java-topology/whitepaper/outreach/play-0001.md

Play! (PS2 Emulator) — CWE-407 Disclosure Brief (play-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

O(H²) interrupt handler lookup in CIopBios::FindIntrHandler() where a linear scan over all allocated interrupt handlers searches for a matching line number. Called from RegisterIntrHandler() and ReleaseIntrHandler(), and potentially from interrupt dispatch.

The Defect

play-0001 (PATCHED — MEDIUM): Source/iop/IopBios.cpp:3106

int32 CIopBios::FindIntrHandler(uint32 line)
{
    for (auto handlerIterator = std::begin(m_intrHandlers);
         handlerIterator != std::end(m_intrHandlers); handlerIterator++)
    {
        auto handler = m_intrHandlers[handlerIterator];
        if (!handler) continue;
        if (handler->line == line) return handlerIterator;
    }
    return -1;
}

Each FindIntrHandler call scans all handler slots. With H registered handlers, cost per call is O(H). Called at registration, release, and potentially dispatch time.

Complexity Proof

At H=64 handler slots (IOP interrupt lines):

• Defective: 64 comparisons per lookup
• Fixed: O(1) direct array index lookup
• 64× op reduction per lookup. Bounded by CIntc::LINES_MAX.

Impact

Play! emulates the PlayStation 2 IOP (I/O Processor). Interrupt handler registration and lookup fire during IOP BIOS emulation. While the handler count is bounded by hardware interrupt line count, the fix eliminates all scanning overhead with a direct-indexed array.

The Fix

Add an m_intrHandlerIndex array mapping interrupt line to handler ID, maintained at register and release time:

// Before — O(H) scan:
for (auto it = begin; it != end; ++it)
    if (m_intrHandlers[it]->line == line) return it;

// After — O(1) direct index:
if (line >= CIntc::LINES_MAX) return -1;
return m_intrHandlerIndex[line];

Patch

Fix available: defects/play-0001/patch/play-0001.patch

Two-file patch across IopBios.h and IopBios.cpp.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (jpd002/Play-).
2. Assess severity — eliminates scanning overhead for interrupt handler lookup.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the Play! team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.