russell@unturf.com 6784cdf1cf feat: add 39 outreach docs (batches 6-8)

Batch 6 (9): dolibarr, jitsi-videobridge, zed, tryton, suricata,
  strawberry, zulip, zesarux, zephyr
Batch 7 (15): xonotic (4), xash3d (3), xenia, xtuple, zabbix (2),
  zathura, zebra, yabause, zephyr-0001
Batch 8 (15): woodpecker (2), wine (4), widelands (3), wesnoth (3),
  wekan (3)

Mix of CWE-407 and CWE-312.

2026-04-14 17:06:28 -04:00

2.7 KiB

Raw Permalink Blame History

Xenia — CWE-407 Disclosure Brief (xenia-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N²) defect in Xenia Xbox 360 emulator kernel object table enumeration. ObjectTable::GetAllObjects uses std::find on a growing results vector for deduplication, making total cost O(N²) where N = occupied object table slots.

The Defect

xenia-0001 (PATCHED — MEDIUM): src/xenia/kernel/util/object_table.cc:219

// In ObjectTable::GetAllObjects() — dedup via linear scan:
std::vector<object_ref<XObject>> results;

for (uint32_t slot = 0; slot < table_capacity_; slot++) {
    auto& entry = table_[slot];
    if (entry.object && std::find(results.begin(), results.end(),
                                  entry.object) == results.end()) {
        entry.object->Retain();
        results.push_back(object_ref<XObject>(entry.object));
    }
}

table_capacity_ can grow large as the emulated Xbox 360 game allocates kernel objects (threads, events, mutexes, files). Each slot insertion checks the entire results vector via std::find, producing O(1+2+...+N) = O(N²/2) total comparisons.

Complexity Proof

At N=1000 unique kernel objects:

Defective: 1000 × 500 average = 500,000 pointer comparisons
Fixed: 1000 × O(1) hash lookups = 1,000 operations
~500x op reduction.

Impact

Xenia emulates Xbox 360 titles. Games that heavily use kernel objects (multithreaded games, games with many I/O handles) grow the object table throughout execution. GetAllObjects fires during debugging, object enumeration, and kernel state queries. Games with complex threading models (common in Xbox 360 titles) create thousands of kernel objects.

The Fix

Add std::unordered_set<XObject*> for O(1) dedup alongside the results vector:

// Before
if (entry.object && std::find(results.begin(), results.end(),
                              entry.object) == results.end()) { ... }

// After
// CWE-407 fix: unordered_set for O(1) dedup.
std::unordered_set<XObject*> seen;
if (entry.object && seen.find(entry.object) == seen.end()) {
    seen.insert(entry.object);
    ...
}

Patch

Fix available: defects/xenia-0001/patch/xenia-0001.patch

Single-file patch on src/xenia/kernel/util/object_table.cc. Adds unordered_set shadow for dedup.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (xenia-project/xenia).
Assess severity — quadratic in kernel object count, affects games with heavy threading.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the Xenia team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.7 KiB Raw Permalink Blame History Unescape Escape