kdenlive+audacity: 5-MOAD scan complete; kdenlive-0009 MOAD-0005 new defect

kdenlive: all 5 MOADs scanned.
- MOAD-0001: 8 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002: pCore god object (3704 refs) noted as Intertangle observation.
- MOAD-0003: CLEAN (thread_local is execution guard, not request identity).
- MOAD-0004: CLEAN (no credential logging).
- MOAD-0005 NEW: buildLumaThumbs() called via QtConcurrent::run() writes
  to MainWindow::m_lumacache (QMap, not thread-safe) without mutex while UI
  widgets read/write the same map from the main thread — data race on project
  load. Patch: add QMutex, wrap all m_lumacache access sites.

audacity: all 5 MOADs scanned.
- MOAD-0001: 2 pre-existing CWE-407 patches confirmed, no new sites found.
- MOAD-0002 through MOAD-0005: CLEAN.

9/9 KdenliveTest PASS (added kdenlive-0009 MOAD-0005 threading test).

defects/gstreamer/SCAN-MOAD-0002-0005.md

@@ -0,0 +1,61 @@
+# GStreamer — All-5-MOAD Scan Report
+
+**Date:** 2026-03-31
+**Source:** https://gitlab.freedesktop.org/gstreamer/gstreamer (depth=1, monorepo)
+**Subprojects scanned:** gstreamer/gst/, gst-plugins-base/gst/, gst-plugins-good/gst/,
+  gst-plugins-bad/ext/webrtc/, gst-plugins-bad/ext/hls/, gst-plugins-bad/ext/curl/
+
+---
+
+## MOAD-0001 (CWE-407) — Findings
+
+| ID | File | Pattern | Severity |
+|----|------|---------|---------|
+| gstreamer-0001 | gst/gstelementfactory.c | gst_element_factory_list_filter O(N×M×S²) cap scan | HIGH |
+| gstreamer-0002 | plugins/elements/gstinputselector.c | pushed_pads GList O(N²) event dedup | MEDIUM |
+| gstreamer-0003 | gst/gsttracerutils.c | get_active_tracers dedup O(H×T²) | MEDIUM |
+| gstreamer-0005 | ext/webrtc/gstwebrtcbin.c | seen_transceivers GList O(T²) in SDP offer creation, 34x | MEDIUM |
+
+All patched. Unit tests PASS.
+
+---
+
+## MOAD-0002 (Intertangle) — CLEAN
+
+GStreamer has natural coupling through `GstBus` (message bus) and `GstClock`
+(global pipeline clock) but these are documented pipeline-level coordination
+points, not shared mutable god objects that intertangle independent subsystems.
+
+Each element manages its own state; `GstContext` propagates context between
+elements with proper negotiation semantics. No intertangle defect identified.
+
+---
+
+## MOAD-0003 (Leaked Context) — CLEAN
+
+GStreamer uses `GPrivate` (GLib thread-local) only for debug logging internals
+(`__categories`, `__level_name`) which hold debug configuration, not
+request-scoped identity. No SSRC, session-ID, client-ID, or pipeline-ID is
+tunneled through thread-locals between request boundaries.
+
+---
+
+## MOAD-0004 (CWE-312 Logged Secret) — FINDING
+
+| ID | File | Pattern | Severity |
+|----|------|---------|---------|
+| gstreamer-0004 | gst-plugins-good/gst/rtsp/gstrtspsrc.c:2001 | proxy_passwd logged verbatim via GST_LOG_OBJECT | MEDIUM |
+
+`gst_rtspsrc_set_proxy()` logs `"set proxy user/pw from properties: user:password"`
+at GST_LEVEL_LOG (level 9). Any process with `GST_DEBUG="*:9"` exposes the
+HTTP proxy password in plaintext. Fix: log username only. Patched in gstreamer-0004.
+
+---
+
+## MOAD-0005 (Thundering Herd) — CLEAN
+
+`gst_registry_get()` uses `_gst_registry_mutex` (GMutex) with double-checked
+locking. Element factory list (`element_factory_list`) is protected by
+`GST_OBJECT_LOCK`. All `g_hash_table_lookup` / `g_hash_table_insert` pairs in
+the registry are inside locked critical sections. No unprotected
+get+null+compute+put pattern found.

defects/gstreamer/patch/gstreamer-0004-rtspsrc-proxy-password-cwe312.patch

@@ -0,0 +1,15 @@
+--- a/subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c
++++ b/subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c
+@@ -1998,8 +1998,12 @@ gst_rtspsrc_set_proxy (GstRTSPSrc * rtsp, const gchar * proxy)
+     if (rtsp->proxy_user != NULL || rtsp->proxy_passwd != NULL) {
+-      GST_LOG_OBJECT (rtsp, "set proxy user/pw from properties: %s:%s",
+-          GST_STR_NULL (rtsp->proxy_user), GST_STR_NULL (rtsp->proxy_passwd));
++      /* CWE-312 fix: never log the proxy password verbatim.
++       * The original GST_LOG_OBJECT call emitted "user:password" into the
++       * debug log at GST_LEVEL_LOG (level 9).  Any process with
++       * GST_DEBUG="*:9" set (a common developer practice) would expose the
++       * HTTP proxy password in plain text.  Log only the username. */
++      GST_LOG_OBJECT (rtsp, "set proxy user from properties: %s",
++          GST_STR_NULL (rtsp->proxy_user));
+     }
+   }

defects/gstreamer/patch/gstreamer-0005-webrtc-seen-transceivers-ghashset.patch

@@ -0,0 +1,52 @@
+--- a/subprojects/gst-plugins-bad/ext/webrtc/gstwebrtcbin.c
++++ b/subprojects/gst-plugins-bad/ext/webrtc/gstwebrtcbin.c
+@@ -3964,7 +3964,13 @@ _create_offer_task (GstWebRTCBin * webrtc, const GstStructure * options,
+-  GList *seen_transceivers = NULL;
++  /* CWE-407 fix: replace GList seen-set with GHashTable for O(1) membership.
++   *
++   * The offer-creation function loops over transceivers->len (T) entries
++   * multiple times, calling g_list_find(seen_transceivers, trans) at each
++   * step.  g_list_find is O(T), so the full function is O(T^2).
++   *
++   * For a WebRTC conference with T=50 transceivers (25 audio + 25 video),
++   * each renegotiation does ~50^2 = 2500 pointer comparisons instead of ~50.
++   * Fix: use a GHashTable with direct pointer hashing for O(1) ops.
++   */
++  GHashTable *seen_transceivers =
++      g_hash_table_new (g_direct_hash, g_direct_equal);
+
+ @@ seen_transceivers = g_list_prepend (seen_transceivers, trans)
+-      seen_transceivers = g_list_prepend (seen_transceivers, trans);
++      g_hash_table_add (seen_transceivers, trans);
+
+ @@ g_assert (!g_list_find (seen_transceivers, trans))
+-            g_assert (!g_list_find (seen_transceivers, trans));
++            g_assert (!g_hash_table_contains (seen_transceivers, trans));
+
+ @@ if (g_list_find (seen_transceivers, trans)) (line 4119)
+-    if (g_list_find (seen_transceivers, trans))
++    if (g_hash_table_contains (seen_transceivers, trans))
+
+ @@ if (!g_list_find (seen_transceivers, trans)) (line 4151)
+-      if (!g_list_find (seen_transceivers, trans))
++      if (!g_hash_table_contains (seen_transceivers, trans))
+
+ @@ seen_transceivers = g_list_prepend (seen_transceivers, trans) (line 4152)
+-        seen_transceivers = g_list_prepend (seen_transceivers, trans);
++        g_hash_table_add (seen_transceivers, trans);
+
+ @@ if (g_list_find (seen_transceivers, trans)) (line 4162)
+-        if (g_list_find (seen_transceivers, trans))
++        if (g_hash_table_contains (seen_transceivers, trans))
+
+ @@ seen_transceivers = g_list_prepend (seen_transceivers, trans) (line 4170)
+-        seen_transceivers = g_list_prepend (seen_transceivers, trans);
++        g_hash_table_add (seen_transceivers, trans);
+
+ @@ if (g_list_find (seen_transceivers, trans)) (line 4216)
+-          if (g_list_find (seen_transceivers, trans))
++          if (g_hash_table_contains (seen_transceivers, trans))
+
+ @@ g_list_free (seen_transceivers) (line 4307)
+-  g_list_free (seen_transceivers);
++  g_hash_table_unref (seen_transceivers);

defects/gstreamer/unit/Gstreamer0004RtspProxyPasswordTest.java

@@ -0,0 +1,83 @@
+package unit;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * CWE-312 unit test: gstreamer-0004 — RTSP proxy password logged verbatim
+ *
+ * Models gst_rtspsrc_set_proxy() in
+ * subprojects/gst-plugins-good/gst/rtsp/gstrtspsrc.c line 2001:
+ *
+ *   DEFECT:
+ *     GST_LOG_OBJECT (rtsp, "set proxy user/pw from properties: %s:%s",
+ *         GST_STR_NULL (rtsp->proxy_user), GST_STR_NULL (rtsp->proxy_passwd));
+ *
+ *   Any process with GST_DEBUG="*:9" set (common during development/debugging)
+ *   exposes the HTTP proxy password in plain text in the debug log.
+ *
+ *   FIX: log only the username, never the password.
+ *     GST_LOG_OBJECT (rtsp, "set proxy user from properties: %s",
+ *         GST_STR_NULL (rtsp->proxy_user));
+ *
+ * This test verifies:
+ *   1. The defective version emits the password into the log buffer.
+ *   2. The fixed version does NOT emit the password into the log buffer.
+ */
+public class Gstreamer0004RtspProxyPasswordTest {
+
+    static List<String> logBuffer = new ArrayList<>();
+
+    static void gstLogDefective(String user, String passwd) {
+        // Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user/pw from properties: %s:%s", user, passwd)
+        logBuffer.add(String.format("set proxy user/pw from properties: %s:%s", user, passwd));
+    }
+
+    static void gstLogFixed(String user) {
+        // Mirrors: GST_LOG_OBJECT(rtsp, "set proxy user from properties: %s", user)
+        logBuffer.add(String.format("set proxy user from properties: %s", user));
+    }
+
+    static boolean logContainsPassword(String password) {
+        for (String entry : logBuffer) {
+            if (entry.contains(password)) return true;
+        }
+        return false;
+    }
+
+    public static void main(String[] args) {
+        final String USER = "proxyuser";
+        final String PASSWORD = "s3cr3tP@ssw0rd";
+
+        System.out.println("gstreamer-0004 CWE-312 RTSP proxy password logging test");
+
+        // Test 1: defective version — password appears in log
+        logBuffer.clear();
+        gstLogDefective(USER, PASSWORD);
+        boolean defectExposesPassword = logContainsPassword(PASSWORD);
+
+        System.out.println("  [defect] log entry: " + logBuffer.get(0));
+        System.out.println("  [defect] password in log: " + defectExposesPassword);
+
+        assert defectExposesPassword :
+            "Defective logger should expose password in log — test setup error";
+
+        // Test 2: fixed version — password does NOT appear in log
+        logBuffer.clear();
+        gstLogFixed(USER);
+        boolean fixExposesPassword = logContainsPassword(PASSWORD);
+
+        System.out.println("  [fix]    log entry: " + logBuffer.get(0));
+        System.out.println("  [fix]    password in log: " + fixExposesPassword);
+
+        assert !fixExposesPassword :
+            "Fixed logger must not expose password in log";
+
+        // Test 3: fixed version still logs the username
+        boolean fixLogsUser = logBuffer.get(0).contains(USER);
+        assert fixLogsUser : "Fixed logger should still log the username";
+
+        System.out.println("  username still logged: " + fixLogsUser);
+        System.out.println("PASS");
+    }
+}

defects/gstreamer/unit/Gstreamer0005WebrtcSeenTransceiversTest.java

@@ -0,0 +1,144 @@
+package unit;
+
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * CWE-407 unit test: gstreamer-0005 — WebRTC seen_transceivers O(T²) → O(T)
+ *
+ * Models _create_offer_task() in
+ * subprojects/gst-plugins-bad/ext/webrtc/gstwebrtcbin.c
+ *
+ * The function tracks which transceivers have already been assigned to
+ * an SDP m-line via a GList *seen_transceivers.  Multiple loops iterate
+ * over all T transceivers and call g_list_find(seen_transceivers, trans)
+ * (O(T) per call).  The full function is O(T^2).
+ *
+ * Fix: replace GList with GHashTable (g_direct_hash / g_direct_equal)
+ * for O(1) contains/add operations, reducing the full function to O(T).
+ *
+ * Parameters: T = number of transceivers (audio+video streams).
+ *   For a 25-participant WebRTC conference: T = 50 (25a + 25v).
+ * Expected ratio: >20x op-count reduction at T=100.
+ */
+public class Gstreamer0005WebrtcSeenTransceiversTest {
+
+    static long slowOps = 0;
+    static long fastOps = 0;
+
+    /**
+     * Slow: GList-style seen-set — O(T) membership check.
+     * Simulates g_list_find(seen_transceivers, trans).
+     */
+    static boolean listContains(List<Integer> seen, int trans) {
+        for (int s : seen) {
+            slowOps++;
+            if (s == trans) return true;
+        }
+        return false;
+    }
+
+    /**
+     * Slow simulation of _create_offer_task seen_transceivers loops.
+     *
+     * Three passes over T transceivers each calling g_list_find:
+     *   Pass 1: renegotiation loop (inner j-loop over T, find on grown list)
+     *   Pass 2: gather existing mids loop (T iterations, find check)
+     *   Pass 3: add extra streams loop (T iterations, find check)
+     *
+     * Total: O(T) inserts + O(T^2) finds = O(T^2)
+     */
+    static void createOfferSlow(int T) {
+        List<Integer> seen = new ArrayList<>();
+
+        // Pass 1: renegotiation — inner loop T finds on partially-filled list
+        for (int i = 0; i < T; i++) {
+            for (int j = 0; j < T; j++) {
+                if (listContains(seen, j)) continue;
+                // only add first match per outer i
+                seen.add(j);
+                break;
+            }
+        }
+
+        seen.clear();
+
+        // Pass 2: gather mids — T iterations, each O(T) find
+        for (int i = 0; i < T; i++) {
+            if (listContains(seen, i)) continue;
+        }
+
+        // Pass 3: add extra streams — T iterations, each O(T) find
+        for (int i = 0; i < T; i++) {
+            if (!listContains(seen, i)) {
+                seen.add(i);
+            }
+        }
+    }
+
+    /**
+     * Fast simulation using HashSet — O(1) contains/add.
+     * Simulates g_hash_table_contains + g_hash_table_add.
+     */
+    static void createOfferFast(int T) {
+        Set<Integer> seen = new HashSet<>();
+
+        // Pass 1: renegotiation
+        for (int i = 0; i < T; i++) {
+            for (int j = 0; j < T; j++) {
+                fastOps++;
+                if (seen.contains(j)) continue;
+                seen.add(j);
+                break;
+            }
+        }
+
+        seen.clear();
+
+        // Pass 2: gather mids
+        for (int i = 0; i < T; i++) {
+            fastOps++;
+            if (seen.contains(i)) continue;
+        }
+
+        // Pass 3: add extra streams
+        for (int i = 0; i < T; i++) {
+            fastOps++;
+            if (!seen.contains(i)) {
+                seen.add(i);
+            }
+        }
+    }
+
+    public static void main(String[] args) {
+        final int T = 100; // 50 audio + 50 video transceivers
+
+        // Warm up
+        createOfferSlow(10);
+        createOfferFast(10);
+        slowOps = 0;
+        fastOps = 0;
+
+        // Measure
+        createOfferSlow(T);
+        long measuredSlowOps = slowOps;
+
+        createOfferFast(T);
+        long measuredFastOps = fastOps;
+
+        double ratio = (double) measuredSlowOps / measuredFastOps;
+
+        System.out.printf("gstreamer-0005 WebRTC seen_transceivers O(T^2) vs O(T)%n");
+        System.out.printf("  T=%d transceivers%n", T);
+        System.out.printf("  slow ops (GList find): %d%n", measuredSlowOps);
+        System.out.printf("  fast ops (GHashTable): %d%n", measuredFastOps);
+        System.out.printf("  ratio:                 %.1fx%n", ratio);
+
+        assert ratio > 10.0 :
+            "Expected >10x ratio at T=" + T + ", got " + ratio;
+
+        System.out.println("PASS");
+    }
+}