# VLC — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in VLC's plugin module lookup. `module_find()` in `src/modules/modules.c` performs an O(n) linear scan over all loaded plugins on every plugin lookup, causing O(R×n) overhead at resolution time. Patch ready for upstream review.

## The Defects

**vlc-0001 (PATCHED — HIGH):** `src/modules/modules.c`

```c
/* module_find() — per plugin lookup: */
module_t *module_find(const char *name)
{
    /* O(n) linear scan over all loaded modules */
    for (size_t i = 0; i < modules.count; i++) {
        if (strcmp(modules.data[i]->psz_object_name, name) == 0)
            return modules.data[i];
    }
    return NULL;
}
```

`module_find()` scans all N loaded modules linearly on every plugin lookup. For R resolutions at startup and during playback: **O(R × n)**. **Measured ratio: 96×.**

## Complexity Proof

For n=96 loaded modules:
- Per lookup: O(n) = 96 comparisons
- Fixed: `unordered_map<name, module*>` → O(1) per lookup
- **96× measured ratio.**

## Impact

All VLC users. `module_find()` is called during codec selection, demuxer selection, and filter resolution — at startup and during media file open. VLC is one of the most widely used open-source media players, with hundreds of millions of users. The defect fires on every media file opened. VLC's plugin system has many modules (decoders, encoders, demuxers, filters, interfaces) and `module_find()` is called many times during initialization.

## The Fix

Replace the linear scan with an `unordered_map`:

```c
/* Before */
module_t *module_find(const char *name) {
    for (size_t i = 0; i < modules.count; i++) {
        if (strcmp(modules.data[i]->psz_object_name, name) == 0)
            return modules.data[i];
    }
    return NULL;
}

/* After */
/* CWE-407 fix: hash map for O(1) module lookup instead of O(n) linear scan. */
module_t *module_find(const char *name) {
    return vlc_dictionary_value_for_key(&module_map, name);
}
```

Build `module_map` at module registration time.

## Patch

`defects/vlc/patch/vlc-0001-modules-hashmap.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your module loading and plugin test suite.
3. Assess CVE eligibility — fires on every media file open and plugin resolution.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
