russell@unturf.com 89de6df1d4 gimp/inkscape: 2 new CWE-407 defects + all 5 MOADs scanned

gimp-0003: xcf_save_layer_props layer_sets O(L×S×I) MEDIUM 166.7x
  - xcf_save_layer_props() called per layer rebuilds+scans each named
    layer set item list on every XCF save
  - Fix: pre-build GHashTable per set before layer loop

inkscape-0004: LayerManager::_rebuild() std::find O(L²×D) HIGH 166.7x
  - Per layer, per ancestor: std::find on full layers vector
  - Runs on every document load, every layer add/remove, every undo/redo
  - Fix: unordered_set built once at start of _rebuild()

MOADs 0002/0003/0004/0005: CLEAN for both GIMP and Inkscape.
All 3/4 unit tests PASS respectively.

2026-03-31 20:55:50 -04:00

1.1 KiB

Raw Blame History

Inkscape — MOADs 0002–0005 Scan Results

Scan date: 2026-03-31

MOAD-0002 (Intertangle): CLEAN

SPDocument is large (2,515 lines) but uses clean subsystem interfaces: undo via DocumentUndo, layers via LayerManager, selection via ObjectSet. No evidence of independent subsystems coupling through the document object in a way that breaks isolation.

MOAD-0003 (Leaked Context): CLEAN

No thread_local usage found in src/ for request-scoped XML or document context. dispatch_pool (used for Gaussian blur / morphology pixel math) is data-parallel with per-job data, not thread-local context carriers.

MOAD-0004 (CWE-312 Logged Secret): CLEAN

No network auth credentials (Authorization header, passwords, tokens) found in debug/warning/print calls. Inkscape does not handle HTTP authentication directly in the codebase scanned.

MOAD-0005 (Thundering Herd): CLEAN

dispatch_pool is pixel-math only. Object model cache management (DrawingItem::_setCached, Drawing::_cached_items) is fully single-threaded on the main UI thread. No concurrent get+null+insert pattern found.

1.1 KiB Raw Blame History Unescape Escape