russell@unturf.com 282282447c kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).

2026-03-31 21:13:14 -04:00

2.4 KiB

Raw Permalink Blame History

GStreamer — All-5-MOAD Scan Report

Date: 2026-03-31 Source: https://gitlab.freedesktop.org/gstreamer/gstreamer (depth=1, monorepo) Subprojects scanned: gstreamer/gst/, gst-plugins-base/gst/, gst-plugins-good/gst/, gst-plugins-bad/ext/webrtc/, gst-plugins-bad/ext/hls/, gst-plugins-bad/ext/curl/

MOAD-0001 (CWE-407) — Findings

ID	File	Pattern	Severity
gstreamer-0001	gst/gstelementfactory.c	gst_element_factory_list_filter O(N×M×S²) cap scan	HIGH
gstreamer-0002	plugins/elements/gstinputselector.c	pushed_pads GList O(N²) event dedup	MEDIUM
gstreamer-0003	gst/gsttracerutils.c	get_active_tracers dedup O(H×T²)	MEDIUM
gstreamer-0005	ext/webrtc/gstwebrtcbin.c	seen_transceivers GList O(T²) in SDP offer creation, 34x	MEDIUM

All patched. Unit tests PASS.

MOAD-0002 (Intertangle) — CLEAN

GStreamer has natural coupling through GstBus (message bus) and GstClock (global pipeline clock) but these are documented pipeline-level coordination points, not shared mutable god objects that intertangle independent subsystems.

Each element manages its own state; GstContext propagates context between elements with proper negotiation semantics. No intertangle defect identified.

MOAD-0003 (Leaked Context) — CLEAN

GStreamer uses GPrivate (GLib thread-local) only for debug logging internals (__categories, __level_name) which hold debug configuration, not request-scoped identity. No SSRC, session-ID, client-ID, or pipeline-ID is tunneled through thread-locals between request boundaries.

MOAD-0004 (CWE-312 Logged Secret) — FINDING

ID	File	Pattern	Severity
gstreamer-0004	gst-plugins-good/gst/rtsp/gstrtspsrc.c:2001	proxy_passwd logged verbatim via GST_LOG_OBJECT	MEDIUM

gst_rtspsrc_set_proxy() logs "set proxy user/pw from properties: user:password" at GST_LEVEL_LOG (level 9). Any process with GST_DEBUG="*:9" exposes the HTTP proxy password in plaintext. Fix: log username only. Patched in gstreamer-0004.

MOAD-0005 (Thundering Herd) — CLEAN

gst_registry_get() uses _gst_registry_mutex (GMutex) with double-checked locking. Element factory list (element_factory_list) is protected by GST_OBJECT_LOCK. All g_hash_table_lookup / g_hash_table_insert pairs in the registry are inside locked critical sections. No unprotected get+null+compute+put pattern found.

2.4 KiB Raw Permalink Blame History Unescape Escape