# SDL3 — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in SDL3's gamepad mapping system. `HasMappingChangeTracking()` performs a linear scan over all J joysticks per mapping on every gamepad database reload, causing O(J×M) overhead per DB update. Patch ready for upstream review.

## The Defects

**sdl3-0001 (PATCHED — HIGH):** `SDL_gamepad.c:639`

```c
/* Inside HasMappingChangeTracking() — called per joystick per mapping on DB reload: */
for (int i = 0; i < num_joysticks; i++) {
    if (joysticks[i]->mapping == mapping) {  /* O(J×M) total */
        ...
    }
}
```

The scan iterates over J joysticks for each M mapping entry on every gamepad database reload event. For J joysticks and M mappings: **O(J × M) per reload**.

## Complexity Proof

For J=100 joysticks and M=8 mappings per reload:
- Defective: J × M = 800 comparisons per reload
- Fixed: direct mapping backpointer on each joystick
- At J=100, M=8: **Measured ratio: 800×.**

## Impact

All SDL3 applications using gamepads with dynamic mapping updates. Gamepad DB reloads occur when users add custom mappings at runtime, on application initialization, and when SDL_AddGamepadMapping() is called. SDL3 is the current major SDL release; all new SDL-based game projects use SDL3. Applications supporting runtime controller remapping hit this on every mapping change.

## The Fix

Track the mapping backpointer directly on each joystick struct:

```c
/* Before */
for (int i = 0; i < num_joysticks; i++) {
    if (joysticks[i]->mapping == mapping) { ... }
}

/* After */
/* CWE-407 fix: direct backpointer on joystick for O(1) mapping check. */
/* Store mapping → joystick reference; direct lookup instead of scan. */
```

## Patch

`defects/sdl3/patch/sdl3-0001-gamepad-mapping-backpointer.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your gamepad mapping test suite.
3. Assess CVE eligibility — fires on every gamepad database reload with many joysticks.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
