russell@unturf.com
efe58242e0
Wine scan: hot paths use hash tables (module lookup), red-black trees (font families, shader cache), binary search (registry), bounded lists (FBO<=64, sampler<=16, MUI<=8). wine-0001 covers loader dependency dedup. No additional CWE-407 defects. MOADs 0002-0005 CLEAN: loader_section is by design, no request-scoped TLS leakage, kerberos logs only auth_data pointer (not value), all caches protected by critical sections. WireGuard-go scan: peers.keyMap is hash map O(1), AllowedIPs is radix trie O(32). Private key and PSK are never logged (only "Updating X" labels). Device struct has per-sub-struct sync.RWMutex with no thundering herd patterns. MOADs 0002-0005 CLEAN: well-decomposed Device struct, no goroutine-local leakage, proper sync.
4.4 KiB
CLEAN — Wine (wine-mirror/wine) — all 5 MOADs scanned 2026-03-31
Repository: https://gitlab.winehq.org/wine/wine Mirror: https://github.com/wine-mirror/wine Version: HEAD (depth=1 clone) Language: C Size: 12,147 files
Note: wine-0001 (UNDF-2026-000000886) covers MOAD-0001 loader dependency dedup in dlls/ntdll/loader.c. This marker covers the remaining 4 MOADs plus additional MOAD-0001 coverage confirming no other hot-path O(N^2) defects beyond wine-0001.
MOAD-0001 (CWE-407): wine-0001 filed; additional sites CLEAN
Hot paths scanned:
-
dlls/ntdll/loader.c: find_basename_module uses hash_table (HASH_MAP_SIZE buckets), find_named_export uses binary search (find_name_in_exports), loader dependency dedup covered by wine-0001.
-
server/registry.c: find_subkey and find_value both use binary search on sorted arrays. O(log N) per registry key/value lookup. CLEAN.
-
dlls/win32u/class.c: find_class uses LIST_FOR_EACH_ENTRY on class_list. The list contains ~13 builtin classes plus app-registered classes. Called once per CreateWindow, not in a loop over windows. In practice N < 50. The linear scan is bounded and not O(N^2). CLEAN.
-
dlls/win32u/font.c: find_family_from_name and find_family_from_any_name both use wine_rb_get (red-black tree). find_cached_gdi_font scans gdi_font_list with hash precheck (fontcmp exits early on hash mismatch) — O(N) per CreateFont but not O(N^2). get_gdi_font_subst called in add_gdi_font_subst at startup only (not runtime hot path). CLEAN.
-
dlls/wined3d/glsl_shader.c: shader program cache uses wine_rb_tree (O(log N)), FFP vertex/fragment shader caches use wine_rb_tree. shader_glsl_find_sampler is O(S) where S = sampler count, bounded by D3D limits (S <= 16). CLEAN.
-
dlls/wined3d/context_gl.c: FBO cache is LIST_FOR_EACH_ENTRY capped at WINED3D_MAX_FBO_ENTRIES=64. Bounded, not O(N^2). CLEAN.
-
dlls/kernelbase/registry.c: MUI cache is LIST_FOR_EACH_ENTRY capped at REG_MUI_CACHE_SIZE=8. CLEAN.
-
dlls/secur32/secur32.c: security package table LIST_FOR_EACH_ENTRY is O(P) where P = number of loaded SSP packages (typically < 10). Called per QuerySecurityPackage, not per-request. CLEAN.
MOAD-0002 (Intertangle): NOTED, architectural
dlls/ntdll/loader.c: loader_section is a single global RTL_CRITICAL_SECTION serializing all PE loader operations (LoadLibrary, FreeLibrary, DllMain calls). This creates a global bottleneck but is mandated by the Windows PE loader specification — simultaneous DLL loads from multiple threads must be serialized to prevent dependency race conditions. This is architectural constraint, not a novel defect.
dlls/win32u: user_lock() serializes all USER32 object operations. Same pattern, same justification (Windows USER32 is single-threaded by design).
No god-object coupling between independent subsystems (e.g., network + graphics + audio sharing mutable state) found. Wine DLLs are architecturally isolated.
MOAD-0003 (Leaked Context): CLEAN
NtCurrentTeb() provides per-thread TEB (Thread Environment Block) carrying:
- LastStatusValue, LastErrorValue (per-thread error codes — by design)
- ActivationContextStack (COM/SxS context — by design)
- tls_slots (TLS slots — explicitly managed by app)
These are per-thread, not request-scoped identity carriers. No cross-request ThreadLocal leakage pattern found.
dlls/kernelbase/locale.c uses NtCurrentTeb() for locale info — Windows API design, not a leaked context defect.
MOAD-0004 (Logged Secret): CLEAN
dlls/kerberos/krb5_ap.c:
- kerberos_SpAcquireCredentialsHandle TRACE logs auth_data as %p (pointer only, not contents). Password extracted via get_password_unixcp() and passed to init_creds() but never logged.
- init_creds() in unixlib.c calls krb5_get_init_creds_password() with password but logs only "success" on completion.
dlls/secur32/wrapper.c: AcquireCredentialsHandle logs pAuthData as %p (pointer). No password/credential value appears in any TRACE/WARN/ERR call.
MOAD-0005 (Thundering Herd): CLEAN
dlls/ntdll/loader.c: all module cache access (cached_modref) occurs under loader_section critical section. No unsynchronized check-then-act.
dlls/win32u: all class_list access under user_lock(). No double-check locking.
dlls/wined3d: GL context operations are per-thread (each thread has its own context_gl). No shared cache without synchronization found.
server/ (wineserver): single-threaded event loop — no concurrent cache misses.