Claude AI code audit of GNUstep core stack — 150 f ixes, 12 perf optimizations, all available for upstream

--0000000000005ebd9e064f4f2fec
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi GNUstep Team,

As an exercise to test out the latest Claude AI capabilities, we recently
completed a comprehensive, bottom-up code audit of the GNUstep core stack =
=E2=80=94
all seven repositories =E2=80=94 covering libobjc2, libs-base, libs-corebas=
e,
libs-opal, libs-quartzcore, libs-gui, and libs-back. The full results,
documentation, and all fix commits are publicly available at:

https://github.com/DTW-Thalion/gnustep-audit

I wanted to share what we found and offer to contribute any or all of the
changes back upstream.

## What we did

We audited the entire stack bottom-up =E2=80=94 runtime through UI layer =
=E2=80=94
examining every file for robustness issues, thread safety gaps, security
vulnerabilities, correctness bugs, and performance bottlenecks. Each
finding was severity-rated, fixed in an atomic commit tagged with a finding
ID, and validated with a dedicated regression test. We also wrote 13
performance benchmarks with a baseline/compare workflow so improvements can
be measured reproducibly.

## What we found and fixed

Across all seven repos, we identified and fixed 150 findings:

- 22 Critical =E2=80=94 including NSSecureCoding bypass (class whitelist co=
mpletely
unimplemented), TLS server verification disabled by default, use-after-free
in objc_exception_rethrow, NULL dereferences, data races in CFRunLoop and
CATransaction, zero thread safety across the entire libs-back backend (189
files, 0 locks), and a swapped sendto() argument in CFSocket that prevented
any data from being sent.

- 46 High =E2=80=94 deadlocks in property spinlocks, race conditions, buffe=
r
overflows (CGContext dash buffer allocated in bytes instead of doubles),
broken APIs, JSON parser with no recursion depth limit (stack overflow
DoS), and integer overflow in binary plist bounds checking.

- 61 Medium =E2=80=94 thread safety gaps in GSLayoutManager, NSView, and
NSApplication event dispatch; missing input validation; and general
robustness issues.

- 14 Low + 10 confirmed bugs =E2=80=94 documentation issues, minor optimiza=
tions,
swapped arguments, wrong variables, and inverted conditions (e.g., TIFF
destination init was inverted, making TIFF writing 100% broken).

We also implemented 12 targeted performance optimizations, including:

- 64-way lock striping for weak references (5=E2=80=938=C3=97 concurrent th=
roughput)
- O(1) LRU linked list for NSCache (replacing an O(n) implementation that
also never evicted)
- Geometric growth for CFArray (O(n) vs O(n=C2=B2) sequential appends)
- X11 expose event coalescing, live resize throttling at 60fps, dirty
region tracking in NSView, DPSimage conversion caching, and stack buffer
allocation in CFRunLoop to eliminate per-iteration malloc

Benchmark results on MSYS2/ucrt64 show +29=E2=80=9331% for retain/release, =
+12=E2=80=9318%
for message dispatch, +46=E2=80=9355% for array operations, and +25% for NS=
Cache.

## How the work is organized

Each of the seven repos has its own fork under our GitHub org (
https://github.com/DTW-Thalion) with fix commits on master. The
gnustep-audit repo itself contains:

- Per-phase findings reports (docs/phase1 through phase6)
- A master audit summary (docs/AUDIT-SUMMARY.md)
- 51 regression tests and 13 benchmarks under instrumentation/
- A Makefile-driven test and benchmark harness with baseline/compare suppor=
t

All 32 regression tests pass on the patched stack (up from 18/32 on
unpatched).

## Offer to contribute upstream

We'd be happy to contribute any or all of these changes back into the main
GNUstep repositories =E2=80=94 whether as pull requests, individual patches=
, or in
whatever form works best for your workflow. Feel free to help yourself to
the repo.

The security-critical fixes (NSSecureCoding, TLS defaults, JSON depth
limit, binary plist overflow) and the confirmed crash bugs (use-after-free,
NULL derefs, inverted conditions) are probably the highest-priority
candidates for upstream integration.

Please feel free to reach out with any questions. We have a lot of respect
for the GNUstep project (and a bit nostalgic for heady days of
NeXTStep/OpenStep) and would like to see this work benefit the broader
community.

It's unclear if the codebase is actively maintained or if many people still
use it, but we hope that this exercise provides some value.

Best regards,

Todd

*Todd White*
Managing Director


177 Huntington Avenue, 17th Floor
Boston, MA 02115
Telephone: +1 617 237-2835 Ext. 101
EIN: 33-2228263

Website <https://www.thalion.global/> | Twitter/X <https://x.com/TTIScience=
> |
YouTube <https://www.youtube.com/@TTIScience>

[image:
https://app.candid.org/profile/16308928/the-thalion-initiative-us-inc-33-22=
28263/?pkId=3D39bf89e9-f544-478c-a3fe-e157e345181d]
<https://app.candid.org/profile/16308928/the-thalion-initiative-us-inc/?pkI=
d=3D39bf89e9-f544-478c-a3fe-e157e345181d&isActive=3Dtrue>

--0000000000005ebd9e064f4f2fec
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div class=3D"gmail_default" style=3D"font-family:ari=
al,sans-serif"><span style=3D"font-family:Arial,Helvetica,sans-serif">Hi GN=
Ustep Team,</span></div><br><span class=3D"gmail_default" style=3D"font-fam=
ily:arial,sans-serif">As an exercise to test out the latest Claude AI capab=
ilities, w</span>e recently completed a comprehensive, bottom-up code audit=
 of the GNUstep core stack =E2=80=94 <span class=3D"gmail_default" style=3D=
"font-family:arial,sans-serif">all=C2=A0</span>seven repositories =E2=80=94=
 covering libobjc2, libs-base, libs-corebase, libs-opal, libs-quartzcore, l=
ibs-gui, and libs-back. The full results, documentation, and all fix commit=
s are publicly available at:<br><br><a href=3D"https://github.com/DTW-Thali=
on/gnustep-audit">https://github.com/DTW-Thalion/gnustep-audit</a><br><br>I=
 wanted to share what we found and offer to contribute any or all of the ch=
anges back upstream.<br><br>## What we did<br><br>We audited the entire sta=
ck bottom-up =E2=80=94 runtime through UI layer =E2=80=94 examining every f=
ile for robustness issues, thread safety gaps, security vulnerabilities, co=
rrectness bugs, and performance bottlenecks. Each finding was severity-rate=
d, fixed in an atomic commit tagged with a finding ID, and validated with a=
 dedicated regression test. We also wrote 13 performance benchmarks with a =
baseline/compare workflow so improvements can be measured reproducibly.<br>=
<br>## What we found and fixed<br><br>Across all seven repos, we identified=
 and fixed 150 findings:<br><br>- 22 Critical =E2=80=94 including NSSecureC=
oding bypass (class whitelist completely unimplemented), TLS server verific=
ation disabled by default, use-after-free in objc_exception_rethrow, NULL d=
ereferences, data races in CFRunLoop and CATransaction, zero thread safety =
across the entire libs-back backend (189 files, 0 locks), and a swapped sen=
dto() argument in CFSocket that prevented any data from being sent.<br><br>=
- 46 High =E2=80=94 deadlocks in property spinlocks, race conditions, buffe=
r overflows (CGContext dash buffer allocated in bytes instead of doubles), =
broken APIs, JSON parser with no recursion depth limit (stack overflow DoS)=
, and integer overflow in binary plist bounds checking.<br><br>- 61 Medium =
=E2=80=94 thread safety gaps in GSLayoutManager, NSView, and NSApplication =
event dispatch; missing input validation; and general robustness issues.<br=
><br>- 14 Low + 10 confirmed bugs =E2=80=94 documentation issues, minor opt=
imizations, swapped arguments, wrong variables, and inverted conditions (e.=
g., TIFF destination init was inverted, making TIFF writing 100% broken).<b=
r><br>We also implemented 12 targeted performance optimizations, including:=
<br><br>- 64-way lock striping for weak references (5=E2=80=938=C3=97 concu=
rrent throughput)<br>- O(1) LRU linked list for NSCache (replacing an O(n) =
implementation that also never evicted)<br>- Geometric growth for CFArray (=
O(n) vs O(n=C2=B2) sequential appends)<br>- X11 expose event coalescing, li=
ve resize throttling at 60fps, dirty region tracking in NSView, DPSimage co=
nversion caching, and stack buffer allocation in CFRunLoop to eliminate per=
-iteration malloc<br><br>Benchmark results on MSYS2/ucrt64 show +29=E2=80=
=9331% for retain/release, +12=E2=80=9318% for message dispatch, +46=E2=80=
=9355% for array operations, and +25% for NSCache.<br><br>## How the work i=
s organized<br><br>Each of the seven repos has its own fork under our GitHu=
b org (<a href=3D"https://github.com/DTW-Thalion">https://github.com/DTW-Th=
alion</a>) with fix commits on master. The gnustep-audit repo itself contai=
ns:<br><br>- Per-phase findings reports (docs/phase1 through phase6)<br>- A=
 master audit summary (docs/AUDIT-SUMMARY.md)<br>- 51 regression tests and =
13 benchmarks under instrumentation/<br>- A Makefile-driven test and benchm=
ark harness with baseline/compare support<br><br>All 32 regression tests pa=
ss on the patched stack (up from 18/32 on unpatched).<br><br>## Offer to co=
ntribute upstream<br><br>We&#39;d be happy to contribute any or all of thes=
e changes back into the main GNUstep repositories =E2=80=94 whether as pull=
 requests, individual patches, or in whatever form works best for your work=
flow.=C2=A0<span class=3D"gmail_default" style=3D"font-family:arial,sans-se=
rif">Feel free to help yourself to the repo.</span><br><br>The security-cri=
tical fixes (NSSecureCoding, TLS defaults, JSON depth limit, binary plist o=
verflow) and the confirmed crash bugs (use-after-free, NULL derefs, inverte=
d conditions) are probably the highest-priority candidates for upstream int=
egration<span class=3D"gmail_default" style=3D"font-family:arial,sans-serif=
">.</span><br><br>Please feel free to reach out with any questions. We have=
 a lot of respect for the GNUstep project <span class=3D"gmail_default" sty=
le=3D"font-family:arial,sans-serif">(and a bit nostalgic for heady days of =
NeXTStep/OpenStep)=C2=A0</span>and would like to see this work benefit the =
broader community.</div><div><br></div><div><div class=3D"gmail_default" st=
yle=3D"font-family:arial,sans-serif">It&#39;s unclear if the codebase is ac=
tively maintained or if many people still use it, but we hope that this exe=
rcise provides some value.</div><br>Best regards,</div><div><br></div><div>=
<div class=3D"gmail_default" style=3D"font-family:arial,sans-serif">Todd</d=
iv><br clear=3D"all"></div><div><div dir=3D"ltr" class=3D"gmail_signature" =
data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><b>Todd White</b><div>M=
anaging Director</div><div><br></div><div></div><div><img src=3D"https://ci=
3.googleusercontent.com/mail-sig/AIorK4xw08RqGgDKsHOD8XqEYb6-GgGIJIf1cRrXVW=
qgRb0R08UESMvMdTT1W33NqQlLRUIicyduuegMbbIF" width=3D"96" height=3D"71"><br>=
</div><div>177 Huntington Avenue, 17th Floor</div><div>Boston, MA 02115</di=
v><div>Telephone: +1 617 237-2835 Ext. 101</div><div>EIN: 33-2228263</div><=
div><br></div><div><a href=3D"https://www.thalion.global/" target=3D"_blank=
">Website</a>=C2=A0| <a href=3D"https://x.com/TTIScience" target=3D"_blank"=
>Twitter/X</a>=C2=A0| <a href=3D"https://www.youtube.com/@TTIScience" targe=
t=3D"_blank">YouTube</a></div><div><br></div><div><a href=3D"https://app.ca=
ndid.org/profile/16308928/the-thalion-initiative-us-inc/?pkId=3D39bf89e9-f5=
44-478c-a3fe-e157e345181d&amp;isActive=3Dtrue" target=3D"_blank"><img src=
=3D"https://cdn.candid.org/seals-of-transparency/2026/candid-seal-gold-2026=
.png" width=3D"96" height=3D"96" alt=3D"https://app.candid.org/profile/1630=
8928/the-thalion-initiative-us-inc-33-2228263/?pkId=3D39bf89e9-f544-478c-a3=
fe-e157e345181d"></a><br></div></div></div></div></div>

--0000000000005ebd9e064f4f2fec--