# SDL2 — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in SDL2's joystick subsystem. `SDL_GetJoystickFromID()` performs a linear scan over all N joysticks on every joystick event, causing O(N) overhead per event and O(N²) overhead under high joystick event rates. Patch ready for upstream review.

## The Defects

**sdl2-0001 (PATCHED — HIGH):** `src/joystick/SDL_joystick.c`

```c
/* Inside SDL_GetJoystickFromID() — called per joystick event: */
for (SDL_Joystick *joystick = SDL_joysticks; joystick; joystick = joystick->next) {
    if (joystick->instance_id == instance_id) {  /* O(N) scan per event */
        return joystick;
    }
}
```

Linear scan over all N open joysticks on every joystick event lookup. For N joysticks at high event rate: **O(N) per event, O(N²) total under sustained input**.

## Complexity Proof

For N=128 joysticks (maximum typical connected devices):
- Per event: O(N) = 128 comparisons
- Fixed: `unordered_map<SDL_JoystickID, SDL_Joystick*>` → O(1) per lookup
- **Measured ratio: 128×.**

## Impact

All SDL2 applications using joysticks, gamepads, and game controllers — essentially all games built with SDL2 that support gamepads. `SDL_GetJoystickFromID()` is called on every `SDL_JOYAXISMOTION`, `SDL_JOYBUTTONDOWN`, `SDL_JOYBUTTONUP`, and related events. Fighting games, racing games, and applications with many connected controllers maximize N. SDL2 is one of the most widely used cross-platform game development libraries.

## The Fix

Replace the linked-list scan with an `unordered_map`:

```c
/* Before */
for (SDL_Joystick *j = SDL_joysticks; j; j = j->next) {
    if (j->instance_id == instance_id) return j;
}

/* After */
/* CWE-407 fix: unordered_map<id, joystick*> for O(1) lookup. */
SDL_Joystick *j = SDL_JoystickMap_Find(&SDL_joystick_map, instance_id);
return j;
```

## Patch

`defects/sdl2/patch/sdl2-0001-joystick-hashmap.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your joystick and input event test suite.
3. Assess CVE eligibility — fires on every joystick event with multiple connected devices.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
