russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.6 KiB

Raw Permalink Blame History

Genesis Plus GX — CWE-407 Disclosure Brief (genesis-plus-gx-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Genesis Plus GX's cheat system. The retro_cheat_set() function uses a linear scan to detect duplicate cheat codes before insertion, causing O(N²) total cost when loading N cheats.

The Defect

genesis-plus-gx-0001 (PATCHED — MEDIUM): libretro/libretro.c in retro_cheat_set()

// Duplicate detection via linear scan of cheatlist[]:
for (i=0; i<maxcheats; i++)
{
    if ((cheatlist[i].address == cheatlist[maxcheats].address)
           && (cheatlist[i].data == cheatlist[maxcheats].data))
       break;
}

Every call to retro_cheat_set() scans the entire cheatlist[] array (up to MAX_CHEATS=150) to check for duplicate address+data pairs. With N cheats loaded, total comparisons reach N*(N-1)/2.

Complexity Proof

At N=150 cheats (MAX_CHEATS):

Defective: 150 × 149 / 2 = ~11,175 comparisons
Fixed: 150 hash lookups (O(1) each via open-addressing hash table)
~75× op reduction.

Impact

Genesis Plus GX is a widely used Sega Genesis/Mega Drive emulator core for RetroArch and other libretro frontends. Cheat databases for popular titles can contain dozens to hundreds of codes. The defect fires on every cheat load operation.

The Fix

Add an open-addressing hash table (cheat_htab[256]) keyed on (address << 32) | data for O(1) duplicate detection:

// Before
for (i=0; i<maxcheats; i++)
    if (cheatlist[i].address == cheatlist[maxcheats].address
        && cheatlist[i].data == cheatlist[maxcheats].data)
        break;

// After — O(1) hash table lookup
uint64_t key = CHEAT_HTAB_MAKE(cheatlist[maxcheats].address,
                                cheatlist[maxcheats].data);
if (cheat_htab_contains(key)) { /* find existing entry to toggle */ }
else if (maxcheats < MAX_CHEATS) { cheat_htab_insert(key); maxcheats++; }

Patch

Fix available: defects/genesis-plus-gx-0001/patch/genesis-plus-gx-0001.patch

Single-file patch in libretro/libretro.c. Adds open-addressing hash table with 256 slots (power-of-two, >= 2*MAX_CHEATS). ~75× speedup at N=150 cheats.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference.
Assess severity — fires on every cheat load, scales quadratically with cheat count.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Genesis Plus GX team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Permalink Blame History Unescape Escape