engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave17 complete: systemd/emacs/vim/qemu/tcl/kafka-0007/spark-0004 + 559/240

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 20:15:47 -04:00
parent 4221966e66
commit cce7ec653a
32 changed files with 3007 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

37
defects/ffmpeg/patch/ffmpeg-deeper-scan-CLEAN.md Normal file
View file

@ -0,0 +1,37 @@
# FFmpeg deeper scan — CWE-407 CLEAN (libavcodec/libavfilter/libavformat)
## Files scanned
| File | Finding |
|---|---|
| `libavcodec/allcodecs.c` | `find_codec_by_name`: single O(N) scan, not nested — CLEAN |
| `libavcodec/allcodecs.c` | `find_codec` by ID: single O(N) scan — CLEAN |
| `libavfilter/allfilters.c` | `avfilter_get_by_name`: single O(F) scan over 593 filters — CLEAN |
| `libavfilter/graphparser.c` | `avfilter_get_by_name` called inside `for chains × for filters` loop |
| `libavformat/format.c` | `av_demuxer_iterate` / `av_muxer_iterate`: single O(N) pass — CLEAN |
## Near-miss: graphparser.c
`libavfilter/graphparser.c` lines 533–535:
```c
for (size_t j = 0; j < ch->nb_filters; j++) {
AVFilterParams *p = ch->filters[j];
const AVFilter *f = avfilter_get_by_name(p->filter_name); // O(593)
…
}
```
`avfilter_get_by_name` is O(F) where F ≈ 593 registered filters (compile-time constant).
For a filtergraph with N filter instances: total work is O(N × 593) = O(N).
This is **not CWE-407**: F is a fixed compile-time constant, not a runtime-growing
collection. The complexity scales linearly with N (filter instances), not quadratically.
If FFmpeg ever moves to dynamic filter registration where F grows at runtime alongside N,
this would become O(N²) and would need a hash table. Currently CLEAN.
## Conclusion
No new CWE-407 defects found in this deeper FFmpeg scan.
`ffmpeg-0001` (codec tag linear scans in `libavformat/utils.c`) remains the only confirmed
defect.