russell@unturf.com 6ba49a5539 shotcut+rawtherapee: 5-MOAD scan, 1 new defect rawtherapee-0001

shotcut-0001 already existed (m_hashes std::find, UNDF-2026-000000805).
Fixed duplicate UNDF comment in patch header. Added SCAN-NOTES.md.
MOADs 0002-0005: MAIN god object noted; 0003/0004/0005 CLEAN.

rawtherapee-0001: BatchQueue::cancelItems() std::find(fd) in loop,
O(I*Q) where I=items to cancel, Q=queue size. 166-333x overhead at
Q=1000-2000. Fix: unordered_set + single remove_if pass. 2/2 PASS.
MOADs 0002-0005: App::get().options() god object noted; 0003/0004/0005 CLEAN.

2026-03-31 21:22:11 -04:00

1.4 KiB

Raw Permalink Blame History

Shotcut MOAD Scan Notes

Date: 2026-03-31 Target: https://github.com/mltframework/shotcut (depth=1) Language: C++/Qt/QML

MOAD-0001 (CWE-407): shotcut-0001 PATCHED

src/docks/playlistdock.cpp PlaylistProxyModel:

m_hashes is std::vector<std::string> (sorted)
filterAcceptsRow() calls std::find(m_hashes.begin(), m_hashes.end(), hash) — O(H) linear
Called once per playlist row when Smart Bin is active — O(N*H) total
Fix: change to std::unordered_set<std::string>, use .count() — O(1) per lookup
Patch: patch/shotcut-0001-playlist-hashes-linear-find.patch
Unit test: unit/ShotcutTest.java — 375x ratio at N=1000, PASS

MOAD-0002 (Intertangle): NOTE only

MainWindow::singleton() accessed via MAIN macro from 47 source files. Subsystems (playlist, timeline, job queue, filters, settings) all couple through this god object. Architectural issue, not patchable at MOAD scope.

MOAD-0003 (Leaked Context): CLEAN

No thread_local, QThreadStorage, or equivalent thread-scoped identity carriers found.

MOAD-0004 (CWE-312 Logged Secret): CLEAN

No cloud credential logging found. Shotcut has no YouTube/S3/OAuth upload path that logs tokens or keys through LOG_DEBUG/LOG_INFO.

MOAD-0005 (Thundering Herd): CLEAN

No unsynchronized cache get+null+compute+put patterns found. Database uses QMutex. No concurrent cache race conditions identified.

1.4 KiB Raw Permalink Blame History