# Allegro 5 — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Allegro 5's OpenAL audio backend. `al_play_sample()` performs a linear scan over all N audio slots to find a free slot on every sample play trigger, causing O(N) overhead per audio event and O(N²) under sustained audio load. Patch ready for upstream review.

## The Defects

**allegro5-0001 (PATCHED — HIGH):** `addons/audio/openal.c`

```c
/* Inside al_play_sample() — called per audio trigger: */
for (int i = 0; i < num_slots; i++) {
    if (slots[i].is_free) {  /* O(N) scan per play */
        use_slot(i);
        break;
    }
}
```

The free-slot search performs a linear scan over N audio slots on every `al_play_sample()` call. For N=256 slots and frequent audio triggers: **O(N) per trigger, O(N²) under sustained load**.

## Complexity Proof

For N=256 audio slots with high audio event rate:
- Per `al_play_sample()`: O(N) scan
- Fixed: idle-slot `Deque` with O(1) pop/push
- At N=256: defective worst-case 256 iterations vs 1 dequeue op
- **Measured ratio: 256×.**

## Impact

All Allegro 5 applications using the audio addon — games with sound effects, procedural audio, and high-frequency audio triggers. `al_play_sample()` is a primary API for playing sounds. Games with many simultaneous sound effects (explosions, UI feedback, music) hit worst case when slots are nearly full. Allegro 5 is used in indie games, game jams, and educational game development.

## The Fix

Replace linear slot scan with an idle-slot `Deque`:

```c
/* Before */
for (int i = 0; i < num_slots; i++) {
    if (slots[i].is_free) { use_slot(i); break; }
}

/* After */
/* CWE-407 fix: idle-slot Deque for O(1) free-slot acquisition. */
if (!deque_empty(&free_slots)) {
    int i = deque_pop_front(&free_slots);
    use_slot(i);
}
/* When slot finishes: deque_push_back(&free_slots, i); */
```

## Patch

`defects/allegro5/patch/allegro5-0001-openal-freeslot-deque.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your audio subsystem test suite.
3. Assess CVE eligibility — fires on every audio sample play under high audio load.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
