russell@unturf.com 282282447c kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).

2026-03-31 21:13:14 -04:00

2.2 KiB

Raw Blame History

Kdenlive — Full 5-MOAD Scan 2026-03-31

Source: https://github.com/KDE/kdenlive (depth=1, HEAD ~2026-03)

MOAD-0001 (CWE-407) — 9 defects total (8 pre-existing, 1 new)

Pre-existing (patches kdenlive-0001 through kdenlive-0008 already exist):

0001: ThumbnailCache storedOnDisk vector linear find
0002: TimelineModel clipIds std::find in mix loop
0003: TimelineController sorted_clips std::find in moveGroup
0004: TimelineModel all_items std::find in resize
0005: PreviewManager m_renderedChunks/m_dirtyChunks QVariantList contains
0006: TimelineController canceled guides vector std::find
0007: AssetParameterModel m_rows indexOf in loops
0008: UrlListParamWidget addItemsInSameFolder std::find on map values

No new CWE-407 defects found in this scan pass.

MOAD-0002 (Intertangle) — OBSERVATION (no patch)

pCore global singleton is referenced 3704 times across the codebase. Classic god-object Intertangle: timeline, bin, effects, render, scripting, and UI all couple through pCore->.... Refactoring scope is architectural and out of band for this scan. Noted as technical debt, not patched.

MOAD-0003 (Leaked Context) — CLEAN

src/logger.cpp has two thread_local variables:

Logger::is_executing — execution guard flag, not request-scoped identity
Logger::result_awaiting — undo/redo result index, not request-scoped identity

No ThreadLocal holding request-scoped user identity or credentials found.

MOAD-0004 (CWE-312 Logged Secret) — CLEAN

No credential logging found. Grep for password/token/secret/api_key in qCDebug/qDebug/qWarning output returned no results in src/.

MOAD-0005 (Thundering Herd) — 1 new defect: kdenlive-0009

Core::buildLumaThumbs() is launched via QtConcurrent::run() (worker thread) and reads/writes MainWindow::m_lumacache (a QMap<QString, QImage>) without any mutex. UI widgets (urllistparamwidget.cpp, listparamwidget.cpp, listdependencyparamwidget.cpp, slideshowclip.cpp) also read/write the same map from the main thread. QMap is not thread-safe for concurrent access from multiple threads. This is a data race — undefined behavior, likely random crashes or corrupted thumbnails during project load.

Patch: kdenlive-0009-lumacache-qtconcurrent-race.patch

2.2 KiB Raw Blame History