69 lines
2.7 KiB
Markdown
69 lines
2.7 KiB
Markdown
# UNDF: UNDF-2026-000000684
|
|
# FFmpeg — MOAD-0002 through MOAD-0005 scan
|
|
|
|
## Scope
|
|
|
|
Full 5-MOAD scan of FFmpeg (libavcodec/ + libavformat/ + libavfilter/) against:
|
|
- MOAD-0002: Intertangle (shared mutable global god object)
|
|
- MOAD-0003: Leaked Context (thread_local holding request-scoped identity)
|
|
- MOAD-0004: Logged Secret (credentials logged verbatim)
|
|
- MOAD-0005: Thundering Herd (cache get+null+compute+put without lock)
|
|
|
|
CWE-407 (MOAD-0001) defects are in ffmpeg-0001 through ffmpeg-0003.
|
|
|
|
## MOAD-0002: Intertangle — CLEAN
|
|
|
|
FFmpeg uses per-AVCodecContext/AVFormatContext state. The global av_log callback
|
|
is intentionally global (logging infrastructure) and is not subsystem coupling.
|
|
The codec_list and filter_list are read-only after compile time.
|
|
No god object coupling independent decode/encode subsystems through shared
|
|
mutable state found.
|
|
Verdict: CLEAN.
|
|
|
|
## MOAD-0003: Leaked Context — CLEAN
|
|
|
|
libavcodec/ffjni.c uses pthread_key to store JNI JNIEnv* per-thread on Android.
|
|
This is correct thread-local JNI attachment — not request-scoped identity leaking
|
|
across subsystem boundaries. The JNI env is detached when the thread exits.
|
|
No other pthread_key or __thread usage carries per-stream or per-request identity.
|
|
Verdict: CLEAN.
|
|
|
|
## MOAD-0004: Logged Secret — DEFECT (ffmpeg-0004)
|
|
|
|
libavformat/http.c http_connect(), line 1640:
|
|
|
|
```c
|
|
if (authstr)
|
|
av_bprintf(&request, "%s", authstr); // line 1634: adds Authorization: Basic <b64>
|
|
if (proxyauthstr)
|
|
av_bprintf(&request, "Proxy-%s", proxyauthstr);
|
|
av_bprintf(&request, "\r\n");
|
|
|
|
av_log(h, AV_LOG_DEBUG, "request: %s\n", request.str); // line 1640: logs full request
|
|
```
|
|
|
|
authstr = "Authorization: Basic dXNlcjpwYXNz\r\n" (base64-encoded user:pass).
|
|
AV_LOG_DEBUG is active whenever ffmpeg -loglevel debug or av_log_set_level(AV_LOG_DEBUG).
|
|
This is extremely common in development, CI, and production verbose-mode deployments.
|
|
|
|
Patch: ffmpeg-0004-http-auth-debug-log-credential-leak.patch
|
|
Unit test: FFmpegHttpAuthLogTest.java (22/22 PASS)
|
|
Severity: MEDIUM (requires debug logging to be active).
|
|
|
|
## MOAD-0005: Thundering Herd — CLEAN
|
|
|
|
FFmpeg uses ff_thread_once() / AVOnce (backed by pthread_once) for all
|
|
static initialization: VLC tables, codec tables, huffman tables.
|
|
pthread_once is atomically guaranteed — no racy double-init possible.
|
|
No get+null+compute+put pattern without lock found in hot paths.
|
|
Verdict: CLEAN.
|
|
|
|
## Summary
|
|
|
|
| MOAD | Finding |
|
|
|------|---------|
|
|
| 0001 | ffmpeg-0001 (format merge O(N²)), ffmpeg-0002 (GIF palette O(256²)), ffmpeg-0003 (mpegts discard O(P²)) |
|
|
| 0002 | CLEAN |
|
|
| 0003 | CLEAN |
|
|
| 0004 | ffmpeg-0004: http.c Authorization header logged at AV_LOG_DEBUG (CWE-312) |
|
|
| 0005 | CLEAN |
|