russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.3 KiB

Raw Blame History

Snort 3 — CWE-407 Disclosure Brief (snort3-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(T²) linear scan in chp_add_candidate_to_tally() at src/network_inspectors/appid/detector_plugins/http_url_patterns.cc. The function uses std::find_if() on match_tally (a CHPMatchTally / std::vector<CHPMatchCandidate>) to find existing app entries, performing O(T) per callback where T = tally entries. This fires on every CHP key pattern match during HTTP URL inspection.

The Defect

snort3-0002 (PATCHED — MEDIUM): http_url_patterns.cc

static inline void chp_add_candidate_to_tally(CHPMatchTally& match_tally, CHPApp* chpapp)
{
    auto it = std::find_if(match_tally.begin(), match_tally.end(),
        [&chpapp](const CHPMatchCandidate& item){ return chpapp == item.chpapp; });
    // O(T) per pattern match callback

Complexity Proof

At T=500 tally entries, P=1,000 pattern matches per HTTP request:

Defective: 1,000 × 500/2 = 250,000 comparisons per request
Fixed: 1,000 × O(1) = 1,000 lookups
250× op reduction per HTTP request

Impact

Snort 3 inspects HTTP traffic at line rate. CHP (Custom HTTP Pattern) matching fires on every HTTP request for URL-based application identification. High-traffic networks processing millions of HTTP requests per second accumulate this cost significantly.

The Fix

Add an std::unordered_map<CHPApp*, std::size_t> match_tally_index to ChpMatchDescriptor. Use the map for O(1) lookup by app pointer:

auto it = match_tally_index.find(chpapp);
if (it != match_tally_index.end()) {
    match_tally[it->second].key_pattern_countdown--;
    return;
}
match_tally_index[chpapp] = match_tally.size();
match_tally.emplace_back(...);

Patch

Fix available: defects/snort3-0002/patch/snort3-0002.patch

Multi-file patch: http_url_patterns.h, http_url_patterns.cc.

250× op reduction at T=500, P=1,000.

What We Ask

Confirm receipt and assign a GitHub issue reference (snort3/snort3).
Assess severity — fires on every HTTP request during CHP pattern matching.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Snort team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Blame History Unescape Escape