UNDF: UNDF-2026-000000684

FFmpeg — MOAD-0002 through MOAD-0005 scan

Scope

Full 5-MOAD scan of FFmpeg (libavcodec/ + libavformat/ + libavfilter/) against:

MOAD-0002: Intertangle (shared mutable global god object)
MOAD-0003: Leaked Context (thread_local holding request-scoped identity)
MOAD-0004: Logged Secret (credentials logged verbatim)
MOAD-0005: Thundering Herd (cache get+null+compute+put without lock)

CWE-407 (MOAD-0001) defects are in ffmpeg-0001 through ffmpeg-0003.

MOAD-0002: Intertangle — CLEAN

FFmpeg uses per-AVCodecContext/AVFormatContext state. The global av_log callback is intentionally global (logging infrastructure) and is not subsystem coupling. The codec_list and filter_list are read-only after compile time. No god object coupling independent decode/encode subsystems through shared mutable state found. Verdict: CLEAN.

MOAD-0003: Leaked Context — CLEAN

libavcodec/ffjni.c uses pthread_key to store JNI JNIEnv* per-thread on Android. This is correct thread-local JNI attachment — not request-scoped identity leaking across subsystem boundaries. The JNI env is detached when the thread exits. No other pthread_key or __thread usage carries per-stream or per-request identity. Verdict: CLEAN.

MOAD-0004: Logged Secret — DEFECT (ffmpeg-0004)

libavformat/http.c http_connect(), line 1640:

if (authstr)
    av_bprintf(&request, "%s", authstr);  // line 1634: adds Authorization: Basic <b64>
if (proxyauthstr)
    av_bprintf(&request, "Proxy-%s", proxyauthstr);
av_bprintf(&request, "\r\n");

av_log(h, AV_LOG_DEBUG, "request: %s\n", request.str);  // line 1640: logs full request

authstr = "Authorization: Basic dXNlcjpwYXNz\r\n" (base64-encoded user:pass). AV_LOG_DEBUG is active whenever ffmpeg -loglevel debug or av_log_set_level(AV_LOG_DEBUG). This is extremely common in development, CI, and production verbose-mode deployments.

Patch: ffmpeg-0004-http-auth-debug-log-credential-leak.patch Unit test: FFmpegHttpAuthLogTest.java (22/22 PASS) Severity: MEDIUM (requires debug logging to be active).

MOAD-0005: Thundering Herd — CLEAN

FFmpeg uses ff_thread_once() / AVOnce (backed by pthread_once) for all static initialization: VLC tables, codec tables, huffman tables. pthread_once is atomically guaranteed — no racy double-init possible. No get+null+compute+put pattern without lock found in hot paths. Verdict: CLEAN.

Summary

MOAD	Finding
0001	ffmpeg-0001 (format merge O(N²)), ffmpeg-0002 (GIF palette O(256²)), ffmpeg-0003 (mpegts discard O(P²))
0002	CLEAN
0003	CLEAN
0004	ffmpeg-0004: http.c Authorization header logged at AV_LOG_DEBUG (CWE-312)
0005	CLEAN

2.7 KiB Raw Permalink Blame History