russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.4 KiB

Raw Permalink Blame History

Thunderbird — CWE-407 Disclosure Brief (thunderbird-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Thunderbird's message copy service. ContainsObject() performs linear scans on a growing active-targets list during bulk message copy/move operations. Patched.

The Defects

thunderbird-0002 (PATCHED — MEDIUM-HIGH): mailnews/base/src/nsMsgCopyService.cpp

// In DoNextCopy() — fires during bulk message move/copy:
for (i = 0; i < cnt; i++) {
    copyRequest = m_copyRequests.ElementAt(i);
    if (activeTargets.ContainsObject(copyRequest->m_dstFolder)) {  // O(N) linear scan
        copyRequest = nullptr;
        continue;
    }
    ...
    activeTargets.AppendObject(copyRequest->m_dstFolder);
}

ContainsObject() performs a linear scan of activeTargets. As the list grows with each iteration, this creates O(N²) complexity where N = number of pending copy requests.

Complexity Proof

thunderbird-0002: At N=500 copy requests:

Defective: ~125,000 object comparisons
Fixed: ~500 hash lookups
250× overhead at N=500. Fires during bulk message operations.

Impact

Thunderbird processes message copy/move operations through this code path. Bulk operations (moving hundreds of messages between folders, applying filters to large mailboxes) trigger quadratic behavior. Users performing email organization on large mailboxes experience unnecessary delays.

The Fix

thunderbird-0002: Replace ContainsObject() with nsTHashSet<nsIMsgFolder*>:

// Before — O(N²)
activeTargets.ContainsObject(copyRequest->m_dstFolder)

// After — O(N)
nsTHashSet<nsIMsgFolder*> activeTargetSet;
activeTargetSet.Contains(copyRequest->m_dstFolder)

Patch

Fix available: defects/thunderbird-0002/patch/thunderbird-0002_nsMsgCopyService_DoNextCopy_ContainsObject_ON2.patch

Single-file patch in mailnews/base/src/nsMsgCopyService.cpp.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Bugzilla reference (bugzilla.mozilla.org).
Assess severity — fires during bulk message move/copy operations.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Thunderbird team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.4 KiB Raw Permalink Blame History Unescape Escape