russell@unturf.com
652608142a
All projects with patches now have outreach docs. 276 new docs covering CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#, PHP, Ruby, JavaScript, Dart, Erlang, R, and more. Outreach gap: 276 -> 0.
2.2 KiB
ScummVM — CWE-407 Disclosure Brief (scummvm-0002)
2026-04-13 · Patch available — awaiting upstream merge
Finding
An O(D×R×depth) defect in the tSage engine walk region system at engines/tsage/core.cpp. _disabledRegions uses Common::List<int> with contains() performing O(D) per check where D = disabled regions. The recursive calculateRestOfRoute() calls contains() on every connected region per step, compounding through recursion depth.
The Defect
scummvm-0002 (PATCHED — MEDIUM): engines/tsage/core.h / engines/tsage/core.cpp
Common::List<int> _disabledRegions;
// In disableRegion():
if (!contains(_disabledRegions, regionId)) // O(D) linear scan
_disabledRegions.push_back(regionId);
// In calculateRestOfRoute():
if (!contains(g_globals->_walkRegions._disabledRegions, (int)currDest)) // O(D) per region per recursion step
Complexity Proof
At D=50 disabled regions, R=100 connected regions, depth=10:
- Defective: 100 × 50 × 10 = 50,000 comparisons per route calculation
- Fixed: 100 × O(1) × 10 = 1,000 lookups
- 50× op reduction per route calculation
Impact
ScummVM's tSage engine powers multiple classic Sierra adventure games. Walk region calculations fire on every player click-to-walk action. Games with complex room layouts and many disabled regions (cutscene barriers, puzzle-locked areas) trigger the worst case.
The Fix
Replace Common::List<int> _disabledRegions with std::unordered_set<int>. Update disableRegion() to use insert() (automatic dedup), enableRegion() to use erase(), and calculateRestOfRoute() to use find() for O(1) lookups. Serialization adapts to iterate the set.
Patch
Fix available: defects/scummvm-0002/patch/scummvm-0002.patch
Multi-file patch: core.h, core.cpp.
50× op reduction at D=50 disabled regions.
What We Ask
- Confirm receipt and assign a GitHub issue reference (scummvm/scummvm).
- Assess severity — fires on every walk-region route calculation in tSage games.
- Coordinate a disclosure date — targeting 90 days from first contact.
- We will credit the ScummVM team in the public disclosure.
Contact: see cover email. This brief is confidential until coordinated disclosure.