engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/obs-0001/CLEAN.md
russell@unturf.com a512770591 obs-studio + synfig: 5-MOAD scan; 1 defect, 1 CLEAN 
obs-studio: CLEAN all 5 MOADs
- MOAD-0001: no std::find in render hot path; da_find() calls are UI-only
- MOAD-0002: clean subsystem separation via handle interfaces
- MOAD-0003: THREAD_LOCAL vars are thread-type markers, not request identity
- MOAD-0004: stream key never logged; RTMP playpath log guarded by level filter
- MOAD-0005: async_cache fully mutex-protected

synfig-0001: CWE-407 in remove_layers_inside_included_pastelayers()
- std::vector<Layer::Handle> + std::find inside ancestor-walk while loop
- O(L * D * P): L layers, D nesting depth, P paste-canvas count
- Fix: std::unordered_set<Layer*> reduces inner lookup from O(P) to O(1)
- 4/4 unit tests PASS, 2.4x speedup at P=2000
2026-03-31 21:35:03 -04:00

1.8 KiB
Raw Blame History

obs-studio: CLEAN across all 5 MOADs (2026-03-31)

Source: https://github.com/obsproject/obs-studio (depth=1)

MOAD-0001 (CWE-407): CLEAN

  • libobs/obs-source.c: da_find() calls on filter arrays are in UI add/remove paths only, not render loop.
  • libobs/obs-scene.c: obs_scene_find_source() linear walk is a utility function, not called in hot render path.
  • frontend/utility/MultitrackVideoOutput.cpp: std::find on speaker_layouts (always <= 8 elements).
  • frontend/widgets/OBSBasic_SceneCollections.cpp: audioSources std::find on max 6 elements.
  • plugins/obs-outputs/rtmp-stream.c: no linear membership checks in hot send/receive path.

MOAD-0002 (Intertangle): CLEAN

  • libobs provides a clean separation via obs_source_t handles, output/encoder/service interfaces.
  • No shared mutable god object coupling render, audio, and UI subsystems observed.

MOAD-0003 (Leaked Context): CLEAN

  • THREAD_LOCAL variables (is_ui_thread, is_graphics_thread, is_audio_thread, thread_graphics) carry thread-type identity, not request-scoped context. Not the leaked-context pattern.

MOAD-0004 (CWE-312): CLEAN

  • plugins/obs-outputs/rtmp-stream.c: stream->key (RTMP stream key) is never passed to blog/info/warn. stream->path (server URL without key) is logged.
  • plugins/obs-outputs/librtmp/rtmp.c: RTMP_Log(RTMP_LOGDEBUG, "... playpath: %s") calls exist but the log_rtmp callback filters all levels > RTMP_LOGWARNING, so debug log never reaches OBS log file.
  • frontend/utility/YoutubeApiWrappers.cpp: token logging guarded by #ifdef _DEBUG only.
  • frontend/oauth/OAuth.cpp: access_token and refresh_token are stored in config, never logged.

MOAD-0005 (Thundering Herd): CLEAN

  • libobs/obs-source.c: async_cache protected by async_mutex (pthread_mutex_init_recursive). All async cache reads and writes properly pair lock/unlock.