russell@unturf.com
f30b6bdb52
kronos-0001 (CWE-407, MEDIUM): SH2HandleBreakpoints() in sh2core.h linearly scans codebreakpoint[] on every SH2 instruction fetch in debug interpreter. MAX_BREAKPOINTS=10, O(10) per fetch at 28.6 MHz emulated = 286M extra comparisons/s. Fix: sorted_bp_addrs[] + binary search, O(log N), 2.54x fewer comparisons measured. kronos-0002 (CWE-312, LOW): netlink.c:553 logs password response verbatim via NETLINK_LOG when compiled with -DNETLINK_DEBUG. Fix: replace %s format with literal [REDACTED]. kronos MOAD-0002/0003/0005: CLEAN mesen-s: all 5 MOADs CLEAN (CheatManager unordered_map O(1), BreakpointManager guarded by _hasBreakpoint fast-path, password hashed before network use, no TLS credential leakage) 8/8 tests PASS
49 lines
2.7 KiB
Text
49 lines
2.7 KiB
Text
CLEAN
|
|
|
|
MOAD-0001 (CWE-407): CLEAN
|
|
- CheatManager.ApplyCheat(): uses unordered_map<uint32_t, CheatCode> keyed
|
|
by address — O(1) lookup per memory read. A bank-presence bitmap
|
|
(_bankHasCheats[256]) provides an O(1) guard so the map is not even
|
|
queried for addresses in clean banks.
|
|
- BreakpointManager.InternalCheckBreakpoint(): iterates vector<Breakpoint>
|
|
linearly, but the vector is bounded by the number of user-set breakpoints
|
|
(typically 0-10) and the fast-path _hasBreakpoint/_hasBreakpointType guard
|
|
skips the loop entirely when no breakpoints are active. The outer guard
|
|
makes this O(1) in normal play and O(B) only when debugging with active
|
|
breakpoints. Not a hot-path O(N^2) pattern.
|
|
- ShortcutKeyHandler._keysDown: unordered_set<uint32_t> for O(1) lookup.
|
|
- KeyCombination.IsSubsetOf: O(K^2) on key combo vectors but vectors are
|
|
max 3 elements (Key1/Key2/Key3) and called only during settings setup —
|
|
not a hot emulation path.
|
|
- All other find() calls use unordered_map/unordered_set or are cold paths.
|
|
- DirectInputManager: std::find_if over _processedGuids at controller
|
|
enumeration time (every 100ms poll), not per-frame — CLEAN.
|
|
- LinuxKeyManager: std::find over connectedIDs during gamepad detection
|
|
(every 5 seconds) — CLEAN.
|
|
|
|
MOAD-0002 (Intertangle): CLEAN
|
|
- Console.h holds CPU/PPU/APU/DMA/Cart as separate typed shared_ptr members.
|
|
Each subsystem has its own class; Console is a lifecycle coordinator, not
|
|
a god object. Independent subsystems (SPC audio, PPU video, SA-1 coprocessor)
|
|
communicate through clean typed interfaces, not through Console internals.
|
|
|
|
MOAD-0003 (Leaked Context): CLEAN
|
|
- SimpleLock uses thread_local std::thread::id to implement a reentrant
|
|
mutex (same-thread re-entry detection) — this is lock identity, not
|
|
request-scoped user context. No per-request identity is stored in TLS.
|
|
|
|
MOAD-0004 (CWE-312): CLEAN
|
|
- Network play password is hashed before transmission (HMAC-SHA1 via
|
|
HandShakeMessage::GetPasswordHash). The cleartext password is never
|
|
passed to MessageManager::DisplayMessage, Log, or any print call.
|
|
GameServerConnection.cpp message logging contains only player names
|
|
and port numbers.
|
|
|
|
MOAD-0005 (Thundering Herd): CLEAN
|
|
- ExpressionEvaluator._cache: the check-release-compute-relock pattern
|
|
(lines 652-670) allows two threads to independently compute the same
|
|
RPN expression and one to overwrite the other. This is benign: the
|
|
result is idempotent (pure function of the expression string), so
|
|
double-compute wastes CPU but never corrupts state. Not a correctness
|
|
hazard; severity is negligible.
|
|
- No other cache+null+compute+put patterns found in the emulation core.
|