russell@unturf.com
16a8ba0900
digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and removeFromXmpTagStringBag call QStringList::contains() inside a loop over existing entries — O(O*N) per image during batch metadata write. Fix: build QSet<QString> before the loop for O(1) lookup. 17x speedup at K=200 keywords (unit test PASS). digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2 token exchange POST body (including client_secret_) via qDebug() at GrantFlowAuthorizationCode completion — exposes cloud service credentials in debug logs/stderr for Google Photos, Flickr, OneDrive integrations. Fix: replace full-body dump with redacted log line. lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls are on QHash/QMap/QSet, no credential logging, no leaked thread context, no unsynchronized cache access.
31 lines
1.5 KiB
Text
31 lines
1.5 KiB
Text
SCAN RESULT: CLEAN
|
|
Target: LMMS (Linux MultiMedia Studio)
|
|
URL: https://github.com/LMMS/lmms
|
|
Commit: depth=1 HEAD as of 2026-03-31
|
|
Scanner: agent blackops
|
|
|
|
MOAD-0001 (CWE-407): CLEAN
|
|
- std::find in AudioEngine::renderStageNoteSetup (m_playHandlesToRemove x m_playHandles)
|
|
is O(R*H) but R (handles being removed per frame) is typically O(1); not a loop defect.
|
|
- Song.cpp recordedModels is QSet — contains() is O(1).
|
|
- LadspaManager m_ladspaManagerMap.contains() is QMap — O(log N), not a hot loop.
|
|
- MidiWinMM outDevs.contains() is QStringList but device count is tiny (1-10). Not actionable.
|
|
- All other contains() calls are on QHash/QMap/QSet containers.
|
|
|
|
MOAD-0002 (Intertangle): CLEAN (NOTED)
|
|
- Engine class is a classic static god object (audioEngine, song, mixer, etc.)
|
|
- This is intentional LMMS architecture, not a new defect pattern to file.
|
|
|
|
MOAD-0003 (Leaked Context): CLEAN
|
|
- thread_local s_renderingThread in AudioEngine.cpp is intentional thread identification.
|
|
- No request-scoped identity stored in thread-local storage.
|
|
|
|
MOAD-0004 (CWE-312): CLEAN
|
|
- No credential logging found in src/core/ or plugins/.
|
|
- Plugin-related "key" log strings refer to musical keys or map keys, not credentials.
|
|
- CarlaBase/rest-server.cpp logs connection keys (WebSocket, not auth secrets).
|
|
|
|
MOAD-0005 (Thundering Herd): CLEAN
|
|
- AudioEngine audio rendering path is single-threaded worker model (AudioEngineWorkerThread).
|
|
- No unsynchronized cache get+null+put patterns found.
|
|
- Mixer uses per-channel m_lock correctly.
|