russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.2 KiB

Raw Blame History

Mednafen — CWE-407 Disclosure Brief (mednafen-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(16) per-character defect in Mednafen's Game Genie code decoder. The GGtobin() function uses a linear scan over a 16-character lookup string to decode each nibble, called 8 times per Game Genie code.

The Defect

mednafen-0001 (PATCHED — LOW): mednafen/mempatcher.cpp:476

static int GGtobin(char c)
{
    static char lets[16]={'A','P','Z','L','G','I','T','Y','E','O','X','U','K','S','V','N'};
    int x;
    for(x=0;x<16;x++)
        if(lets[x] == toupper(c)) return(x);
    return(0);
}

Each call scans up to 16 characters. Called 8 times per Game Genie code decode. Total: up to 128 comparisons per code.

Complexity Proof

Per 8-character Game Genie code:

Defective: 8 × 16 = 128 comparisons (worst case)
Fixed: 8 × 1 = 8 array lookups (direct-index LUT)
~16× op reduction per code.

Impact

Mednafen is a multi-system emulator supporting NES, SNES, Genesis, and many other platforms. Game Genie codes are decoded when users enter cheat codes. While the per-code cost is small, the fix demonstrates clean O(1) lookup via a compile-time LUT.

The Fix

Replace the linear scan with a 256-byte direct-index lookup table:

// After — compile-time LUT, O(1) per character
static const signed char GGLut[256] = { /* A=0, P=1, Z=2, ... */ };
static int GGtobin(char c) {
    int v = (int)GGLut[(unsigned char)c];
    return (v < 0) ? 0 : v;
}

Patch

Fix available: defects/mednafen-0001/patch/mednafen-0001.patch

Single-file patch in mednafen/mempatcher.cpp. Replaces linear scan with 256-byte LUT. Case-insensitive (both upper and lower entries in table). ~16× speedup per character lookup.

What We Ask

A patch is ready for review.

Confirm receipt and assign a contact or issue tracker reference.
Assess severity — minor optimization, clean constant-time replacement.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Mednafen team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.2 KiB Raw Blame History Unescape Escape