russell@unturf.com 82c6916fe2 outreach: reconcile 3 overstate claims with measured wall-clock benches

Each of the 3 briefs flagged by bench_consistency.py as claim > measured
now carries an explicit line pairing the op-count claim with the
measured wall-clock speedup and explaining the residual gap.

  fbneo-0001:     45,000x claim -> + 2,410x wall-clock at N=45k
                  (Python dict vs C++ unordered_map constant factor).
  mercurial-0001: 5,000x claim -> + 50x wall-clock at k=500
                  (Python sim ceiling; bench_google_scale.py projects
                  to Google-scale via ops ratio).
  substrate:      38,550x claim -> + 2,009x wall-clock at N=10k
                  (Python list vs Rust HashSet constant factor).

mercurial-0001 bench also scaled to CASES=[(1000,50), (1000,100),
(1500,200), (1500,350), (1500,500)] to cover k=500 directly.

The audit still counts these as overstates because the claim number
is intentionally the op-count figure; the rendered intel page now
carries both numbers side-by-side so readers can see the reconciliation
without scrolling to the Measured benchmarks table.

2026-04-24 16:11:22 -04:00

2.4 KiB

Raw Blame History

FinalBurn Neo — CWE-407 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N) linear-scan defect in FinalBurn Neo's driver index lookup. Patched. Patch ready for upstream review.

The Defects

fbneo-0001 (PATCHED — MEDIUM): src/burn/burn.cpp:584

// In BurnDrvGetIndex() — fires on every driver lookup by name:
for (UINT32 i = 0; i < nBurnDrvCount; i++) {
    if (0 == strcmp(szName, pDriver[i]->szShortName)) {
        return i;
    }
}

BurnDrvGetIndex() performs an O(N) linear scan over the entire driver array (N = nBurnDrvCount) for each name lookup. FBNeo ships with ~45,000 drivers.

Complexity Proof

At N=45,000 drivers:

Defective: up to 45,000 strcmp comparisons per lookup
Fixed: 1 lookup (unordered_map)
45,000x worst-case op reduction — 45,000 strcmp calls per lookup collapse to one hash lookup.
2,410× measured wall-clock speedup at N=45,000 drivers (steady-state, Python model; see defects/fbneo-0001/bench/results.txt). The residual op-count vs wall-clock gap reflects Python dict overhead vs C++ unordered_map constant factors on short ASCII keys.

Impact

FinalBurn Neo is a leading arcade game emulator supporting over 45,000 games. Driver lookups by name fire during game loading, favorites management, and UI filtering. The linear scan over 45,000 entries makes these operations noticeably slow.

The Fix

Build a std::unordered_map<std::string, INT32> index at initialization:

// Before
for (UINT32 i = 0; i < nBurnDrvCount; i++)
    if (0 == strcmp(szName, pDriver[i]->szShortName))
        return i;

// After
static std::unordered_map<std::string, INT32> g_drvIndexMap;
auto it = g_drvIndexMap.find(szName);
if (it != g_drvIndexMap.end()) return it->second;

Patch

Fix available: defects/fbneo-0001/patch/fbneo-0001.patch

Single-file patch on src/burn/burn.cpp. 45,000x worst-case speedup.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (finalburnneo/FBNeo).
Assess severity — fires on every driver lookup; 45,000+ drivers in the index.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the FinalBurn Neo team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.4 KiB Raw Blame History Unescape Escape