java-topology/whitepaper/outreach/thunderbird-0001.md

Thunderbird — CWE-407 Disclosure Brief (thunderbird-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Thunderbird's account manager startup. IndexOf() inside a loop performs quadratic duplicate detection during LoadAccounts(), plus two additional O(N²) patterns in RemoveAccount() and GetAllIdentities(). Patched.

The Defects

thunderbird-0001 (PATCHED — MEDIUM): mailnews/base/src/nsMsgAccountManager.cpp

// In LoadAccounts() — fires on every Thunderbird startup:
for (uint32_t i = 0; i < accountsArray.Length(); i++) {
    if (accountsArray.IndexOf(accountsArray[i]) != i) continue;  // O(N) per iteration
    ...
}

IndexOf() is a linear scan used for duplicate detection. For N account entries, total cost is O(N²). Additionally, RemoveAccount() has nested loops with IndexOf() for identity reuse checking (O(A×I²)), and GetAllIdentities() has nested loops for identity dedup (O(A×I²)).

Complexity Proof

thunderbird-0001: At N=500 accounts:

• Defective: ~125,000 comparisons during startup
• Fixed: ~500 hash insertions/lookups
• 250× overhead at N=500. Runs on every Thunderbird startup.

Impact

Thunderbird is one of the most widely-used open-source email clients, with tens of millions of users. While most users have fewer than 10 accounts, enterprise and ISP deployments can have hundreds. LoadAccounts() runs on every startup, making this a startup performance regression that scales quadratically with account count.

The Fix

thunderbird-0001: Use nsTHashSet<nsCString> for O(1) membership checks:

// Before — O(N²)
if (accountsArray.IndexOf(accountsArray[i]) != i) continue;

// After — O(N)
nsTHashSet<nsCString> seenAccounts;
if (!seenAccounts.Insert(accountsArray[i], fallible)) continue;

Patch

Fix available: defects/thunderbird-0001/patch/thunderbird-0001_nsMsgAccountManager_LoadAccounts_indexOf_ON2.patch

Single-file patch in mailnews/base/src/nsMsgAccountManager.cpp.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a Bugzilla reference (bugzilla.mozilla.org).
2. Assess severity — fires on every Thunderbird startup and account removal.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Thunderbird team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.