russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.1 KiB

Raw Blame History

FCEUX — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(C) linear-scan defect in FCEUX's cheat system memory read handler. Patched. Patch ready for upstream review. Fires on every CPU memory read.

The Defects

fceux-0001 (PATCHED — HIGH): src/cheat.cpp:79

// In SubCheatsRead() — fires on every memory read through cheat handler:
CHEATF_SUBFAST *s = SubCheats;
int x = numsubcheats;
do {
    if (s->addr == A) {
        // handle cheat value substitution
    }
    s++;
} while (--x);

SubCheatsRead() is installed as the read handler for cheat-patched addresses. It linearly scans the entire SubCheats[] array (up to 256 entries) to find the matching address. The NES 6502 CPU executes millions of memory reads per second.

Complexity Proof

At C=64 active cheats:

Defective: 64 comparisons per memory read
Fixed: 1 lookup (direct-address table, 64KB)
64x op reduction per memory read.

Impact

FCEUX emulates the NES. When cheats are active, every memory read through a cheat-patched address scans the full cheat list. With many active cheats (Game Genie codes, memory freezes), emulation speed degrades linearly.

The Fix

Add a cheat_idx[0x10000] direct-address lookup table mapping NES addresses to SubCheats indices:

// Before
do { if (s->addr == A) ... s++; } while (--x);

// After
static int cheat_idx[0x10000];  // -1 = no cheat
int idx = cheat_idx[A];
if (idx >= 0) { CHEATF_SUBFAST *s = &SubCheats[idx]; ... }

Patch

Fix available: defects/fceux-0001/patch/fceux-0001.patch

Single-file patch on src/cheat.cpp. 64x speedup at C=64 active cheats.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (TASEmulators/fceux).
Assess severity — fires on every memory read through cheat handlers.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the FCEUX team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Blame History