ffmpeg-0004 (MOAD-0004 / CWE-312): libavformat/http.c http_connect() logs the full
HTTP request at AV_LOG_DEBUG, including the Authorization: Basic header with
base64-encoded user:pass. Fix: produce a sanitized copy before av_log, replacing
auth header values with ***REDACTED***. Wire bytes unchanged. 22/22 unit tests PASS.
FFmpeg MOADs 0002/0003/0005: CLEAN. ImageMagick MOADs 0002-0005: CLEAN.
curl-0001 (UNDF-2026-000000040): lib/http_aws_sigv4.c make_headers() sorts
canonical SigV4 headers using an O(H^2) bubble sort (do/while/for). Every
SigV4 HTTP request pays H^2 comparisons. At H=200: 35,024 vs 794 (44x).
Fix: qsort on a temporary pointer array, O(H log H).
ffmpeg-0001 (UNDF-2026-000000070): libavfilter/formats.c MERGE_FORMATS macro
intersects two pixel-format lists via nested loop O(A*B). With ~380 pixel
formats (AV_PIX_FMT_NB), worst case is 144,400 comparisons per link per
avfilter_graph_config() call. At A=B=380: 72,390 vs 3,420 (21x).
Fix: sort b, bsearch for membership, O((A+B) log B).
Unit tests: CurlTest.java, FFmpegTest.java — both PASS.
nmap-0002: nmap.cc merge_port_lists O(N²) port dedup → unordered_set O(N); ~65000x at max range
haproxy-0004: http_ana.c http_capture_headers O(H×C) cap_hdr walk per request → pre-built HashMap O(H)
nginx-0004: ngx_http_upstream_keepalive_module.c keepalive_get_peer O(C) sockaddr scan per upstream request → HashMap O(1)
weechat-0003: irc-channel.c irc_channel_search O(C) linked-list scan per message handler → channels_hashtable O(1)
zeek-0002: Attr.cc Attributes::AddAttrs O(A²) triple-Find/RemoveAttr per attr → unordered_map index O(A)
curl-0004: mime.c search_header O(P×H) 3x per part per mime_add_headers → pre-indexed header name set O(P)
