java-topology/whitepaper/outreach/lime3ds-0001.md

Lime3DS — CWE-407 Disclosure Brief (lime3ds-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Lime3DS's multiplayer room system. The ban list storage uses std::vector<std::string> with std::find for username and IP ban checking, producing O(B) per join request and O(B²) for bulk ban operations where B = ban list size.

The Defect

lime3ds-0001 (PATCHED — MEDIUM): src/network/room.cpp

// Multiple sites use std::find on vector ban lists:
// Join request — checks both username and IP ban:
if (std::find(username_ban_list.begin(), username_ban_list.end(),
              member.user_data.username) != username_ban_list.end()) {
    SendUserBanned(event->peer);
    return;
}
if (std::find(ip_ban_list.begin(), ip_ban_list.end(), ip) != ip_ban_list.end()) {
    SendUserBanned(event->peer);
    return;
}

// Ban operation — dedup check before insert:
if (std::find(username_ban_list.begin(), username_ban_list.end(), username) ==
    username_ban_list.end()) {
    username_ban_list.emplace_back(username);
}

Six call sites use std::find on std::vector for ban list operations across join, ban, and unban handlers.

Complexity Proof

At B=500 banned entries, J=100 join attempts:

• Defective: 100 × 500 × 2 (username + IP) = 100,000 comparisons
• Fixed: 100 × 2 O(1) hash lookups = 200 operations
• ~500× op reduction.

Impact

Lime3DS (formerly Citra) is a Nintendo 3DS emulator with online multiplayer support. Public multiplayer rooms accumulate ban lists over time. Every join request triggers linear scans of both ban lists, adding latency to connection establishment.

The Fix

Replace std::vector<std::string> with std::unordered_set<std::string> for O(1) membership, insert, and erase:

// Before
UsernameBanList username_ban_list;  // vector
IPBanList ip_ban_list;              // vector

// After
std::unordered_set<std::string> username_ban_list;
std::unordered_set<std::string> ip_ban_list;

Patch

Fix available: defects/lime3ds-0001/patch/lime3ds-0001.patch

Single-file patch in src/network/room.cpp. Converts both ban lists from vectors to unordered sets. Serialization to/from vectors preserved for network protocol compatibility. ~500× speedup at 500 bans.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference.
2. Assess severity — fires on every multiplayer room join attempt.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Lime3DS team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.