russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.4 KiB

Raw Blame History

Exim — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(H^2) defect in Exim's MX host comparison during mail delivery batching. Patched. Patch ready for upstream review.

The Defects

exim-0001 (PATCHED — HIGH): src/src/deliver.c:451

// In same_hosts() — fires during delivery batching:
for (;;) {
    host_item *hi;
    for (hi = two; hi != end_two->next; hi = hi->next)  // O(H) inner scan
        if (Ustrcmp(one->name, hi->name) == 0) break;
    if (hi == end_two->next) return FALSE;
    if (one == end_one) break;
    one = one->next;
}

same_hosts() compares MX-equal-priority host segments with a nested linear scan: for each host in segment one, scan segment two for a match. With H equal-priority hosts, the comparison costs O(H^2).

Complexity Proof

At H=20 equal-priority MX hosts, N=500 recipients:

Defective: 500 x 20^2 = 200,000 string comparisons
Fixed: 500 x 20 = 10,000 lookups (AVL tree)
20x op reduction per delivery batch.

Impact

Exim handles email for millions of servers worldwide. same_hosts() fires from deliver_message() for every address in addr_remote that might batch with the current delivery. Mailing list deliveries to domains with many equal-priority MX hosts (round-robin load balancing) hit this path hard.

The Fix

Build a tree_node AVL set from the two segment before the matching loop:

// Before
for (hi = two; hi != end_two->next; hi = hi->next)
    if (Ustrcmp(one->name, hi->name) == 0) break;

// After
tree_node *set = NULL;
for (hi = two; hi != end_two->next; hi = hi->next) {
    tree_node *tn = store_get(sizeof(tree_node), GET_UNTAINTED);
    tn->name = hi->name;
    tree_insertnode(&set, tn);
}
if (!tree_search(set, one->name)) return FALSE;

Patch

Fix available: defects/exim/patch/exim-0001-same-hosts-mx-segment-hashset.patch

Single-file patch on src/src/deliver.c. 20x speedup at H=20 equal-priority MX hosts.

What We Ask

A patch is ready for review.

Confirm receipt and assign a bug tracker reference (bugs.exim.org).
Assess severity — fires during mail delivery batching; scales with MX host count.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Exim team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.4 KiB Raw Blame History