russell@unturf.com
e292f57db2
natron-0001: Node graph traversal visited-set O(N^2) via std::list+std::find Engine/Node.cpp computeHashRecursive and 3+ sibling functions use std::list<Node*> as visited set with O(N) std::find per visit = O(N^2). Fix: std::unordered_set<Node*>. 249.5x at N=500 nodes. 3/3 PASS. ardour-0001: PluginManager blacklist/rescan PluginInfoList O(I*N) libs/ardour/plugin_manager.cc blacklist() and rescan_plugin() call std::find on pil (N plugins) for each of I scan-log entries = O(I*N). Fix: unordered_set + remove_if. 19.4x at N=1000 I=20. 3/3 PASS. MOADs 0002-0005: CLEAN with notes in SCAN-MOAD-0002-0005.md each.
2.4 KiB
Natron — MOAD-0002 through MOAD-0005 Scan
Repo: https://github.com/NatronGitHub/Natron Scanned: 2026-03-31 Primary defect: natron-0001 (MOAD-0001 CWE-407)
MOAD-0002 — Intertangle (god object / shared mutable global)
Finding: PRESENT but TOLERABLE — AppManager singleton
AppManager (Engine/AppManager.h, ~700 lines) is a global singleton accessed via appPTR macro throughout all engine code. It aggregates: image cache, disk cache, texture cache, TLS registry, plugin/OFX host, color management, project list, knob factory, and GPU context.
Subsystems (Node, EffectInstance, Knob, RotoContext) directly call appPTR->removeAllImagesFromCacheWithMatchingIDAndDifferentKey(), appPTR->getAppTLS(), appPTR->clearAllCaches(), etc., creating tight coupling between the render engine and the cache/TLS infrastructure.
This is a recognized architectural pattern in VFX compositor engines (Nuke, Shake follow similar patterns). The coupling is intentional for performance (cache locality, TLS cleanup) and does not rise to the level of a distinct patch-worthy defect given that the primary damage is already captured in MOAD-0001. No separate ticket filed.
MOAD-0003 — Leaked Context (thread_local holding request-scoped identity)
Finding: CLEAN
Natron uses a custom TLSHolder<T> (Engine/TLSHolder.h) rather than raw thread_local. The holder tracks which threads own TLS data and provides explicit cleanupTLSForThread() at render thread exit (OutputSchedulerThread.cpp lines 2071, 3601). TLS stores render recursion depth, expression evaluation state, and per-thread render arguments — all genuinely thread-scoped, not request-scoped leaks. No leaked-context defect found.
MOAD-0004 — Logged Secret (CWE-312)
Finding: CLEAN
Scanned Engine/ and Gui/ for credential logging via qDebug, qWarning, qCritical. No license keys, authentication tokens, API keys, or cloud render credentials are logged verbatim. Natron does not implement cloud rendering or license key validation in this codebase. No CWE-312 defect found.
MOAD-0005 — Thundering Herd (CWE-362)
Finding: CLEAN
Examined Node::addImageToCache / removeAllImagesFromCache patterns. The image cache in AppManager uses QMutex-protected access. Cache lookups in render threads use the TLS pattern (copyTLSFromSpawnerThread) to avoid cross-thread races. No unguarded get+null+compute+put pattern found in the hot render path. No CWE-362 defect found.