UNDF: UNDF-2026-000001112

Kdenlive — Full 5-MOAD Scan 2026-03-31 (updated 2026-04-03)

Source: https://github.com/KDE/kdenlive (depth=1, HEAD ~2026-03/04)

MOAD-0001 (CWE-407) — 10 defects total (8 pre-existing, 2 new)

Pre-existing (patches kdenlive-0001 through kdenlive-0008 already exist):

0001: ThumbnailCache storedOnDisk vector linear find
0002: TimelineModel clipIds std::find in mix loop
0003: TimelineController sorted_clips std::find in moveGroup
0004: TimelineModel all_items std::find in resize
0005: PreviewManager m_renderedChunks/m_dirtyChunks QVariantList contains
0006: TimelineController canceled guides vector std::find
0007: AssetParameterModel m_rows indexOf in loops
0008: UrlListParamWidget addItemsInSameFolder std::find on map values

New (2026-04-03 rescan):

0009: (MOAD-0005, see below) lumacache QtConcurrent data race
0010: KeyframeModelList::checkConsistency() QList::contains() O(P*K^2)
- Phase 1: builds union of keyframe positions using O(K) QList::contains per element
- Phase 2: checks per-param list using O(K) QList::contains per fullList item
- Fix: std::set (uses operator<) for O(log K) insert/lookup in both phases
- Patch: kdenlive-0010-keyframemodellist-checkconsistency-qlists-contains.patch
- Benchmark: 50x at K=100, 250x at K=500, 500x at K=1000 (P=3 params)

MOAD-0002 (Intertangle) — OBSERVATION (no patch)

pCore global singleton is referenced 3704 times across the codebase. Classic god-object Intertangle: timeline, bin, effects, render, scripting, and UI all couple through pCore->.... Refactoring scope is architectural and out of band for this scan. Noted as technical debt, not patched.

MOAD-0003 (Leaked Context) — CLEAN

src/logger.cpp has two thread_local variables:

Logger::is_executing — execution guard flag, not request-scoped identity
Logger::result_awaiting — undo/redo result index, not request-scoped identity

No ThreadLocal holding request-scoped user identity or credentials found.

MOAD-0004 (CWE-312 Logged Secret) — CLEAN

No credential logging found. Grep for password/token/secret/api_key in qCDebug/qDebug/qWarning output returned no results in src/.

MOAD-0005 (Thundering Herd) — 1 new defect: kdenlive-0009

Core::buildLumaThumbs() is launched via QtConcurrent::run() (worker thread) and reads/writes MainWindow::m_lumacache (a QMap<QString, QImage>) without any mutex. UI widgets (urllistparamwidget.cpp, listparamwidget.cpp, listdependencyparamwidget.cpp, slideshowclip.cpp) also read/write the same map from the main thread. QMap is not thread-safe for concurrent access from multiple threads. This is a data race — undefined behavior, likely random crashes or corrupted thumbnails during project load.

Patch: kdenlive-0009-lumacache-qtconcurrent-race.patch

2.8 KiB Raw Blame History