# mpv: CWE-407 scan result — CLEAN

Scanned 2026-03-30.

## Areas inspected

- `player/` — playlist, command, loadfile, external_files, client
- `options/` — m_config_core, m_config_frontend, m_property, m_option
- `filters/` — f_output_chain, filter, f_lavfi, f_decoder_wrapper
- `demux/` — demux_timeline (stream mapping), demux_mkv (track matching)
- `input/` — input bindings, section management
- `common/` — playlist.c

## Findings

mpv uses small, bounded data structures throughout:
- Playlists: no dedup/membership checks (just appends)
- Filter chains: typically <10 filters
- Input bindings: <100 per section
- Media tracks: <20 per file
- Option lists: ~300-500 (compile-time constant)
- Client list: <10

All linear scans operate on data sets with natural bounds well below the
threshold where O(N^2) matters. No CWE-407 defects found.