russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.3 KiB

Raw Permalink Blame History

Thunderbird — CWE-407 Disclosure Brief (thunderbird-0003)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Three O(n²) defects in Thunderbird's IMAP auto-sync manager. IndexOf() calls inside loops produce quadratic behavior during IMAP folder synchronization. Patched.

The Defects

thunderbird-0003 (PATCHED — HIGH): mailnews/imap/src/nsAutoSyncManager.cpp

Three methods use IndexOf() inside loops:

ChainFoldersInQ() — nested loops O(N²):

for (pqidx = 1; pqidx < pqElemCount; pqidx++) {
    for (idx = 0; idx < elemCount; idx++) {
        IsSibling(aChainedQ[idx], aQueue[pqidx], isSibling);

AutoUpdateFolders() — IndexOf per folder O(N²):

int32_t idx = mUpdateQ.IndexOf(autoSyncState);  // O(N) per folder

OnDownloadCompleted() — IndexOf for priority reordering O(N²):

int32_t myIndex = mPriorityQ.IndexOf(autoSyncStateObj);  // O(N) per completion

Complexity Proof

thunderbird-0003: At N=500 IMAP folders:

Defective: ~125,000 comparisons per sync cycle per method
Fixed: ~500 hash lookups per sync cycle per method
250× overhead at N=500. Fires on EVERY IMAP sync cycle.

Impact

This is HIGH severity because it runs on every IMAP sync interval for every folder. Enterprise users with 500+ IMAP folders (common in corporate environments with shared mailboxes, mailing list archives, and complex folder hierarchies) experience quadratic slowdown on every sync cycle, typically running every few minutes.

The Fix

thunderbird-0003: Maintain a HashMap<nsIAutoSyncState*, int32_t> for O(1) index lookups, updated when queue contents change.

Patch

Fix available: defects/thunderbird-0003/patch/thunderbird-0003_nsAutoSyncManager_IndexOf_ON2.patch

Single-file patch in mailnews/imap/src/nsAutoSyncManager.cpp.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Bugzilla reference (bugzilla.mozilla.org).
Assess severity — fires on every IMAP sync cycle for every folder.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Thunderbird team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Permalink Blame History Unescape Escape