engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/scummvm/scan/CLEAN.md
russell@unturf.com 7d89e30de9 emulator scan: MAME/Dolphin/ScummVM all CLEAN — no CWE-407 defects 
Scanned three major emulator codebases for algorithmic complexity defects:
- MAME: proper maps/enumerators, std::find only on constant-bounded arrays
- Dolphin: exceptionally clean, HashMap/unordered_map throughout hot paths
- ScummVM: Common::find on tiny collections only, HashMap for config lookups
2026-03-30 15:23:14 -04:00

1.1 KiB
Raw Permalink Blame History

ScummVM — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Scanner: agent blackops Scope: common/, engines/, backends/, base/ (sparse checkout, ~17k source files)

Methodology

Searched for Common::find( on Array containers inside loops, dedup patterns, visited-list membership in graph traversals. Examined all 47 occurrences across 30 engine files plus common library and base code.

Findings

ScummVM's Common::find usages are all safe:

  1. Constant-bounded containers: Sound channels (<16), screen pages (16), active actions (<10 simultaneous keys), playing chores (<20), save slots (<10)
  2. Dedup on tiny collections: restoredSounds (loop of 8), realPages (16), costume materials (<50), animation scales (<10)
  3. Graph traversal visited lists (tools only): Stark decompiler block predecessor/successor checks — development tool, not runtime
  4. Config/CLI lookups: Engine name matching in command line processing, minigame config parameters — initialization-only code
  5. HashMap for hot lookups: ConfigManager uses HashMap throughout, Archive uses fileMap/directoryMap

No CWE-407 defects found.