russell@unturf.com 52bf9f213e snes9x+mgba: 5-MOAD scan; 1 defect (mgba-0001) / snes9x CLEAN

mgba-0001: SM83DebuggerCheckBreakpoints() O(N) linear scan per GB/GBC
CPU instruction — no bloom filter guard, unlike ARMDebugger which already
has bpBloom[4].  Fix: add identical bloom guard to SM83Debugger.
Op-count ratio 10.4x at N=16 breakpoints (PASS).

snes9x: CLEAN across all 5 MOADs.  Breakpoint array is fixed size-6 (O(1)).
Cheat apply is per-frame O(G*C), not per-instruction.  No credential logging.

2026-03-31 21:48:05 -04:00

1.9 KiB

Raw Blame History

snes9x scan — CLEAN (all 5 MOADs)

Target: snes9x — Super Nintendo emulator Source: https://github.com/snes9xgit/snes9x Scan date: 2026-03-31

MOAD-0001: CWE-407 — CLEAN

Candidate sites examined:

Breakpoints (cpuexec.cpp)

S9xBreakpoint[] is a fixed array of exactly 6 entries. Our CPU exec loop iterates for (int Break = 0; Break != 6; Break++) — constant time, not O(N) over user-supplied breakpoint count. Not a defect.

Cheats (cheats2.cpp / cheats.cpp)

S9xUpdateCheatsInMemory() iterates all groups and all cheats per frame. This is O(G×C) but is called at video frame granularity (60 Hz), not per CPU instruction. There is no membership test inside the loop — each cheat directly writes its target address. Not O(N²).
Cheat search (cheats.cpp) scans all of WRAM/SRAM/IRAM looking for a value. These are O(M) single-pass scans over flat byte arrays — not O(N²) list membership.

Snapshot / state (snapshot.cpp)

State save/restore serializes fixed-layout structs. No list membership pattern found.

Cheat duplicate check (cheats2.cpp `S9xCheatIsDuplicate`)

String comparison across group names — called only when adding a cheat interactively, not in any hot path.

MOAD-0002: Intertangle — CLEAN (by design)

snes9x has global god-state (Settings, CPU, PPU, Memory, etc.) but this is standard emulator architecture coupling all subsystems through a shared machine state. Not a surprising entanglement defect — it is the intended design for a cycle-accurate SNES emulator.

MOAD-0003: Leaked Context — CLEAN

C/C++ codebase. No ThreadLocal, ScopedValue, ContextVar patterns.

MOAD-0004: CWE-312 — CLEAN

No network credentials or auth tokens found in snes9x core. Netplay (netplay.cpp) uses direct TCP socket; no auth tokens logged to stdout or files.

MOAD-0005: Thundering Herd — CLEAN

Single-threaded event loop. No concurrent cache get+null+compute+put pattern.

1.9 KiB Raw Blame History Unescape Escape