jitsi-meet-0003: av-moderation pendingAudio/Video/Desktop Array.find()
dedup O(P^2) in large moderated meetings — 249.5x op-count at P=500,
138.5x measured at P=2000. Fix: Map<id, participant> for O(1) dedup.
jitsi-meet-0004: visitors middleware delta Array.findIndex() per update
O(U*V) in large broadcast events — 15x at V=5000 U=1000. Fix: Map-based
apply-delta O(1) per join/leave.
solvespace-0002: VRML export colours_present std::vector + find_if
O(T*C) per triangle — 250x op-count at T=50k C=500. Fix: unordered_map
keyed by ToPackedInt() RGBA uint32.
MOAD-0002/0003/0004/0005: CLEAN for both targets.
All 13 unit tests PASS.
libjpeg-turbo-0001: rdcolmap.c add_map_entry() O(P*C) linear color dedup.
For each pixel in a PPM colormap file, a linear scan checks the palette
(up to 256 entries). With large images (JPEG_MAX_DIMENSION=65500) and a
saturated palette, cost reaches O(W*H*256). Fix: open-addressing hash set
resets once per _read_color_map() call, giving O(1) average per pixel.
Measured 128-131x speedup. 7/7 unit tests PASS.
libwebp: CLEAN on all 5 MOADs. GetColorPalette uses open-addressing hash,
backward references use hash chains, palette sort O(N^2) bounded to N<=256
once per image, DSP init uses mutex-protected lazy initialization.
cmake-0005: cmQtAutoGen MergeOptions std::find over baseOpts in newOpts loop, O(N*M), 31.5x at N=M=50
cmake-0006: cmVisualStudio10TargetGenerator FinishWritingSource writtenSettings O(S^2), 15.3x at S=30
cmake-0007: cmGeneratorExpressionNode TargetRuntimeDllDirsNode dllDirs O(D^2), 10.3x at D=100
MPD: all 5 MOADs CLEAN; updated CLEAN.md with MOAD-0002 through MOAD-0005 analysis.
Unit tests: 3/3 PASS.
freecad-0003: CrossSection::removeDuplicates O(W^2*E) wire dedup via
std::find_if over growing list; fix: hash-keyed seen-set O(W*E log E).
Severity MEDIUM-HIGH, ~200x at W=400 duplicate wires.
freecad-0004: SketchAnalysis::detectMissingEqualityConstraints O(C*M^2)
std::find_if over std::list of equal-line/radius candidates; fix:
unordered_multimap keyed on canonical (GeoId,GeoId) pair, O(C).
Severity MEDIUM-HIGH, ~5x at C=50/M=50, grows with M^2.
kicad-0003: BOARD_NETLIST_UPDATER::testConnectivity calls FindPadByNumber
(O(P) linear scan) for each of N pins per footprint; fix: build
unordered_map<padNumber,PAD*> once per footprint, O(P+N) total.
Severity HIGH, ~19x at P=256 pads, ~512x at P=512 pads.
MOAD-0002/0003/0004/0005: CLEAN for both projects (documented in SCAN-NOTES).
mgba-0001: SM83DebuggerCheckBreakpoints() O(N) linear scan per GB/GBC
CPU instruction — no bloom filter guard, unlike ARMDebugger which already
has bpBloom[4]. Fix: add identical bloom guard to SM83Debugger.
Op-count ratio 10.4x at N=16 breakpoints (PASS).
snes9x: CLEAN across all 5 MOADs. Breakpoint array is fixed size-6 (O(1)).
Cheat apply is per-frame O(G*C), not per-instruction. No credential logging.
libtiff-0001: TIFFReadDirectory + TIFFReadCustomDirectory both contain
identical O(D^2) nested loops to detect duplicate IFD tags (bugzilla 1994
dedup block, tif_dirread.c). Adversarial TIFF with D=65535 entries causes
~2.1B comparisons per IFD open. Fix: sorted seen-array with binary-search
insert, O(D log D). Java model confirms 37x at D=8000; asymptotic ~3900x
at D=65535.
libpng: all 5 MOADs CLEAN. add_one_chunk O(new*old) in pngset.c is bounded
by a ~30-entry fixed chunk list; chunk dedup during read uses a bitmask O(1).
obs-studio: CLEAN all 5 MOADs
- MOAD-0001: no std::find in render hot path; da_find() calls are UI-only
- MOAD-0002: clean subsystem separation via handle interfaces
- MOAD-0003: THREAD_LOCAL vars are thread-type markers, not request identity
- MOAD-0004: stream key never logged; RTMP playpath log guarded by level filter
- MOAD-0005: async_cache fully mutex-protected
synfig-0001: CWE-407 in remove_layers_inside_included_pastelayers()
- std::vector<Layer::Handle> + std::find inside ancestor-walk while loop
- O(L * D * P): L layers, D nesting depth, P paste-canvas count
- Fix: std::unordered_set<Layer*> reduces inner lookup from O(P) to O(1)
- 4/4 unit tests PASS, 2.4x speedup at P=2000
llamacpp-0001: llama-grammar.cpp advance_stack/accept_token stacks_new
dedup via std::find on vector<vector<ptr>>, O(S^2) per grammar-constrained
token. Fix: companion std::set<llama_grammar_stack> for O(S log S). ~16x at S=300.
aria2-0001: DHTPeerAnnounceEntry addPeerAddrEntry peerAddrEntries_ vector
std::find dedup, O(P^2) as DHT peers accumulate per infohash. Fix:
unordered_map keyed by ip:port for O(P) amortized. ~15x at P=3000.
Both: MOADs 0002-0005 CLEAN per scan markers.
Both targets scanned across all 5 MOADs. No defects found.
NetworkManager: single-threaded GLib main loop, no hot-path O(N^2) scans,
all WiFi PSK/EAP/VPN secrets guarded with "<hidden>" in supplicant config log.
avahi: single-threaded poll loop, hashmap-based record and lookup caching,
no credentials, no thread-local context, no concurrent cache patterns.
digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and
removeFromXmpTagStringBag call QStringList::contains() inside a loop over
existing entries — O(O*N) per image during batch metadata write.
Fix: build QSet<QString> before the loop for O(1) lookup.
17x speedup at K=200 keywords (unit test PASS).
digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2
token exchange POST body (including client_secret_) via qDebug() at
GrantFlowAuthorizationCode completion — exposes cloud service credentials
in debug logs/stderr for Google Photos, Flickr, OneDrive integrations.
Fix: replace full-body dump with redacted log line.
lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls
are on QHash/QMap/QSet, no credential logging, no leaked thread context,
no unsynchronized cache access.
kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
widgets read/write the same map from the main thread — data race on project
load. Patch: add QMutex, wrap all m_lumacache access sites.
audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.
9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).
ffmpeg-0004 (MOAD-0004 / CWE-312): libavformat/http.c http_connect() logs the full
HTTP request at AV_LOG_DEBUG, including the Authorization: Basic header with
base64-encoded user:pass. Fix: produce a sanitized copy before av_log, replacing
auth header values with ***REDACTED***. Wire bytes unchanged. 22/22 unit tests PASS.
FFmpeg MOADs 0002/0003/0005: CLEAN. ImageMagick MOADs 0002-0005: CLEAN.
natron-0001: Node graph traversal visited-set O(N^2) via std::list+std::find
Engine/Node.cpp computeHashRecursive and 3+ sibling functions use
std::list<Node*> as visited set with O(N) std::find per visit = O(N^2).
Fix: std::unordered_set<Node*>. 249.5x at N=500 nodes. 3/3 PASS.
ardour-0001: PluginManager blacklist/rescan PluginInfoList O(I*N)
libs/ardour/plugin_manager.cc blacklist() and rescan_plugin() call
std::find on pil (N plugins) for each of I scan-log entries = O(I*N).
Fix: unordered_set + remove_if. 19.4x at N=1000 I=20. 3/3 PASS.
MOADs 0002-0005: CLEAN with notes in SCAN-MOAD-0002-0005.md each.
gimp-0003: xcf_save_layer_props layer_sets O(L×S×I) MEDIUM 166.7x
- xcf_save_layer_props() called per layer rebuilds+scans each named
layer set item list on every XCF save
- Fix: pre-build GHashTable per set before layer loop
inkscape-0004: LayerManager::_rebuild() std::find O(L²×D) HIGH 166.7x
- Per layer, per ancestor: std::find on full layers vector
- Runs on every document load, every layer add/remove, every undo/redo
- Fix: unordered_set built once at start of _rebuild()
MOADs 0002/0003/0004/0005: CLEAN for both GIMP and Inkscape.
All 3/4 unit tests PASS respectively.
blender-0004: MOAD-0001 CWE-407 anim_channels_edit.cc
rearrange_animchannel_islands() calls BLI_findptr(anim_data_visible, channel, ...)
inside the channel-grouping loop — O(C*V) where C=channels, V=visible channels.
In a complex rig: C=V=1000, 1,000,000 pointer comparisons per reorder.
Fix: build blender::Set<void*> from anim_data_visible before loop, O(1) lookup.
Measured: 250x op-count ratio at C=V=1000.
darktable-0004: MOAD-0004 CWE-312 pwstorage backends
backend_kwallet.c and backend_apple_keychain.c log credential key/value pairs
verbatim via dt_print(DT_DEBUG_PWSTORAGE, "storing (%s, %s)", key, value).
`value` for Piwigo export is JSON including plaintext password.
Triggered by `darktable -d pwstorage` or `-d all` (common debugging mode).
Fix: replace value argument with "[REDACTED]" in all four dt_print calls.
darktable-0005: MOAD-0001 CWE-407 modulegroups test_visible O(M*G*P)
_lib_modulegroups_update_iop_visibility() iterates M=80 IOP modules, calling
_lib_modulegroups_test_visible() which iterates G=8 groups doing g_list_find_custom
(linear scan of P=10 module names per group) — O(M*G*P) per UI refresh.
Called on every search keystroke, module toggle, and group switch.
Fix: precompute GHashTable of all visible module names; test_visible = O(1).
Measured: 37.8x op-count ratio at M=80, G=8, P=10.
MOADs 0002/0003/0005 CLEAN for blender; MOADs 0002/0003/0005 CLEAN for darktable.
All 4 blender + 5 darktable unit tests PASS.
libreoffice-0001: SavePivotTableXml member-to-cache O(M*C) std::find
sc/source/filter/excel/xepivotxml.cxx SavePivotTableXml()
for (member : aMembers) std::find(aCacheFieldItems) -> O(M*C)
Fix: unordered_map<OUString,size_t> index built once -> O(M+C)
Measured: 7.1x speedup at M=C=2000
calligra-0001: KoShapeManager addShape QList::contains O(N^2) dedup
libs/flake/KoShapeManager.cpp addShape() called from setShapes() loop
QList<KoShape*>::contains is O(N); N calls = O(N^2) total
Fix: change d->shapes to QSet<KoShape*> for O(1) membership
Measured: 12.6x speedup at N=5000
MOADs 0002-0005: CLEAN for both targets (see README.md per defect)
Both unit tests: PASS
suitecrm-0004: SugarBean.php subpanel union field dedup in_array($field, $all_fields)
inside nested foreach over subpanel queries — O(S*F^2), 4.3x at S=40 F=60.
Fix: parallel hash set for O(1) isset() check.
dolibarr-0004: emailcollector_card.php line 575 — IMAP password logged verbatim
unconditionally in dol_syslog(). CWE-312 HIGH. Fix: replace with literal ***.
dolibarr-0005: functions_ldap.php line 98 — LDAP admin searchPassword first 3 chars
leaked via dol_trunc() in dol_syslog() and browser print when $ldapdebug=true.
CWE-312 MEDIUM. Fix: replace dol_trunc(...) with literal *** in both sinks.
All 4 SuiteCRM tests PASS. All 5 Dolibarr tests PASS.
MOADs 0002/0003/0005 CLEAN for both targets (PHP single-threaded, architectural globals).
taiga-0001: taiga/events/middleware.py stores request X-Session-ID in threading.local,
leaking it across thread-pool requests when process_response is skipped.
Fix: replace with contextvars.ContextVar for proper per-request isolation.
redmine-0004: Role#add_permission! in app/models/role.rb calls permissions.include?(p)
(Array O(P)) inside a perms.each loop — O(P^2) total. At P=1000 permissions,
68.6x overhead measured. Fix: build a Set once before the loop, use Set#add?.
jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
Fix: HashSet for O(1) membership; pre-built index map for indexOf
Unit test: 4/4 PASS, 19-35x op-count reduction at N=200
woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
two nested loops over items and deps: O(N*D*N) = O(N^2)
Fix: pre-build name-set map for O(1) lookup, O(N) total
Unit test: 3/3 PASS, 20x op-count reduction at N=100
woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
Exposes full Bearer JWT token in application logs
Fix: log only that header was found, not its value
Unit test: 3/3 PASS
ollama-0001: kvcache/causal.go buildMask() Except []int linear scan O(B*E).
For Gemma3 multi-image prompts, slices.Contains(opts.Except, i) is called
per batch token. With N images x 256 tokens/image, B and |except| both scale
as N*256 giving quadratic prefill cost. Fix: convert Except to map[int]struct{}
before the outer loop. 3.4x speedup at N=10 images. Unit test PASS.
dosbox-staging scanned for all 5 MOADs; all CLEAN. Linear scans operate on
fixed small palettes (16 CGA colors), hardcoded 3-item lists, or single-call
config paths. Mixer mutex consistent. No credential logging.
Updated defects/ollama/CLEAN.md to note the missed defect from prior scan.
langchain-0001: MultiVectorRetriever._get_relevant_documents() dedup
IDs from vectorstore sub_docs uses list.contains() inside loop, O(k^2).
k is unbounded in production RAG pipelines (configurable via search_kwargs).
Fix: track seen IDs in a set, keep list for order. 499.5x at k=1000.
forgejo-0002: LoadRepoConfig() license sort O(P*L) where L=776 licenses.
Two SliceContainsString calls in back-to-back loops iterate full license
list for each preferred license and vice versa. Fix: build lookup sets
before loops. 19.5x at P=20 preferred licenses.
forgejo-0003: synchronizePublicKeys() three O(N*M) scans per LDAP sync.
Dedup of providedKeys is O(K^2), plus two O(P*G) set-difference loops.
Runs per user per sync cycle. Fix: use maps for O(1) membership. 178.6x
at K=G=500.
forgejo-0001 (search.go RepoIDs) already patched in prior scan.
MOADs 0002-0005 CLEAN for both targets.
MOAD-0004 CWE-312: EveHttpLogJSONHeaders() in output-json-http.c logs HTTP
credential headers (Authorization, Proxy-Authorization, Cookie, Set-Cookie)
verbatim when dump-all-headers or custom field logging is enabled. Patch adds
a credential denylist that emits "[REDACTED]" instead of the raw value.
Default suricata.yaml.in shows Authorization as a custom field example with
no warning. Unit test 5/5 PASS.
MOADs 0001/0002/0003/0005 CLEAN: bitarray+hash+radix+RB-tree hot paths,
per-tenant DetectEngineCtx, thread-scoped thread_local, HRLOCK-guarded THash.
snort3-0002: chp_add_candidate_to_tally() in http_url_patterns.cc calls std::find_if
over CHPMatchTally vector for each Aho-Corasick HTTP key-pattern match callback,
O(M*T) per packet. Fix: add unordered_map index to ChpMatchDescriptor for O(1) lookup.
48x op-count reduction at T=100/M=20. 3/3 PASS.
pgbouncer-0001: scram_client_first() logs user->passwd (SCRAM verifier or plaintext
password) at slog_debug level, CWE-312. Fix: remove the log line. 5/5 PASS.
pgbouncer MOAD-0002/0003/0005 CLEAN (single-threaded libevent loop).
snort3 MOAD-0002/0003/0004/0005 CLEAN.
MOAD-0001: citra-0001 RasterizerCache page_table surfaces vector O(P*S^2)
UnregisterSurface calls std::find(surfaces.begin(), surfaces.end(), surface_id)
for each of P pages a surface spans. With S overlapping surfaces per page,
total unregister cost is O(P*S) per surface, O(P*S^2) overall.
Fix: change std::vector<SurfaceId> to std::unordered_set<SurfaceId>
(std::hash<Common::SlotId> already defined). 3.4x measured at S=500, P=64.
Hot path: InvalidateRegion called per CPU write to GPU texture memory.
MOAD-0002: CLEAN. System singleton is intentional single-emulator architecture;
subsystems injected via System& reference, no intertangle coupling found.
MOAD-0003: CLEAN. thread_local only used for JNIEnv* JVM attachment in Android
JNI (standard pattern, not request-scoped identity).
MOAD-0004: CLEAN. No credential values logged verbatim; JWT token size only.
MOAD-0005: CLEAN. GetPublicKey static cache is room-server single-threaded;
JitEngine shader cache is GPU-thread single-threaded; all others use mutex.
Source: azahar-emu/azahar (Citra continuation), depth=1.
