SDL2 — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in SDL2's joystick subsystem. SDL_GetJoystickFromID() performs a linear scan over all N joysticks on every joystick event, causing O(N) overhead per event and O(N²) overhead under high joystick event rates. Patch ready for upstream review.

The Defects

sdl2-0001 (PATCHED — HIGH): src/joystick/SDL_joystick.c

/* Inside SDL_GetJoystickFromID() — called per joystick event: */
for (SDL_Joystick *joystick = SDL_joysticks; joystick; joystick = joystick->next) {
    if (joystick->instance_id == instance_id) {  /* O(N) scan per event */
        return joystick;
    }
}

Linear scan over all N open joysticks on every joystick event lookup. For N joysticks at high event rate: O(N) per event, O(N²) total under sustained input.

Complexity Proof

For N=128 joysticks (maximum typical connected devices):

Per event: O(N) = 128 comparisons
Fixed: unordered_map<SDL_JoystickID, SDL_Joystick*> → O(1) per lookup
Measured ratio: 128×.

Impact

All SDL2 applications using joysticks, gamepads, and game controllers — essentially all games built with SDL2 that support gamepads. SDL_GetJoystickFromID() is called on every SDL_JOYAXISMOTION, SDL_JOYBUTTONDOWN, SDL_JOYBUTTONUP, and related events. Fighting games, racing games, and applications with many connected controllers maximize N. SDL2 is one of the most widely used cross-platform game development libraries.

The Fix

Replace the linked-list scan with an unordered_map:

/* Before */
for (SDL_Joystick *j = SDL_joysticks; j; j = j->next) {
    if (j->instance_id == instance_id) return j;
}

/* After */
/* CWE-407 fix: unordered_map<id, joystick*> for O(1) lookup. */
SDL_Joystick *j = SDL_JoystickMap_Find(&SDL_joystick_map, instance_id);
return j;

Patch

defects/sdl2/patch/sdl2-0001-joystick-hashmap.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your joystick and input event test suite.
Assess CVE eligibility — fires on every joystick event with multiple connected devices.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.3 KiB Raw Blame History Unescape Escape