russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.6 KiB

Raw Blame History

Kronos — CWE-407 Disclosure Brief (kronos-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(N) defect in Kronos's (Yabause fork) SH2 breakpoint handler. The SH2HandleBreakpoints() function uses a linear scan over the breakpoint array on every instruction fetch, firing millions of times per second during debugging.

The Defect

kronos-0001 (PATCHED — LOW): yabause/src/sys/sh2/include/sh2core.h:562 in SH2HandleBreakpoints()

static INLINE int SH2HandleBreakpoints(SH2_struct *context) {
    if (context->bp.inbreakpoint == 0) {
        for (i=0; i < context->bp.numcodebreakpoints; i++) {
            if (context->regs.PC == context->bp.codebreakpoint[i].addr) {
                // breakpoint hit
                return 1;
            }
        }
    }
    return 0;
}

This function is called on every instruction execution during debugging. With N breakpoints, each instruction pays O(N) for the linear scan. MAX_BREAKPOINTS is 10, so individual scans are fast, but the function fires millions of times per second.

Complexity Proof

At N=10 breakpoints, millions of instructions/sec:

Defective: 10 comparisons per instruction (worst case)
Fixed: O(log 10) = 4 comparisons per instruction (binary search)
~2.5× op reduction per instruction. Compounds over millions of calls/sec.

Impact

Kronos is a Sega Saturn emulator (Yabause fork). The breakpoint handler fires on every emulated instruction during debugging sessions. Reducing per-instruction overhead directly improves debug-mode performance.

The Fix

Maintain a sorted breakpoint address table and use binary search:

// After — O(log N) binary search on sorted_bp_addrs[]
int lo = 0, hi = context->bp.numcodebreakpoints - 1;
while (lo <= hi) {
    int mid = (lo + hi) >> 1;
    if (pc == context->bp.sorted_bp_addrs[mid]) { return 1; }
    else if (pc < a) { hi = mid - 1; }
    else { lo = mid + 1; }
}

Patch

Fix available: defects/kronos-0001/patch/kronos-0001.patch

Two-file patch across sh2core.h and sh2core.c. Adds sorted address table with SH2RebuildSortedBreakpoints() called on add/delete. ~2.5× speedup at 10 breakpoints, per instruction.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference.
Assess severity — fires on every emulated instruction during debugging.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Kronos team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Blame History Unescape Escape