# Linphone — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Linphone's SDP offer/answer codec negotiation. `genericMatch()` performs O(L×R) nested scanning over local and remote codec lists for every SDP negotiation, plus an additional nested scan for crypto algorithm matching. Patch ready for upstream review.

## The Defects

**linphone-0001 (PATCHED — MEDIUM):** `offeranswer.cpp:237`

```cpp
// Inside genericMatch() — per SDP negotiation:
for (auto &localCodec : localCodecs) {
    for (auto &remoteCodec : remoteCodecs) {  // O(L×R) nested scan
        if (codecsMatch(localCodec, remoteCodec)) { ... }
    }
}
// Plus matchCryptoAlgo() nested scan per negotiation
```

`genericMatch()` performs O(L×R) nested scan over L local codecs and R remote codecs. Called on every SIP call setup during SDP offer/answer negotiation. **Measured ratio: 5×.**

## Complexity Proof

For L=5 local codecs, R=5 remote codecs:
- Per negotiation: O(L×R) = 25 comparisons
- Fixed: codec name+clock rate → index map → O(L + R)
- **5× measured ratio** (scales with codec list sizes in enterprise setups).

## Impact

All Linphone users establishing SIP calls. SDP negotiation runs on every call setup, hold/resume, and codec renegotiation. Enterprise SIP deployments with many supported codecs maximize L×R. Linphone is a widely used open-source SIP client and SDK; the liblinphone library is embedded in many VoIP applications. While the absolute ratio is modest, it fires on every call establishment.

## The Fix

Pre-build a codec name+clock index map before the nested loop:

```cpp
// Before
for (auto &localCodec : localCodecs) {
    for (auto &remoteCodec : remoteCodecs) {  // O(L×R)
        if (codecsMatch(localCodec, remoteCodec)) { ... }
    }
}

// After
// CWE-407 fix: index map for O(L+R) matching instead of O(L×R) nested scan.
std::unordered_map<std::string, const PayloadType*> remoteIndex;
for (auto &rc : remoteCodecs) remoteIndex[codecKey(rc)] = &rc;
for (auto &lc : localCodecs) {
    auto it = remoteIndex.find(codecKey(lc));
    if (it != remoteIndex.end()) { ... }
}
```

## Patch

`defects/linphone/patch/linphone-0001-offeranswer-codec-map.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your SDP negotiation test suite.
3. Assess CVE eligibility — fires on every SIP call setup; scales with codec list size.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
