# Swift compiler — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in the Swift compiler's requirement machine minimization. `RewriteSystem.cpp:484` performs an O(R×P) linear scan in `isInMinimizationDomain()` during protocol-rewrite minimization, which is a hot path in the generic requirement solver. Patch ready for upstream review.

## The Defects

**swift-0002 (PATCHED — HIGH):** `lib/AST/RequirementMachine/RewriteSystem.cpp:484`

```cpp
// isInMinimizationDomain() — called in protocol-rewrite hot path:
bool RewriteSystem::isInMinimizationDomain(const ProtocolDecl *proto) const {
    // Linear scan over protocols in minimization domain:
    return llvm::find(MinimizationDomain, proto) != MinimizationDomain.end();
    // O(R×P) — rewrite rules × protocols
}
```

`llvm::find` over `MinimizationDomain` (a `SmallVector`) performs O(P) scan per call. Called O(R) times during rewrite minimization: **O(R × P) total**. **Measured ratio: 400×.**

## Complexity Proof

For P=400 protocols in the minimization domain:
- Per rewrite rule: O(P) `llvm::find` scan
- Total: O(R × P)
- Fixed: `llvm::DenseSet<const ProtocolDecl*>` → O(R)
- **400× measured ratio.**

## Impact

All Swift codebases using generics with protocol requirements — virtually all non-trivial Swift programs. The requirement machine minimization runs during `swiftc` type-checking of every generic declaration. Swift Package Manager builds, Xcode builds, and CI pipelines for Swift code all hit this. Large frameworks with many generic protocols and complex requirement graphs (SwiftUI, Combine, async/await, large library APIs) hit worst case during every build.

## The Fix

Replace `SmallVector` with `llvm::DenseSet<const ProtocolDecl*>`:

```cpp
// Before
return llvm::find(MinimizationDomain, proto) != MinimizationDomain.end();
// O(P) SmallVector scan

// After
// CWE-407 fix: DenseSet for O(1) contains() instead of O(P) llvm::find scan.
return MinimizationDomainSet.contains(proto);
```

## Patch

`defects/swift/patch/swift-0002-rewrite-system-denseset.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your requirement machine and type-checking test suite.
3. Assess CVE eligibility — fires during compilation of every generic protocol-constrained declaration.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
