russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Permalink Blame History

SameBoy — CWE-407 Disclosure Brief (sameboy-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(B) linear scan in should_break() at Core/debugger.c:1421, called on every instruction execution during emulation. The function iterates all B breakpoints for every instruction, even when no breakpoint exists at the current PC address. At ~4M instructions per second on a Game Boy, this produces massive overhead.

The Defect

sameboy-0002 (PATCHED — HIGH): Core/debugger.c:1421

static unsigned should_break(GB_gameboy_t *gb, uint16_t addr, bool jump_to)
{
    // No fast path — always iterates ALL breakpoints
    for (unsigned i = 0; i < gb->n_breakpoints; i++) {
        // O(B) per instruction
    }
}

Complexity Proof

At B=20 breakpoints, ~4M instructions/second:

Defective: 4,000,000 × 20 = 80,000,000 breakpoint checks/second
Fixed: 4,000,000 × O(1) bitmap check = 4,000,000 checks
20× throughput improvement during debugging

Impact

SameBoy checks breakpoints on every instruction during emulation. This path directly affects emulation speed during debugging sessions. Developers working with multiple breakpoints (common in ROM reverse engineering) experience visible slowdown proportional to breakpoint count.

The Fix

Add a 64KB boolean lookup table (bool breakpoint_address_set[0x10000]) to the gameboy struct, indexed by 16-bit address. On breakpoint add/remove, update the table. should_break() checks the table first:

if (!gb->breakpoint_address_set[addr]) return 0;  // O(1) fast path

Patch

Fix available: defects/sameboy-0002/patch/sameboy-0002.patch

Covers breakpoint add, delete, and rebuild paths.

What We Ask

Confirm receipt and assign a GitHub issue reference (LIJI32/SameBoy).
Assess severity — fires on every instruction during debugging.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the SameBoy team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Permalink Blame History Unescape Escape