engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

Browse source 
kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).
This commit is contained in:
russell@unturf.com 2026-03-31 21:13:14 -04:00
parent fb090af082
commit 282282447c
12 changed files with 890 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
defects/gstreamer/patch/gstreamer-0004-rtspsrc-proxy-password-cwe312.patch Normal file
View file

@ -0,0 +1,15 @@
--- a/subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c
+++ b/subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c
@@ -1998,8 +1998,12 @@ gst_rtspsrc_set_proxy (GstRTSPSrc * rtsp, const gchar * proxy)
if (rtsp->proxy_user != NULL || rtsp->proxy_passwd != NULL) {
- GST_LOG_OBJECT (rtsp, "set proxy user/pw from properties: %s:%s",
- GST_STR_NULL (rtsp->proxy_user), GST_STR_NULL (rtsp->proxy_passwd));
+ /* CWE-312 fix: never log the proxy password verbatim.
+ * The original GST_LOG_OBJECT call emitted "user:password" into the
+ * debug log at GST_LEVEL_LOG (level 9). Any process with
+ * GST_DEBUG="*:9" set (a common developer practice) would expose the
+ * HTTP proxy password in plain text. Log only the username. */
+ GST_LOG_OBJECT (rtsp, "set proxy user from properties: %s",
+ GST_STR_NULL (rtsp->proxy_user));
}
}

52
defects/gstreamer/patch/gstreamer-0005-webrtc-seen-transceivers-ghashset.patch Normal file
View file

@ -0,0 +1,52 @@
--- a/subprojects/gst-plugins-bad/ext/webrtc/gstwebrtcbin.c
+++ b/subprojects/gst-plugins-bad/ext/webrtc/gstwebrtcbin.c
@@ -3964,7 +3964,13 @@ _create_offer_task (GstWebRTCBin * webrtc, const GstStructure * options,
- GList *seen_transceivers = NULL;
+ /* CWE-407 fix: replace GList seen-set with GHashTable for O(1) membership.
+ *
+ * The offer-creation function loops over transceivers->len (T) entries
+ * multiple times, calling g_list_find(seen_transceivers, trans) at each
+ * step. g_list_find is O(T), so the full function is O(T^2).
+ *
+ * For a WebRTC conference with T=50 transceivers (25 audio + 25 video),
+ * each renegotiation does ~50^2 = 2500 pointer comparisons instead of ~50.
+ * Fix: use a GHashTable with direct pointer hashing for O(1) ops.
+ */
+ GHashTable *seen_transceivers =
+ g_hash_table_new (g_direct_hash, g_direct_equal);
@@ seen_transceivers = g_list_prepend (seen_transceivers, trans)
- seen_transceivers = g_list_prepend (seen_transceivers, trans);
+ g_hash_table_add (seen_transceivers, trans);
@@ g_assert (!g_list_find (seen_transceivers, trans))
- g_assert (!g_list_find (seen_transceivers, trans));
+ g_assert (!g_hash_table_contains (seen_transceivers, trans));
@@ if (g_list_find (seen_transceivers, trans)) (line 4119)
- if (g_list_find (seen_transceivers, trans))
+ if (g_hash_table_contains (seen_transceivers, trans))
@@ if (!g_list_find (seen_transceivers, trans)) (line 4151)
- if (!g_list_find (seen_transceivers, trans))
+ if (!g_hash_table_contains (seen_transceivers, trans))
@@ seen_transceivers = g_list_prepend (seen_transceivers, trans) (line 4152)
- seen_transceivers = g_list_prepend (seen_transceivers, trans);
+ g_hash_table_add (seen_transceivers, trans);
@@ if (g_list_find (seen_transceivers, trans)) (line 4162)
- if (g_list_find (seen_transceivers, trans))
+ if (g_hash_table_contains (seen_transceivers, trans))
@@ seen_transceivers = g_list_prepend (seen_transceivers, trans) (line 4170)
- seen_transceivers = g_list_prepend (seen_transceivers, trans);
+ g_hash_table_add (seen_transceivers, trans);
@@ if (g_list_find (seen_transceivers, trans)) (line 4216)
- if (g_list_find (seen_transceivers, trans))
+ if (g_hash_table_contains (seen_transceivers, trans))
@@ g_list_free (seen_transceivers) (line 4307)
- g_list_free (seen_transceivers);
+ g_hash_table_unref (seen_transceivers);