russell@unturf.com 1e10775b90 jitsi-videobridge: 3 CWE-407 defects, MOADs 0002-0005 CLEAN; woodpecker: 1 CWE-407 + 1 CWE-312, MOADs 0002/0003/0005 CLEAN

jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
  Fix: HashSet for O(1) membership; pre-built index map for indexOf
  Unit test: 4/4 PASS, 19-35x op-count reduction at N=200

woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
  two nested loops over items and deps: O(N*D*N) = O(N^2)
  Fix: pre-build name-set map for O(1) lookup, O(N) total
  Unit test: 3/3 PASS, 20x op-count reduction at N=100

woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
  log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
  Exposes full Bearer JWT token in application logs
  Fix: log only that header was found, not its value
  Unit test: 3/3 PASS

2026-03-31 20:18:44 -04:00

2.4 KiB

Raw Permalink Blame History

Zephyr RTOS — MOAD scan summary

Target: zephyr (https://github.com/zephyrproject-rtos/zephyr) Scan date: 2026-03-31 Commit: depth=1 HEAD

MOAD-0001 (CWE-407) — CLEAN (kernel + net core)

No O(N²) list-contains-inside-loop in hot paths found.

Scheduler uses priority bitmask (_prio_run_bitmask) + priority-keyed wait queues — O(1) ready task selection.
net_if_ipv4_addr_lookup_raw iterates interfaces×addresses — O(I×A) called only on control-path (bind, autoconf, ARP), not per-packet.
nbr_lookup (IPv6 neighbor cache) is O(N_neighbors) — CONFIG_NET_IPV6_MAX_NEIGHBORS defaults to 8, effectively O(1) in practice; not nested inside another loop.
pkt_filter/base.c evaluate() does O(R×T) rule+test scan per packet — R and T are compile-time bounded small constants, not dynamically growing lists.
sys_slist_find in bluetooth host is used as a registration guard (once per callback register), not per-event — O(C) not O(C²).
Net management event dispatch (net_mgmt.c) is a single-pass O(C) callback scan per event — no inner list scan.

MOAD-0002 (Intertangle) — CLEAN

Net subsystem uses a clean layered architecture: L2 (wifi/ethernet) registers with net_if via a fixed vtable (net_l2_api). IPv4/IPv6 are accessed through iface->config.ip.ipv4/ipv6. No shared mutable global god object coupling independent subsystems was found.

MOAD-0003 (Leaked Context) — CLEAN

Z_THREAD_LOCAL z_errno_var is per-thread errno — correct and standard. k_thread_custom_data is a general-purpose user slot; no pattern of request-scoped identity stored in it and then leaked to a subsequent task was found. Zephyr does not have a ScopedValue-equivalent API because it targets bare-metal RTOS contexts without user-space green threads.

MOAD-0004 (CWE-312) — 2 DEFECTS (see zephyr-0001, zephyr-0002)

zephyr-0001: wifi_credentials_shell.c print_network_info() prints PSK and EAP-TLS key_passwd verbatim via shell — patched.
zephyr-0002: wifi_mgmt.c wifi_connect() dumps PSK and SAE password as hex via LOG_HEXDUMP_DBG — patched.

MOAD-0005 (Thundering Herd) — CLEAN

Memory slabs (kernel/mem_slab.c) use k_spin_lock around all alloc/free operations — no unsynchronized get+null+alloc+put. Kernel object pools are protected by ISR-safe spinlocks. No concurrent cache race pattern found.

2.4 KiB Raw Permalink Blame History Unescape Escape