# UNDF: UNDF-2026-000000070
# FFmpeg deeper scan — CWE-407 CLEAN (libavcodec/libavfilter/libavformat)

## Files scanned

| File | Finding |
|---|---|
| `libavcodec/allcodecs.c` | `find_codec_by_name`: single O(N) scan, not nested — CLEAN |
| `libavcodec/allcodecs.c` | `find_codec` by ID: single O(N) scan — CLEAN |
| `libavfilter/allfilters.c` | `avfilter_get_by_name`: single O(F) scan over 593 filters — CLEAN |
| `libavfilter/graphparser.c` | `avfilter_get_by_name` called inside `for chains × for filters` loop |
| `libavformat/format.c` | `av_demuxer_iterate` / `av_muxer_iterate`: single O(N) pass — CLEAN |

## Near-miss: graphparser.c

`libavfilter/graphparser.c` lines 533–535:

```c
for (size_t j = 0; j < ch->nb_filters; j++) {
    AVFilterParams *p = ch->filters[j];
    const AVFilter *f = avfilter_get_by_name(p->filter_name);  // O(593)
    …
}
```

`avfilter_get_by_name` is O(F) where F ≈ 593 registered filters (compile-time constant).
For a filtergraph with N filter instances: total work is O(N × 593) = O(N).

This is **not CWE-407**: F is a fixed compile-time constant, not a runtime-growing
collection.  The complexity scales linearly with N (filter instances), not quadratically.
If FFmpeg ever moves to dynamic filter registration where F grows at runtime alongside N,
this would become O(N²) and would need a hash table.  Currently CLEAN.

## Conclusion

No new CWE-407 defects found in this deeper FFmpeg scan.
`ffmpeg-0001` (codec tag linear scans in `libavformat/utils.c`) remains the only confirmed
defect.