java-topology/defects/ffmpeg/patch/ffmpeg-deeper-scan-CLEAN.md

UNDF: UNDF-2026-000000070

FFmpeg deeper scan — CWE-407 CLEAN (libavcodec/libavfilter/libavformat)

Files scanned

File	Finding
libavcodec/allcodecs.c	find_codec_by_name: single O(N) scan, not nested — CLEAN
libavcodec/allcodecs.c	find_codec by ID: single O(N) scan — CLEAN
libavfilter/allfilters.c	avfilter_get_by_name: single O(F) scan over 593 filters — CLEAN
libavfilter/graphparser.c	avfilter_get_by_name called inside for chains × for filters loop
libavformat/format.c	av_demuxer_iterate / av_muxer_iterate: single O(N) pass — CLEAN

Near-miss: graphparser.c

libavfilter/graphparser.c lines 533–535:

for (size_t j = 0; j < ch->nb_filters; j++) {
    AVFilterParams *p = ch->filters[j];
    const AVFilter *f = avfilter_get_by_name(p->filter_name);  // O(593)
    …
}

avfilter_get_by_name is O(F) where F ≈ 593 registered filters (compile-time constant). For a filtergraph with N filter instances: total work is O(N × 593) = O(N).

This is not CWE-407: F is a fixed compile-time constant, not a runtime-growing collection. The complexity scales linearly with N (filter instances), not quadratically. If FFmpeg ever moves to dynamic filter registration where F grows at runtime alongside N, this would become O(N²) and would need a hash table. Currently CLEAN.

Conclusion

No new CWE-407 defects found in this deeper FFmpeg scan. ffmpeg-0001 (codec tag linear scans in libavformat/utils.c) remains the only confirmed defect.