java-topology/whitepaper/outreach/dolphin-0001.md

Dolphin — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N) linear-scan defect in Dolphin Emulator's breakpoint system. Patched. Patch ready for upstream review.

The Defects

dolphin-0001 (PATCHED — MEDIUM): Source/Core/Core/PowerPC/BreakPoints.cpp:52

// In GetRegularBreakpoint() — fires on every breakpoint check:
auto bp = std::ranges::find(m_breakpoints, address, &TBreakPoint::address);
if (bp == m_breakpoints.end())
    return nullptr;

m_breakpoints is a std::vector<TBreakPoint>. std::ranges::find performs an O(N) linear scan for each breakpoint address lookup. With N breakpoints set, every check costs O(N).

Complexity Proof

At N=64 breakpoints:

• Defective: 64 comparisons per lookup
• Fixed: 1 lookup (unordered_map)
• 64x op reduction per breakpoint check.

Impact

Dolphin emulates GameCube and Wii. Breakpoint lookups fire during debugging. The linear scan over the breakpoint list degrades the debugging experience as breakpoint count increases.

The Fix

Add std::unordered_map<u32, std::size_t> m_bp_index alongside the vector, rebuilt on every mutation:

// Before
auto bp = std::ranges::find(m_breakpoints, address, &TBreakPoint::address);

// After
auto it = m_bp_index.find(address);
if (it == m_bp_index.end()) return nullptr;
return &m_breakpoints[it->second];

Patch

Fix available: defects/dolphin-0001/patch/dolphin-0001.patch

Two-file patch across BreakPoints.h and BreakPoints.cpp. 64x speedup at N=64 breakpoints.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (dolphin-emu/dolphin).
2. Assess severity — fires on every breakpoint check during debugging.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Dolphin team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.