russell@unturf.com e292f57db2 natron/ardour: 2 CWE-407 defects, all 5 MOADs scanned

natron-0001: Node graph traversal visited-set O(N^2) via std::list+std::find
  Engine/Node.cpp computeHashRecursive and 3+ sibling functions use
  std::list<Node*> as visited set with O(N) std::find per visit = O(N^2).
  Fix: std::unordered_set<Node*>. 249.5x at N=500 nodes. 3/3 PASS.

ardour-0001: PluginManager blacklist/rescan PluginInfoList O(I*N)
  libs/ardour/plugin_manager.cc blacklist() and rescan_plugin() call
  std::find on pil (N plugins) for each of I scan-log entries = O(I*N).
  Fix: unordered_set + remove_if. 19.4x at N=1000 I=20. 3/3 PASS.

MOADs 0002-0005: CLEAN with notes in SCAN-MOAD-0002-0005.md each.

2026-03-31 21:05:15 -04:00

2.7 KiB

Raw Blame History

Ardour — MOAD-0002 through MOAD-0005 Scan

Repo: https://github.com/Ardour/ardour Scanned: 2026-03-31 Primary defect: ardour-0001 (MOAD-0001 CWE-407)

MOAD-0002 — Intertangle (god object / shared mutable global)

Finding: PRESENT but TOLERABLE — Session class

Session (libs/ardour/ardour/session.h, 2452 lines) is Ardour's central god object. It owns: transport state, MIDI engine, audio engine, disk I/O, plugin management, automation, synchronization (SMPTE/MTC/LTC), editing history, and all route/track data. Virtually every subsystem holds a Session& reference and calls back into Session for transport state, disk access, and event delivery.

This is characteristic of mature DAW architecture (Pro Tools, Logic, Reaper share similar patterns). The coupling is deeply embedded and fixing it would require a multi-year refactor orthogonal to our CWE-407 mission. No separate ticket filed.

MOAD-0003 — Leaked Context (thread_local holding request-scoped identity)

Finding: CLEAN for our purposes

DiskReader uses thread_local Sample* _sum_buffer, _mixdown_buffer, _gain_buffer (disk_reader.cc lines 50-52). These are audio I/O scratch buffers allocated per audio thread at thread creation (init_thread_local_buffers) and freed at thread exit. This is correct per-thread resource management for real-time audio, not a leaked request-scoped context. AudioFileSource uses thread_local SizedSampleBuffer* thread_interleave_buffer similarly. No request-identity leak found.

MOAD-0004 — Logged Secret (CWE-312)

Finding: PRESENT — hardcoded Soundcloud client_secret (CWE-798 adjacent)

libs/ardour/soundcloud_upload.cc lines 85-87 embed a hardcoded Soundcloud OAuth2 client_id ("6dd9cf0ad281aa57e07745082cec580b") and client_secret ("53f5b0113fb338800f8a7a9904fc3569") in plaintext source. These are embedded in every Ardour binary and exposed in the public repository. Soundcloud discontinued its third-party upload API in 2019, so these credentials are no longer active, and there is no verbatim logging of user passwords or tokens (the Get_Auth_Token response is not traced). Not filing a separate ticket since the API is defunct and the credentials are expired. Noted for completeness.

MOAD-0005 — Thundering Herd (CWE-362)

Finding: CLEAN

Ardour uses RCU (Read-Copy-Update) patterns extensively for concurrent data access in the audio processing path (RCUWriter<PortIndex>, _audio_input_ports.reader(), etc. in port_manager.cc, port_engine_shared.cc). Cache access in route.cc (_connection_cache) is protected by the route's lock. No unguarded get+null+compute+put pattern found in real-time paths. Session uses a dedicated process lock for the audio callback. No CWE-362 defect found.

2.7 KiB Raw Blame History