russell@unturf.com edf083b2c4 openfoam+stella: 5-MOAD scan; openfoam-0002 CWE-407, stella CLEAN

openfoam-0002: CFCFaceToCellStencil::calcCellStencil allGlobalFaces dedup
uses findIndex() O(G) linear scan inside nested forAll(cells)*forAll(faces)
loop. Developer left comment "Note:should use hashset?" — confirmed defect.
Fix: labelHashSet seen replaces findIndex, 77x op-count speedup at C=2000/F=12.

stella: all 5 MOADs CLEAN. BreakpointMap uses unordered_map O(1); TrapArray
uses std::array<uInt8,0x10000> O(1); single-threaded, no credentials, no
thread-local identity, no thundering herd.

2026-03-31 21:55:06 -04:00

1.7 KiB

Raw Blame History

Stella (Atari 2600 Emulator) — 5-MOAD Scan

Target: https://github.com/stella-emu/stella Scan date: 2026-03-31

MOAD-0001 — CWE-407 Algorithmic Complexity: CLEAN

Our hot paths were the primary concern for a cycle-accurate emulator running at 1.19 MHz.

BreakpointMap (src/debugger/BreakpointMap.hxx): Uses std::unordered_map<Breakpoint, uInt32, BreakpointHash> — O(1) lookup per CPU instruction. CLEAN.

TrapArray (src/debugger/TrapArray.hxx): Uses std::array<uInt8, 0x10000> — O(1) direct address index. CLEAN.

TIA dispatch (src/emucore/tia/): No linear scan in cycle dispatch. CLEAN.

Watchpoints (src/debugger/DebuggerParser.cxx): myWatches is a StringList iterated in showWatches() — only called on debugger step (interactive), not per CPU instruction. Bounded watch count (user-set). CLEAN.

No O(N) container scan found inside our per-instruction or per-cycle execution paths.

MOAD-0002 — Intertangle / God Object: CLEAN

OSystem aggregates console, settings, sound, and video — classic god object shape. However, all subsystems are accessed via typed references with clear ownership. No shared mutable global state shared across independent subsystems. CLEAN.

MOAD-0003 — Leaked Context / ThreadLocal: CLEAN

Stella is single-threaded. No thread_local, no ThreadLocal, no pthread_key_*. CLEAN.

MOAD-0004 — CWE-312 Credentials in Logs: CLEAN

Stella is an offline emulator with no network connectivity, no authentication, no credential handling. No log paths found containing passwords, tokens, or keys. CLEAN.

MOAD-0005 — Thundering Herd: CLEAN

Stella is single-threaded. No concurrent cache initialization patterns. CLEAN.

Summary

All 5 MOADs: CLEAN

1.7 KiB Raw Blame History