# UNDF: UNDF-2026-000000684
# FFmpeg — MOAD-0002 through MOAD-0005 scan

## Scope

Full 5-MOAD scan of FFmpeg (libavcodec/ + libavformat/ + libavfilter/) against:
- MOAD-0002: Intertangle (shared mutable global god object)
- MOAD-0003: Leaked Context (thread_local holding request-scoped identity)
- MOAD-0004: Logged Secret (credentials logged verbatim)
- MOAD-0005: Thundering Herd (cache get+null+compute+put without lock)

CWE-407 (MOAD-0001) defects are in ffmpeg-0001 through ffmpeg-0003.

## MOAD-0002: Intertangle — CLEAN

FFmpeg uses per-AVCodecContext/AVFormatContext state. The global av_log callback
is intentionally global (logging infrastructure) and is not subsystem coupling.
The codec_list and filter_list are read-only after compile time.
No god object coupling independent decode/encode subsystems through shared
mutable state found.
Verdict: CLEAN.

## MOAD-0003: Leaked Context — CLEAN

libavcodec/ffjni.c uses pthread_key to store JNI JNIEnv* per-thread on Android.
This is correct thread-local JNI attachment — not request-scoped identity leaking
across subsystem boundaries. The JNI env is detached when the thread exits.
No other pthread_key or __thread usage carries per-stream or per-request identity.
Verdict: CLEAN.

## MOAD-0004: Logged Secret — DEFECT (ffmpeg-0004)

libavformat/http.c http_connect(), line 1640:

```c
if (authstr)
    av_bprintf(&request, "%s", authstr);  // line 1634: adds Authorization: Basic <b64>
if (proxyauthstr)
    av_bprintf(&request, "Proxy-%s", proxyauthstr);
av_bprintf(&request, "\r\n");

av_log(h, AV_LOG_DEBUG, "request: %s\n", request.str);  // line 1640: logs full request
```

authstr = "Authorization: Basic dXNlcjpwYXNz\r\n" (base64-encoded user:pass).
AV_LOG_DEBUG is active whenever ffmpeg -loglevel debug or av_log_set_level(AV_LOG_DEBUG).
This is extremely common in development, CI, and production verbose-mode deployments.

Patch: ffmpeg-0004-http-auth-debug-log-credential-leak.patch
Unit test: FFmpegHttpAuthLogTest.java (22/22 PASS)
Severity: MEDIUM (requires debug logging to be active).

## MOAD-0005: Thundering Herd — CLEAN

FFmpeg uses ff_thread_once() / AVOnce (backed by pthread_once) for all
static initialization: VLC tables, codec tables, huffman tables.
pthread_once is atomically guaranteed — no racy double-init possible.
No get+null+compute+put pattern without lock found in hot paths.
Verdict: CLEAN.

## Summary

| MOAD | Finding |
|------|---------|
| 0001 | ffmpeg-0001 (format merge O(N²)), ffmpeg-0002 (GIF palette O(256²)), ffmpeg-0003 (mpegts discard O(P²)) |
| 0002 | CLEAN |
| 0003 | CLEAN |
| 0004 | ffmpeg-0004: http.c Authorization header logged at AV_LOG_DEBUG (CWE-312) |
| 0005 | CLEAN |