CubicSDR Project Evaluation

Project: CubicSDR v0.2.8 License: GPL-2.0+ Language: C++ (C++11/14)

Architecture

Well-organized modules: SDR I/O, demodulation, audio, visualization, and modem plugins
Threading model: Producer-consumer pattern with blocking queues for SDR -> demod -> audio pipeline
Build: Single monolithic CMakeLists.txt supporting Windows/macOS/Linux
Vendored deps: lodepng, tinyxml, rtaudio, cubicvr2, hamlib, liquid-dsp in external/

Issue	Severity
Zero test coverage — no test framework, no test files, CI only builds	Critical
Monolithic files — `AppFrame.cpp` is ~3,200 lines	High
Memory safety — raw `new`/`delete` for threads, `reinterpret_cast` type punning in DataTree, suppressed MSVC C4996 warnings	High
Outdated CMake — targets 2.8.12, uses `-std=c++0x` draft flag, deprecated patterns	Medium
Incomplete .gitignore — missing IDE, OS, and build artifact patterns	Medium
Minimal docs — no CONTRIBUTING, CHANGELOG, API docs, or Doxygen	Medium
Open TODOs in project code, including acknowledged bugs	Low-Medium
No input validation on XML config files	Medium

Add unit tests — Start with DataTree, Timer, ThreadBlockingQueue, frequency conversion utilities
Fix .gitignore — Add .vs/, *.obj, CMakeCache.txt, .DS_Store, IDE files
Modernize CMake — Bump to 3.10+, use target_compile_features(cxx_std_14), replace deprecated variables
Replace raw new/delete with std::unique_ptr/std::shared_ptr for thread objects in CubicSDR.cpp
Split AppFrame.cpp — Extract menu handling, keyboard shortcuts, device management into separate files
Remove MSVC C4996 suppression — Address the underlying unsafe CRT calls (sprintf -> snprintf, etc.)
Replace reinterpret_cast type punning in DataTree.h with memcpy-based serialization (avoids UB)
Use git submodules or a package manager for vendored external dependencies
Add CI test execution after builds
Resolve or convert to tracked issues the open TODOs

DataTree.h contains multiple reinterpret_cast operations for type punning — potential aliasing violations and undefined behavior. Use memcpy or std::bit_cast instead.
CubicSDR.cpp allocates thread objects (std::thread*) with raw new and manual delete. Any exception between allocation and deletion causes a leak. Should use std::unique_ptr<std::thread>.
IOThread.cpp catch(...) re-throws after setting termination flags — correct for cleanup, but callers rarely handle the propagated exception
MSVC C4996 warning is globally suppressed, hiding potential buffer overflow risks from unsafe CRT functions.

cmake_minimum_required(VERSION 2.8.12) — should be 3.10+
Uses ADD_DEFINITIONS(-std=c++0x) instead of target_compile_features() — c++0x is the C++11 draft, not the finalized standard
Uses deprecated CMAKE_CREATE_WIN32_EXE variable
Uses global include_directories() instead of target_include_directories()
Hardcoded library paths: link_directories(/usr/local/lib), ALSA paths at /usr/include and /usr/lib
Header/source file lists in CMakeLists.txt have some mismatches (.cpp files listed as headers, .h files listed as sources)

README.md is minimal with no inline build instructions
No CONTRIBUTING.md, CHANGELOG.md, CODE_OF_CONDUCT.md, or architecture docs
No Doxygen or API documentation
Build instructions exist only on external wiki; user manual in separate repository

CI exists (.circleci/) but only builds — no test execution, no .github/workflows/ or .travis.yml
Recent commits are macOS-focused (bundling, code signing)
Single branch (master), tags from 0.1.0 to 0.2.7

Currently only covers build/, cmake_build/, dist/. Missing entries for:

IDE files (.vs/, *.suo, .idea/, *.xcworkspace, *.xcodeproj)
OS files (.DS_Store, Thumbs.db, desktop.ini)
Compiled artifacts (*.o, *.obj, *.dll, *.so, *.dylib, *.exe, *.lib, *.a)
CMake generated files (CMakeCache.txt, CMakeFiles/, cmake_install.cmake, Makefile)
Package files (*.deb, *.rpm, *.dmg)