russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Blame History

Decaf — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(M) linear-scan defect in Decaf's Wii U MCP device module loading. Patched. Patch ready for upstream review.

The Defects

decaf-0001 (PATCHED — MEDIUM): src/libdecaf/src/ios/mcp/ios_mcp_mcp_device.cpp:89,155

// In mcpGetFileLength() and mcpLoadFile() — fires on every module load:
if (std::find(decaf::config()->system.lle_modules.begin(),
              decaf::config()->system.lle_modules.end(),
              name) == decaf::config()->system.lle_modules.end()) {

lle_modules is a std::vector<std::string>. std::find performs an O(M) linear scan for each module lookup. With M configured LLE modules and N module load calls, total cost reaches O(N*M).

Complexity Proof

At M=50 LLE modules:

Defective: 50 comparisons per module load
Fixed: 1 lookup per module load (unordered_set)
50x op reduction per module load.

Impact

Decaf emulates the Wii U. Module loading fires during boot and game startup. Games that load many system modules hit this path repeatedly with a growing LLE module list.

The Fix

Build a static std::unordered_set<std::string> from the LLE modules vector once, then use O(1) find():

// Before
std::find(lleVec.begin(), lleVec.end(), name) == lleVec.end()

// After
static const auto sLleModuleSet = std::unordered_set<std::string>(lleVec.begin(), lleVec.end());
sLleModuleSet.find(std::string(name)) == sLleModuleSet.end()

Patch

Fix available: defects/decaf-0001/patch/decaf-0001.patch

Single-file patch on ios_mcp_mcp_device.cpp. 50x speedup at M=50 LLE modules.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (decaf-emu/decaf-emu).
Assess severity — fires during boot and module loading.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Decaf team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Blame History