russell@unturf.com
efe58242e0
Wine scan: hot paths use hash tables (module lookup), red-black trees (font families, shader cache), binary search (registry), bounded lists (FBO<=64, sampler<=16, MUI<=8). wine-0001 covers loader dependency dedup. No additional CWE-407 defects. MOADs 0002-0005 CLEAN: loader_section is by design, no request-scoped TLS leakage, kerberos logs only auth_data pointer (not value), all caches protected by critical sections. WireGuard-go scan: peers.keyMap is hash map O(1), AllowedIPs is radix trie O(32). Private key and PSK are never logged (only "Updating X" labels). Device struct has per-sub-struct sync.RWMutex with no thundering herd patterns. MOADs 0002-0005 CLEAN: well-decomposed Device struct, no goroutine-local leakage, proper sync.
99 lines
4.4 KiB
Markdown
99 lines
4.4 KiB
Markdown
CLEAN — Wine (wine-mirror/wine) — all 5 MOADs scanned 2026-03-31
|
|
|
|
Repository: https://gitlab.winehq.org/wine/wine
|
|
Mirror: https://github.com/wine-mirror/wine
|
|
Version: HEAD (depth=1 clone)
|
|
Language: C
|
|
Size: 12,147 files
|
|
|
|
Note: wine-0001 (UNDF-2026-000000886) covers MOAD-0001 loader dependency dedup
|
|
in dlls/ntdll/loader.c. This marker covers the remaining 4 MOADs plus additional
|
|
MOAD-0001 coverage confirming no other hot-path O(N^2) defects beyond wine-0001.
|
|
|
|
## MOAD-0001 (CWE-407): wine-0001 filed; additional sites CLEAN
|
|
|
|
Hot paths scanned:
|
|
|
|
- dlls/ntdll/loader.c: find_basename_module uses hash_table (HASH_MAP_SIZE buckets),
|
|
find_named_export uses binary search (find_name_in_exports), loader dependency
|
|
dedup covered by wine-0001.
|
|
|
|
- server/registry.c: find_subkey and find_value both use binary search on sorted
|
|
arrays. O(log N) per registry key/value lookup. CLEAN.
|
|
|
|
- dlls/win32u/class.c: find_class uses LIST_FOR_EACH_ENTRY on class_list. The list
|
|
contains ~13 builtin classes plus app-registered classes. Called once per
|
|
CreateWindow, not in a loop over windows. In practice N < 50. The linear scan
|
|
is bounded and not O(N^2). CLEAN.
|
|
|
|
- dlls/win32u/font.c: find_family_from_name and find_family_from_any_name both use
|
|
wine_rb_get (red-black tree). find_cached_gdi_font scans gdi_font_list with hash
|
|
precheck (fontcmp exits early on hash mismatch) — O(N) per CreateFont but not
|
|
O(N^2). get_gdi_font_subst called in add_gdi_font_subst at startup only (not
|
|
runtime hot path). CLEAN.
|
|
|
|
- dlls/wined3d/glsl_shader.c: shader program cache uses wine_rb_tree (O(log N)),
|
|
FFP vertex/fragment shader caches use wine_rb_tree. shader_glsl_find_sampler
|
|
is O(S) where S = sampler count, bounded by D3D limits (S <= 16). CLEAN.
|
|
|
|
- dlls/wined3d/context_gl.c: FBO cache is LIST_FOR_EACH_ENTRY capped at
|
|
WINED3D_MAX_FBO_ENTRIES=64. Bounded, not O(N^2). CLEAN.
|
|
|
|
- dlls/kernelbase/registry.c: MUI cache is LIST_FOR_EACH_ENTRY capped at
|
|
REG_MUI_CACHE_SIZE=8. CLEAN.
|
|
|
|
- dlls/secur32/secur32.c: security package table LIST_FOR_EACH_ENTRY is O(P)
|
|
where P = number of loaded SSP packages (typically < 10). Called per
|
|
QuerySecurityPackage, not per-request. CLEAN.
|
|
|
|
## MOAD-0002 (Intertangle): NOTED, architectural
|
|
|
|
dlls/ntdll/loader.c: loader_section is a single global RTL_CRITICAL_SECTION
|
|
serializing all PE loader operations (LoadLibrary, FreeLibrary, DllMain calls).
|
|
This creates a global bottleneck but is mandated by the Windows PE loader
|
|
specification — simultaneous DLL loads from multiple threads must be serialized to
|
|
prevent dependency race conditions. This is architectural constraint, not a novel
|
|
defect.
|
|
|
|
dlls/win32u: user_lock() serializes all USER32 object operations. Same pattern,
|
|
same justification (Windows USER32 is single-threaded by design).
|
|
|
|
No god-object coupling between independent subsystems (e.g., network + graphics +
|
|
audio sharing mutable state) found. Wine DLLs are architecturally isolated.
|
|
|
|
## MOAD-0003 (Leaked Context): CLEAN
|
|
|
|
NtCurrentTeb() provides per-thread TEB (Thread Environment Block) carrying:
|
|
- LastStatusValue, LastErrorValue (per-thread error codes — by design)
|
|
- ActivationContextStack (COM/SxS context — by design)
|
|
- tls_slots (TLS slots — explicitly managed by app)
|
|
|
|
These are per-thread, not request-scoped identity carriers. No cross-request
|
|
ThreadLocal leakage pattern found.
|
|
|
|
dlls/kernelbase/locale.c uses NtCurrentTeb() for locale info — Windows API
|
|
design, not a leaked context defect.
|
|
|
|
## MOAD-0004 (Logged Secret): CLEAN
|
|
|
|
dlls/kerberos/krb5_ap.c:
|
|
- kerberos_SpAcquireCredentialsHandle TRACE logs auth_data as %p (pointer only,
|
|
not contents). Password extracted via get_password_unixcp() and passed to
|
|
init_creds() but never logged.
|
|
- init_creds() in unixlib.c calls krb5_get_init_creds_password() with password
|
|
but logs only "success" on completion.
|
|
|
|
dlls/secur32/wrapper.c: AcquireCredentialsHandle logs pAuthData as %p (pointer).
|
|
No password/credential value appears in any TRACE/WARN/ERR call.
|
|
|
|
## MOAD-0005 (Thundering Herd): CLEAN
|
|
|
|
dlls/ntdll/loader.c: all module cache access (cached_modref) occurs under
|
|
loader_section critical section. No unsynchronized check-then-act.
|
|
|
|
dlls/win32u: all class_list access under user_lock(). No double-check locking.
|
|
|
|
dlls/wined3d: GL context operations are per-thread (each thread has its own
|
|
context_gl). No shared cache without synchronization found.
|
|
|
|
server/ (wineserver): single-threaded event loop — no concurrent cache misses.
|