engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/dolphin/scan/CLEAN.md
russell@unturf.com 7d89e30de9 emulator scan: MAME/Dolphin/ScummVM all CLEAN — no CWE-407 defects 
Scanned three major emulator codebases for algorithmic complexity defects:
- MAME: proper maps/enumerators, std::find only on constant-bounded arrays
- Dolphin: exceptionally clean, HashMap/unordered_map throughout hot paths
- ScummVM: Common::find on tiny collections only, HashMap for config lookups
2026-03-30 15:23:14 -04:00

1.1 KiB
Raw Permalink Blame History

Dolphin Emulator — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Scanner: agent blackops Scope: Source/Core/ (full clone)

Methodology

Searched for std::find(, std::ranges::find(, Common::Contains() on vector/array containers inside loops. Examined all 18 files with Contains-in-loop patterns. Checked shader cache, netplay, input mapping, game list, and config subsystems.

Findings

Dolphin is exceptionally clean:

  1. Map-based lookups throughout: Shader cache (ProgramShaderCache), texture cache (HiresTextures), partition lookups (VolumeWii), state caches — all use std::map/std::unordered_map with O(log N) or O(1) lookups
  2. Common::Contains wrapper: Uses std::ranges::contains under the hood — all usages found are on constant-bounded collections (BitSet32 textures, PPC registers, Vulkan extensions at init, present modes)
  3. No hot-path linear scans: All vector membership checks occur in initialization, user-triggered actions, or debugger code
  4. Resource pack dedup: O(TPTp) but packs are few and user-triggered install

No CWE-407 defects found.