russell@unturf.com 282282447c kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).

2026-03-31 21:13:14 -04:00

2.5 KiB

Raw Blame History

Audacity — Full 5-MOAD Scan 2026-03-31

Source: https://github.com/audacity/audacity (depth=1, HEAD ~2026-03)

MOAD-0001 (CWE-407) — 2 defects total (both pre-existing)

Pre-existing patches (audacity-0001, audacity-0002 already exist):

0001: TrackeditActionsController selectedTracks std::find in 7 track loop methods
0002: WaveTrack::CanOffsetClips() movingClips std::find in clip iteration loop

No new CWE-407 defects found in this scan pass.

Additional patterns reviewed and dismissed:

au3/libraries/au3-registries/Registry.cpp:260 — InsertNewItemUsingPreferences calls std::find on saved preference ordering, but this runs once per plugin registration at startup, not in a hot per-frame/per-event loop. Not actionable.
au3/libraries/au3-cloud-audiocom/TaskExecutionService.cpp:242 — mProcessedTasks capped at 100 items, single-threaded, not a scaling issue.
au3/libraries/au3-effects/EffectOutputTracks.cpp:86 — GetMatchingInput scans mOMap once per effect application, not in an inner loop. Not actionable.

MOAD-0002 (Intertangle) — CLEAN

No single god-object equivalent to kdenlive's pCore found. Services are injected via muse::Inject dependency injection. Subsystems communicate through interfaces, not shared mutable global state.

MOAD-0003 (Leaked Context) — CLEAN

No thread_local or QThreadStorage variables found in src/. The au3 libraries use mutex-protected state (confirmed in recentfilescontroller.cpp where m_thumbnailCacheMutex is used correctly).

MOAD-0004 (CWE-312 Logged Secret) — CLEAN

OAuth implementation reviewed:

au3cloud/internal/oauthhttpserverreplyhandler.cpp: LOGW() << "Invalid request: " << url fires when an unexpected path is received on the local callback server. The OAuth code and state params in the URL would only be logged if the path didn't match the registered callback path — which means normal OAuth flow is not logged. Low risk, error path only.
au3cloud/internal/au3cloudservice.cpp: buildOAuthRequestURL includes client_secret in the URL but this is only passed to platformInteractive()->openUrl() (the system browser), never logged.
No LOGD/LOGI calls found that output access_token or refresh_token.

MOAD-0005 (Thundering Herd) — CLEAN

src/project/internal/recentfilescontroller.cpp thumbnail cache uses m_thumbnailCacheMutex (std::mutex) correctly at every access site. No other cache get+null+compute+put patterns found without synchronization.

2.5 KiB Raw Blame History