# Meson — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Meson's build target configuration. `extra_files` deduplication in `mesonbuild/build.py` uses O(n²) list membership checks per target build configuration. Patch ready for upstream review.

## The Defects

**meson-0001 (PATCHED — HIGH):** `mesonbuild/build.py`

```python
# extra_files dedup — per target build config:
for f in new_files:
    if f not in extra_files:  # O(n) list scan per file
        extra_files.append(f)
# O(n²) total dedup
```

`if f not in extra_files` performs O(n) list scan per file. For n extra files: **O(n²) total**. **Measured ratio: 150×.**

## Complexity Proof

For n=150 extra files per target:
- O(n²) = 22,500 comparisons
- Fixed: `set` before loop → O(n)
- **150× measured ratio.**

## Impact

All Meson users building targets with many extra source files — IDE integration files, documentation files, and resource files tracked as `extra_files`. Meson is a widely used build system for C, C++, and Rust projects (GNOME, GLib, systemd, Mesa use Meson). Large projects with many extra files per target hit O(n²) on every `meson setup` and reconfiguration.

## The Fix

Pre-build a `set` from `extra_files` before the dedup loop:

```python
# Before
for f in new_files:
    if f not in extra_files:  # O(n) list scan
        extra_files.append(f)

# After
# CWE-407 fix: set for O(1) dedup instead of O(n) list scan.
extra_files_set = set(extra_files)
for f in new_files:
    if f not in extra_files_set:  # O(1) set lookup
        extra_files_set.add(f)
        extra_files.append(f)
```

## Patch

`defects/meson/patch/meson-0001-build-extra-files-set.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your build target and configuration test suite.
3. Assess CVE eligibility — fires on every meson setup with large extra_files per target.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
