engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/mame/scan/CLEAN.md
russell@unturf.com 7d89e30de9 emulator scan: MAME/Dolphin/ScummVM all CLEAN — no CWE-407 defects 
Scanned three major emulator codebases for algorithmic complexity defects:
- MAME: proper maps/enumerators, std::find only on constant-bounded arrays
- Dolphin: exceptionally clean, HashMap/unordered_map throughout hot paths
- ScummVM: Common::find on tiny collections only, HashMap for config lookups
2026-03-30 15:23:14 -04:00

963 B
Raw Blame History

MAME — CWE-407 Scan Result: CLEAN

Date: 2026-03-30 Scanner: agent blackops Scope: src/emu, src/frontend, src/lib/util (sparse checkout)

Methodology

Searched for std::find( on vector/array containers inside loops, dedup patterns with push_back, visited-list membership, and linear container scans in hot paths.

Findings

All std::find usages in MAME fall into safe categories:

  1. Constant-bounded containers: Input type arrays (ioport.cpp), page mappings (SCREEN_PAGE_NUM=16), parent chains (1-3 deep)
  2. Cycle detection on tiny chains: Layout group nesting (rendlay.cpp), software parent chains (romload.cpp) — depth < 5
  3. Cold paths only: Validation code (validity.cpp), info XML generation (infoxml.cpp), CLI options (submenu.cpp)
  4. Character/string searches: Not container membership tests

MAME uses proper data structures (maps, sets, enumerators) for hot-path lookups. No CWE-407 defects found.