russell@unturf.com 1e10775b90 jitsi-videobridge: 3 CWE-407 defects, MOADs 0002-0005 CLEAN; woodpecker: 1 CWE-407 + 1 CWE-312, MOADs 0002/0003/0005 CLEAN

jitsi-videobridge (Kotlin/Java video conferencing bridge):
- 0001: Prioritize.kt selectedSourceNames.contains()+indexOf() inside forEach over conferenceSources, O(C*S)
- 0002: BandwidthAllocator.kt selectedSources getter List.contains() dedup inside forEach, O(S^2)
- 0003: ConferenceSpeechActivity.java endpointsChanged() ArrayList.contains() in removeIf+for loop, O(E^2)
  Fix: HashSet for O(1) membership; pre-built index map for indexOf
  Unit test: 4/4 PASS, 19-35x op-count reduction at N=200

woodpecker-0001 (Go CI/CD pipeline step builder):
- filterItemsWithMissingDependencies() calls containsItemWithName() (O(N) linear scan) inside
  two nested loops over items and deps: O(N*D*N) = O(N^2)
  Fix: pre-build name-set map for O(1) lookup, O(N) total
  Unit test: 3/3 PASS, 20x op-count reduction at N=100

woodpecker-0002 (CWE-312 credential logging):
- shared/token/token.go ParseRequest() logs raw Authorization header value at Trace level:
  log.Trace().Msgf("token.ParseRequest: found token in header: %s", token)
  Exposes full Bearer JWT token in application logs
  Fix: log only that header was found, not its value
  Unit test: 3/3 PASS

2026-03-31 20:18:44 -04:00

2 KiB

Raw Blame History

FreeRTOS-Kernel — All 5 MOADs CLEAN

Target: FreeRTOS-Kernel (https://github.com/FreeRTOS/FreeRTOS-Kernel) Scan date: 2026-03-31 Commit: depth=1 HEAD

MOAD-0001 (CWE-407) — CLEAN

No O(N²) list-contains-inside-loop patterns found in hot paths.

pxReadyTasksLists uses a priority-indexed array: O(1) lookup by priority.
listGET_OWNER_OF_NEXT_ENTRY is a round-robin next pointer — O(1) per tick.
event_groups.c xEventGroupSetBits iterates waiting tasks once — O(T) not O(T²).
xTaskGetHandle does O(P×N) name scan across all priority lists — called only by name, not per-tick. No outer loop calls it again.
Timer lists use sorted insertion by expiry; prvInsertTimerInActiveList is O(N) but timers are inserted infrequently.

MOAD-0002 (Intertangle) — CLEAN

Global task lists (pxReadyTasksLists, xSuspendedTaskList, etc.) are the intentional scheduler state, not a god-object coupling independent subsystems. Each kernel primitive (queues, semaphores, mutexes, event groups, timers) owns its own list and communicates through the task state machine cleanly.

MOAD-0003 (Leaked Context) — CLEAN

pvThreadLocalStoragePointers is per-task storage sized at compile time. No pattern of request-scoped identity stored in task-local slots and then accessed by a different request was found. The C-runtime TLS block (xTLSBlock) is correctly swapped on every context switch via configSET_TLS_BLOCK.

MOAD-0004 (CWE-312) — CLEAN

No WiFi passwords, TLS keys, or credentials in kernel source. Examples directory contains only a trivial task-blink cmake_example/main.c with no credentials. Portable BSP files reference hardware register maps (password field is a hardware register name, not a user credential).

MOAD-0005 (Thundering Herd) — CLEAN

All shared state is protected by taskENTER_CRITICAL / taskEXIT_CRITICAL or scheduler suspension (vTaskSuspendAll). Queue/mutex operations are atomic. Timer command queue uses a proper send/receive pattern — no unsynchronized get+null+alloc+put cache pattern found.

2 KiB Raw Blame History Unescape Escape