russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.4 KiB

Raw Blame History

Jicofo — CWE-407 Disclosure Brief (jicofo-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(P*R) defect in Jicofo's participant reinvite logic. The reInviteParticipantsById() method uses List.contains() to match participant IDs against a reinvite list, producing quadratic cost when reinviting multiple participants.

The Defect

jicofo-0001 (PATCHED — MEDIUM): jicofo/src/main/java/org/jitsi/jicofo/conference/JitsiMeetConferenceImpl.java:2086

private int reInviteParticipantsById(List<String> participantIdsToReinvite, ...) {
    for (Participant participant : participants.values()) {
        if (participantIdsToReinvite.contains(participant.getEndpointId())) {  // O(R) per participant
            participantsToReinvite.add(participant);
        }
    }
}

participantIdsToReinvite is a List<String>. The contains() call is O(R) per participant, giving O(P*R) total where P = total participants and R = reinvite list size.

Complexity Proof

At P=500 participants, R=100 reinvites:

Defective: 500 × 100 = 50,000 string comparisons
Fixed: 500 × O(1) HashSet lookups = 500 operations
~100× op reduction.

Impact

Jicofo is the Jitsi conference focus component that manages participant sessions in Jitsi Meet. Participant reinvites fire during bridge migrations, network reconnections, and conference reconfigurations. Large conferences with hundreds of participants and batch reinvites hit this path.

The Fix

Convert the reinvite list to a HashSet<String> before the loop:

// Before
if (participantIdsToReinvite.contains(participant.getEndpointId())) { ... }

// After
Set<String> idSet = new HashSet<>(participantIdsToReinvite);
if (idSet.contains(participant.getEndpointId())) { ... }

Patch

Fix available: defects/jicofo-0001/patch/jicofo-0001-reinvite-participants-list-contains-quadratic.patch

Single-file patch in JitsiMeetConferenceImpl.java. ~100× speedup at 100 reinvites.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (jitsi/jicofo).
Assess severity — fires during bridge migration and participant reinvite events.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Jitsi team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.4 KiB Raw Blame History Unescape Escape