engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

vlc+kodi: 5-MOAD scan; vlc-0003 CWE-312 SMB credentials logged verbatim

Browse source 
vlc-0003: modules/access/dsm/access.c:585 logs psz_login + psz_domain
via msg_Warn() on every successful SMB1 login. VLC debug logs are
routinely shared in bug reports, exposing SMB usernames and domain
names. Fix: remove our credential log line. 6/6 unit tests PASS.

VLC MOADs 0002/0003/0005 CLEAN. Kodi all 5 MOADs CLEAN (CWE-407
previously noted; CServiceBroker + LanguageHookTls documented as
architectural debt, no patch warranted).
This commit is contained in:
russell@unturf.com 2026-03-31 21:10:43 -04:00
parent 409d0f1907
commit fb090af082
4 changed files with 268 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

46
defects/kodi/SCAN.md Normal file
View file

@ -0,0 +1,46 @@
## Kodi 5-MOAD Scan — 2026-03-31
Target: https://github.com/xbmc/xbmc (depth=1)
### MOAD-0001 (CWE-407) — CLEAN
Kodi uses proper containers (maps, sets, unordered_map.contains()) throughout.
Only 11 files use std::find, all on small fixed-size collections:
- VAAPI/DXVA m_freeSurfaces std::find: bounded by decoder surface pool size
(typically 16-32 surfaces), inside locked sections. Not O(N^2) at scale.
- MusicInfoScanner thumbs std::find: thumbs is a user-configured list of 3-10
items. Bounded, not hot-path O(N^2).
- WSDiscovery IP dedup: O(N^2) but network discovery is bounded to ~100 devices max.
No significant MOAD-0001 defects found.
### MOAD-0002 (Intertangle) — ARCHITECTURAL NOTE (no patch)
CServiceBroker is a global service locator exposing 30+ subsystems (addons,
PVR, network, video, audio, filesystem, settings, peripherals, etc.). This is
a classic god-object / intertangle pattern. However, it is intentional Kodi
architecture providing DI-style access without singletons. Patching it would
require a multi-year architectural refactor. Documented as architectural debt.
### MOAD-0003 (Leaked Context) — ARCHITECTURAL NOTE (no patch)
xbmc/interfaces/legacy/LanguageHook.cpp uses `thread_local LanguageHook* addonLanguageHookTls`
to carry per-addon-invocation identity (addon ID, version, invoker ID) in our
scripting bridge. This is the MOAD-0003 pattern: request-scoped identity held
in thread-local storage. The LanguageHook.h comment (line 91) even acknowledges
the problem: "I need an InheritableThreadLocal C++ equivalent."
xbmc/interfaces/python/PyContext.cpp uses `thread_local PyContextState*` for
Python GIL management (not identity leakage per se — GIL state is inherently
per-thread).
The LanguageHook TLS is a true MOAD-0003 site but correcting it requires
replacing all addon callback dispatch with an explicit context parameter.
Documented as architectural debt.
### MOAD-0004 (CWE-312) — CLEAN
xbmc/platform/posix/filesystem/SMBFile.cpp redacts credentials in SMB log
messages using std::regex: `"(\\w+://)\\S+:\\S+@"` replaced with
`"$1USERNAME:PASSWORD@"`. No plaintext credential logging found elsewhere.
CLog searches across xbmc/network/, xbmc/filesystem/ return no password hits.
### MOAD-0005 (Thundering Herd) — CLEAN
CVideoThumbLoader::GetArtFromCache() has an unguarded get+insert pattern but
CBackgroundInfoLoader runs a single worker thread (std::unique_ptr<CThread>),
so concurrent access to m_artCache is impossible by design.
VAAPI/DXVA surface cache operations are all wrapped in std::unique_lock.
No concurrent cache stampede found.