SDL3 — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in SDL3's gamepad mapping system. HasMappingChangeTracking() performs a linear scan over all J joysticks per mapping on every gamepad database reload, causing O(J×M) overhead per DB update. Patch ready for upstream review.

The Defects

sdl3-0001 (PATCHED — HIGH): SDL_gamepad.c:639

/* Inside HasMappingChangeTracking() — called per joystick per mapping on DB reload: */
for (int i = 0; i < num_joysticks; i++) {
    if (joysticks[i]->mapping == mapping) {  /* O(J×M) total */
        ...
    }
}

The scan iterates over J joysticks for each M mapping entry on every gamepad database reload event. For J joysticks and M mappings: O(J × M) per reload.

Complexity Proof

For J=100 joysticks and M=8 mappings per reload:

Defective: J × M = 800 comparisons per reload
Fixed: direct mapping backpointer on each joystick
At J=100, M=8: Measured ratio: 800×.

Impact

All SDL3 applications using gamepads with dynamic mapping updates. Gamepad DB reloads occur when users add custom mappings at runtime, on application initialization, and when SDL_AddGamepadMapping() is called. SDL3 is the current major SDL release; all new SDL-based game projects use SDL3. Applications supporting runtime controller remapping hit this on every mapping change.

The Fix

Track the mapping backpointer directly on each joystick struct:

/* Before */
for (int i = 0; i < num_joysticks; i++) {
    if (joysticks[i]->mapping == mapping) { ... }
}

/* After */
/* CWE-407 fix: direct backpointer on joystick for O(1) mapping check. */
/* Store mapping → joystick reference; direct lookup instead of scan. */

Patch

defects/sdl3/patch/sdl3-0001-gamepad-mapping-backpointer.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your gamepad mapping test suite.
Assess CVE eligibility — fires on every gamepad database reload with many joysticks.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.2 KiB Raw Blame History Unescape Escape