russell@unturf.com 282282447c kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).

2026-03-31 21:13:14 -04:00

2.2 KiB

Raw Blame History

OpenCV — All-5-MOAD Scan Report

Date: 2026-03-31 Source: https://github.com/opencv/opencv (depth=1) Modules scanned: modules/core/, modules/dnn/, modules/features2d/, modules/gapi/, modules/objdetect/, modules/videoio/, modules/stitching/

MOAD-0001 (CWE-407) — Findings

ID	File	Pattern	Severity
opencv-0001	modules/objdetect/src/qrcode.cpp	QRDecode::divideIntoEvenSegments O(S²) spline std::find	HIGH
opencv-0001	modules/dnn/src/op_timvx.cpp	tvUpdateConfictMap O(C²×G) std::find in DFS	HIGH
opencv-0002	modules/gapi/src/compiler/passes/pattern_matching.cpp	patternEndOpNodes/StartOpNodes O(M×E+M×S)	MEDIUM
opencv-0003	modules/dnn/src/onnx/onnx_importer.cpp	ifInt8Output() static vector+std::find O(N×I×L), 32x	MEDIUM

All patched. Unit tests PASS.

MOAD-0002 (Intertangle) — CLEAN

GKernelPackage (G-API kernel registry) uses std::map<string, ...> with proper O(1) insertions. No god object coupling independent subsystems through shared mutable global state identified. Each backend maintains its own state; the GCompiler takes a snapshot of the kernel package at compile time.

cv::theRNG() is thread-local (TLS-backed), not a shared global.

MOAD-0003 (Leaked Context) — CLEAN for request-scoped identity

OpenCV uses TLSData<CoreTLSData> (thread-local storage) for per-thread state (RNG, error state, OpenCL contexts). This is appropriate thread-scoped use — no request-scoped identity is tunneled through thread-locals. The gapi D3D11 backend uses static thread_local for device/context which is also thread-scoped.

No request-id, trace-id, or user-session data is carried via thread-locals.

MOAD-0004 (CWE-312 Logged Secret) — CLEAN

No auth credentials, API keys, or passwords found in logging output in the scanned modules. modules/videoio/ does not log RTSP/HTTP auth headers. The G-API VPL/OneVPL backend does not log device credentials.

MOAD-0005 (Thundering Herd) — CLEAN

ocl.cpp OpenCL program cache (phash + cacheList) is guarded by program_cache_mutex (AutoLock). Registry lookups (ocl device/context) use proper locking. No get+null+compute+put without synchronization found.

2.2 KiB Raw Blame History Unescape Escape