java-topology/whitepaper/outreach/retroarch-0002.md

RetroArch — CWE-407 Disclosure Brief (retroarch-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(C×(E+D)) linear scan in core_info_database_supports_content_path() at core_info.c:2503, called per ROM file per database during content scanning. With C=100 cores, E=5 extensions, D=3 databases, F=40,000 ROM files, and DB=150 databases, total comparisons reach 4.8 billion. MAME users report multi-minute scan times that should complete in seconds.

A second function, core_info_database_match_archive_member() at core_info.c:2464, shares the same O(C×D) pattern on the same hot path.

The Defect

retroarch-0002 (PATCHED — HIGH): core_info.c:2503

// core_info_database_supports_content_path() iterates ALL installed cores (C),
// calling string_list_find_elem twice per core: once for supported_extensions_list
// (O(E)) and once for databases_list (O(D)).
// Called from task_database.c:1142 for every ROM file × every database.

Complexity Proof

At C=100, E=5, D=3, F=1,000 files, DB=150:

• Defective: F × DB × C × (E+D) = 1,000 × 150 × 100 × 8 = 120,000,000 comparisons
• Fixed: F × DB × 2 hash lookups = 300,000 lookups
• 250× measured overhead at C=100 cores

Impact

RetroArch serves millions of users across desktop, mobile, and embedded platforms. The content scanner runs on every ROM library import. MAME collections (40,000+ ROMs) trigger the worst case. Users on low-power devices (Raspberry Pi, Android TV) experience multi-minute freezes during scanning.

The Fix

Build two hash maps at core_info_init_list() time:

• ext_to_databases: extension → set of database names that support it
• database_has_archive_member: set of database names with archive-member flag

Both core_info_database_supports_content_path() and core_info_database_match_archive_member() become O(1) amortized via hash lookups.

Patch

Fix available: defects/retroarch-0002/patch/retroarch-0002-core-info-database-supports-linear-scan.patch

250× speedup at C=100 cores with F=1,000 files.

What We Ask

1. Confirm receipt and assign a GitHub issue reference (libretro/RetroArch).
2. Assess severity — content scanner freezes UI for minutes on large ROM sets.
3. Coordinate a disclosure date — targeting 90 days from first contact.
4. We will credit the RetroArch team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.