Swift compiler — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in the Swift compiler's requirement machine minimization. RewriteSystem.cpp:484 performs an O(R×P) linear scan in isInMinimizationDomain() during protocol-rewrite minimization, which is a hot path in the generic requirement solver. Patch ready for upstream review.

The Defects

swift-0002 (PATCHED — HIGH): lib/AST/RequirementMachine/RewriteSystem.cpp:484

// isInMinimizationDomain() — called in protocol-rewrite hot path:
bool RewriteSystem::isInMinimizationDomain(const ProtocolDecl *proto) const {
    // Linear scan over protocols in minimization domain:
    return llvm::find(MinimizationDomain, proto) != MinimizationDomain.end();
    // O(R×P) — rewrite rules × protocols
}

llvm::find over MinimizationDomain (a SmallVector) performs O(P) scan per call. Called O(R) times during rewrite minimization: O(R × P) total. Measured ratio: 400×.

Complexity Proof

For P=400 protocols in the minimization domain:

Per rewrite rule: O(P) llvm::find scan
Total: O(R × P)
Fixed: llvm::DenseSet<const ProtocolDecl*> → O(R)
400× measured ratio.

Impact

All Swift codebases using generics with protocol requirements — virtually all non-trivial Swift programs. The requirement machine minimization runs during swiftc type-checking of every generic declaration. Swift Package Manager builds, Xcode builds, and CI pipelines for Swift code all hit this. Large frameworks with many generic protocols and complex requirement graphs (SwiftUI, Combine, async/await, large library APIs) hit worst case during every build.

The Fix

Replace SmallVector with llvm::DenseSet<const ProtocolDecl*>:

// Before
return llvm::find(MinimizationDomain, proto) != MinimizationDomain.end();
// O(P) SmallVector scan

// After
// CWE-407 fix: DenseSet for O(1) contains() instead of O(P) llvm::find scan.
return MinimizationDomainSet.contains(proto);

Patch

defects/swift/patch/swift-0002-rewrite-system-denseset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your requirement machine and type-checking test suite.
Assess CVE eligibility — fires during compilation of every generic protocol-constrained declaration.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History Unescape Escape