russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

1.9 KiB

Raw Blame History

DuckStation — CWE-407 Disclosure Brief (duckstation-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N^2) defect in DuckStation's cheat system unique-prefix builder. Patched. Patch ready for upstream review.

The Defects

duckstation-0001 (PATCHED — MEDIUM): src/core/cheats.cpp:598

// In GetCodeListUniquePrefixes() — fires when loading cheat lists:
if (std::find(ret.begin(), ret.end(), prefix) == ret.end())
    ret.push_back(prefix);

ret is a std::vector<std::string_view>. std::find performs O(N) linear scan for each cheat code prefix. With N codes, building the unique prefix list costs O(N^2).

Complexity Proof

At N=500 cheat codes:

Defective: 500 x 500 / 2 = 125,000 comparisons
Fixed: 500 x 1 = 500 lookups (unordered_set)
250x op reduction.

Impact

DuckStation emulates the PlayStation 1. Cheat databases for popular games can contain hundreds of codes. Loading a large cheat list triggers the quadratic prefix builder.

The Fix

Add an std::unordered_set<std::string_view> to track seen prefixes:

// Before
if (std::find(ret.begin(), ret.end(), prefix) == ret.end())
    ret.push_back(prefix);

// After
std::unordered_set<std::string_view> seen;
if (seen.insert(prefix).second)
    ret.push_back(prefix);

Patch

Fix available: defects/duckstation-0001/patch/duckstation-0001-cheats-unique-prefixes-set.patch

Single-file patch on src/core/cheats.cpp. 250x speedup at N=500 cheat codes.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (stenzek/duckstation).
Assess severity — fires when loading cheat lists.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the DuckStation team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

1.9 KiB Raw Blame History