russell@unturf.com f30b6bdb52 kronos: 2 CWE-407/CWE-312 defects; mesen-s: all 5 MOADs CLEAN ...

kronos-0001 (CWE-407, MEDIUM): SH2HandleBreakpoints() in sh2core.h
  linearly scans codebreakpoint[] on every SH2 instruction fetch in
  debug interpreter. MAX_BREAKPOINTS=10, O(10) per fetch at 28.6 MHz
  emulated = 286M extra comparisons/s. Fix: sorted_bp_addrs[] +
  binary search, O(log N), 2.54x fewer comparisons measured.

kronos-0002 (CWE-312, LOW): netlink.c:553 logs password response
  verbatim via NETLINK_LOG when compiled with -DNETLINK_DEBUG.
  Fix: replace %s format with literal [REDACTED].

kronos MOAD-0002/0003/0005: CLEAN
mesen-s: all 5 MOADs CLEAN (CheatManager unordered_map O(1),
  BreakpointManager guarded by _hasBreakpoint fast-path,
  password hashed before network use, no TLS credential leakage)

8/8 tests PASS

2026-03-31 19:56:06 -04:00

1,005 B

Raw Permalink History

View raw