russell@unturf.com
f30b6bdb52
kronos-0001 (CWE-407, MEDIUM): SH2HandleBreakpoints() in sh2core.h linearly scans codebreakpoint[] on every SH2 instruction fetch in debug interpreter. MAX_BREAKPOINTS=10, O(10) per fetch at 28.6 MHz emulated = 286M extra comparisons/s. Fix: sorted_bp_addrs[] + binary search, O(log N), 2.54x fewer comparisons measured. kronos-0002 (CWE-312, LOW): netlink.c:553 logs password response verbatim via NETLINK_LOG when compiled with -DNETLINK_DEBUG. Fix: replace %s format with literal [REDACTED]. kronos MOAD-0002/0003/0005: CLEAN mesen-s: all 5 MOADs CLEAN (CheatManager unordered_map O(1), BreakpointManager guarded by _hasBreakpoint fast-path, password hashed before network use, no TLS credential leakage) 8/8 tests PASS
36 lines
1.9 KiB
Text
36 lines
1.9 KiB
Text
MOAD-0001 (CWE-407): 2 defects found — see kronos-0001, kronos-0002
|
|
|
|
MOAD-0001 (CWE-407): DEFECT — kronos-0001
|
|
- SH2HandleBreakpoints() in yabause/src/sys/sh2/include/sh2core.h:565
|
|
scans codebreakpoint[0..numcodebreakpoints-1] linearly on EVERY
|
|
instruction fetch in the debug interpreter (SH2KronosDebugInterpreterExec,
|
|
SH2SimpleDebugInterpreterExec). MAX_BREAKPOINTS=10, so worst-case 10
|
|
comparisons per instruction. At ~10 MIPS emulated that is 100M extra
|
|
comparisons/second in debug sessions.
|
|
- Fix: keep sorted_bp_addrs[] in sorted order; binary-search O(log N).
|
|
Rebuild (insertion-sort, max 10 elements) only on add/del breakpoint.
|
|
|
|
MOAD-0002 (Intertangle): CLEAN
|
|
- Saturn hardware is modeled as separate global structs (MSH2/SSH2, VDP1,
|
|
VDP2, SCSP, SMPC, SCU). These are intentional hardware-accuracy globals,
|
|
not an accidental god-object coupling. No independent subsystem is coupled
|
|
through another's internals.
|
|
|
|
MOAD-0003 (Leaked Context): CLEAN
|
|
- No thread_local or pthread_getspecific usage found in emulation core.
|
|
The emulator is structured as a single main loop with the UI running in a
|
|
separate Qt thread — context is passed explicitly, not via TLS.
|
|
|
|
MOAD-0004 (CWE-312): DEFECT — kronos-0002
|
|
- yabause/src/utils/src/netlink.c:553
|
|
NETLINK_LOG("password response: %s", NetlinkArea->inbuffer+start)
|
|
When compiled with -DNETLINK_DEBUG (enabled for debug builds),
|
|
NETLINK_LOG expands to DebugPrintf(MainLog, ...) and writes the
|
|
Saturn modem internet-login password verbatim to the debug log.
|
|
Also: login response (line 543) logs the username verbatim.
|
|
- Fix: replace format string with a literal "[REDACTED]" sentinel.
|
|
|
|
MOAD-0005 (Thundering Herd): CLEAN
|
|
- No cache get+null+compute+put pattern found outside of NETLINK_DEBUG
|
|
debug paths. YGL texture cache (yglcache.c) uses a hash table with
|
|
no concurrent writers — single-threaded render thread.
|