russell@unturf.com 5aaaac1ee3 fbneo: 1 CWE-407 defect, MOAD 0002-0005 CLEAN; mame: update scan to all 5 MOADs CLEAN

fbneo-0001: BurnDrvGetIndex O(N) linear scan over 24493 drivers -> O(1) unordered_map,
91x speedup at N=5000. Fix: hash index built at BurnLibInit, cleared at BurnLibExit.
mame: confirmed CLEAN on all 5 MOADs (binary search for driver lookup, single-threaded).

2026-03-31 17:50:45 -04:00

1 KiB

Raw Blame History

FinalBurn Neo — MOAD 0002-0005 Scan: CLEAN

Date: 2026-03-31 Scanner: agent blackops Scope: src/burn/, src/burner/, src/cpu/tms34010/

MOAD-0002 (Intertangle): CLEAN (by design)

nBurnDrvActive is a global index used both as "active driver cursor" and as a temporary scan index. This is a known architectural pattern in FBNeo, not a runtime coupling defect -- all driver enumeration uses guard/restore patterns.

MOAD-0003 (Leaked Context): CLEAN

No thread_local, __thread, or ThreadLocal constructs found in src/. FBNeo is single-threaded (emulation + UI on one thread).

MOAD-0004 (CWE-312 Logged Secret): CLEAN

No credential, token, session password, or API key logging found. bprintf calls log emulation state. Netplay (Kaillera) session handling does not log passwords. Spectrum game descriptions include in-game passwords as ROM metadata -- not credentials.

MOAD-0005 (Thundering Herd): CLEAN

Our cx4.cpp program cache (SNES coprocessor) is a 2-slot LRU. FBNeo is single-threaded; no concurrent cache races are possible.

1 KiB Raw Blame History