and should be wrapped for readability and localized context diff comparisons. A list of items:
-
-
-* Bullet item 1.
-* Bullet item 2.
-
-
-
-
-[[another-tag-for-main-body]]
-== Breaking up the flow into sections
-
-You can use sections to group sections of your document together, but they are not necessary.
-
-.Example embedded image text.
-image::http://brlcad.org/images/logo/BRL-CAD_gear_logo_w_name_256.png[width=256]
-
-Another image, but rendered inline image:http://brlcad.org/images/logo/BRL-CAD_gear_logo_64x64.png[width=64] with the paragraph text.
-
-More paragraphs...
-
-[cols="2*"]
-|===
-|Type
-|Description
-
-|ell
-|Generalized Ellipsoid
-|arb8
-|Arbitrary Regular Polyhedron with up to 8 vertices
-|===
-
-
-[CAUTION]
-====
-There's a lot more you can do with AsciiDoc. Consult the reference documentation for syntax and examples:
-
-
-* https://docs.asciidoctor.org/asciidoc/latest/[AsciiDoc Language Documentation]
-* https://docs.asciidoctor.org/asciidoc/latest/syntax-quick-reference/[AsciiDoc Syntax Quick Reference]
-
-====
-
-
-

doc/asciidoc/articles/about.adoc

@@ -1,25 +0,0 @@
-= About BRL-CAD
-Christopher Sean Morrison <devs@brlcad.org>
-:doctype: article
-:toc:
-:toclevels: 3
-
-[[article-body]]
-BRL-CAD is a powerful cross-platform Open Source combinatorial Constructive Solid Geometry (CSG) solid modeling system that includes interactive 3D solid geometry editing, high-performance ray-tracing support for rendering and geometric analysis, network-distributed framebuffer support, image and signal-processing tools, path-tracing and photon mapping support for realistic image synthesis, a system performance analysis benchmark suite, an embedded scripting interface, and libraries for robust high-performance geometric representation and analysis.
-
-For more than 20 years, BRL-CAD has been the primary tri-service solid modeling CAD system used by the U.S. military to model weapons systems for vulnerability and lethality analyses. The solid modeling system is frequently used in a wide range of military, academic, and industrial applications including in the design and analysis of vehicles, mechanical parts, and architecture. The package has also been used in radiation dose planning, medical visualization, computer graphics education, CSG concepts and modeling education, and system performance benchmark testing among other purposes.
-
-BRL-CAD supports a great variety of geometric representations including an extensive set of traditional CSG primitive implicit solids such as boxes, ellipsoids, cones, and tori, as well as explicit solids made from closed collections of Uniform B-Spline Surfaces, Non-Uniform Rational B-Spline (NURBS) surfaces, n-Manifold Geometry (NMG), and purely faceted mesh geometry. All geometric objects may be combined using boolean set-theoretic CSG operations including union, intersection, and difference.
-
-BRL-CAD has been under active development with a portability heritage that includes systems such as a DEC VAX-11/780 running 4.3 BSD; DECStations running ULTRIX; Silicon Graphics 3030, 4D "IRIS", O2, Onyx, and Origin systems running various versions of IRIX; Sun Microsystems Sun-3 and Sun-4 Sparcs running SunOS; the Cray 1, Cray X-MP, Cray Y-MP, and Cray 2 running UNICOS; DEC Alpha AXP running OSF/1; Apple Macintosh II running A/UX; iPSC/860 Hypercube running NX/2; the Alliant FX/8, FX/80, and FX/2800; Gould/Encore SEL PowerNode6000/9000 and NP1; NeXT workstations; IBM RS/6000; HPPA 9000/700 running HPUX; Ardent/Stardent; Encore Multi-Max; and much more.
-
-BRL-CAD is a collection of more than 400 tools, utilities, and applications comprising more than a million lines of source code. The package is intentionally designed to be extensively cross-platform and is actively developed on and maintained for many common operating system environments including BSD, Linux, Solaris, Mac OS X, and Windows among others. BRL-CAD is distributed in binary and source code form as free open source software (FOSS), provided under Open Source Initiative (OSI) approved license terms.
-
-
-[NOTE]
-====
-Mike Muuss began the initial architecture and design of BRL-CAD back in 1979. Development as a unified package began in 1983. The first public release was made in 1984. BRL-CAD became an open source project on 21 December 2004.
-
-====
-
-

doc/asciidoc/articles/adrt_gallery/generate_adrt_gallery.cmake

@@ -1,115 +0,0 @@
-# generate_adrt_gallery.cmake -- regenerate the ADRT path-tracing snapshot.
-#
-# Run via: cmake -DADRT=... -DRT=... -DMGED=... -DDB=<share/db dir>
-#               -DIMGDIR=... -DWORKDIR=... -DSIZE=512
-#               -P generate_adrt_gallery.cmake
-#
-# Reproduces the committed images for doc/asciidoc/articles/adrt_pathtrace.adoc:
-# path-traced renders from the standalone `adrt` tool alongside `rt` full
-# lighting and `rt` ambient occlusion, for the sample toyjeep, chessboard,
-# castle, and Cornell box models.  Cross-platform: uses only cmake tooling.
-
-cmake_minimum_required(VERSION 3.20)
-
-foreach(v ADRT RT MGED DB IMGDIR WORKDIR)
-  if(NOT DEFINED ${v})
-    message(FATAL_ERROR "generate_adrt_gallery: -D${v}=... is required")
-  endif()
-endforeach()
-if(NOT DEFINED SIZE)
-  set(SIZE 512)
-endif()
-
-set(RENDER_TIMEOUT 1800)
-set(AO "set ambSamples=128")
-
-file(MAKE_DIRECTORY "${WORKDIR}")
-file(MAKE_DIRECTORY "${IMGDIR}")
-
-set(N_OK 0)
-set(N_FAIL 0)
-set(FAILED "")
-
-# Run a render command whose -o target is "${IMGDIR}/<out>", and report on it.
-function(render label out)
-  set(img "${IMGDIR}/${out}")
-  file(REMOVE "${img}")
-  execute_process(
-    COMMAND ${ARGN}
-    WORKING_DIRECTORY "${WORKDIR}" TIMEOUT ${RENDER_TIMEOUT}
-    RESULT_VARIABLE rc OUTPUT_VARIABLE log ERROR_VARIABLE log)
-  if(EXISTS "${img}")
-    file(SIZE "${img}" isz)
-  else()
-    set(isz 0)
-  endif()
-  if(isz GREATER 0 AND rc EQUAL 0)
-    message(STATUS "[${label}] wrote ${out} (${isz} bytes)")
-    math(EXPR N_OK "${N_OK} + 1" )
-  else()
-    message(WARNING "[${label}] FAILED (rc=${rc}):\n${log}")
-    math(EXPR N_FAIL "${N_FAIL} + 1")
-    list(APPEND FAILED "${out}")
-  endif()
-  set(N_OK "${N_OK}" PARENT_SCOPE)
-  set(N_FAIL "${N_FAIL}" PARENT_SCOPE)
-  set(FAILED "${FAILED}" PARENT_SCOPE)
-endfunction()
-
-# --- Toy jeep: path trace, rt comparison, and adrt shading modes ------------
-set(TJ "${DB}/toyjeep.g")
-render(toyjeep_path   adrt_toyjeep_path.png
-  ${ADRT} -s${SIZE} -H256 -p12 -a35 -e25 -o "${IMGDIR}/adrt_toyjeep_path.png" "${TJ}" all)
-render(toyjeep_normal adrt_toyjeep_normal.png
-  ${ADRT} -s${SIZE} -m normal -p12 -a35 -e25 -o "${IMGDIR}/adrt_toyjeep_normal.png" "${TJ}" all)
-render(toyjeep_phong  adrt_toyjeep_phong.png
-  ${ADRT} -s${SIZE} -m phong -p12 -a35 -e25 -o "${IMGDIR}/adrt_toyjeep_phong.png" "${TJ}" all)
-render(toyjeep_depth  adrt_toyjeep_depth.png
-  ${ADRT} -s${SIZE} -m depth -p12 -a35 -e25 -o "${IMGDIR}/adrt_toyjeep_depth.png" "${TJ}" all)
-render(toyjeep_rt     adrt_toyjeep_rt.png
-  ${RT} -s${SIZE} -a35 -e25 -A0.4 -o "${IMGDIR}/adrt_toyjeep_rt.png" "${TJ}" all)
-render(toyjeep_rt_ao  adrt_toyjeep_rt_ao.png
-  ${RT} -s${SIZE} -a35 -e25 -A1.1 -c "${AO}" -o "${IMGDIR}/adrt_toyjeep_rt_ao.png" "${TJ}" all)
-
-# --- Chessboard: bright sky lifts the flat, light-colored tiles -------------
-set(CH "${DB}/chess/chessboard.g")
-render(chess_path   adrt_chess_path.png
-  ${ADRT} -s${SIZE} -H768 -p12 -a40 -e35 -C 255/255/255 -o "${IMGDIR}/adrt_chess_path.png" "${CH}" board.g)
-render(chess_rt     adrt_chess_rt.png
-  ${RT} -s${SIZE} -a40 -e35 -A0.4 -o "${IMGDIR}/adrt_chess_rt.png" "${CH}" board.g)
-render(chess_rt_ao  adrt_chess_rt_ao.png
-  ${RT} -s${SIZE} -a40 -e35 -A1.1 -c "${AO}" -o "${IMGDIR}/adrt_chess_rt_ao.png" "${CH}" board.g)
-
-# --- Castle: facetize the CSG to a colored BoT, then path trace -------------
-# The castle is one region unioning many instanced solids; on-the-fly NMG
-# evaluation fails, so convert it once with the Manifold facetizer.  rt still
-# traces the original CSG natively for the comparison images.
-set(CFAC "${WORKDIR}/castle_fac.g")
-file(REMOVE "${CFAC}")
-configure_file("${DB}/castle.g" "${CFAC}" COPYONLY)
-execute_process(COMMAND ${MGED} -c "${CFAC}" facetize -o castle_only all.g/castle
-  TIMEOUT ${RENDER_TIMEOUT} RESULT_VARIABLE frc OUTPUT_VARIABLE flog ERROR_VARIABLE flog)
-execute_process(COMMAND ${MGED} -c "${CFAC}" r castle_r u castle_only
-  TIMEOUT 120 OUTPUT_QUIET ERROR_QUIET)
-execute_process(COMMAND ${MGED} -c "${CFAC}" mater castle_r plastic 255 255 100 0
-  TIMEOUT 120 OUTPUT_QUIET ERROR_QUIET)
-render(castle_path   adrt_castle_path.png
-  ${ADRT} -s${SIZE} -H256 -p12 -a135 -e30 -o "${IMGDIR}/adrt_castle_path.png" "${CFAC}" castle_r)
-render(castle_rt     adrt_castle_rt.png
-  ${RT} -s${SIZE} -a135 -e30 -A0.4 -o "${IMGDIR}/adrt_castle_rt.png" "${DB}/castle.g" castle)
-render(castle_rt_ao  adrt_castle_rt_ao.png
-  ${RT} -s${SIZE} -a135 -e30 -A1.1 -c "${AO}" -o "${IMGDIR}/adrt_castle_rt_ao.png" "${DB}/castle.g" castle)
-
-# --- Cornell box: global illumination from the emissive ceiling panel -------
-set(CB "${DB}/cornell-kunigami.g")
-render(cornell_path  adrt_cornell_path.png
-  ${ADRT} -s${SIZE} -H512 -E 278,370.9,-454 -L 278,274,279 -p25 -o "${IMGDIR}/adrt_cornell_path.png" "${CB}" all.g)
-render(cornell_phong adrt_cornell_phong.png
-  ${ADRT} -s${SIZE} -m phong -E 278,370.9,-454 -L 278,274,279 -p25 -o "${IMGDIR}/adrt_cornell_phong.png" "${CB}" all.g)
-
-message(STATUS "")
-message(STATUS "ADRT path-tracing snapshot: ${N_OK} rendered, ${N_FAIL} failed.")
-if(FAILED)
-  string(REPLACE ";" ", " failstr "${FAILED}")
-  message(STATUS "Failed: ${failstr}")
-endif()

doc/asciidoc/articles/adrt_pathtrace.adoc

@@ -1,220 +0,0 @@
-= Path Tracing with ADRT
-:doctype: article
-:toc:
-:toclevels: 3
-
-ADRT (the _Advanced Distributed Ray Tracer_) is BRL-CAD's triangle-based
-rendering engine.  Alongside the usual scanline shaders it carries a
-Monte-Carlo *path tracer* that computes global illumination -- soft ambient
-light, contact shadows, and diffuse color bleeding -- by tracing many random
-light paths per pixel.  This article explains how ADRT is put together and
-walks through producing path-traced images with the standalone `adrt`
-command, comparing the result to `rt`'s ambient-occlusion lighting.
-
-.Path-traced global illumination: the Cornell box rendered with `adrt -m path`
-image::images/adrt_cornell_path.png[Cornell box path traced,384]
-
-== How ADRT works
-
-ADRT is layered on top of BRL-CAD's *TIE* (Triangle Intersection Engine), the
-same SIMD-friendly kd-tree ray tracer used by `rtwizard`, `nirt`'s mesh mode,
-and the geometry viewers.  Because TIE only intersects triangles, ADRT first
-*tessellates* geometry:
-
-* Bags-of-triangles (BoT) are handed to TIE directly.
-* Every other solid (CSG primitives, NMG, etc.) is tessellated to triangles as
-  the database tree is walked.  Region colors are carried onto the resulting
-  meshes, and regions whose material shader is a light source (the classic
-  `light` shader or an OSL `emitter`) are marked *emissive*.
-
-Rendering itself lives in *librender* (`src/adrt/librender`), a small library of
-interchangeable shaders selected by name:
-
-[cols="1,4"]
-|===
-|`path`   |Monte-Carlo path tracer (global illumination)
-|`phong`  |Direct Phong lighting from the eye
-|`normal` |Surface normals encoded as RGB
-|`depth`  |Camera-space depth
-|`flat`   |Flat region color
-|`component`, `cut`, `flos`, `grid`, `spall`, `surfel` |Analysis shaders
-|===
-
-Several front ends drive that library:
-
-* *`adrt`* -- a single-process, headless renderer that writes an image file.
-  This is the tool used throughout this article.
-* *`isst`* -- an interactive Tcl/Tk + OpenGL viewer for real-time fly-throughs.
-* *`adrt_master`* / *`adrt_slave`* -- a networked master/worker pair (the
-  "distributed" in ADRT) that farms tiles out to compute nodes for an external
-  observer.
-
-== Rendering a path-traced image
-
-The `adrt` command loads a `.g` database, frames the requested objects, renders
-one frame, and writes the image (the extension selects the format):
-
-----
-adrt [options] model.g object [object ...]
-----
-
-[cols="1,4"]
-|===
-|`-o file`   |Output image; extension picks the format (default `adrt.png`)
-|`-s N`      |Square image size in pixels (default 512); or `-w`/`-n` for width/height
-|`-m mode`   |Shader: `path`, `phong`, `normal`, `depth`, `flat` (default `path`)
-|`-H N`      |Path-tracer samples per pixel (default 32) -- more samples, less noise
-|`-a` / `-e` |View azimuth / elevation in degrees (default 35 / 25)
-|`-E x,y,z`  |Explicit eye point in model units (overrides `-a`/`-e`)
-|`-L x,y,z`  |Explicit look-at point (default: model center)
-|`-p fov`    |Perspective half-angle in degrees (default 25)
-|`-C r/g/b`  |Environment/sky color, 0-255 (default `230/237/255`)
-|`-P N`      |Render threads (default: all CPUs)
-|===
-
-A first render of the sample toy jeep:
-
-----
-adrt -s 512 -H 256 -a 35 -e 25 -o toyjeep.png toyjeep.g all
-----
-
-`adrt` reports the triangle count, load time, and render time, then writes the
-PNG.  The camera is a perspective camera aimed at the model center; `-a`/`-e`
-orbit it and `-p` sets the field of view.  For scenes that are not simply
-oriented -- an enclosed, Y-up Cornell box, for instance -- give an explicit eye
-and look-at point instead:
-
-----
-adrt -s 512 -H 512 -E 278,370.9,-454 -L 278,274,279 -p 25 \
-     -o cornell.png cornell-kunigami.g all.g
-----
-
-=== The environment and ambient light
-
-Rays that leave the scene without hitting anything pick up light from a built-in
-environment: a vertical gradient of the sky color, full strength overhead and
-dimming toward the ground.  This "overcast sky" is what illuminates open
-scenes.  With diffuse surfaces it produces physically-based *ambient occlusion*
-for free -- up-facing faces catch the bright sky while crevices and undersides
-fall into shadow -- and it also paints the graduated background.  `-C` tunes the
-sky color and brightness (a brighter sky lifts flat, light-colored surfaces).
-
-Enclosed scenes such as the Cornell box see no sky; there, the emissive light
-region is the only source, and the interior is lit entirely by bounced,
-indirect light.
-
-== Path tracing versus `rt` ambient occlusion
-
-`rt`, BRL-CAD's production CSG ray tracer, approximates indirect shading with an
-*ambient occlusion* pass, enabled with a nonzero ambient factor and a sample
-count:
-
-----
-rt -A1.1 -c "set ambSamples=128" -s512 -a35 -e25 -o out.png model.g object
-----
-
-The panels below compare, for the same view, ADRT's path tracer against `rt`
-with full lighting only and `rt` with ambient occlusion added.  ADRT's path
-tracer resolves the sky illumination and soft inter-surface shadowing in a
-single physically-based pass; `rt`'s ambient occlusion darkens cavities on top
-of its direct lighting model.
-
-.Toy jeep -- `adrt -m path` / `rt` full lighting / `rt` ambient occlusion
-[cols="1,1,1",frame=none,grid=none]
-|===
-|image:images/adrt_toyjeep_path.png[adrt path,256]
-|image:images/adrt_toyjeep_rt.png[rt plain,256]
-|image:images/adrt_toyjeep_rt_ao.png[rt AO,256]
-|*adrt path traced*
-|*rt full lighting*
-|*rt ambient occlusion*
-|===
-
-.Chessboard -- `adrt -m path` / `rt` full lighting / `rt` ambient occlusion
-[cols="1,1,1",frame=none,grid=none]
-|===
-|image:images/adrt_chess_path.png[adrt path,256]
-|image:images/adrt_chess_rt.png[rt plain,256]
-|image:images/adrt_chess_rt_ao.png[rt AO,256]
-|*adrt path traced*
-|*rt full lighting*
-|*rt ambient occlusion*
-|===
-
-== Global illumination: the Cornell box
-
-The Cornell box is the classic test of indirect lighting: a closed room lit only
-by a small ceiling panel.  ADRT detects the emissive light region and lets the
-path tracer bounce that light around the room.  Compared with the direct-only
-`phong` shader, the path-traced image adds the glowing light source, soft
-shadows beneath the blocks, and *color bleeding* -- the red floor and blue walls
-tint the neighboring surfaces.
-
-.Cornell box -- `adrt -m path` (global illumination) versus `adrt -m phong` (direct only)
-[cols="1,1",frame=none,grid=none]
-|===
-|image:images/adrt_cornell_path.png[adrt path,320]
-|image:images/adrt_cornell_phong.png[adrt phong,320]
-|*Path traced:* area light, soft shadows, color bleeding
-|*Phong:* direct lighting only, no indirect light
-|===
-
-== Complex CSG: facetize first
-
-ADRT tessellates as it loads, but a few heavily-booleaned models do not survive
-on-the-fly NMG evaluation -- the sample `castle`, whose whole structure is one
-region unioning dozens of instanced solids, is one.  `rt` traces it natively as
-CSG, but for ADRT the robust path is to convert it to a triangle mesh once with
-the Manifold-based facetizer, then render the mesh:
-
-----
-# in mged, on a working copy of the database
-facetize -o castle_bot all.g/castle
-
-adrt -s 512 -H 256 -a 135 -e 30 -o castle.png castle.g castle_bot
-----
-
-.Castle -- facetized then `adrt -m path` / `rt` full lighting / `rt` ambient occlusion
-[cols="1,1,1",frame=none,grid=none]
-|===
-|image:images/adrt_castle_path.png[adrt path,256]
-|image:images/adrt_castle_rt.png[rt plain,256]
-|image:images/adrt_castle_rt_ao.png[rt AO,256]
-|*adrt path traced*
-|*rt full lighting*
-|*rt ambient occlusion*
-|===
-
-== Other shading modes
-
-The same `adrt` invocation reaches librender's analysis shaders through `-m`,
-useful for inspecting form and orientation without lighting:
-
-[cols="1,1,1",frame=none,grid=none]
-|===
-|image:images/adrt_toyjeep_phong.png[phong,256]
-|image:images/adrt_toyjeep_normal.png[normal,256]
-|image:images/adrt_toyjeep_depth.png[depth,256]
-|*`-m phong`* direct lighting
-|*`-m normal`* surface normals
-|*`-m depth`* camera depth
-|===
-
-== Notes and limitations
-
-* The path tracer is a straightforward forward tracer with no next-event
-  estimation or denoising.  Raise `-H` to reduce Monte-Carlo noise; large
-  perfectly-diffuse, high-albedo surfaces are the noisiest.
-* Materials are approximated: regions render as opaque diffuse surfaces using
-  their region color, `light`/`emitter` regions become area lights, and
-  specular/refractive shaders are not yet modeled.
-* Only triangle-representable geometry contributes; non-tessellatable solids
-  (for example infinite half-spaces) are skipped.
-
-[NOTE]
-====
-The images in this article are a committed snapshot.  Developers can regenerate
-them from the built tools by configuring with
-`-DBRLCAD_GENERATE_ADRT_GALLERY=ON` and building the `adrt-pathtrace-snapshot`
-target.
-====

doc/asciidoc/articles/build_pattern.adoc

@@ -1,147 +0,0 @@
-= Using the Build Pattern Tool
-Lee A Butler; Eric W Edwards; Dwayne L Kregel
-:doctype: article
-:toc:
-:toclevels: 3
-
-[[build_pattern_generalinfo]]
-== General Pattern Information
-
-As mentioned previously, the Build Pattern tool automates the process of making copies of existing geometry in rectangular, spherical, or cylindrical patterns. The user can choose to pattern at any of three depths of duplication: top, regions, and primitives.
-
-The Build Pattern tool is run from the graphical user interface (GUI) (under the Tools menu); it currently has no command-line equivalent. The bottom of the pattern control GUI is a usage dialog box that lists pertinent information about each item on the GUI as the user mouses over the text.
-
-There are many input fields. Some stand alone, and others belong to series that work together to provide the needed information for a specific option. Each series is denoted by a diamond-shaped check box. If the diamond is highlighted red, then all fields in that series are required. All required fields must be filled in for the pattern tool to work properly. It is also important to note that all dimensions must be in millimeters and that no commas should be used in number strings.
-
-The Build Pattern tool is designed to work from a prototype geometry object. That is to say, the object that is patterned is not included in the resultant pattern.
-
-
-[[build_pattern_names]]
-== Pattern Names
-
-As shown in Figure E-1, the tool appends three numbers to all patterned objects (unless you are using the increment option for primitives, in which case, the numbers for regions and primitives are incremented by the increment amount). For rectangular patterns, the first number is the X axis offset, the second is the Y axis offset, and the third is the Z axis offset. For spherical patterns, the first number references the azimuth, the second references the elevation, and the third references the radii. For cylindrical patterns, the first number references the radii, the second number references the height, and the third number references the azimuth.
-
-
-[[build_pattern_fields]]
-== Common Fields for all Patterns:
-
-There are several fields in the pattern tool GUI that are common to all types of patterns.
-
-The Group Name field is for the name of the combination to be created (or appended to) by a pattern call.
-
-The Source String and Replacement String fields must be used together. The source string is the set of characters in each element of the patterned object to be changed. The replacement string is the set of characters that will replace the source string.
-
-.Example of pattern-generated assembly names.
-image::../articles/images/build_pattern_fig01.png[]
-
-The Increment field is only for use when duplicating to the primitive level. It is added to the leftmost number field of each primitive. To determine the increment, examine the primitives of the object(s) you wish to pattern and find the largest span. For example, to create a pattern to the primitive level with the following primitives (which may or may not be in regions or assemblies):
-
-
-....
-
-part.s22 part.s22-1 part.s23 part.s24 part.s24+1 part.s24-1 part.s25,
-      
-....
-
-one needs to determine the span. Note that the leftmost numbers in these primitives range from 22 to 25. The span is the count of distinct leftmost numbers taken inclusively, from the lowest through the highest: 22, 23, 24, and 25 -- four values in all. It is computed as (highest - lowest) + 1, that is, (25 - 22) + 1 = 4. If we use an increment of four, each leftmost number is shifted up by four (22 becomes 26, 23 becomes 27, and so on), and we will get the following set of primitives.
-
-
-....
-
-part.s26 part.s26-1 part.s27 part.s28 part.s28+1 part.s28-1 part.s29
-      
-....
-
-Although it is acceptable to use a greater increment, gaps in numbers may be troublesome if one is using this capability extensively.
-
-Finally, the Objects field is used for the names of all the items to be patterned.
-
-
-[[build_pattern_stringsub]]
-== String Substitution
-
-It is also possible to create a pattern in which a string of characters in each element in the object is changed (e.g., "l_" -> "r_"). This is useful for symmetry applications (e.g., left - right) or series (e.g., 1 - n). Each element of the object must have the source string so the user must be thorough and name each primitive, region, and assembly properly. Consider the following example: image:../articles/images/build_pattern_fig07.png[]
-
-Top-level duplications copy the patterned object and reference its entire structure with matrices, as follows:
-
-
-....
-
-/pattern group
-       /COPIED assemblies [MATRICES]
-	    /assemblies
-		  /regions
-			/primitives
-      
-....
-
-Region-level duplications copy all assembly and regions and reference from the region level down with matrices.
-
-
-....
-
-/pattern group
-       /COPIED assemblies
-	    /COPIED regions [MATRICES]
-/primitives
-      
-....
-
-Primitive-level duplications copy the entire tree structure to the primitive level without matrices using an increment on all primitives.
-
-
-....
-
-/pattern group
-       /COPIED assemblies       NO MATRICES
-	    /COPIED regions
-		 /COPIED primitives
-      
-....
-
-
-
-
-[[build_pattern_recpatterns]]
-== Rectangular Patterns
-
-The rectangular pattern GUI (shown in Figure E-2) is designed to facilitate one-, two-, or three-dimensional rectangular patterns. The default X, Y, and Z directions are positive along each axis. In order to create a rectangle that is not axis aligned, these vectors may be changed with the condition that each must remain precisely perpendicular to the other two. If the Use Directions series is checked, the user specifies the number of copies and the Delta between copies for each axis. If the Use Lists series is checked, the user can specify a list of deltas along each axis.
-
-.The user interface for building rectangular patterns.
-image::../articles/images/build_pattern_fig02.png[]
-
-
-[[build_pattern_spherical]]
-== Spherical Patterns
-
-The spherical pattern GUI (shown in Figure E-3) facilitates sphere-shaped patterns rotated around a center vertex using user-specified radii with azimuth and elevation angles. As shown in Figure E-4, the patterned objects--in this case, a series of arrows--may be oriented as built around the sphere or rotated by azimuth and/or elevation such that they are oriented toward the pattern center using the Rotate Azimuth and Rotate Elevation check boxes.
-
-As shown in Figure E-4, the Pattern Center field is the coordinate at the center of the pattern. The Object Center field is a user-defined coordinate used to locate the object(s) relative to the pattern center. It acts as the key point for any transformations to the pattern object(s).
-
-The Starting Azimuth and Starting Elevation fields follow the same right-hand-rule Cartesian coordinate conventions as Multi-Device Geometry Editor (MGED) viewing. The Starting Radius is the distance from the Pattern Center to the object center at the user-specified azimuths and elevations.
-
-If the Create Az/El series is checked, the user defines the number of azimuths and elevations and the deltas between each. If the Use Lists series is checked, the user must specify a list of azimuths and/or elevations.
-
-The Create Radii and Use Radii List series define offsets from the Starting Radius, allowing the user to create a pattern of concentric spheres. If Create Radii is checked, the user specifies the Number of Radii and the Radius Delta in order to construct a number of equally offset sphere patterns. If the Use Radii List is checked, the user specifies a list of radius offsets.
-
-.The user interface for building spherical patterns.
-image::../articles/images/build_pattern_fig03.png[]
-
-Without the Rotate Azimuth or Rotate Elevation boxes checked, the patterned objects are oriented as built without any rotations. Notice, for example, that every arrow in Figure E-5 points to the left. Notice also that for each patterned arrow, the Object Center (here specified as the tip of the arrow) is located on the circle outline at a distance of one Starting Radius from the Pattern Center. If we set the Object Center to the coordinate at the base of the arrow, the base would then lie on the circular outline. Wherever the Object Center is set is the point at which MGED works with the Object Center coordinate to place and rotate patterned objects.
-
-.Examples of different spherical pattern orientations.
-image::../articles/images/build_pattern_fig04.png[]
-
-.Implementation of spherical patterns.
-image::../articles/images/build_pattern_fig05.png[]
-
-
-[[build_pattern_cylind]]
-== Cylindrical Patterns
-
-The cylindrical pattern GUI (shown in Figure E-6) facilitates the creation of cylinder-shaped patterns with user-defined center, direction, height, azimuth, and radii inputs. The Base Center is the vertex of the cylinder shape. The Object Center is a user-defined coordinate used to locate the object(s) relative to the Base Center and Height Direction. It acts as the key point for any transformations to the pattern object(s). The Height Direction is the vector along which the cylinder runs. The Starting Height is the offset from the Base Center along the Height Direction that the pattern will place the Object Center.
-
-.The user interface for building cylindrical patterns.
-image::../articles/images/build_pattern_fig06.png[]
-
-

doc/asciidoc/articles/build_region.adoc

@@ -1,73 +0,0 @@
-= Using the build_region Command
-Lee A Butler; Eric W Edwards; Dwayne L Kregel
-:doctype: article
-:toc:
-:toclevels: 3
-
-Just as the Build Pattern tool can help automate the process of building multiple occurrences of objects, the build_region command can help automate the process of creating regions. The command (which currently has no graphical user interface equivalent) uses meaning assigned by the user in the primitive name based on the intended use of the primitive.
-
-The user includes the Boolean operation and relational information in the name of the primitive using a simple naming convention. The naming convention is designed around the following two assumptions:
-
-
-* The same text "tag" is used for all primitives in a region.
-* A sequential numbering pattern is used.
-
-For example, let's say we want to build the four rounded corners of a "tub" region for a toy metal wagon assembly (see Figure F-1). We could choose something such as "wgn"--an abbreviated form of "wagon"--as the tag. This tag is short, easy to type, and representative of the final assembly name. Our primitives would therefore be of the form wgn.s#.
-
-[[build_region5]]
-.The rounded corners of a toy wagon.
-image::../articles/images/build_region_fig01.png[]
-
-Next, we create an arb8 for one long side of the wagon tub. It is named wgn.s1. After that, we create an rcc for one corner of the tub. It is named wgn.s2. To get a hollow quarter cylinder, we need to subtract a cylinder and intersect a bounding box (see Figure F-2). In order to relate the subtraction and intersecting primitives with wgn.s2, they will each share the same root name, wgn.s2. The subtraction primitive will be named wgn.s2-1, and the intersecting primitive will be named wgn.s2+1.
-
-[[build_region7]]
-.Arb8, cylinder, and two Boolean primitives.
-image::../articles/images/build_region_fig02.png[]
-
-Now we have created the following four primitives:
-
-
-....
-
-wgn.s1 wgn.s2 wgn.s2+1 wgn.s2-1
-    
-....
-
-If we separate the primitives sequentially as follows,
-
-
-....
-
-wgn.s1
-
-wgn.s2 wgn.s2+1 wgn.s2-1,
-    
-....
-
-we can begin to see the Boolean structure falling out of the naming convention
-
-
-....
-
-u wgn.s1
-
-u wgn.s2 + wgn.s2+1 - wgn.s2-1
-    
-....
-
-If we wanted to make a second subtraction from wgn.s2--say, for a drain hole in the corner of the wagon--we would name that primitive wgn.s2-2, as shown in <<build_region9>>. We can break this name down as follows: the root name `wgn` identifies the region; `.s2` is the base solid the operation applies to; and the trailing `-2` marks this as the second subtraction from that solid (the first having been `wgn.s2-1`).
-
-[[build_region9]]
-.The region and the subtraction primitives.
-image::../articles/images/build_region_fig03.png[]
-
-Note that the root name stays the same so we can maintain the relationship, and the second number (associated with the Boolean operation) is incremented sequentially.
-
-[[build_region11]]
-.Raytraced image with hole.
-image::../articles/images/build_region_fig04.png[]
-
-Obviously, the overall success or failure of the build_region command depends on primitives being named properly. But if they are, the command can organize them in one automated step, creating complex regions in just a few keystrokes.
-
-Another modeling benefit of the build_region tool is that it allows the user to quickly organize primitives. Assume, for example, that we have used the aforementioned naming convention to construct a complicated region. If there was a subsection of the region that we needed to, say, keep out for another assembly, delete from our database, move slightly, or copy, it would be a simple matter to create a new region with just those primitives that we needed.
-

doc/asciidoc/articles/camo_shader.adoc

@@ -1,103 +0,0 @@
-= Camouflage shader
-:doctype: article
-:toc:
-:toclevels: 3
-
-[[Introduction]]
-== Introduction
-
-The "camo" shader creates a pseudo-random tri-color camouflage pattern on the object using a fractal noise pattern. This is a procedural shader based upon a fractal noise function known as fractional brownian motion or fBm.
-
-The fractal noise function produces a pseudo- random number in the range [-1.0 ... 1.0] from the 3-space coordinates of a point in the bounding volume of the region. This noise value is used to determine the color of the object at the given location.
-
-
-
-.Table 1
-[cols="2*"]
-|===
-|Noise Value
-|Object Color
-
-|nv < thresh1
-|color 1
-|nv < thresh1 and nv < thresh2
-|color 2
-|nv > thresh2
-|color 3
-|===
-
-
-
-The fractal pattern has infinite resolution. As a result, the borders of the color splashes never become pixelated, no mater how close the eyepoint is to the surface.
-
-
-
-.Table 2
-[cols="3*"]
-|===
-|parameter
-|Abbreviation
-|Default Value
-3+|Noise Parameters
-
-|lacunarity
-|l
-|2.1753974
-|H
-|H
-|1.0
-|octaves
-|o
-|4.0
-|size
-|s
-|1.0
-|vscale
-|v
-|1.0/1.0/1.0
-|delta
-|d
-|1000/1000/1000
-3+|*Shader Specific Parameters*
-|thresh1
-|t1
-|-0.25
-|thresh2
-|t2
-|0.25
-|color1
-|c1
-|97/74/41
-|color2
-|c2
-|26/77/10
-|color3
-|c3
-|38/38/38
-|===
-
-
-
-*Lacunarity*
-
-The grid on which the noise function is built is scaled by this value for each successive octave of noise which will be combined to produce the final result.
-
-*Octaves*
-
-The number of times the noise grid will be scaled and recombined to produce the final noise function
-
-*Size, Vscale*
-
-If *size* is set it is used as a scalar which defines the size of the noise grid on the object. So if t2=0.5 and size=5mm then splotches of color3 would tend to be no larger than 5-10mm. If non-uniform scaling is required, Vscale can specify the grid size in X, Y and Z.
-
-*Delta*
-
-This specifies a translation in noise space for the origin of region space. Since the origin of noise space is reflected 8 ways, it is undesirable to have that portion of noise space overlap with region space.
-
-
-[[Limitations]]
-== Limitations
-
-Because of the continuous nature of the fractal noise space, it is impossible to get a splash of color1 directly adjacent to a splash of color3.
-
-

doc/asciidoc/articles/ebm_primitive.adoc

@@ -1,57 +0,0 @@
-= Using the Extruded Bitmap Primitive
-Lee A Butler; Eric W Edwards; Dwayne L Kregel
-:doctype: article
-:toc:
-:toclevels: 3
-
-The extruded bitmap (ebm) primitive allows the user to make a three-dimensional (3-D) shape from a two-dimensional black-and-white image. This feature can be helpful when dealing with complex outlines, text, or other complicated shapes captured as images.
-
-For example, the ebm could be used if one wanted to model 3-D letters, such as in a company name, onto the side of a simulated wall or building. Note also that the same image used for the projection can, with some extra processing, form the basis for the ebm (see Figures C-1-C-3).
-
-[[ebm3]]
-.Example of the .bw image used for ebm.
-image::../articles/images/ebm_primitive_fig01.png[]
-
-[[ebm4]]
-.Example of ebm.
-image::../articles/images/ebm_primitive_fig02.png[]
-
-[[ebm5]]
-.Example of the ebm with projection shader added.
-image::../articles/images/ebm_primitive_fig03.png[]
-
-To make an ebm, the image file must be a black and white (.bw) file. A .bw image is a grayscale raw image file with only one channel. Each pixel can be turned on or off, but it has no color data. As shown in Figures C-2 and C-3, the white part of the image may be extruded in a straight line in the +Z direction to whatever length the user specifies. Regardless of the complexity of the geometry, all of the extruded shapes form a single ebm primitive.
-
-To enter an ebm in a database, the in command must be used. The arguments are as shown in the following example:
-
-[[ebm8]]
-[cols="7*"]
-[%noheader]
-|===
-|in
-|sample.ebm
-|ebm
-|image.bw
-|600
-|800
-|1
-|Make a shape.
-|Name it sample.
-|Make it an ebm.
-|Use the image.bw image file.
-|The image is 600 pixels wide.
-|The image is 800 pixels high.
-|Extrude the shape 1 inch (or whatever working units are in effect at the time) in the +Z direction.
-|===
-
-
-[NOTE]
-====
-Points to Remember About the ebm
-* The ebm cannot be created with the make, create, or inside commands.
-* The desired width and height of the ebm are input as pixel values, but the extrusion distance can be expressed in any working units.
-* Extrusions are made in the +Z direction, although after an ebm is made, the shape can be rotated, translated, or scaled.
-* When extruded, all shapes form a single ebm primitive.
-
-====
-

doc/asciidoc/articles/gallery/gallery_manifest.cmake

@@ -1,108 +0,0 @@
-# gallery_manifest.cmake -- data table for the procedural geometry gallery.
-#
-# Pure-CMake data file consumed by generate_gallery.cmake.  ALL per-demo
-# knowledge lives here so the generator stays generic (no `mged tops` parsing,
-# no platform branches).
-#
-# Each demo is one bracket-argument string in GALLERY_DEMO_<i>, with fields
-# separated by '|'.  Bracket args ([=[ ... ]=]) preserve embedded quotes,
-# semicolons, and commas verbatim, so captions need no escaping.  The caption
-# is the LAST field; the generator takes everything after the 9th '|' as the
-# caption (so semicolons in captions are safe).
-#
-# Fields (in order):
-#   name      image basename -> gallery_<name>.png
-#   section   group heading (drives .adoc sections, in first-seen order)
-#   driver    exec | stdin:<inputfile> | tomged | mgedcmd:<cmd>
-#   exe       target/binary basename (resolved via ensearch)
-#   args      argument template; @OUT@ = chosen .g path, @IN:<file>@ = input data path
-#   gfile     database to render: @OUT@ (the chosen .g) or @GLOB@ (lone *.g in workdir)
-#   objects   space-separated render objects
-#   autoview  space-separated objects for `-c "autoview ..."`, or empty
-#   render    ao (default, adds -c "set ambSamples=64") | noao
-#   caption   one-line description
-
-set(GALLERY_DEMO_COUNT 61)
-
-# ---- New demonstrations -----------------------------------------------------
-set(GALLERY_DEMO_0  [=[terragen|New demonstrations|exec|terragen|@OUT@|@OUT@|all|terrain.r water.r|ao|Fractal DSP terrain island with reflective water and a cloud environment-map sky; rendered with the new rt autoview command framing terrain+water.]=])
-set(GALLERY_DEMO_1  [=[voxelize|New demonstrations|exec|voxelize|@OUT@|@OUT@|all||ao|Demonstrates BRL-CAD's "vol" (3-D volume) and "ebm" (extruded bitmap) primitives by sampling a procedural 3-D scalar field (a triply-periodic gyroid by default) over a regular grid. It writes sidecar .vol/.ebm data files and builds an orange voxel isosurface (with a cutaway box) plus a blue extruded height-field companion.]=])
-set(GALLERY_DEMO_2  [=[lattice|New demonstrations|exec|lattice|@OUT@|@OUT@|all||ao|A full geodesic-sphere space-frame built by instancing one unit strut prototype across every de-duplicated geodesic edge, with joint spheres.]=])
-set(GALLERY_DEMO_3  [=[loftwing|New demonstrations|exec|loftwing|@OUT@|@OUT@|all||ao|A lofted NACA 4-digit airfoil wing (ARS) with taper, twist, sweep, and dihedral and a full root section.]=])
-set(GALLERY_DEMO_4  [=[loftwing_prop|New demonstrations|exec|loftwing|@OUT@ --mode prop|@OUT@|all||ao|Propeller mode of loftwing: one strongly twisted NACA blade instanced around a central hub to form a 3-blade propeller.]=])
-set(GALLERY_DEMO_5  [=[gears|New demonstrations|exec|gears|@OUT@|@OUT@|all|ground.r|ao|Builds a meshing involute spur-gear train, demonstrating the sketch->extrude procedural-modeling workflow in libwdb: each gear is one extruded involute tooth profile unioned in rotated copies around a hub with a central bore, laid left-to-right so the teeth interlock, plus a ground plane and a light under a top group "all".]=])
-set(GALLERY_DEMO_6  [=[helicoil|New demonstrations|exec|helicoil|@OUT@|@OUT@|all|coil.r|ao|Procedurally builds helical pipe solids (spring, screw, or DNA double helix) swept along a helix centerline via mk_pipe(); the default "spring" mode renders a chrome coil spring on a ground plane with a light, assembled into a top-level group "all".]=])
-set(GALLERY_DEMO_7  [=[specimen|New demonstrations|exec|specimen|@OUT@|@OUT@|all|ground.r|ao|Analytic-primitive specimen shelf (rpc, rhc, epa, ehy, hyp, eto, hrt, arbn, particle, tor, tgc, ell); rt autoview frames the shelf.]=])
-set(GALLERY_DEMO_59 [=[seashell|New demonstrations|exec|seashell|@OUT@|@OUT@|all||ao|A shelf of procedurally grown seashells. Each shell is one watertight BoT solid: a superformula generating curve (the aperture cross-section) is swept along a logarithmic helico-spiral, with the coil radius, axial rise, and cross-section all scaling by the same exponential growth factor per whorl -- the self-similar "gnomonic" growth a real mollusk uses -- so successive whorls nest without intersecting. Four species (a planispiral nautilus, a rounded-pentagon-mouthed conch, a tall fluted turret/auger, and a round snail) come from one parametric model, each with analytically smoothed vertex normals and rounded, tapered ends.]=])
-set(GALLERY_DEMO_60 [=[seashell_nautilus|New demonstrations|exec|seashell|@OUT@ --mode nautilus|@OUT@|all||ao|Single hero shell from the seashell generator: a pearly planispiral nautilus. The logarithmic-spiral sweep of a growing elliptical aperture reproduces the classic equiangular whorl, closed into a ray-traceable BoT solid with smooth shading.]=])
-
-# ---- Fractals & recursion ---------------------------------------------------
-set(GALLERY_DEMO_8  [=[sphflake|Fractals & recursion|exec|sphflake|-d 3 -f @OUT@|@OUT@|scene.r|depth0.r depth1.r depth2.r depth3.r|ao|Recursive mirror-sphere flake fractal; rendered with rt autoview framing the flake (depth0-3.r) over a checkered plane.]=])
-set(GALLERY_DEMO_9  [=[donuts|Fractals & recursion|exec|donuts|-o @OUT@|@OUT@|scene.r|depth0.r depth1.r depth2.r depth3.r|ao|Recursive torus "donut flake" fractal; rendered with rt autoview framing the flake regions.]=])
-set(GALLERY_DEMO_10 [=[menger|Fractals & recursion|exec|menger|-o @OUT@|@OUT@|menger|sponge.r|ao|A Menger sponge fractal carved from a cube with the recursive exterior (subtractive) pattern, on a ground plane with two lights.]=])
-set(GALLERY_DEMO_11 [=[pyramid|Fractals & recursion|exec|pyramid|5|@GLOB@|tree||ao|Generates a recursive 3-D Sierpinski-style pyramid built from ARB4 tetrahedra, subdividing each pyramid into 4 smaller ones per level (inspired by Glassner's SigGraph paper).]=])
-set(GALLERY_DEMO_12 [=[torii|Fractals & recursion|exec|torii|@OUT@|@OUT@|all||ao|An interwoven chain-mail weave of interlocking torii with a radial gradient of tube thickness (and color). Adjacent rings thread each other's holes without the solid tubes ever intersecting (verified 0 overlaps), so the whole sheet is a single, articulating, fully 3D-printable piece of mail.]=])
-
-# ---- Architecture & structural ----------------------------------------------
-set(GALLERY_DEMO_13 [=[masonry_frame|Architecture & structural|exec|masonry|-t frame -u ft -w 12,8 -o 3,0,5,7 -n wall|@GLOB@|r.wall.studs||ao|masonry wall generator, wood-frame wall type: studs, plates, and framing around a window opening.]=])
-set(GALLERY_DEMO_14 [=[masonry_sheetrock|Architecture & structural|exec|masonry|-t sheetrock -u ft -w 12,8 -o 3,0,5,7 -n wall|@GLOB@|r.wall.sr1||ao|masonry wall generator, sheetrock wall type.]=])
-set(GALLERY_DEMO_15 [=[masonry_brick|Architecture & structural|exec|masonry|-t brick -u in -w 96,48 -n wall|@GLOB@|r.wall.b||ao|masonry wall generator, brick wall type (prototype brick).]=])
-set(GALLERY_DEMO_16 [=[masonry_bm|Architecture & structural|exec|masonry|-t bm -u in -w 96,48 -m 0.25 -n wall|@GLOB@|r.wall.b||ao|masonry wall generator, mortar-brick wall type: brick with horizontal and vertical mortar joints.]=])
-set(GALLERY_DEMO_17 [=[brickwall|Architecture & structural|tomged|brickwall||@OUT@|g.brick||ao|Builds a brick wall: emits mged commands that create RPP brick solids arranged in rows (with optional mortar slabs between them) to fill a specified wall width and height. Output is a stream of mged commands on stdout, not a .g directly.]=])
-set(GALLERY_DEMO_18 [=[mkbuilding|Architecture & structural|exec|mkbuilding|@OUT@|@OUT@|house||ao|Generates a physically dimensioned building with material-separated walls, slabs, framed openings, roof, and optional structural members; JSON, OSM, and CityJSON specifications can produce full building catalogs.]=])
-set(GALLERY_DEMO_19 [=[cchannel|Architecture & structural|exec|cchannel|-f @OUT@ -H 0.2|@OUT@|channel.r||ao|Creates a section of fully configurable C-channel (structural metal beam). Default is a 1" diameter by 12" long section of American standard C-channel, here generated with a row of drilled holes.]=])
-set(GALLERY_DEMO_20 [=[ringworld|Architecture & structural|exec|ringworld|-o @OUT@|@OUT@|all.g||ao|Generates a "ringworld" as imagined by Larry Niven: a central sun sphere and a large CSG ring (built from three RCCs) orbiting it, combined into a top-level group all.g.]=])
-
-# ---- Organic, molecular & scenery -------------------------------------------
-set(GALLERY_DEMO_21 [=[vegetation|Organic, molecular & scenery|exec|vegetation|@OUT@ 20 30000 300 0.1 42|@GLOB@|plant.r||ao|Procedurally generates plant-like geometry (trees/shrubbery) from particle primitives built recursively with random branching and growth parameters, including an optional repeatability seed.]=])
-set(GALLERY_DEMO_22 [=[clutter|Organic, molecular & scenery|exec|clutter||@GLOB@|clut||ao|Generates procedural "clutter" made of primitive geometric objects: a grid of detail cells on a ground plane, each holding a random stack of spheres, crystals, or mixed primitives (boxes, cylinders, cones, ellipsoids), all enclosed by concentric torus rings and lit by four corner lights.]=])
-set(GALLERY_DEMO_23 [=[metaball|Organic, molecular & scenery|exec|metaball|-o @OUT@|@OUT@|meatballs.r||ao|Programmatically creates and combines metaball ("blobby") primitives: it generates three sets of randomly-placed iso-method metaballs via libwdb, then reads them back and merges all their points into one combined "mega metaball" via librt.]=])
-set(GALLERY_DEMO_24 [=[molecule|Organic, molecular & scenery|stdin:mol-cube.dat|molecule|Cube|@GLOB@|molecule||ao|Ball-and-stick molecule (spheres for atoms, cylinders for bonds) read from a G. Adams .dat file -- here a bonded cube of atoms with a central hub.]=])
-set(GALLERY_DEMO_25 [=[pdb-g|Organic, molecular & scenery|exec|pdb-g|@IN:caffeine.pdb@ @OUT@|@OUT@|all_atoms.r||ao|Reads a Protein Data Bank (PDB) text file and converts each atom into a 1mm-radius sphere, grouping them into a single combination to produce a BRL-CAD geometry database of the molecule (caffeine).]=])
-
-# ---- Mechanical & engineering -----------------------------------------------
-set(GALLERY_DEMO_26 [=[pipe|Mechanical & engineering|stdin:pipe.stdin|pipe|-t demo @OUT@|@OUT@|demo.pipe demo.fluid||ao|Generates piping (fuel/hydraulic lines, etc.) in MGED format from a routed sequence of 3D points, building both tubing regions and inner fluid regions, with automatically generated elbow regions wherever the pipe changes direction.]=])
-set(GALLERY_DEMO_27 [=[pipetest|Mechanical & engineering|exec|pipetest||@GLOB@|p1 p2 p3 pipe1||ao|Generates a test database of pipe and particle primitives: three particle solids (spherical, cylindrical, and conical) plus a multi-segment straight pipe and a bent pipe traced around a cube's faces.]=])
-set(GALLERY_DEMO_28 [=[tube|Mechanical & engineering|stdin:tube.stdin|tube||@GLOB@|g0||ao|Generates a gun-tube (cannon barrel) as a procedural spline/cylinder whose core lies on the X axis, optionally deformed per-frame from projectile firing data. With no stdin data it emits the static frame-0 geometry from a built-in center-of-mass table.]=])
-set(GALLERY_DEMO_29 [=[lens|Mechanical & engineering|exec|lens|@OUT@|@OUT@|lens_DCX_f600.0_d200.0.r||ao|Generates basic optical lenses (plano/double convex or concave) by using the lensmaker's equation to derive the geometry from inputs like type, diameter, focal length, refractive index, and thickness.]=])
-
-# ---- NURBS, B-rep, splines & surfaces ---------------------------------------
-set(GALLERY_DEMO_30 [=[brep_simple|NURBS, B-rep, splines & surfaces|exec|brep_simple||@GLOB@|cube.r||ao|Creates a single twisted-cube B-Rep solid directly via the openNURBS API (8 vertices, 12 edges, 6 faces) and writes it to a BRL-CAD database, demonstrating NURBS B-Rep construction.]=])
-set(GALLERY_DEMO_31 [=[brep_cube|NURBS, B-rep, splines & surfaces|exec|brep_cube||@GLOB@|cube.r||ao|Creates a twisted-cube B-Rep solid (8 vertices, 12 edges, 6 faces) by directly using the openNURBS API, then writes it to a BRL-CAD database. Copied almost verbatim from the openNURBS example_brep.cpp to explore B-Rep creation.]=])
-set(GALLERY_DEMO_32 [=[brep_cobb|NURBS, B-rep, splines & surfaces|exec|brep_cobb|@OUT@|@OUT@|cobb.r||ao|A Cobb NURBS unit sphere tiled with six rational Bezier patches.]=])
-set(GALLERY_DEMO_33 [=[brep_surface|NURBS, B-rep, splines & surfaces|exec|brep_surface|-H 1.0|@GLOB@|brep_surface.r||ao|Creates a single plate-mode NURBS (B-Rep) surface with a given thickness, defined by four control points, and writes it as a region to a .g database.]=])
-set(GALLERY_DEMO_34 [=[brep_trimmed|NURBS, B-rep, splines & surfaces|exec|brep_trimmed||@GLOB@|brep_trimmed.r||ao|Generates a single B-rep NURBS surface (a flat 10x10 square patch) with both an outer trimming loop and an interior rectangular trim/hole, demonstrating ON_Brep construction of trimmed surfaces.]=])
-set(GALLERY_DEMO_35 [=[brep_invalid|NURBS, B-rep, splines & surfaces|exec|brep_invalid||@GLOB@|brep_invalid.r||ao|Creates a single trimmed NURBS B-rep surface (one face of a Cobb sphere) with a deliberately invalid inner trim loop, to test/demonstrate handling of invalid trim geometry.]=])
-set(GALLERY_DEMO_36 [=[breplicator|NURBS, B-rep, splines & surfaces|exec|breplicator||@GLOB@|brep||ao|breplicator is a test tool for the BREP (boundary representation) primitive in librt; it builds a single closed 6-faced NURBS solid (an arb8-shaped box) via mk_brep() and writes it to a database.]=])
-set(GALLERY_DEMO_37 [=[csgbrep|NURBS, B-rep, splines & surfaces|exec|csgbrep||@GLOB@|all.g||ao|A reference gallery of CSG/implicit primitives, each also converted to a brep, grouped under a single top object.]=])
-set(GALLERY_DEMO_38 [=[surfaceintersect|NURBS, B-rep, splines & surfaces|exec|surfaceintersect|@OUT@|@OUT@|all||ao|Writes the two twisted-cube NURBS B-rep surfaces (red and blue). The experimental surface-surface intersection is behind a -x flag (off by default, as it currently crashes).]=])
-set(GALLERY_DEMO_39 [=[spltest|NURBS, B-rep, splines & surfaces|exec|spltest|@OUT@|@OUT@|spltest||ao|A NURBS spline test: a valid order-2 B-spline surface built from a 3x3 control mesh with a gently lifted center.]=])
-set(GALLERY_DEMO_40 [=[tea|NURBS, B-rep, splines & surfaces|exec|tea||@GLOB@|UtahTeapot||ao|Converts the Utah Teapot description from the IEEE CG&A database into BRL-CAD spline (NURBS) format, producing the classic closed-bottom teapot as a B-spline solid.]=])
-set(GALLERY_DEMO_41 [=[wavy|NURBS, B-rep, splines & surfaces|exec|wavy||@GLOB@|wavy||ao|Creates a random wavy surface modeled as a B-spline (NURBS) surface, generating a 10x10 grid of points with randomized height and interpolating them into a spline solid.]=])
-set(GALLERY_DEMO_42 [=[kurt|NURBS, B-rep, splines & surfaces|exec|kurt||@GLOB@|all||ao|Builds a surface from a multi-valued cubic function sampled over an 18x18 grid, triangulated into a BoT height-field sheet.]=])
-set(GALLERY_DEMO_43 [=[sketch|NURBS, B-rep, splines & surfaces|exec|sketch||@GLOB@|all||noao|Builds a 2D sketch (line/arc/bezier segments) and extrudes it into a renderable solid via mk_extrusion.]=])
-
-# ---- Primitives, BoT & API basics -------------------------------------------
-set(GALLERY_DEMO_44 [=[wdb_example|Primitives, BoT & API basics|exec|wdb_example|@OUT@|@OUT@|box_n_ball.r||ao|Demonstrates creating a BRL-CAD geometry database from C code using the libwdb API: it writes a sphere (ball.s) and an rpp/box (box.s), then unions them into a green plastic region named box_n_ball.r.]=])
-set(GALLERY_DEMO_45 [=[globe|Primitives, BoT & API basics|exec|globe|@OUT@|@OUT@|globe.r land.c||ao|Creates a set of concentric spherical "shells" (like an onion) that together form a unified solid sphere: a green solid land core surrounded by progressively transparent blue air layers.]=])
-set(GALLERY_DEMO_46 [=[bottest|Primitives, BoT & API basics|exec|bottest|@OUT@|@OUT@|bot_u_surf bot_ccw_surf bot_cw_surf bot_u_solid bot_ccw_solid bot_cw_solid bot_u_plate bot_ccw_plate bot_cw_plate bot_solid_dup_vs bot_solid_dup_fs||ao|Generates a set of test BOT (Bag of Triangles) solids in a .g database, covering every BOT mode/orientation combination: surface, solid, and plate types in unoriented/CCW/CW orientations, plus BOTs with duplicate vertices and faces for fuse/condense testing.]=])
-set(GALLERY_DEMO_47 [=[pix2g|Primitives, BoT & API basics|exec|pix2g|@IN:moss64.pix@ @OUT@ 64 64|@OUT@|image.c||ao|pix2g generates geometry from a pixmap (.pix) image: it creates one colored sphere per pixel arranged on a grid, where each sphere's color matches the corresponding pixel's RGB value, producing a 3D point-cloud rendition of the image.]=])
-
-# ---- src/shapes -- parametric shape generators ------------------------------
-set(GALLERY_DEMO_48 [=[bolt|src/shapes -- parametric shape generators|exec|bolt|-o3 -fbolt.g -n1 -hd30 -hh20 -wd45 -wh4 -sd14 -sh90|@GLOB@|bolta||ao|bolt is a BRL-CAD libwdb program that creates a bolt (in mm). It can build four types: a bolt head, head + washer, head + washer + stem, or head + stem. The head is a hex (two arb8 solids), the washer and stem are RCCs.]=])
-set(GALLERY_DEMO_49 [=[coil|src/shapes -- parametric shape generators|mgedcmd:coil mycoil|coil||@OUT@|mycoil||ao|Coil Generator -- a program to create coils (helical springs) using the BRL-CAD pipe primitive.]=])
-set(GALLERY_DEMO_50 [=[fence|src/shapes -- parametric shape generators|exec|fence|-o @OUT@ -L 2000 -N 1200 -j 400 -R 30 -r 5 -a 30 -c "70 90 110"|@OUT@|fence.r||ao|A chain-link fence generator. Every parameter (height, length, pole radius/spacing, wire radius, mesh twist angle, materials/colors) can be adjusted; it builds vertical RCC poles plus a woven zig-zag wire mesh between them.]=])
-set(GALLERY_DEMO_51 [=[gastank|src/shapes -- parametric shape generators|exec|gastank|-fgastank.g -n1 -H800 -w1200 -d500 -r120|@GLOB@|tnka||ao|A solid gas tank with all edges and corners rounded, composed of 3 arb8s, 8 spheres, and 12 cylinders, centered at the origin (dimensions in mm). Introduced in BRL-CAD release 4.4.]=])
-set(GALLERY_DEMO_52 [=[handle|src/shapes -- parametric shape generators|exec|handle|-fhandle.g -n1 -l200 -H120 -r130 -r215|@GLOB@|hana||ao|handle is a BRL-CAD libwdb sample program that constructs a handle (in millimeters) from three cylinders, two tori, and two arb8s, with its base centered at (0,0,0) and its height extending in the +Z direction. Introduced in BRL-CAD release 4.4.]=])
-set(GALLERY_DEMO_53 [=[human|src/shapes -- parametric shape generators|exec|human|-A -n Body|@GLOB@|Body||ao|Generator for human models based on height (and other anthropometric parameters). It procedurally builds an articulated humanoid body assembled from primitives (head, neck, torso, arms with shoulder/elbow/wrist joints, hands, thighs/calves with knee joints, and feet), defaulting to a standing 50th-percentile man.]=])
-set(GALLERY_DEMO_54 [=[picket_fence|src/shapes -- parametric shape generators|exec|picket_fence|@OUT@ fence_ 1000 30 0 0 0 3000 0 0 4500 2000 0|@OUT@|fence_sec0.c fence_sec1.c||ao|picket_fence builds a wooden picket fence: vertical pointed-top pickets (arb8 posts with wedge-cut tops) joined by two horizontal stringer rails, laid out along a sequence of x/y/z waypoints so the fence can follow a multi-segment path. Rendered as brown plastic pickets with two rails across two fence sections.]=])
-set(GALLERY_DEMO_55 [=[tire|src/shapes -- parametric shape generators|mgedcmd:tire|tire||@OUT@|tire-215-55R17||ao|tire is BRL-CAD's Tire Generator, a program to create basic tire shapes (with an optional wheel). The rendered model is a default ISO 215/55R17 passenger tire mounted on a wheel hub.]=])
-set(GALLERY_DEMO_56 [=[window|src/shapes -- parametric shape generators|exec|window|-fwindow.g -n1 -H1618 -w1000 -d100 -r80|@GLOB@|wina||ao|window constructs a window with all edges and corners rounded, composed of two arb8s and four cylinders, built using libwdb in millimeters. The front of the window is centered at the origin and extends in the negative X-direction by the window depth.]=])
-set(GALLERY_DEMO_57 [=[window_frame|src/shapes -- parametric shape generators|exec|window_frame|-fwindow_frame.g -n1 -H1618 -w1000 -d100 -r80 -i120|@GLOB@|wfra||ao|window_frame constructs a window frame with all edges and corners rounded, composed of 4 arb8s and 8 cylinders (in millimeters). The front of the frame is centered at the origin and extends in the negative x-direction by its depth.]=])
-set(GALLERY_DEMO_58 [=[wire|src/shapes -- parametric shape generators|stdin:wire.stdin|wire||@GLOB@|wires||ao|wire creates wiring or fuel lines from user-supplied endpoint coordinates and line radii. It builds a continuous tube as a chain of truncated cones (segments) joined by spheres at the vertices, grouped under a "wires" combination -- here a four-turn helix.]=])
-
-# ---- Not rendered (documented in "Known limitations", no image) -------------
-set(GALLERY_NR_COUNT 3)
-set(GALLERY_NR_0 [=[nmgmodel|Intentionally non-manifold NMG exercising 3-, 2-, 1-, and 0-manifold features (a holed/voided block plus dangling faces, wires, and a lone vertex). It generates valid geometry, but the libnmg raytracer aborts on it (BU_ASSERT in isect.c), so it cannot be raytraced.]=])
-set(GALLERY_NR_1 [=[tea_nmg|Utah teapot as a t-NURBS NMG (closed bottom). The vertex-fuse fix lets it write geometry, but rt aborts importing the t-NURBS NMG (NMG_CK_DISKMAGIC) -- a librt limitation with t-NURBS NMG, not a usage issue.]=])
-set(GALLERY_NR_2 [=[gtimes|A ray-trace/database timing benchmark: it opens an existing .g repeatedly and prints timings for db_open, db_dirbuild, db_update_nref, tops, and db_close. It produces no geometry.]=])

doc/asciidoc/articles/gallery/generate_gallery.cmake

@@ -1,294 +0,0 @@
-# generate_gallery.cmake -- regenerate the procedural geometry gallery snapshot.
-#
-# Run via:  cmake -DRT=... -DMGED=... -DBINDIR=... -DMANIFEST=... -DIMGDIR=...
-#                 -DADOC=... -DINPUTDIR=... -DWORKDIR=... -DSIZE=512
-#                 -DTITLE=... -P generate_gallery.cmake
-#
-# Drives every demo (manifest row) to produce a .g, ray traces it to a 512px
-# PNG with rt, and emits the AsciiDoc article.  Cross-platform: uses only
-# cmake / execute_process / file / string -- no bash, cmd, python, or shell.
-# Tool argv is passed directly (no shell), so quoting bugs are impossible.
-
-cmake_minimum_required(VERSION 3.20)
-
-# ---- required inputs --------------------------------------------------------
-foreach(v RT MGED MANIFEST IMGDIR ADOC INPUTDIR WORKDIR)
-  if(NOT DEFINED ${v})
-    message(FATAL_ERROR "generate_gallery: -D${v}=... is required")
-  endif()
-endforeach()
-if(NOT DEFINED SIZE)
-  set(SIZE 512)
-endif()
-if(NOT DEFINED TITLE)
-  set(TITLE "BRL-CAD Procedural Geometry Gallery")
-endif()
-if(NOT DEFINED BINDIR)
-  get_filename_component(BINDIR "${RT}" DIRECTORY)
-endif()
-
-set(GEN_TIMEOUT 300)    # seconds for a single geometry-generation step
-set(RENDER_TIMEOUT 1800) # seconds for a single rt render
-
-include("${MANIFEST}")
-
-file(MAKE_DIRECTORY "${WORKDIR}")
-file(MAKE_DIRECTORY "${IMGDIR}")
-
-# ---- helpers ----------------------------------------------------------------
-
-# Split a |-delimited record into D_name D_section D_driver D_exe D_args
-# D_gfile D_objects D_autoview D_render D_caption.  Caption (last field) is the
-# verbatim remainder, so embedded semicolons/commas are preserved.
-function(parse_demo rec)
-  set(remaining "${rec}")
-  foreach(fn name section driver exe args gfile objects autoview render)
-    string(FIND "${remaining}" "|" p)
-    if(p LESS 0)
-      set(D_${fn} "${remaining}" PARENT_SCOPE)
-      set(remaining "")
-    else()
-      string(SUBSTRING "${remaining}" 0 ${p} v)
-      set(D_${fn} "${v}" PARENT_SCOPE)
-      math(EXPR np "${p} + 1")
-      string(SUBSTRING "${remaining}" ${np} -1 remaining)
-    endif()
-  endforeach()
-  set(D_caption "${remaining}" PARENT_SCOPE)
-endfunction()
-
-# Locate a demo executable by basename in BINDIR (handles the .exe suffix).
-function(resolve_exe name outvar)
-  foreach(cand "${name}" "${name}.exe")
-    if(EXISTS "${BINDIR}/${cand}")
-      set(${outvar} "${BINDIR}/${cand}" PARENT_SCOPE)
-      return()
-    endif()
-  endforeach()
-  set(${outvar} "" PARENT_SCOPE)
-endfunction()
-
-# Substitute @OUT@ and @IN:<file>@ tokens in a single argv element.  @OUT@ is
-# substituted as a RELATIVE filename (the demo runs with WORKING_DIRECTORY set
-# to its work dir), so legacy generators with small fixed-size filename buffers
-# do not truncate a long absolute path.  @IN: paths stay absolute.
-function(subst_tokens tok outrel outvar)
-  if(tok MATCHES "^@IN:(.+)@$")
-    set(${outvar} "${INPUTDIR}/${CMAKE_MATCH_1}" PARENT_SCOPE)
-  else()
-    string(REPLACE "@OUT@" "${outrel}" tok "${tok}")
-    set(${outvar} "${tok}" PARENT_SCOPE)
-  endif()
-endfunction()
-
-# ---- main loop --------------------------------------------------------------
-
-set(SECTION_ORDER "")   # ordered unique list of section names (no ';' in names)
-set(N_OK 0)
-set(N_FAIL 0)
-set(FAILED "")
-
-math(EXPR LAST "${GALLERY_DEMO_COUNT} - 1")
-foreach(i RANGE 0 ${LAST})
-  parse_demo("${GALLERY_DEMO_${i}}")
-
-  set(wd "${WORKDIR}/${D_name}")
-  file(REMOVE_RECURSE "${wd}")
-  file(MAKE_DIRECTORY "${wd}")
-  set(out_rel "${D_name}.g")        # relative name passed to demo args (@OUT@)
-  set(outg "${wd}/${out_rel}")      # absolute path for gfile resolution / mged
-
-  resolve_exe("${D_exe}" exepath)
-  if(NOT exepath)
-    message(WARNING "[${D_name}] executable '${D_exe}' not found in ${BINDIR} -- skipping")
-    list(APPEND FAILED "${D_name} (no exe)")
-    math(EXPR N_FAIL "${N_FAIL} + 1")
-    continue()
-  endif()
-
-  # Build the resolved argv list (quotes respected, tokens substituted).
-  separate_arguments(rawargs UNIX_COMMAND "${D_args}")
-  set(finalargs "")
-  foreach(tok ${rawargs})
-    subst_tokens("${tok}" "${out_rel}" rtok)
-    list(APPEND finalargs "${rtok}")
-  endforeach()
-
-  # ---- run the generator step by driver -------------------------------------
-  set(rc 0)
-  set(genout "")
-  if(D_driver STREQUAL "exec")
-    execute_process(
-      COMMAND "${exepath}" ${finalargs}
-      WORKING_DIRECTORY "${wd}" TIMEOUT ${GEN_TIMEOUT}
-      RESULT_VARIABLE rc OUTPUT_VARIABLE genout ERROR_VARIABLE genout)
-  elseif(D_driver MATCHES "^stdin:(.+)$")
-    set(infile "${INPUTDIR}/${CMAKE_MATCH_1}")
-    execute_process(
-      COMMAND "${exepath}" ${finalargs}
-      WORKING_DIRECTORY "${wd}" TIMEOUT ${GEN_TIMEOUT}
-      INPUT_FILE "${infile}"
-      RESULT_VARIABLE rc OUTPUT_VARIABLE genout ERROR_VARIABLE genout)
-  elseif(D_driver STREQUAL "tomged")
-    # capture exe stdout (mged command stream), then pipe into mged
-    execute_process(
-      COMMAND "${exepath}" ${finalargs}
-      WORKING_DIRECTORY "${wd}" TIMEOUT ${GEN_TIMEOUT}
-      OUTPUT_FILE "${wd}/cmds.mged" ERROR_VARIABLE genout RESULT_VARIABLE rc)
-    if(rc EQUAL 0)
-      execute_process(
-        COMMAND "${MGED}" -c "${outg}"
-        WORKING_DIRECTORY "${wd}" TIMEOUT ${GEN_TIMEOUT}
-        INPUT_FILE "${wd}/cmds.mged" OUTPUT_VARIABLE genout ERROR_VARIABLE genout
-        RESULT_VARIABLE rc)
-    endif()
-  elseif(D_driver MATCHES "^mgedcmd:(.+)$")
-    set(gedcmd "${CMAKE_MATCH_1}")
-    file(WRITE "${wd}/cmds.mged" "${gedcmd}\nq\n")
-    execute_process(
-      COMMAND "${MGED}" -c "${outg}"
-      WORKING_DIRECTORY "${wd}" TIMEOUT ${GEN_TIMEOUT}
-      INPUT_FILE "${wd}/cmds.mged" OUTPUT_VARIABLE genout ERROR_VARIABLE genout
-      RESULT_VARIABLE rc)
-  else()
-    message(WARNING "[${D_name}] unknown driver '${D_driver}' -- skipping")
-    list(APPEND FAILED "${D_name} (bad driver)")
-    math(EXPR N_FAIL "${N_FAIL} + 1")
-    continue()
-  endif()
-
-  # ---- resolve the database to render ---------------------------------------
-  if(D_gfile STREQUAL "@OUT@")
-    set(gpath "${outg}")
-  elseif(D_gfile STREQUAL "@GLOB@")
-    file(GLOB gg "${wd}/*.g")
-    list(LENGTH gg ng)
-    if(ng EQUAL 0)
-      set(gpath "")
-    else()
-      list(GET gg 0 gpath)
-      if(ng GREATER 1)
-        message(WARNING "[${D_name}] ${ng} .g files in workdir; using ${gpath}")
-      endif()
-    endif()
-  else()
-    set(gpath "${wd}/${D_gfile}")
-  endif()
-
-  if(NOT gpath OR NOT EXISTS "${gpath}")
-    message(WARNING "[${D_name}] generation failed (rc=${rc}, no .g). Output:\n${genout}")
-    list(APPEND FAILED "${D_name} (no .g)")
-    math(EXPR N_FAIL "${N_FAIL} + 1")
-    continue()
-  endif()
-
-  # ---- render with rt -------------------------------------------------------
-  set(imgpath "${IMGDIR}/gallery_${D_name}.png")
-  file(REMOVE "${imgpath}")   # rt refuses to overwrite an existing -o target
-
-  set(rtcmd "${RT}" "-s${SIZE}")
-  if(NOT D_render STREQUAL "noao")
-    list(APPEND rtcmd -c "set ambSamples=64")
-  endif()
-  if(NOT D_autoview STREQUAL "")
-    list(APPEND rtcmd -c "autoview ${D_autoview}")
-  endif()
-  list(APPEND rtcmd -A1 -o "${imgpath}" "${gpath}")
-  separate_arguments(objlist UNIX_COMMAND "${D_objects}")
-  foreach(o ${objlist})
-    list(APPEND rtcmd "${o}")
-  endforeach()
-
-  execute_process(
-    COMMAND ${rtcmd}
-    WORKING_DIRECTORY "${wd}" TIMEOUT ${RENDER_TIMEOUT}
-    RESULT_VARIABLE rc OUTPUT_VARIABLE rtout ERROR_VARIABLE rtout)
-
-  set(ok FALSE)
-  if(EXISTS "${imgpath}")
-    file(SIZE "${imgpath}" isz)
-    if(isz GREATER 3000)
-      set(ok TRUE)
-    endif()
-  endif()
-
-  if(ok)
-    message(STATUS "[${D_name}] rendered ${imgpath} (${isz} bytes)")
-    math(EXPR N_OK "${N_OK} + 1")
-  else()
-    message(WARNING "[${D_name}] rt render failed (rc=${rc}). Output:\n${rtout}")
-    list(APPEND FAILED "${D_name} (render)")
-    math(EXPR N_FAIL "${N_FAIL} + 1")
-  endif()
-
-  # ---- stash result for adoc emission ---------------------------------------
-  set(R_${i}_name "${D_name}")
-  set(R_${i}_section "${D_section}")
-  set(R_${i}_caption "${D_caption}")
-  set(R_${i}_ok "${ok}")
-  if(NOT D_section IN_LIST SECTION_ORDER)
-    list(APPEND SECTION_ORDER "${D_section}")
-  endif()
-endforeach()
-
-# ---- emit the AsciiDoc article ---------------------------------------------
-
-set(AO_LINE "rt -s${SIZE} -c \"set ambSamples=64\" [-c \"autoview <objs>\"] -A1 -o <name>.png <db>.g <objects>")
-
-set(adoc "= ${TITLE}\n")
-string(APPEND adoc ":doctype: article\n")
-string(APPEND adoc ":toc:\n")
-string(APPEND adoc ":toclevels: 2\n")
-string(APPEND adoc "\n")
-string(APPEND adoc "This gallery shows the procedural-geometry demonstration programs in BRL-CAD's\n")
-string(APPEND adoc "`src/proc-db` and `src/shapes` directories. Each model is built from source by its\n")
-string(APPEND adoc "generator program and then ray traced with `rt` -- no hand modeling. The renders are\n")
-string(APPEND adoc "auto-framed and auto-lit by the ray tracer using ambient occlusion:\n")
-string(APPEND adoc "\n----\n${AO_LINE}\n----\n")
-string(APPEND adoc "\n")
-string(APPEND adoc "Some renders use the `rt -c \"autoview <objs>\"` command to frame a sub-scene (for\n")
-string(APPEND adoc "example, to exclude a distant light source from the view).\n")
-string(APPEND adoc "\n")
-string(APPEND adoc "NOTE: This article and its images are a committed snapshot. Developers can regenerate\n")
-string(APPEND adoc "them from the built tools by configuring with `-DBRLCAD_GENERATE_GALLERY=ON` and\n")
-string(APPEND adoc "building the `procedural-gallery-snapshot` target.\n")
-
-foreach(sec ${SECTION_ORDER})
-  string(APPEND adoc "\n== ${sec}\n\n")
-  string(APPEND adoc "[cols=\"1,3\"]\n[%noheader]\n|===\n")
-  foreach(i RANGE 0 ${LAST})
-    if(DEFINED R_${i}_ok AND R_${i}_ok AND R_${i}_section STREQUAL sec)
-      set(nm "${R_${i}_name}")
-      string(APPEND adoc "|image:images/gallery_${nm}.png[${nm},${SIZE}]\n")
-      string(APPEND adoc "|*${nm}*: ${R_${i}_caption}\n")
-    endif()
-  endforeach()
-  string(APPEND adoc "|===\n")
-endforeach()
-
-# Known limitations
-if(DEFINED GALLERY_NR_COUNT AND GALLERY_NR_COUNT GREATER 0)
-  string(APPEND adoc "\n== Known limitations\n\n")
-  string(APPEND adoc "A few programs are part of the source tree but are not shown above, because the\n")
-  string(APPEND adoc "geometry they produce cannot be ray traced in the current tree:\n\n")
-  math(EXPR NRLAST "${GALLERY_NR_COUNT} - 1")
-  foreach(j RANGE 0 ${NRLAST})
-    set(rec "${GALLERY_NR_${j}}")
-    string(FIND "${rec}" "|" p)
-    string(SUBSTRING "${rec}" 0 ${p} nrname)
-    math(EXPR np "${p} + 1")
-    string(SUBSTRING "${rec}" ${np} -1 nrreason)
-    string(APPEND adoc "* *${nrname}* -- ${nrreason}\n")
-  endforeach()
-endif()
-
-file(WRITE "${ADOC}" "${adoc}")
-
-# ---- summary ----------------------------------------------------------------
-message(STATUS "")
-message(STATUS "Gallery snapshot: ${N_OK} rendered, ${N_FAIL} failed/skipped.")
-if(FAILED)
-  string(REPLACE ";" ", " failstr "${FAILED}")
-  message(STATUS "Failed/skipped: ${failstr}")
-endif()
-message(STATUS "Article written: ${ADOC}")

doc/asciidoc/articles/gallery/inputs/caffeine.pdb

@@ -1,26 +0,0 @@
-HEADER    CAFFEINE (1,3,7-TRIMETHYLXANTHINE) FORMULA C8H10N4O2                  
-HETATM    1  N1  CAF A   1      -1.250   1.250   0.000  1.00  0.00           N  
-HETATM    2  C2  CAF A   1       0.000   1.500   0.000  1.00  0.00           C  
-HETATM    3  O2  CAF A   1       1.200   1.300   0.000  1.00  0.00           O  
-HETATM    4  N3  CAF A   1       1.500   0.000   0.000  1.00  0.00           N  
-HETATM    5  C4  CAF A   1       1.000  -1.000   0.000  1.00  0.00           C  
-HETATM    6  C5  CAF A   1       0.000  -1.500   0.000  1.00  0.00           C  
-HETATM    7  C6  CAF A   1      -1.000  -1.000   0.000  1.00  0.00           C  
-HETATM    8  O6  CAF A   1      -1.800  -2.000   0.000  1.00  0.00           O  
-HETATM    9  N7  CAF A   1      -1.500   0.000   0.000  1.00  0.00           N  
-HETATM   10  C8  CAF A   1      -2.300   1.000   0.000  1.00  0.00           C  
-HETATM   11  H8  CAF A   1      -3.000   1.200   0.000  1.00  0.00           H  
-HETATM   12  N9  CAF A   1      -2.900   2.100   0.000  1.00  0.00           N  
-HETATM   13  CM1 CAF A   1      -1.800   2.200   0.000  1.00  0.00           C  
-HETATM   14 HM1A CAF A   1      -1.000   2.500   0.000  1.00  0.00           H  
-HETATM   15 HM1B CAF A   1      -2.400   2.900   0.000  1.00  0.00           H  
-HETATM   16 HM1C CAF A   1      -2.200   1.300   0.000  1.00  0.00           H  
-HETATM   17  CM3 CAF A   1       2.200   0.500   0.000  1.00  0.00           C  
-HETATM   18 HM3A CAF A   1       2.700   1.200   0.000  1.00  0.00           H  
-HETATM   19 HM3B CAF A   1       2.800  -0.200   0.000  1.00  0.00           H  
-HETATM   20 HM3C CAF A   1       1.900   0.800   0.000  1.00  0.00           H  
-HETATM   21  CM7 CAF A   1      -2.300  -0.500   0.000  1.00  0.00           C  
-HETATM   22 HM7A CAF A   1      -3.200  -0.700   0.000  1.00  0.00           H  
-HETATM   23 HM7B CAF A   1      -1.800  -1.300   0.000  1.00  0.00           H  
-HETATM   24 HM7C CAF A   1      -2.800   0.100   0.000  1.00  0.00           H  
-END                                                                             

doc/asciidoc/articles/gallery/inputs/mol-cube.dat

@@ -1,32 +0,0 @@
-0 0 Carbon 40 40 40
-0 1 Center 230 60 60
-1 0 -4.0 -4.0 -4.0 1.2 0
-1 1  4.0 -4.0 -4.0 1.2 0
-1 2  4.0  4.0 -4.0 1.2 0
-1 3 -4.0  4.0 -4.0 1.2 0
-1 4 -4.0 -4.0  4.0 1.2 0
-1 5  4.0 -4.0  4.0 1.2 0
-1 6  4.0  4.0  4.0 1.2 0
-1 7 -4.0  4.0  4.0 1.2 0
-1 8  0.0  0.0  0.0 1.8 1
-2 0 1
-2 1 2
-2 2 3
-2 3 0
-2 4 5
-2 5 6
-2 6 7
-2 7 4
-2 0 4
-2 1 5
-2 2 6
-2 3 7
-2 8 0
-2 8 1
-2 8 2
-2 8 3
-2 8 4
-2 8 5
-2 8 6
-2 8 7
-3

doc/asciidoc/articles/gallery/inputs/pipe.stdin

@@ -1,8 +0,0 @@
-mm
-50 5
-0 0 0
-300 0 0
-300 300 0
-300 300 300
-0 300 300
-0 300 600

doc/asciidoc/articles/gallery/inputs/wire.stdin

@@ -1,204 +0,0 @@
-wire.g
-101
-300.0000 0.0000 0.0000
-25.0000
-290.5749 74.6070 15.0000
-25.0000
-262.8920 144.5261 30.0000
-25.0000
-218.6906 205.3641 45.0000
-25.0000
-160.7480 253.2984 60.0000
-25.0000
-92.7051 285.3170 75.0000
-25.0000
-18.8372 299.4080 90.0000
-25.0000
--56.2144 294.6862 105.0000
-25.0000
--127.7338 271.4481 120.0000
-25.0000
--191.2272 231.1540 135.0000
-25.0000
--242.7051 176.3356 150.0000
-25.0000
--278.9329 110.4374 165.0000
-25.0000
--297.6344 37.6000 180.0000
-25.0000
--297.6344 -37.6000 195.0000
-25.0000
--278.9329 -110.4374 210.0000
-25.0000
--242.7051 -176.3356 225.0000
-25.0000
--191.2272 -231.1540 240.0000
-25.0000
--127.7338 -271.4481 255.0000
-25.0000
--56.2144 -294.6862 270.0000
-25.0000
-18.8372 -299.4080 285.0000
-25.0000
-92.7051 -285.3170 300.0000
-25.0000
-160.7480 -253.2984 315.0000
-25.0000
-218.6906 -205.3641 330.0000
-25.0000
-262.8920 -144.5261 345.0000
-25.0000
-290.5749 -74.6070 360.0000
-25.0000
-300.0000 -0.0000 375.0000
-25.0000
-290.5749 74.6070 390.0000
-25.0000
-262.8920 144.5261 405.0000
-25.0000
-218.6906 205.3641 420.0000
-25.0000
-160.7480 253.2984 435.0000
-25.0000
-92.7051 285.3170 450.0000
-25.0000
-18.8372 299.4080 465.0000
-25.0000
--56.2144 294.6862 480.0000
-25.0000
--127.7338 271.4481 495.0000
-25.0000
--191.2272 231.1540 510.0000
-25.0000
--242.7051 176.3356 525.0000
-25.0000
--278.9329 110.4374 540.0000
-25.0000
--297.6344 37.6000 555.0000
-25.0000
--297.6344 -37.6000 570.0000
-25.0000
--278.9329 -110.4374 585.0000
-25.0000
--242.7051 -176.3356 600.0000
-25.0000
--191.2272 -231.1540 615.0000
-25.0000
--127.7338 -271.4481 630.0000
-25.0000
--56.2144 -294.6862 645.0000
-25.0000
-18.8372 -299.4080 660.0000
-25.0000
-92.7051 -285.3170 675.0000
-25.0000
-160.7480 -253.2984 690.0000
-25.0000
-218.6906 -205.3641 705.0000
-25.0000
-262.8920 -144.5261 720.0000
-25.0000
-290.5749 -74.6070 735.0000
-25.0000
-300.0000 -0.0000 750.0000
-25.0000
-290.5749 74.6070 765.0000
-25.0000
-262.8920 144.5261 780.0000
-25.0000
-218.6906 205.3641 795.0000
-25.0000
-160.7480 253.2984 810.0000
-25.0000
-92.7051 285.3170 825.0000
-25.0000
-18.8372 299.4080 840.0000
-25.0000
--56.2144 294.6862 855.0000
-25.0000
--127.7338 271.4481 870.0000
-25.0000
--191.2272 231.1540 885.0000
-25.0000
--242.7051 176.3356 900.0000
-25.0000
--278.9329 110.4374 915.0000
-25.0000
--297.6344 37.6000 930.0000
-25.0000
--297.6344 -37.6000 945.0000
-25.0000
--278.9329 -110.4374 960.0000
-25.0000
--242.7051 -176.3356 975.0000
-25.0000
--191.2272 -231.1540 990.0000
-25.0000
--127.7338 -271.4481 1005.0000
-25.0000
--56.2144 -294.6862 1020.0000
-25.0000
-18.8372 -299.4080 1035.0000
-25.0000
-92.7051 -285.3170 1050.0000
-25.0000
-160.7480 -253.2984 1065.0000
-25.0000
-218.6906 -205.3641 1080.0000
-25.0000
-262.8920 -144.5261 1095.0000
-25.0000
-290.5749 -74.6070 1110.0000
-25.0000
-300.0000 -0.0000 1125.0000
-25.0000
-290.5749 74.6070 1140.0000
-25.0000
-262.8920 144.5261 1155.0000
-25.0000
-218.6906 205.3641 1170.0000
-25.0000
-160.7480 253.2984 1185.0000
-25.0000
-92.7051 285.3170 1200.0000
-25.0000
-18.8372 299.4080 1215.0000
-25.0000
--56.2144 294.6862 1230.0000
-25.0000
--127.7338 271.4481 1245.0000
-25.0000
--191.2272 231.1540 1260.0000
-25.0000
--242.7051 176.3356 1275.0000
-25.0000
--278.9329 110.4374 1290.0000
-25.0000
--297.6344 37.6000 1305.0000
-25.0000
--297.6344 -37.6000 1320.0000
-25.0000
--278.9329 -110.4374 1335.0000
-25.0000
--242.7051 -176.3356 1350.0000
-25.0000
--191.2272 -231.1540 1365.0000
-25.0000
--127.7338 -271.4481 1380.0000
-25.0000
--56.2144 -294.6862 1395.0000
-25.0000
-18.8372 -299.4080 1410.0000
-25.0000
-92.7051 -285.3170 1425.0000
-25.0000
-160.7480 -253.2984 1440.0000
-25.0000
-218.6906 -205.3641 1455.0000
-25.0000
-262.8920 -144.5261 1470.0000
-25.0000
-290.5749 -74.6070 1485.0000
-25.0000
-300.0000 -0.0000 1500.0000
-25.0000

doc/asciidoc/articles/gcv.adoc

@@ -1,880 +0,0 @@
-= The Geometry Conversion Library
-Jon Engbert
-:doctype: article
-:toc:
-:toclevels: 3
-
-== Introduction
-
-The Geometry Conversion Library (GCV or libgcv) provides a unified API for geometry conversion capabilities under a plugin-based architecture.
-
-The GCV public API is declared in C headers located within `include/gcv/`. The single `include/gcv.h` header includes the entire GCV public API.
-
-
-== Architecture
-
-The Geometry Conversion Library consists of a stream-based API for geometry conversion and associated operations. Input and output are provided by "reader" and "writer" converters (provided by plugins). Intermediate operations are provided by "filters". Readers and writers are types of filters that provide input and output support for model formats, while basic filters apply transformations to models and geometry.
-
-Geometry is stored in an in-memory BRL-CAD database (`struct db_i` in `include/rt/db_instance.h`) during the intermediate steps of conversion. For writer filters, this database is marked read-only and its geometry should not be modified. All names within a BRL-CAD database must be unique.
-
-.GCV architecture
-image::../articles/images/gcv_architecture.png[]
-
-
-== Building GCV
-
-GCV can be built in a similar manner as other BRL-CAD libraries. After configuring with CMake, building the `libgcv` target will produce a dynamic library. For Unix-based systems, the procedure should be similar to the following:
-
-
-....
-
-$ cd brlcad
-$ mkdir build
-$ cd build
-$ cmake ..
-$ make libgcv
-....
-
-
-
-Plugins can be built under `gcv_ _plugin_name_` targets, or collectively under the `gcv_plugins` target.
-
-The command-line utility can be built under the `gcv` target. At this time, the `gcv` program is not installed automatically; the binary will be placed into `build/src/conv/gcv/`.
-
-
-== Example: Using GCV in an application
-
-The following code illustrates a basic use of GCV from within an application. Note that there may be multiple filters providing import/export capabilities for a given format; the below code simply selects the first matching filter encountered.
-
-.gcv_app.c
-[example]
-====
-
-[source,c]
-----
-#include "common.h"
-
-#include "bu/log.h"
-#include "bu/mime.h"
-#include "gcv.h"
-
-/* Convert the file at 'in_path' to the file at 'out_path', selecting the
- * first registered reader and writer filter that match the file types
- * inferred from the two path extensions.  Returns 0 on success. */
-int
-convert(const char *in_path, const char *out_path)
-{
-    struct gcv_context context;
-    const struct gcv_filter *in_filter, *out_filter;
-    bu_mime_model_t in_type, out_type;
-
-    /* Infer the model file types from the filename extensions. */
-    in_type = (bu_mime_model_t)bu_file_mime(in_path, BU_MIME_MODEL);
-    out_type = (bu_mime_model_t)bu_file_mime(out_path, BU_MIME_MODEL);
-
-    /* A context holds the conversion state, including an in-memory
-     * database used for the intermediate representation. */
-    gcv_context_init(&context);
-
-    /* Look up a reader for the input type and a writer for the output
-     * type.  find_filter() returns the first matching registered filter,
-     * or NULL if none is available. */
-    in_filter = find_filter(GCV_FILTER_READ, in_type, in_path, &context);
-    out_filter = find_filter(GCV_FILTER_WRITE, out_type, NULL, &context);
-
-    if (!in_filter || !out_filter) {
-	bu_log("No filter available for the requested conversion\n");
-	gcv_context_destroy(&context);
-	return 1;
-    }
-
-    /* Read the input into the context's in-memory database.  Passing NULL
-     * for the options selects the defaults from gcv_opts_default().  The
-     * argc/argv pair would carry any filter-specific option strings.
-     * gcv_execute() returns 1 on success and 0 on failure. */
-    if (!gcv_execute(&context, in_filter, NULL, 0, NULL, in_path)) {
-	bu_log("Read filter '%s' failed for '%s'\n", in_filter->name, in_path);
-	gcv_context_destroy(&context);
-	return 1;
-    }
-
-    /* Write the in-memory database out through the selected writer. */
-    if (!gcv_execute(&context, out_filter, NULL, 0, NULL, out_path)) {
-	bu_log("Write filter '%s' failed for '%s'\n", out_filter->name, out_path);
-	gcv_context_destroy(&context);
-	return 1;
-    }
-
-    gcv_context_destroy(&context);
-    return 0;
-}
-----
-
-====
-
-
-== GCV Public API
-
-The public API for interacting with GCV filter plugins is summarized below.
-
-.GCV public filter API
-[cols="2*"]
-[%noheader]
-|===
-|`struct gcv_context`
-|Stores the conversion state. Plugins may store messages in the `bu_avs_t` member `messages`.
-|`gcv_context_init()`
-|Initialize a `struct gcv_context`. Creates an in-memory `struct db_i` for conversion data.
-|`gcv_context_destroy()`
-|Frees memory associated with a `struct gcv_context`.
-|`struct gcv_filter`
-|Stores characteristics of a filter.
-|`struct gcv_opts`
-|Store generic options applying to all filters.
-|`gcv_opts_default()`
-|Initialize a `struct gcv_opts` with default values.
-|`gcv_list_filters()`
-|Returns a pointer to a `const struct bu_ptbl` containing all registered filters as `const struct gcv_filter` pointers.
-|`gcv_execute()`
-|Perform a filter operation on a `struct gcv_context`. Returns `1` on success and `0` on failure. If `gcv_options` is `NULL`, the defaults will be used as set by `gcv_opts_default()`. The parameters `argc` and `argv` are used for option parsing as specified by the struct gcv_filter.
-|===
-
-
-== The Internal Plugin API
-
-The GCV plugin API is declared in `include/gcv/api.h`. Plugins provide an externally-visible `const struct gcv_plugin` defining their filters, which are described by `struct gcv_filter`.
-
-.The gcv_filter struct
-[cols="2*"]
-[%noheader]
-|===
-|`name`
-|Specifies a unique name for the filter, allowing it to be identified by application code.
-|`filter_type`
-|Specifies the type of filter.
-|`create_opts_fn`
-|Optional pointer to a function that allocates and initializes `struct bu_opt_desc` data and an opaque pointer for storing the option data. If non-`NULL`, `free_opts_fn` must also be specified. This member is private for use by libgcv and the associated plugin.
-|`free_opts_fn`
-|Optional pointer to a function that frees any opaque pointer allocated by `create_opts_fn`. This member is private for use by libgcv and the associated plugin.
-|`filter_fn`
-|Pointer to a function which performs the filter operation. The `db_i` passed to a writer function within a `gcv_context` is marked read-only (the pointer is to a non-`const` struct due to in-memory data that may be modified). Filters of type `GCV_FILTER_FILTER` receive a `NULL` value for `target`. Must return `1` on success and `0` on failure. This member is private for use by libgcv and the associated plugin.
-|===
-
-As shown in the above table, filters may initialize data structures for processing command-line style option strings via `bu_opt`. Please refer to `include/bu/opt.h` for full documentation on the `bu_opt` API.
-
-=== Utility Functions
-
-In addition to availability of the rest of the BRL-CAD API, the Geometry Conversion Library provides a number of utility functions that may be useful during plugin development.
-
-.GCV utility functions
-[cols="2*"]
-[%noheader]
-|===
-|`gcv_bot_is_solid()`, `gcv_bot_is_closed()`, `gcv_bot_is_orientable()`
-|Performs topological tests for determining whether a given triangular mesh is a manifold, orientable, closed fan satisfying requisite conditions for object solidity. `gcv_bot_is_solid()` is equivalent to `gcv_bot_is_closed && gcv_bot_is_orientable()`
-|`gcv_facetize()`
-|Produces a triangular mesh tessellation of the object at the given database path using the specified tolerances. Note that if the object at the given path is a combination, a single mesh will be produced from all objects within its tree, and so calling gcv_facetize() on a tree unnecessarily high in the hierarchy and containing many objects is more likely to fail during Boolean evaluation.
-|===
-
-There are also many relevant functions provided by the BRL-CAD API, including a new mesh decimation function.
-
-.BRL-CAD mesh decimation API
-[cols="2*"]
-[%noheader]
-|===
-|`rt_bot_decimate_gct()`
-|Fast implementation of an iterative mesh decimation algorithm.
-|===
-
-
-
-== Developing a Minimal Plugin
-
-=== Basic Code
-
-The following steps will implement a minimal plugin providing a reader filter.
-
-
-. Add the following line to `misc/mime_cad.types`. This file is used to generate `include/bu/mime.h`:
-+
-
-----
-
-model/foo               bar
-----
-
-+
-This will associate the file extension `.bar` with a new `BU_MIME_MODEL_FOO` value of `bu_mime_model_t`.
-
-. Create the following file at `src/libgcv/plugins/foo/CMakeLists.txt`:
-+
-.CMakeLists.txt
-[example]
-====
-
-----
-
-LIBGCV_ADD_PLUGIN(foo "foo_read.c" "librt;libbu")
-----
-
-====
-
-. Create the following file at `src/libgcv/plugins/foo/foo_read.c`:
-+
-.foo_read.c
-[example]
-====
-
-[source,c]
-----
-#include "common.h"
-
-#include "bu/log.h"
-#include "bu/mime.h"
-#include "gcv/api.h"
-#include "wdb.h"
-
-/* The reader callback.  For a GCV_FILTER_READ filter, 'target' is the
- * path of the input file, and geometry should be written into the
- * in-memory database reachable through context->dbip.  Return 1 on
- * success and 0 on failure. */
-static int
-foo_read(struct gcv_context *context, const struct gcv_opts *gcv_options,
-	 const void *UNUSED(options_data), const char *target)
-{
-    struct rt_wdb *wdbp;
-
-    if (gcv_options->verbosity_level)
-	bu_log("Reading foo file: %s\n", target);
-
-    /* Open the context's in-memory database for writing. */
-    wdbp = wdb_dbopen(context->dbip, RT_WDB_TYPE_DB_INMEM);
-    mk_id_units(wdbp, "Converted from foo format", "mm");
-
-    /* ... parse 'target' and create objects with the wdb (mk_*) API,
-     * e.g. mk_sph(), mk_bot(), mk_lcomb() ... */
-
-    return 1;
-}
-
-/* Describe the filter: a unique name, its type, the model type it
- * handles, and the callbacks.  This reader defines no filter-specific
- * options, so the create/free option hooks and data_supported are NULL. */
-static const struct gcv_filter gcv_conv_foo_read = {
-    "FOO Reader", GCV_FILTER_READ, BU_MIME_MODEL_FOO, NULL,
-    NULL, NULL, foo_read
-};
-
-/* A plugin exports a NULL-terminated array of its filters ... */
-static const struct gcv_filter * const filters[] = {&gcv_conv_foo_read, NULL};
-
-/* ... referenced by a struct gcv_plugin ... */
-static const struct gcv_plugin gcv_plugin_info_s = { filters };
-
-/* ... which libgcv discovers by dlsym()-ing this exported entry point. */
-COMPILER_DLLEXPORT const struct gcv_plugin *
-gcv_plugin_info(void) { return &gcv_plugin_info_s; }
-----
-
-====
-
-
-
-=== Traversing the Database
-
-BRL-CAD provides the `db_walk_tree()` function for traversing the database in hierarchical order. You can specify your own visitor callbacks as documented in `include/rt/tree.h`, or use the region-end functions provided by GCV (`include/gcv/util.h`) to tessellate geometry at the region level.
-
-.GCV region-end tessellation callbacks
-[cols="2*"]
-[%noheader]
-|===
-|`gcv_region_end()`
-|Apply Boolean evaluation to region-level tessellated meshes using the default NMG Boolean evaluator, replacing each region-level node and its subtree of tessellated leaf meshes with a single BoT structure that is then passed to the specified callback. The `client_data` pointer should point to a `struct gcv_region_end_data`. The individual leaf nodes must already be tessellated into BoTs. This can be done by specifying a `leaf_func` such as `rt_booltree_leaf_tess()`. In the case of failure, an error message is emitted via `bu_log()` and the callback is not invoked. Any use of `bu_bomb()` produced by the callback is trapped and an error message is displayed while continuing the tree walk.
-|`gcv_bottess_region_end()`
-|Boolean evaluator roughly based on UnBBoolean's j3dbool (and associated papers). Does not take a callback.
-|`gcv_region_end_mc()`
-|Experimental variant of `gcv_region_end()` based on the marching-cubes algorithm. Tessellates leaves internally and does not require a `leaf_func`.
-|===
-
-The following example implements a filter that tessellates all geometry into BoT mesh objects and counts the total number of faces.
-
-.tessellation_statistics.c
-[example]
-====
-
-[source,c]
-----
-#include "common.h"
-
-#include "bu/log.h"
-#include "bu/mime.h"
-#include "nmg.h"
-#include "rt/geom.h"
-#include "raytrace.h"
-#include "gcv/api.h"
-#include "gcv/util.h"
-
-/* State shared with the region-end callback. */
-struct tess_stats {
-    size_t face_count;
-};
-
-/* Invoked once per region by gcv_region_end() after the region's leaf
- * meshes have been Boolean-evaluated into a single NMG region 'r'.  Here
- * we simply tally the outward-facing (OT_SAME) faces.  This routine must
- * be prepared to run in parallel. */
-static void
-count_region_faces(struct nmgregion *r, const struct db_full_path *UNUSED(pathp),
-		   struct db_tree_state *UNUSED(tsp), void *client_data)
-{
-    struct tess_stats *stats = (struct tess_stats *)client_data;
-    struct shell *s;
-
-    NMG_CK_REGION(r);
-
-    for (BU_LIST_FOR(s, shell, &r->s_hd)) {
-	struct faceuse *fu;
-	for (BU_LIST_FOR(fu, faceuse, &s->fu_hd)) {
-	    if (fu->orientation != OT_SAME)
-		continue;
-	    bu_semaphore_acquire(BU_SEM_GENERAL);
-	    stats->face_count++;
-	    bu_semaphore_release(BU_SEM_GENERAL);
-	}
-    }
-}
-
-/* A GCV_FILTER_FILTER receives a NULL target and operates on the geometry
- * already present in context->dbip.  Return 1 on success, 0 on failure. */
-static int
-tessellation_statistics(struct gcv_context *context, const struct gcv_opts *gcv_options,
-			const void *UNUSED(options_data), const char *UNUSED(target))
-{
-    struct tess_stats stats = {0};
-    struct gcv_region_end_data end_data;
-    struct db_tree_state tree_state;
-    struct model *the_model = nmg_mm();
-
-    /* Configure the tree-walk state: tolerances come from the conversion
-     * options, and ts_m provides the NMG model used during tessellation. */
-    RT_DBTS_INIT(&tree_state);
-    tree_state.ts_tol = &gcv_options->calculational_tolerance;
-    tree_state.ts_ttol = &gcv_options->tessellation_tolerance;
-    tree_state.ts_m = &the_model;
-
-    /* gcv_region_end() expects its client_data to point at this struct. */
-    end_data.write_region = count_region_faces;
-    end_data.vlfree = &rt_vlfree;
-    end_data.client_data = &stats;
-
-    /* Walk every top-level object.  Leaves are tessellated to BoTs by
-     * rt_booltree_leaf_tess(); gcv_region_end() then Boolean-evaluates
-     * each region and invokes our callback with the result. */
-    (void)db_walk_tree(context->dbip, (int)gcv_options->num_objects,
-		       (const char **)gcv_options->object_names, 1, &tree_state,
-		       NULL, gcv_region_end, rt_booltree_leaf_tess, &end_data);
-
-    bu_log("Total faces after tessellation: %zu\n", stats.face_count);
-
-    return 1;
-}
-
-static const struct gcv_filter gcv_conv_tess_stats = {
-    "Tessellation Statistics", GCV_FILTER_FILTER, BU_MIME_MODEL_AUTO, NULL,
-    NULL, NULL, tessellation_statistics
-};
-----
-
-====
-
-
-=== Converting Unsupported Entities
-
-Although BRL-CAD supports a wide array of common geometric primitives, you may encounter objects that can't be directly imported or exported into an analogous entity. In these cases, conversion filters usually tessellate the incompatible geometry (typically during export) or convert it into an approximation or a composite of several other primitives (often during import).
-
-.Tessellation of incompatible entities
-image::../articles/images/gcv_unsupported_tessellation.png[]
-
-
-=== Comparing Geometry
-
-When developing a filter, it is often useful to be able to compare different models during testing. This capability is provided by the `gdiff` tool. There are two versions of `gdiff`: the standalone command-line version and the `gdiff` provided within the MGED interface.
-
-The command-line `gdiff` quickly produces a textual summary for a two- or three- way diff of several BRL-CAD databases. Documentation for this utility is available under `brlman gdiff`.
-
-The `gdiff` command available within the MGED interface provides a different capability. It uses BRL-CAD's ray tracer to produce a visual display of the differences between two objects within the same database. To compare geometry from separate databases, you can first merge the databases using the `dbconcat` command from within MGED. See `brlman dbconcat` for full documentation.
-
-.Usage of MGED's gdiff utility
-[cols="2*"]
-|===
-|Usage:
-|`gdiff [OPTION]... obj1 obj2`
-
-|`--tol=#`, `-t#`
-|Tolerance in millimeters.
-|`--ray-diff`, `-R`
-|Test for differences with raytracing.
-|`--view-left`, `-l`
-|Visualize volumes added only by left object.
-|`--view-both`, `-b`
-|Visualize volumes common to both objects.
-|`--view-right`, `-r`
-|Visualize volumes added only by right object.
-|`--grazing`, `-G`
-|Report differences in grazing hits (raytracing mode).
-|===
-
-.Using MGED's gdiff utility
-image::../articles/images/gcv_using_gdiff.png[]
-
-
-=== Creating Unit Tests
-
-BRL-CAD provides a library of standard models that may be used for unit tests, located under `$BRLCAD_ROOT/share/db/` (note that these files are generated during the build process). Unit tests can be integrated into the build system using the `add_test` CMake command.
-
-
-
-== Example: Extending an Application
-
-The following example will leverage the filter in the above plugin example, `tessellation_statistics.c`, to implement a function that counts the number of faces in a model after tessellation.
-
-.gcv_embedded.c
-[example]
-====
-
-[source,c]
-----
-#include "common.h"
-
-#include "bu/log.h"
-#include "bu/mime.h"
-#include "gcv.h"
-
-/* Defined in tessellation_statistics.c, above. */
-extern const struct gcv_filter gcv_conv_tess_stats;
-
-/* Load the geometry file at 'in_path' into a fresh context, then run the
- * tessellation-statistics filter over it.  A GCV_FILTER_FILTER operates
- * on the geometry already in the context, so its target is NULL.
- * Returns 0 on success. */
-int
-report_tessellation_stats(const char *in_path)
-{
-    struct gcv_context context;
-    const struct gcv_filter *in_filter;
-    bu_mime_model_t in_type;
-
-    gcv_context_init(&context);
-
-    /* Import the input model into the context's in-memory database. */
-    in_type = (bu_mime_model_t)bu_file_mime(in_path, BU_MIME_MODEL);
-    in_filter = find_filter(GCV_FILTER_READ, in_type, in_path, &context);
-    if (!in_filter || !gcv_execute(&context, in_filter, NULL, 0, NULL, in_path)) {
-	bu_log("Failed to read '%s'\n", in_path);
-	gcv_context_destroy(&context);
-	return 1;
-    }
-
-    /* Run the filter; it tallies the faces and reports via bu_log(). */
-    if (!gcv_execute(&context, &gcv_conv_tess_stats, NULL, 0, NULL, NULL)) {
-	bu_log("Tessellation-statistics filter failed\n");
-	gcv_context_destroy(&context);
-	return 1;
-    }
-
-    gcv_context_destroy(&context);
-    return 0;
-}
-----
-
-====
-
-
-== The GCV Frontend
-
-GCV includes a command-line front-end utility, `gcv`, implemented in `src/conv/gcv/gcv.c`. Full documentation is available under `brlman gcv` and `gcv --help`.
-
-.Basic usage of the gcv utility
-[example]
-====
-
-....
-
-$ gcv --input=a.stl --output=b.fg4
-Input file format: BU_MIME_MODEL_STL
-Output file format: BU_MIME_MODEL_VND_FASTGEN
-Input file path: a.stl
-Output file path: b.fg4
-    Converting Part: all_cpu_cpw6_cw_cpubox_cpubox.a
-    Using solid name: s.all_cpu_cpw6_cw_cpubox_cpubox.a
-    Making region (all_cpu_cpw6_cw_cpubox_cpubox.a)
-...
-....
-
-====
-
-.Generic options
-[example]
-====
-
-....
-
-$ gcv --input=a.fg4 --output=b.vrml --input-and-output-opts --verbosity=1 --output-only-opts --objects=comp_0001.r
-....
-
-====
-
-.Filter-specific options
-[example]
-====
-
-....
-
-$ gcv --input=a.fg4 --output=b.obj --input-only-opts --colors=a.fg4.colors --output-only-opts --vertex-normals
-....
-
-====
-
-.Specifying conversion formats
-[example]
-====
-
-....
-
-$ gcv --input=infile.txt --output=outfile.obj --input-format=stl
-....
-
-====
-
-
-== Conversion Filters
-
-GCV currently contains support for import and export into five model formats, detailed below.
-
-.Conversion formats supported by GCV
-[cols="2*"]
-|===
-|Format
-|File Extension
-
-|BRL-CAD
-|`.g`
-|FASTGEN4
-|`.fg4`
-|WaveFront Object
-|`.obj`
-|StereoLithography
-|`.stl`
-|Virtual Reality Modeling Language
-|`.vrml`
-|===
-
-=== Common Conversion Options
-
-The `gcv_opts` struct stores generic options applying to many filters, detailed below. Not all options may be applicable to or respected by every filter.
-
-.Conversion formats supported by GCV
-[cols="2*"]
-[%noheader]
-|===
-|`debug_mode`
-|Print debugging info if set to `1`. Default is `0`.
-|`verbosity_level`
-|Verbosity level. The default, level `0`, is "quiet" (only error messages are produced).
-|`scale_factor`
-|Specify the scale factor to be applied during import or export, as units per mm. Default is `1.0`.
-|`calculational_tolerance`
-|Calculational tolerance. Defaults to the RT defaults. If you use a non-default value, you should set the ray tracer tolerance to match it when using the resulting model.
-|`tessellation_tolerance`
-|Tessellation tolerance. The default value is: `abs = 0.0` `rel = 1.0e-2` `norm = 0.0` 
-|`tessellation_algorithm`
-|Specify use of either the default, marching-cubes, or bottess-based tessellation algorithm.
-|`max_cpus`
-|Maximum number of processors to utilize where possible. Default is `0`, specifying the maximum available during execution.
-|`num_objects`
-|Number of objects to convert. If `0` (the default), all top-level objects will be converted.
-|`object_names`
-|Names of objects to convert (must have `num_objects` elements). Default is `NULL`.
-|`default_name`
-|Name assigned to objects without names. Defaults to "`unnamed`".
-|`bu_debug_flag`
-|Debug flag for libbu (see `include/bu/debug.h`), applied via bitwise-OR with the original value. The original debug flag will be restored after conversion. Defaults to `0`.
-|`rt_debug_flag`
-|Debug flag for librt (see `include/rt/debug.h`), applied via bitwise-OR with the original value. The original debug flag will be restored after conversion. Defaults to `0`.
-|`nmg_debug_flag`
-|Debug flag for libnmg (see `include/nmg.h`), applied via bitwise-OR with the original value. The original debug flag will be restored after conversion. Defaults to `0`.
-|===
-
-.Using struct gcv_opts
-[example]
-====
-
-----
-
-static int
-apply_filter_with_options(struct gcv_context *context, const struct gcv_filter *filter, const char *target)
-{
-    struct gcv_opts options;
-    const char *argv[] = { "--colors=colors.dat", "--continue" };
-    const size_t argc = sizeof(argv) / sizeof(argv[0]);
-
-    gcv_opts_default(&options);
-    options->debug_mode = 1;
-
-    return gcv_execute(context, filter, &options, argc, argv, target);
-}
-----
-
-====
-
-
-=== FASTGEN4 Reader
-
-.FASTGEN4 reader options
-[cols="2*"]
-[%noheader]
-|===
-|`--colors=_path_`
-|Path to a file specifying component colors.
-|`--muves=_path_`
-|Create a MUVES input file containing any CHGCOMP and CBACKING components.
-|`--plot=_path_`
-|Create a libplot3 plot file of all CTRI and CQUAD elements processed.
-|`--sections=_list_`
-|Process only a list ("`3001, 4082, 5347`") or a range ("`2315 - 3527`") of section IDs.
-|===
-
-
-=== FASTGEN4 Writer
-
-At this time, the FASTGEN4 writer plugin does not make use of any filter-specific options.
-
-
-=== OBJ Reader
-
-.OBJ reader options
-[cols="2*"]
-[%noheader]
-|===
-|`--continue`
-|Continue processing on nmg-bomb. Conversion will fall back to native BoT mode if a fatal error occurs when using the nmg or BoT-via-nmg modes.
-|`--fuse-vertices`
-|Fuse vertices that are near enough to be considered identical. Can make the solidity detection more reliable, but may significantly increase processing time during the conversion.
-|`--grouping=_mode_`
-|Select which OBJ face grouping is used to create BRL-CAD primitives. `group` = group (default) `material` = material `none` = none `object` = object `texture` = texture 
-|`--conversion-mode=_mode_`
-|Select the conversion mode. `bot` = native BoT (default) `nmg` = NMG `nmgbot` = BoT via NMG 
-|`--bot-plate-thickness=_thickness_`
-|Thickness (mm) used when a BoT is not a closed volume and it's converted as a plate or plate-nocos BoT.
-|`--bot-ignore-normals`
-|Ignore the normals defined in the input file when using native BoT conversion mode.
-|`--bot-open-type=_type_`
-|Select the type used for BoTs that aren't closed volumes. `surface` = surface (default) `plate` = plate `nocos` = plate-nocos 
-|`--bot-plot`
-|Creates a plot/overlay (`.plot3`) file of open edges for BoTs that aren't closed volumes. `_bot_name_.plot3` will be created in the current directory and will overwrite any existing file with the same name.
-|`--bot-orientation=_mode_`
-|Select the BoT orientation mode. `unoriented` = unoriented (default) `ccw` = counterclockwise `cw` = clockwise 
-|===
-
-
-=== OBJ Writer
-
-.OBJ writer options
-[cols="2*"]
-[%noheader]
-|===
-|`--vertex-normals`
-|Output vertex normals.
-|`--usemtl`
-|Place `usemtl` statements in the output file. These statements are fictional (they do not refer to any material database). The materials named provide information about the material codes assigned to the objects in the BRL-CAD database. The material names will be of the form "`_aircode___los___material_`", where _aircode_ is the code number for the air represented by that region, if it does represent air; otherwise, this will be `0`. The _los_ is the Line Of Sight thickness (`0` to `100`) assigned to the region, and _material_ is the material code number assigned.
-|===
-
-
-=== STL Reader
-
-.STL reader options
-[cols="2*"]
-[%noheader]
-|===
-|`--binary`
-|Specify that the input file is in binary STL format (the default assumes ASCII).
-|`--starting-ident=_number_`
-|Specify the starting ident for the regions created. The default is `1000`. This number will be incremented for each region, unless `--constant-ident` is specified.
-|`--constant-ident`
-|Specify that the starting ident should remain constant.
-|`--material=_code_`
-|Specify the material code that will be assigned to all created regions (the default is `0`).
-|===
-
-
-=== STL Writer
-
-.STL writer options
-[cols="2*"]
-[%noheader]
-|===
-|`--binary`
-|Write output as a binary STL file. The default is ASCII. In the case of ASCII output, the region name is specified on the "solid" line of the STL file. In the case of binary output, all the regions are output as a single STL part.
-|`--output-dir`
-|Specify that the output path should be a directory. Each region converted is written to a separate file. File names are constructed from the full path names of each region (the path from the specified object to the region). Any "`/`" characters in the path name are replaced by "`@`" characters and "`.`" and white space are replaced by "`_`" characters.
-|===
-
-
-=== VRML Reader
-
-The native VRML reader accepts both VRML 1.0 and VRML97/2.0 files. VRML 1.0
-imports preserve ordered property state, separator scoping, `DEF`/`USE`
-instances, transformations, material colors, analytic cube, cone, cylinder,
-and sphere geometry, and indexed polygon meshes. Concave polygons are
-triangulated, and per-face material bindings are emitted as separate colored
-regions.
-
-VRML constructs that do not have a BRL-CAD equivalent or are not
-implemented yet, including cameras, lights, textures, text, line sets,
-and point sets, are accepted but do not produce objects. External
-content referenced by `WWWInline` is not fetched during conversion.
-
-The VRML reader plugin does not make use of any filter-specific options.
-
-
-=== VRML Writer
-
-.VRML writer options
-[cols="2*"]
-[%noheader]
-|===
-|`--bot-dump`
-|BoT dump. Mutually exclusive with `--evaluate-all`.
-|`--evaluate-all`
-|Evaluate all, CSG and BoTs. Mutually exclusive with `--bot-dump`.
-|===
-
-
-=== Open Asset Import Library Reader
-
-The Open Asset Import Library (assimp) is an open source library integrated into GCV, capable of loading and converting geometry from 45 3D file-formats.
-
-.Conversion extensions supported by Asset Import Library reader
-[cols="3*"]
-[%noheader]
-|===
-|.3d
-|.gltf / .glb (1.0)
-|.obj
-|.3ds
-|.gltf (2.0)
-|.off
-|.3mf
-|.hmp
-|.ogex
-|.ac
-|.ifc
-|.ply
-|.ac3d
-|.lwo
-|.pmx
-|.acc
-|.lws
-|.q3o
-|.ase
-|.lxo
-|.q3s
-|.b3d
-|.md2
-|.raw
-|.blend
-|.md3
-|.sib
-|.bvh
-|.md5
-|.smd
-|.cms
-|.mdc
-|.stl
-|.cob
-|.mdl
-|.x
-|.dae
-|.mesh / .mesh.xml
-|.x3d
-|.dxf
-|.ms3d
-|.xgl
-|.fbx
-|.nff
-|.zgl
-|===
-
-.Asset Import Library reader options
-[cols="2*"]
-[%noheader]
-|===
-|`--starting-ident=_number_`
-|Specify the starting ident for the regions created. The default is `1000`. This number will be incremented for each region, unless `--constant-ident` is specified.
-|`--constant-ident`
-|Specify that the starting ident should remain constant.
-|`--material=_code_`
-|Specify the material code that will be assigned to all created regions (the default is `0`).
-|`--format=_file_fmt_`
-|Specify the file format for conversion. By default, this is inferred from the file extension.
-|===
-
-.Specifying the Asset Import reader
-[example]
-====
-NOTE: As the Asset Import library handles many formats, some of which are also handled by other conversion methods, it currently must be explicitly called to invoke. The format itself is then inferred from the files extension.
-
-
-....
-
-$ gcv --input-format=assetimport input_file.ext output_file.ext
-....
-
-====
-
-
-=== Open Asset Import Library Writer
-
-The Open Asset Import Library (assimp) is an open source library integrated into GCV, capable of exporting to 15 different 3D file-formats.
-
-.Conversion extensions supported by Asset Import Library writer
-[cols="3*"]
-[%noheader]
-|===
-|.3ds
-|.fbx
-|.pbrt
-|.3mf
-|.glb
-|.ply
-|.assbin (assetimport binary)
-|.gltf
-|.stl
-|.assxml (assetimport xml)
-|.json
-|.stp
-|.dae
-|.obj
-|.x3d
-|===
-
-.Asset Import Library writer options
-[cols="2*"]
-[%noheader]
-|===
-|`--format=_file_fmt_`
-|Specify the file format for conversion. By default, this is inferred from the file extension.
-|===
-
-.Specifying the Asset Import writer
-[example]
-====
-NOTE: As the Asset Import library handles many formats, some of which are also handled by other conversion methods, it currently must be explicitly called to invoke. The format itself is then inferred from the files extension.
-
-
-....
-
-$ gcv --output-format=assetimport input_file.ext output_file.ext
-....
-
-====

doc/asciidoc/articles/ged.adoc

@@ -1,620 +0,0 @@
-= GED: An Interactive Solid Modeling System
-Michael J. Muuss <mulferts@austin.dsccc.com>; Keith A. Applin; J. Robert Suckling; Gary S. Moss; Earl P. Weaver; Charles A. Stanley
-:doctype: article
-:toc:
-:toclevels: 3
-
-[[Preface]]
-== Preface
-
-For many years the production and modification of target descriptions, no matter what method used, has been a slow, labor-intensive procedure. In an effort to improve the response time of target descriptions, the Ballistic Research Laboratory (BRL) has developed an interactive solid modeling system. This system is called the Graphics Editor (GED) and is designed to replace the traditional manual method of production and modification of target descriptions. GED presently applies to the combinatorial geometry (COMGEOM) solid modeling technique. Using GED, the target descriptions are interactively viewed, modified, and constructed with immediate visual feedback at each step. The GED system virtually eliminates explicit numerical input and opens a new dimension in the target description process.
-
-
-[[INTRODUCTION]]
-== INTRODUCTION
-
-As the Army's lead laboratory for vulnerability technology, the Ballistic Research Laboratory (BRL) constantly performs vulnerability analyses for a wide variety of military systems. Vital to these vulnerability studies are three dimensional computer models of the physical characteristics of these systems. These computer models are generally called target descriptions. Since the mid 1960's, BRL has used a solid modeling technique called combinatorial geometry (COMGEOM) to model targets. The COMGEOM technique uses logic operations to combine basic geometric shapes or primitives to produce the three-dimensional target description. The COMGEOM target descriptions are processed by the Geometric Information For Targets
-
-_(GIFT)\u1,2\d_
-
-
-----
-
-\u1\d Lawrence W. Bain, Mathew J. Reisinger, "The GIFT Code User Manual; Vol I,
-Introduction and Input Requirements," BRL Report No. 1802, July 1975. (AD# B0060371)
-----
-
-
-----
-
-\u2\d Gary G. Kuehl, Lawrence W. Bain, Mathew J. Reisinger, "The GIFT Code User
-Manual; Vol II, the Output Options," ARRADCOM Technical Report No. ARBRL-TR-02189,
-September 1979. (AD# A078364)
-----
-
-code for use in follow-on vulnerability assessment codes.
-
-Target descriptions are basically large collections of numerical data which traditionally have been handled manually in a batch environment. Hence, the production and modification of target descriptions has been a slow, labor-intensive process. In 1980, BRL initiated an effort to improve the response time of the target description process by applying interactive computer graphics techniques. As a result of this work unit, BRL has developed the Graphics EDitor (GED), an interactive solid modeling system based on the COMGEOM technique. Using GED an analyst can view, build, and modify target descriptions interactively by manipulating the graphical representation, thus providing immediate visual feedback on a vector display device. The GED system is designed to replace the manual method of production and modification of target descriptions.
-
-This report is intended to serve as a user manual for the GED system. The process of viewing and editing a description using GED is covered in detail. The internal data structure is also covered, as it is an important part in the overall design of the GED system.
-
-
-[[COMGEOM_BACKGROUND]]
-== COMGEOM BACKGROUND
-
-Since the GED system is presently based on the COMGEOM solid modeling technique, a brief overview of the COMGEOM technique is required to effectively use GED. For more detailed information on the COMGEOM technique see references 1 and 2.
-
-The COMGEOM technique utilizes two basic entities - a solid and a region. A solid is defined as one of fifteen basic geometric shapes or primitives. Table I contains a list of these fifteen solids. The individual parameters of each solid define the solid's location, size, and orientation. A region is a combination of one or more solids and is defined as the volume occupied by the resulting combination of solids. Solids are combined into regions using any of three logic operations: union(OR), intersection(+), or difference(-). The union of two solids is defined as the volume in either of the solids. The difference of two solids is defined as the volume of the first solid minus the volume of the second solid. The intersection of two solids is defined as the volume common to both solids. Figure 1 presents a graphical representation of these operations. Any number of solids may be combined to produce a region. As far as the COMGEOM technique is concerned, only a region can represent a component of the target. The solids are only building blocks to be combined into regions. Since regions represent the components of the target system, they are further identified by code numbers. These code numbers either identify the region as a target component (nonzero item code) or as air (nonzero air code). Any volume not defined as a region is assumed to be "universal air" and is given an air code of "01". If it is necessary to distinguish between universal "01" air and any other kind of air, then that volume must be defined as a region and given an air code other than "01". Normally, regions cannot occupy the same volume (overlap), but regions identified with air codes can overlap with any region identified as a component (i.e. one that has a nonzero item code). Regions identified with different air codes however, can not overlap.
-
-
-[[COMPUTER_GRAPHICS]]
-== COMPUTER GRAPHICS
-
-Computer graphics is one of the fastest growing fields in the computer industry. Computer graphics has applications in many diverse areas, from electronic games to medicine, from cartoons to the space industry. Just what is interactive computer graphics and why is it so versatile? Human visual perception is quite keen and communications with a computer are generally faster and easier with images or displays rather than with numbers. Furthermore, by driving the display image with the computer, one can actually communicate with the computer through the display itself. This technology is called interactive computer graphics. The user converses with the computer through the display using devices such as light pens, data tablets, function switches, and control dials. The response of the computer is immediately reflected on the display. Thus a fast channel of communication is available between person and machine.
-
-
-[[APPROACH_TO_THE_PROBLEM]]
-== APPROACH TO THE PROBLEM
-
-To speed up the model description process, a faster more efficient method of manipulating the large masses of data involved in a target description is needed. Interactive computer graphics seems to provide the capability of handling such data in an efficient, relatively fast manner. The key to the whole situation is SOFTWARE - the missing link between the target description problem and a possible solution.
-
-In view of this fact, existing software graphics packages were evaluated with respect to their utility in the target description process. Quite an exhaustive search of commercially available systems was conducted and none were found which completely satisfied our requirements. A study was then initiated to examine the feasibility of producing the required graphics software in-house. The result of this study was a preliminary version of GED which, using existing hardware, quite convincingly demonstrated the feasibility of such an undertaking\u3\d.
-
-
-----
-
-\u3\d Michael John Muuss, Earl P. Weaver, "Interactive Construction of
-COMGEOM Targets - A Feasibility Study", report to be published.
-----
-
-It was then decided to develop GED into a full production code and to acquire the hardware necessary for full implementation of the system. The production level GED code has been used since January 1982 to build target descriptions interactively at BRL.
-
-
-[[GED_OVERVIEW]]
-== GED OVERVIEW
-
-The main function of the GED system is to edit target descriptions with immediate visual feedback. Hence, GED produces images both suitable for editing and capable of being displayed in real time. When an object is displayed, the solids combined to model the object are drawn. No attempt is made to produce edge representations of regions or to remove hidden lines. At the present, such an undertaking would take away from the "real time" displays now enjoyed.
-
-The GED is a modular code written in the C programming language which presently runs under the BRL UNIX Networking System\u4\d.
-
-
-
-
-----
-
-\u4\d Michael John Muuss, "BRLNET - The Implementation of a
-Multi-processor UNIX System", a final report of work done under ARO
-Project Number 1127, August 27, 1980.
-----
-
-
-
-The workstations presently used are Vector General (VG) 3DI vector refresh systems driven by DEC PDP-11/34 or PDP-11/70 computers. Peripheral devices include a joystick, a pen and data tablet, function switches, and control dials. These peripheral devices and functions of each are discussed in later sections.
-
-Overall control of GED is maintained via the keyboard. The keyboard commands perform general housekeeping functions and allow one to control what is displayed, create/modify combinations, list solid parameters, etc. The keyboard commands are discussed in a later section.
-
-
-[[GED_INTERNAL_DATA_STRUCTURE]]
-== GED INTERNAL DATA STRUCTURE
-
-One of the critical aspects of a graphics software package is its internal data structure. Since the target description problem deals with such large volumes of data, the importance of the data structure here is emphasized. Thus it is felt that an introduction to the internal data structure of GED is important for any potential user.
-
-The GED internal data structure is hierarchical in nature with each node or position in the hierarchy being occupied by an OBJECT. An OBJECT is the GED basic data unit and is defined as either a SOLID or a COMBINATION. A SOLID is one of the generalized COMGEOM primitive types while a COMBINATION is a group of objects. Each member object of a combination has a transformation associated with it. Any object not at the top of an hierarchy is referenced by (is a member of) a higher combination and each such reference has an associated transformation. The bottom object of every hierarchy path is a solid. This hierarchical data structure allows actual subsystems of a target to be grouped together and edited as a unit without worrying about individual parts. To display any object, each path in the object's hierarchy is traveled to its bottom position where a solid is located. The transformations are accumulated for each path traversed and then applied to the solid at the bottom of the path. The solid is then drawn. The hierarchy is traversed recursively until all objects are drawn. Let's use a high explosive projectile as an example. Figure 2 depicts the hierarchy involved. If one were to display the combination "heround", six solids would be drawn on the screen. Table II lists each solid name, the transformation applied to the solid's parameters, and the path used to reach the solid.
-
-One very useful type of combination is the INSTANCE. An instance is a referral to an object (solid or combination) without the object itself being duplicated. To produce an instance of an object, a combination is created with the object being instanced as a member object. As with any other combination, this member has an associated transformation, hence it can be edited as a unit. The instance is most useful when an object appears many times in a description. The desired number of instances are made and positioned in the description. Any future changes in the object require that only the original (prototype) be changed. The modifications of the prototype object will then be automatically reflected in all the instances of that object.
-
-
-[[KEYBOARD_COMMANDS]]
-== KEYBOARD COMMANDS
-
-To execute GED, one simply types "ged file", where "file" is the data file to be edited. The GED keyboard commands are used to maintain overall control of the system and to perform general housekeeping functions. Each command is invoked by entering a single character followed by other parameters (if necessary) separated by spaces. In most cases, the response on the screen will be the word "done" once the command is completed. This response is not printed for the commands where the results of the command are readily visible on the screen.
-
-In the following pages, the GED keyboard commands will be presented and discussed. Examples will be given in appropriate cases. Table III, at the end of this section, presents a summary of the GED keyboard commands and the function of each.
-
-*c oldsolid newsolid*
-
-This command is used to produce and display a copy of a solid. In this case, the solid "oldsolid" will be copied into a solid called "newsolid". A new identical solid record is added to the data file. The solid parameters are copied as they appear in the solid record.
-
-
-----
-
-Examples:     c arb8 hullbot.s
-              c arb8 turrettop.s
-              c tgc wheelrim.s
-              c tor tire1.s
-----
-
-
-
-*n old new*
-
-This command is used to rename objects in the data file. In this case, the object "old" will be renamed "new". A note of caution: the name is changed only in the object record itself, not in any member records. Thus if the object "old" appears as a member of any other object, the name will not be changed there.
-
-
-----
-
-Examples:     n test hull
-              n g00 air
-              n g1 turret
-----
-
-
-
-*Z*
-
-This command clears (Zaps) the screen of all displayed objects.
-
-*g group obj1 obj2 ..... objn*
-
-This command creates or appends to a combination record and is used to group objects together either for editing or displaying purposes. In this case, "obj1" through "objn" are added as members to the combination "group". If "group" does not exist, it is created and "obj1" through "objn" are added as members.
-
-
-----
-
-Examples:   g shell hull turret
-            g tank wheels engine crew shell
-            g tank track
-
-r region op1 sol1 op2 sol2 .... opn soln
-----
-
-
-
-This command is used to create regions or append to regions. If "region" exists, then solids "sol1" through "soln" are added as members with "op1" through "opn" as the defining operations. If "region" does not exist, then it is created and solids "sol1" through "soln" are added as members with "op1" through "opn" as the defining operations. A region is merely a combination record with a flag set and is distinguished from other combinations (groups) since it has meaning to the COMGEOM solid modeling system.
-
-When a region is created, the item and air codes are set equal to zero. To change the item and air codes use the "I" command. Note: In the past all members of a region had to be solids, but recently regions have been allowed as members of regions. Hence, the names "soli" can also be regions now.
-
-
-----
-
-Examples:    r hulltop.r + hulltop.s - hullleft.s - hullright.s
-             r gun + gun.s - gunin.s
-             r gunair + gunin.s
-           
-----
-
-
-
-*i object combname brname*
-
-This command is used to make an instance of an object. An instance of an object is produced by creating a combination and making the object a member. In this case, an instance of "object" is made by creating the combination record "combname" (if "combname" does not already exist) and adding "object" as a member. This member also has a second name "brname" added to the member record, which can be thought of as the name of this branch in the hierarchical data structure. If "combname" already exists, then "object" is added as the next member and "brname" is added as the branch name.
-
-An instance is used to refer to an object, without making actual copies of the object. Instances are useful when one is adding a certain component to a target description many times. Furthermore, any modifications to an object which has been instanced need only be done in the original (prototype) object. These modifications will then be automatically reflected in all the instances of the object.
-
-
-----
-
-Examples:       i heround ammo he1
-                i heround ammo he2
-                i heat ammo heat1
-                i heat ammo heat2
-----
-
-
-
-*f face distance*
-
-This command allows the user to project a face of an arb (arbitrary polyhedron) being edited a normal distance to create a new arb. The value of "face" is 4 digits such as 1256. If the face is projected in the wrong direction use a negative "distance". One use for this command is for producing armor plates of a desired thickness.
-
-
-----
-
-Examples:     f 1234 20
-              f 2367 34.75
-              f 2367 -34.75
-----
-
-
-
-*l object*
-
-This command is used to list information about objects in the data file. The information listed depends on what type of record "object" is. If "object" is a combination record, then the members are listed. If "object" is a solid record, then the GED general solid type and the parameters as presently in the data file are listed. Note: only the solid parameters as they exist in the solid record are listed, no transformation matrix is applied. Hence, if the solid was edited as a member of a combination, the "l" command will not reflect the editing in the listed parameters.
-
-
-----
-
-Examples:      l hull
-               l turret
-               l turtop.s
-               l arb8
-             
-----
-
-
-
-*mirror -[axis] oldsolid newsolid*
-
-This command is used to create and display a new solid record which is the mirror image of an existing solid. The mirror image is about an axis and is created by changing the signs on the solid's parameters depending on which axis the solid is mirrored about. In this case, a mirror image of the solid "oldsolid" will created about the axis indicated by "axis" and the new solid record will be called "newsolid". The only acceptable values for the parameter "axis" are "x", "y", and "z".
-
-
-----
-
-Examples:     mirror -y tur.left.s tur.right.s
-              mirror -z tur.top.s tur.bot.s
-              mirror -x tur.front.s tur.back.s
-----
-
-
-
-*p dx [dy] [dz]*
-
-This command allows a user in the SOLID EDITING mode to input exact parameter modifications by the keyboard. The meaning of the values typed after the p command varies depending on what solid editing feature is being used. Examples of this command will be given in the discussion on solid editing.
-
-*D comb mem1 mem2 .... memn*
-
-This command allows one to delete members from a combination record. In this case, members "mem1" through "memn" will be deleted from the combination "comb".
-
-
-----
-
-Examples:     D tank hull wheels
-              D region1 solid8 solid112
-              D turtop.r tursidel.s tursider.s turback.s
-----
-
-
-
-*I region item air*
-
-This command allows one to change the item or air code numbers of a region. If the air code ("air") is not included, a zero is assumed. To change the air code, a zero item code should be used (see second example below).
-
-
-----
-
-Examples:
-            I region1 105
-            I region7 0 2
-            I region11 129 0
-----
-
-
-
-*e object*
-
-This command is used to display (draw) objects on the screen. In this case, "object" will be displayed on the screen. Note that "object" must be found in the table of contents.
-
-*d object*
-
-This command is used to drop (delete) objects from the display. In this case, "object" will be deleted from the screen display. This command is opposite of the "e" command.
-
-*k object*
-
-This command is used to remove (kill) objects from the data file. In this case, "object" will be removed from the data file. Note the distinction between the "d" command which deletes objects from the display and the "k" command which removes objects from the data file.
-
-*t*
-
-This command produces a list of the table of contents of all objects in the data file. The objects are listed a screenfull at a time. A carriage return will produce the next screenfull.
-
-*a arbname rot fb*
-
-This command is used to create and display a new arb8 solid record. This new arb8 has two square (5 units x 5 units) parallel faces which are 0.5 units apart. These parallel faces are in planes whose orientations are defined by the two input angles - the rotation (rot) angle and the fallback (fb) angle. The orientation of armor plates are frequently defined using rotation and fallback angles. The vertex of this new arb8 is located in the center of the screen.
-
-
-----
-
-Examples:     a hullsec3.s 45 30
-              a tursec2.s 90 20
-              a topglacis.s 0 60
-----
-
-
-
-*x*
-
-This command is the display debug command. It will produce a list of all objects that have been displayed , the paths traversed to draw the objects, and whether or not the objects are displayed in the present view.
-
-*q*
-
-This command is used to quit the graphics editor code. This is the normal halt.
-
-
-[[PERIPHERAL_DEVICES]]
-== PERIPHERAL DEVICES
-
-Before we discuss the features of GED, we will introduce the hardware devices used to implement them. These devices are the "tools of the trade" for the GED user. We will discuss only basic operational characteristics here. Specific use of these devices will be covered in the later sections on the viewing and editing features of GED.
-
-The JOYSTICK is a mechanical device used to do the rotations in GED. Any movement of the stick left or right rotates the display about the x-axis. Any movement of the stick up or down rotates the display about the y-axis. When the joystick is twisted in a clockwise or counterclockwise direction, the display rotates about the z-axis. Any combination motion of the stick will produce a "combined" rotation about the appropriate axes. All of these motions have a spring return to a null center position.
-
-The FUNCTION SWITCH box contains thirty-two buttons. When any of the buttons is pressed, an action occurs or condition is set. Figure 3 depicts the functions programmed for each button. The buttons in the shaded area are used for editing while the rest are used for viewing the display. The exact functions assigned to these buttons will be discussed in the sections on viewing the display and on editing.
-
-The CONTROL DIALS (knobs) are used to send digital information to the computer. As a knob is turned, a succession of numbers are available for use by the computer. Figure 4 depicts the functions assigned to each of the ten knobs. The exact functions of each of these knobs will be discussed in the angle distance cursor section and in the viewing features section.
-
-The DATA TABLET is a graphics input device containing an X-Y coordinate grid which corresponds to the grid on the screen. Information is entered using a pen-like stylus. The distance this pen is from the tablet is important. If the pen tip is within one half inch of the tablet surface, the cursor location on the screen corresponds to the X,Y location of the pen on the tablet. This condition is called the "near" position. If the pen is more than one half inch from the tablet surface, the cursor remains located in the center of the screen. When the pen is pressed against the tablet surface, the pressure switch is activated and a bit is set which is a signal used by GED. The exact meaning of the pen near and pen press depends on what is being done and will be covered in the appropriate sections of this report.
-
-
-[[ANGLE_DISTANCE_CURSOR]]
-== ANGLE DISTANCE CURSOR (ADC)
-
-The angle distance cursor is a construction aid used to measure angles and distances. It should be noted that all measurements are made in the projected space of the screen, so one should measure only in a view normal to the surface where the measurement is to take place. The ADC is placed on (or removed from) the display by pushing the "ADC" function switch button (see Figure 3). The ADC consists of three cursors which cover the entire screen. Figure 5 depicts the ADC as it appears on the screen. All the cursors are centered at the same point and can be moved to any location on the screen. Two of these cursors rotate for angle measuring purposes. Angle cursor 1 is solid while angle cursor 2 is dashed. Angle cursor 1 has movable tic marks for measuring distances on the screen. The two angle cursors move with the horizontal and vertical lines of the main cursor. The resulting effect is the moving of the center point horizontally or vertically. The ADC is controlled by the bottom row of the control dial knobs (see Figure 4) :
-
-
-----
-
-     Knob 6   moves the center in the horizontal direction
-     Knob 7   moves the center in the vertical direction
-     Knob 8   rotates angle cursor 1  (alpha)
-     Knob 9   rotates angle cursor 2  (beta)
-     Knob 10  moves the tic marks
-----
-
-
-
-Whenever the ADC is on the screen, there is a readout at the bottom of the screen listing pertinent information about the ADC. This information includes the angles that angle cursors 1 and 2 have been rotated (alpha and beta), the distance the tic marks are from the center of the ADC, and the location of the center of the ADC. This information is continually updated on the screen.
-
-
-[[VIEWING_FUNCTIONS]]
-== VIEWING FUNCTIONS
-
-The GED viewing features are designed to allow one to examine a target description in close detail. Any of the viewing features can be invoked at any time. It should be noted, that these functions do not change the actual data, only the way these data are displayed.
-
-Six standard views (front, rear, top, bottom, left, and right) and one oblique view (azimuth 35, elevation 25) are each assigned to the function buttons (see Figure 3). Hence, any of these views is immediately available at the press of the appropriate function button. The views available are not limited to these standard views however, as the display can be rotated to any view by using the joystick. By pressing the function button labeled "save view" (see Figure 3), the present viewing aspect angle of the display is saved. At any time, the saved view can be immediately returned to the screen by pressing the "restore view" function button (see Figure 3). The "restore view" button will be lit whenever a view has been saved. The function button labeled "reset" (see Figure 3), restores the display to the default view (front) when pressed.
-
-The display can be panned or slewed on the screen in two ways - using the data tablet and pen or by using the control knobs. When one is editing, the tablet and pen are not available for slewing, hence one must use the control knobs to slew the display. If one is NOT editing, then whenever the pen is pressed, the display moves in the direction of an imaginary vector drawn from the center of the screen to the cursor location on the screen. Recall that there is a one-to-one correspondence between the pen location and the cursor location. The longer this vector, the faster the display will move. To slew the display using the control knobs, one uses the knobs labeled "slew x" or "slew y" (see Figure 4). The null positions on these knobs is in the center or straight up. If the "slew x" knob is turned clockwise of center, the display will move to the right. If it is turned counterclockwise, the display will move to the left. For the "slew y" control knob, clockwise of the center moves the display up and counterclockwise moves the display down. The further these knobs are turned from center, the faster the display moves.
-
-One can zoom the display by using the control knob labeled "zoom" (see Figure 4). Again the null position of this knob is center or straight up. Turning this knob clockwise of center causes the display to increase in size producing a zoom-in effect. Turning this knob counterclockwise of center causes the display to decrease in size or zoom-out. Again, the further the "zoom" knob is turned from center, the faster the zooming will occur.
-
-The viewing features of GED also include a slice mode. To invoke the slice feature, one presses the "slice mode" function button (see Figure 3). An imaginary slicing plane, parallel to the screen, can then be moved about by turning the first control knob (see Figure 4). Turning this knob clockwise moves the imaginary plane into the screen and counterclockwise moves the plane out of the screen. All portions of the display in front of the plane are eliminated from the display. The result of moving this plane into the screen is a slicing effect with the parts of the display closest disappearing first. To leave the slice mode, just press the "slice mode" button again.
-
-
-[[SELECTING_OBJECTS_FOR_EDITING]]
-== SELECTING OBJECTS FOR EDITING
-
-Before we discuss the editing features of GED, we will discuss how one selects objects for editing. To be edited, an object must be displayed on the screen. Since the object to be edited may be only a small portion of the display, a procedure is needed to select an object from the many objects being displayed. This procedure relies on the hierarchical structure of the GED data base. As stated before, when objects are displayed, every path of every object is traversed and the bottom object, which is always a solid, is drawn. Hence one can think of each solid drawn not as one solid, but as the unique path used to reach that solid. As an example, the six paths (solids) for the sample object "heround" were presented in Table II.
-
-To select an object for editing, one first must enter the illuminate mode by pressing the function button labeled "illuminate" (see Figure 3). The data tablet and pen are then used to select the object. The surface of the data tablet is divided into imaginary horizontal strips. Each of these strips corresponds to a path (solid) drawn on the screen. For example, if the sample "heround" were displayed, the tablet surface would be divided into six horizontal strips. The pen is used in the "near" mode (within one half inch of tablet surface) to illuminate the paths. The path corresponding to the pen location is written in the upper right hand corner of the screen. The solid at the bottom of this path is illuminated (drawn brighter) on the screen. In this manner one can "scan" the complete display by simply moving the pen up and down the tablet in the near mode. Hence, the illuminate mode is also quite useful just to identify objects in a description. However, the primary purpose of the illumination mode is to select objects for editing.
-
-The actual selecting of an object for editing is a two-step process. First, one selects the path desired, then one selects the particular object of interest from that path. One "selects" by pressing the pen on the tablet surface. When a path is selected, the word PATH followed by the members of that path is written in the upper right of the screen. At that point, one is ready to select a specific member (object) from that path for editing. Again, the tablet is used for this selection. The tablet surface is now divided into as many rows (zones) as there are members in the selected path. When the pen, in the near mode, is in a path member's assigned zone on the tablet, that member's name will be illuminated in the path listing. When the specific member to be edited is illuminated, it is selected by pressing the pen. The word EDIT will now appear in the upper right of the screen ahead of the path listing. One is now ready to edit this selected object.
-
-The only way out of the EDIT mode is to accept or reject any editing performed. This is done by pressing the function buttons labeled "accept" or "reject" (see Figure 3). If at any time in the selection process an incorrect object is selected, just press the "reject" button and begin the selection process again.
-
-
-[[OBJECT_EDITING]]
-== OBJECT EDITING
-
-The heart of the GED system is its editing features. The editing features are divided into two classes: object editing and solid editing. Object editing is designed to allow one to change the location, size, and orientation of an object. Recall that an object is defined as the basic data unit of the GED system and includes both combinations and solids. In the case of a solid, one needs to change not only its location, size, and orientation, but also its "shape". Changing the shape of a solid means changing any of its individual parameters. Hence, solid editing is handled separately.
-
-Any object in the data file may be selected for object editing. The object is picked using the object selection procedure discussed earlier. Recall that in the GED data structure, all members of combinations have transformation matrices associated with them, allowing assemblies to be edited as units. Object editing is the vehicle for performing such tasks. All object editing is done using homogeneous transformation matrices. When the editing is accepted, new transformation matrices are created in all appropriate member locations. If the object happens to be a single-member path (solid) then the matrix is applied to the solid's parameters. Otherwise, all object editing is stored in transformation matrices in the data base.
-
-Once an object is selected for editing, the second row of function buttons (see Figure 3) is used to select the editing to be done. Then either the data tablet and pen or the joystick are used to perform the actual editing.
-
-To SCALE a selected object, one first presses the function button labeled "scale object". The data tablet and pen are then used to scale the object. The object is scaled about the target origin, thus unless the object is centered at the origin, some translation of the object will occur. The location of the pen on the tablet when pressed determines the scale factor used. If the pen is above the center of the screen, the scale factor will be greater than one. The further the pen is located above the center, the larger the scale factor. Likewise, if the pen is located below the vertical center, the scale factor will be less than one and the further below the center, the smaller the scale factor. As long as the pen is pressed, the object will continue to increase or decrease in size.
-
-To ROTATE a selected object, one first presses the function button labeled "rotate object". The joystick is then used to rotate the object. The object is rotated about the center of the view (screen). If one wishes to rotate the object about another point of interest, the entire display can be slewed until the desired point is positioned at the center of the screen.
-
-To TRANSLATE a selected object, one has three function buttons from which to select (see Figure 3). The data tablet and pen are then used to translate the object. The center of the object "follows" the pen (cursor) location whenever the pen is pressed. The three function buttons define the direction allowed for movement of the object. The button labeled with a horizontal arrow (<--->), allows the object to follow only the horizontal location of the pen. The vertical location of the object does not change. The function button labeled with a vertical arrow ( ), allows the object to follow only the vertical location of the pen. The horizontal location of the object does not change. The function labeled with crossed arrows (<--->) allows the object to follow the X,Y location of the pen.
-
-The object editing features can be invoked in any order and at any time once an object has been selected for editing. During object editing, any of the viewing features, such as changing views, zooming, and slewing, can be used and in fact are usually quite useful. Again, the only way to exit the object editing mode is to accept or reject the editing. If the "reject" button is pressed, the object will return to its pre-edit state. If the "accept" button is pressed, the data base will be changed to reflect the object editing performed.
-
-
-[[SOLID_EDITING]]
-== SOLID EDITING
-
-The solid editing feature allows the user to interactively translate, rotate, scale, and modify individual parameters of a solid. Whenever one is in the solid edit mode, the parameters of the solid being edited are listed and continually updated at the bottom of the screen. Certain parameters are also labeled on the solid being edited. Solid editing is generally used to "build" objects by producing solids of the desired shape and size in the correct orientation and position. Once the object is built, object editing is used to scale, orient, and position the object in the description. The general philosophy of solid editing is to first create a copy of a prototype solid with the desired name and then to edit this solid. The prototype solids should not be edited. As an example, suppose one were to build the sample object "heround" mentioned earlier. To produce the base of the shell, one would need a cylindrical shaped solid. The prototype solid is the TGC (see Table I), so one would type:
-
-*c tgc shellcase.s*
-
-A new solid record called shellcase.s would be created and displayed on the screen. This shellcase.s solid would then be edited using solid editing to produce the exact solid parameters desired. The solid record tgc would be unchanged and available for copying the next time a cylindrical solid is needed.
-
-The procedure for solid editing is quite similar to that for object editing. First, the solid must be selected for editing. A solid is selected for editing using the illuminate mode, just as in object editing, except a solid must be selected. Recall that the bottom object in every hierarchy path is a solid. Second, one must push the function button labeled "solid edit" (see Figure 3). This button sets up the solid edit mode: the solid parameters are listed at the bottom of the screen, pertinent solid parameters are labeled on the display, the solid editing function buttons are activated, and a menu header depending on the solid type is written on the right side of the screen. The meaning of the menu will be discussed shortly. Third, one selects (by pressing the appropriate function buttons) and performs the editing desired. Finally, one exits the solid editing mode by accepting or rejecting the editing performed, just as in object editing.
-
-Recall, in the section on object editing it was mentioned that since a solid is indeed an object, a solid can be edited (translated, rotated, and scaled) as an object. Hence, the solid editing mode is really only necessary to perform parameter modifications. However, much of the object editing is done about the target or screen center, which can be annoying when editing a solid. Also, precise parameter modifications are possible (using the "p" keyboard command) in solid editing. Thus it was deemed desirable to include translation, rotation, and scaling in solid editing also.
-
-Solid TRANSLATION allows the user to place the solid being edited anywhere in the description. To invoke this option, one presses the function button labeled "solid trans" (see Figure 3). To move the solid, use the data tablet and pen. Whenever the pen is pressed, the VERTEX of the solid moves to that location on the screen. One can read the actual coordinates of the vertex on the bottom of the screen, along with the other parameters. If the actual desired coordinates of the vertex are known, one can place the solid exactly using the "p" keyboard command. For example, to place a solid's vertex at the coordinates (x, y, z) one would type
-
-*p x y z*
-
-The solid would then jump to this location.
-
-The solid SCALE feature allows the user to scale the solid being edited to any desirable size. The scaling is done about the vertex of the solid, hence NO translation of the solid occurs. The scaling is performed using the data tablet and pen, just as in object scaling. One can input an exact scale factor using the "p" keyboard command. For example, typing
-
-*p factor*
-
-will scale the solid by an amount equal to "factor". The value of "factor" is absolute - the original solid is scaled. The size of the original solid is defined when the "solid scale" function button is pressed. By setting "factor" equal to one, the original size solid will be displayed on the screen.
-
-Solid ROTATION allows the user to rotate the solid being edited to any desired orientation. The rotation is performed about the vertex of the solid. To select this option, one presses the function button labeled "solid rotate" (see Figure 3). The actual rotation is done using the joystick. One can input exact angles to rotate the solid by using the "p" keyboard command. For example, typing
-
-*p alpha beta gamma*
-
-will rotate the solid "alpha" degrees about the x-axis, "beta" degrees about the y-axis, and "gamma" degrees about the z-axis. Alpha, beta, and gamma are measured from the original "zero" orientation of the solid, defined when the "solid edit" function button was pressed. Hence, typing
-
-*p 0 0 0*
-
-will always return the solid to its original position (its position when the current solid editing session began).
-
-The PARAMETER editing feature allows the user to modify any of the parameters which comprise the selected solid. To invoke this feature, one presses the function button labeled "menu" (see Figure 3). A menu (listing) of parameters to edit will then appear on the right side of the screen under the menu header. The contents of this menu of course depend on the type of solid being edited. To select an item (parameter) from this menu, one uses the data tablet and pen. The immediate region (strip) surrounding each item of the menu "belongs" to that item. Whenever the pen is in one of these regions, that menu item will get brighter in the menu listing on the screen. A menu item is picked by pressing the pen when that item name is illuminated. It should be noted that whenever the pen is in the "menu area", the code assumes the user is attempting to pick a menu item. Hence, the menu area of the screen (the far right edge) can NOT be used by the pen for editing while the menu is on the screen.
-
-For parameter editing, the solid type determines the menu items. The GED code recognizes four general solid types for parameter editing. All the specific solid types which fall into one of these general classes are treated as the general type. For example, all the cylindrical solid types are treated as the general type - the TGC. In the following paragraphs, we will discuss parameter editing for each of these general types of solids.
-
-[[ARB_PARAMETER_EDITING]]
-=== ARB PARAMETER EDITING
-
-The GENERAL ARB class of solids represents all the convex polyhedrons (RPP, BOX, RAW, and ARBs). The ARBs comprise five classes of polyhedrons each with a characteristic number of vertices. These are the ARB8, ARB7, ARB6, ARB5, and ARB4, where the ARB8 has eight vertices, etc. GED handles all these ARBs as ARB8s, but with some vertices equal. All the eight vertices of the GENERAL ARB are labeled on the screen, although in certain cases (RAW,ARB7,ARB6,ARB5,ARB4) some vertices will be equal. Figure 6 depicts typical ARBs as they would be displayed and labeled during solid editing.
-
-To edit the ARB vertices, EDGES are moved. Hence, the GENERAL ARB menu is a list of edges to move:
-
-
-----
-
-GENERAL ARB MENU
-  move edge 12
-  move edge 23
-  move edge 34
-  move edge 14
-  move edge 15
-  move edge 26
-  move edge 56
-  move edge 67
-  move edge 78
-  move edge 58
-  move edge 37
-  move edge 48
-----
-
-
-
-The edge to be moved is selected from this menu and is then moved using the data tablet and pen. When the pen is pressed, the line containing the selected edge is moved so it goes through the pen location and is parallel to the original edge. The endpoints of the new edge are then calculated to remain in the "bounding" planes of that edge. In the case of the ARB8, for example, the bounding planes for edge 58 are planes 4378 and 1265 (see Figure 6).
-
-The information printed on the bottom of the screen is the x, y, z coordinates of the eight vertices:
-
-
-----
-
- vertex         coordinates
-  1,2        x1 y1 z1  x2 y2 y3
-  3,4        x3 y3 z3  x4 y4 z4
-  5,6        x5 y5 z5  x6 y6 z6
-  7,8        x7 y7 z7  x8 y8 z8
-----
-
-
-
-These values are continually updated during solid editing.
-
-The user can force the line containing an edge through any point using the "p" keyboard command. Hence typing
-
-*p x y z*
-
-will force the line containing the edge being edited to pass through the point (x, y, z). No check is made for concave ARBs or for ARBs with crossed edges. Visual feedback from the display is considered adequate to detect these situations.
-
-
-[[TGC_PARAMETER_EDITING]]
-=== TGC PARAMETER EDITING
-
-The TGC general class of solids includes all the cylindrical COMGEOM solids. The defining parameters of the TGC are two base vectors (A and B), a height vector (H), two top vectors (C and D), and the vertex (V). Reference 1 contains more information on these parameters. The top vectors C and D are directed the same as the base vectors A and B respectively, hence the top vectors are defined only by their lengths (c and d). Figure 7 depicts these parameters on typical TGCs. When a TGC is edited in the solid editing mode, only vectors A and B are labeled on the display.
-
-All the vectors (A,B,C,D,H) of the TGC can be scaled during parameter editing. In addition, the height vector (H) and the base (AxB) can be rotated. These parameter editing options are reflected in the TGC menu:
-
-
-----
-
-TGC MENU
-scale H
-scale A
-scale B
-scale c
-scale d
-rotate H
-rotate AxB
-----
-
-
-
-The scaling of the lengths of the vectors is done using the data tablet and pen in the same manner as object editing. Exact vector lengths can be achieved easily using the "p" keyboard command. If one is scaling a vector, then typing
-
-*p x*
-
-will make the vector being scaled have a length equal to "x".
-
-To rotate vector H or surface AxB, one uses the joystick. Since vectors C and D have the same direction as vectors A and B respectively, the top and bottom surfaces of the TGC will remain parallel. Hence rotating the base surface (AxB) will also rotate the top surface. The "p" keyboard command is not used with the parameter rotation of the TGC.
-
-During solid editing, the parameters of the TGC are constantly updated on the bottom of the screen:
-
-
-
-
-----
-
-
-V   x y z
-H   x y z |H| a b g rot fb
-A   x y z |A|
-B   x y z |B|
-c   |c|
-d   |d|
-----
-
-
-
-_AxB a b g rot fb_
-
-where "a", "b", "g" are the direction cosines and "rot" and "fb" are the rotation and fallback angles of the listed vector.
-
-
-[[ELLG_PARAMETER_EDITING]]
-=== ELLG PARAMETER EDITING
-
-The ELLG general class represents all the ellipsoidal solids, including spheres and ellipsoids of revolution. The defining parameters of the ELLG are three mutually perpendicular vectors (A, B, and C) and the vertex (V). Reference 1 contains a more complete definition of these parameters. Figure 8 depicts typical ELLGs with these parameters labeled. When an ELLG is being edited, only vectors A and B are labeled on the display.
-
-The parameter editing of the ELLG consists of scaling the lengths of the vectors A, B, C. These parameter editing options are listed in the menu:
-
-
-
-
-----
-
-
-ELLG MENU
- scale A
- scale B
- scale C
-----
-
-
-
-The scaling of these vectors is done using the data tablet and pen in exactly the same manner as in object scaling. The "p" keyboard command again can be used to produce a vector of desired length.
-
-The parameters of the ELLG are continually updated on the bottom of the screen during solid editing:
-
-
-
-
-----
-
-V   x y z
-A   x y z |A| a b g rot fb
-B   x y z |B| a b g rot fb
-C   x y z |C| a b g rot fb
-----
-
-
-
-where "a", "b", "g" are the direction cosines and "rot" and "fb" are the rotation and fallback angles of the listed vector.
-
-
-[[TOR_PARAMETER_EDITING]]
-=== TOR PARAMETER EDITING
-
-The TOR general class of solids contains only one type of torus, one with circular cross-sections. The defining parameters of the TOR are two radii (r1 and r2), a normal vector (N), and the vertex (V). The scalar r1 is the distance from the vertex to the midpoint of the circular cross section. The scalar r2 is the radius of the circular cross-section. The vector N is used to orient the torus. Reference 1 contains a more detailed definition of these parameters. Figure 9 depicts these parameters. During solid editing, none of these parameters are labeled on the screen.
-
-The parameter editing of the TOR consists of scaling the radii, hence the menu contains only two members:
-
-
-
-
-----
-
-
-  TORUS MENU
-scale radius 1
-scale radius 2
-----
-
-
-
-As before, the scaling of these radii are done using the data tablet and pen and the "p" keyboard command can be used to produce a radius of any desired length.
-
-The parameters of the TOR are continually updated on the bottom of the screen during solid editing:
-
-
-
-
-----
-
-V   x y z
-r1  |r1|
-r2  |r2|
-N   x y z a b g rot fb
-----
-
-
-
-where "a", "b", "g" are the direction cosines and "rot" and "fb" are the rotation and fallback angles of the vector N.
-
-Table IV presents a summary of parameter editing for each of the general solid classes.
-
-
-
-[[CONCLUSION]]
-== CONCLUSION
-
-BRL has developed the Army's first interactive solid modeling system, called GED. GED performs two basic functions: viewing and editing. The standard viewing capabilities of zooming, slewing, slicing, and rotation are available. Likewise, all the standard editing features are also available. The user easily traverses the hierarchical data structure, applying the editing functions of rotation, translation, and scaling to any position in the hierarchy. The hierarchical structure can be modified and regrouped and regions created and modified. Specific parameter editing can also be applied to the solids to produce any shape solid desired. GED has made great gains in reducing the bottleneck the target description process has been creating in the vulnerability process at BRL.

doc/asciidoc/articles/hy/CMakeLists.txt

@@ -1,19 +0,0 @@
-set(articles_HY about_hy.adoc)
-  
-if(TARGET mged OR TARGET qged OR TARGET archer)
-  if(BRLCAD_EXTRADOCS)
-    add_asciidoc("HTML" articles_HY articles/hy articles_EN_IMAGES_cp)
-  endif(BRLCAD_EXTRADOCS)
-endif(TARGET mged OR TARGET qged OR TARGET archer)
-
-cmakefiles(
-  CMakeLists.txt
-  ${articles_HY}
-)
-
-# Local Variables:
-# tab-width: 8
-# mode: cmake
-# indent-tabs-mode: t
-# End:
-# ex: shiftwidth=2 tabstop=8

doc/asciidoc/articles/hy/about_hy.adoc

@@ -1,25 +0,0 @@
-= Օգտվողի մասին BRL-CAD
-Christopher Sean Morrison <devs@brlcad.org>; Karen Mgebrova
-:doctype: article
-:toc:
-:toclevels: 3
-
-[[article-body]]
-BRL-CAD հզոր խաչաձեւ հարթակի Open Source համակցական կառուցողական Պինդ Geometry (CSG) մոդելավորման ամուր համակարգ, որը ներառում է ինտերակտիվ 3D ամուր երկրաչափություն խմբագրում, բարձր կատարողական ճառագայթների-հետեւել աջակցություն ցուցաբերելու եւ երկրաչափական վերլուծություն, ցանցային բաշխված framebuffer աջակցություն, պատկերի եւ ազդանշանի մշակման գործիքների ուղին, տեղանքի պլանը գծելը եւ պրոտոնների քարտեզագրման աջակցություն իրական պատկերի սինթեզ է, որ համակարգի կատարողականի վերլուծությունը ելակետային Suite է, ներդրված scripting ինտերֆեյսի եւ գրադարանների համար առողջ արագագործ երկրաչափական ներկայացուցչության եւ վերլուծություն:
-
-Ավելի քան 20 տարի, BRL-CAD եղել է հիմնական tri ծառայության ամուր մոդելավորում CAD համակարգի կողմից օգտագործվում է ԱՄՆ ռազմական եւ մոդելի զենք համակարգեր Խոցելիության եւ lethality վերլուծություններ: Կոշտ մոդելավորում համակարգը հաճախ օգտագործվում է մի շարք ռազմական, գիտական ​​եւ արդյունաբերական կիրառություններ այդ թվում `նախագծման եւ վերլուծություն տրանսպորտային միջոցների, մեխանիկական մասերի, եւ ճարտարապետությունը. Փաթեթը է նաեւ օգտագործվել ճառագայթման դոզան պլանավորման, բժշկական արտացոլման, համակարգչային գրաֆիկայի կրթության, CSG հայեցակարգերի եւ մոդելավորման կրթության եւ համակարգի կատարողականի ելակետային փորձարկման ի թիվս այլ նպատակների համար.
-
-BRL-CAD աջակցում է մեծ տեսականի, այդ թվում `երկրաչափական ներկայացուցչությունների լայն շարք ավանդական CSG պարզունակ անուղղակի չոր, ինչպիսիք են տներ, ellipsoids, cones, եւ tori, ինչպես նաեւ բացահայտ չոր պատրաստված փակ հավաքածուներից միասնական B-Spline մակերեսներին, ոչ Uniform բանական B-Spline (NURBS) մակերեսների, N-Ջրաբաշխիչ Geometry (NMG), եւ զուտ faceted ցանց երկրաչափություն. Բոլոր երկրաչափական օբյեկտները կարող են համատեղվել օգտագործում են Բուլյան սահմանված-տեսական CSG գործողությունների, այդ թվում միության, խաչմերուկում, եւ տարբերությունը.
-
-BRL-CAD եղել են ակտիվ զարգացման հետ դյուրատարություն ժառանգություն, որը ներառում է այնպիսի համակարգերը, որպես Դեկտեմբեր VAX-11/780 անընդմեջ 4.3 BSD, DECStations վազում ULTRIX, Սիլիկոնային գրաֆիկա 3030, 4D «Իրիս», O2, օնիքս, եւ ծագման համակարգերի վազում տարբեր տարբերակները IRIX, Sun Microsystems Sun, 3 – րդ եւ Sun-4 Sparcs վազում SunOS է, Cray 1, Cray X-պատգամավոր, Cray Y-պատգամավոր, եւ Cray 2 վազում UNICOS, Դեկտեմբեր Alpha AXP վազում OSF / 1, Apple Macintosh II վարման A / UX; iPSC/860 Hypercube վազում NX / 2, իսկ արտարժութային Alliant / 8, FX/80, եւ FX/2800. Gould / Encore sel PowerNode6000/9000 եւ NP1, ՀԱՋՈՐԴ workstations, IBM RS/6000, HPPA 9000/700 վազում HPUX, վառ / Stardent, Encore Multi-Max եւ շատ ավելին.
-
-BRL-CAD մի հավաքածու է ավելի քան 400 գործիքներ, կոմունալ ծառայությունների, եւ ծրագրեր կազմող ավելի քան մեկ միլիոն գծերը կոդով.Փաթեթը, որը դիտավորյալ նախատեսված է լայնորեն խաչաձեւ պլատֆորմը, եւ ակտիվորեն զարգանում են եւ պահպանվում են ընդհանուր օպերացիոն համակարգ միջավայրում այդ թվում `BSD, Linux, Solaris, Mac OS X, եւ Windows եւ այլն: BRL-CAD, որը բաժանվում է երկուական եւ կոդով ձեւը, ինչպես նաեւ անվճար բաց կոդով ծրագրային ապահովում (FOSS), նախատեսված Open Source նախաձեռնություն (OSI) կողմից լիցենզիայի պայմանները:
-
-
-[NOTE]
-====
-Mike Muuss սկսեց սկզբնական ճարտարապետության եւ նախագծման BRL-CAD դեռեւս 1979 թ. Մշակում, որպես միասնական փաթեթի սկսվել է 1983 թ. Առաջին հրապարակային թողարկումն իրականացվել է 1984 թ. BRL-CAD դարձավ բաց կոդով նախագիծ է 21 դեկտեմբերի 2004 թ.
-
-====
-
-