38 lines
1.5 KiB
Markdown
38 lines
1.5 KiB
Markdown
# UNDF: UNDF-2026-000000070
|
||
# FFmpeg deeper scan — CWE-407 CLEAN (libavcodec/libavfilter/libavformat)
|
||
|
||
## Files scanned
|
||
|
||
| File | Finding |
|
||
|---|---|
|
||
| `libavcodec/allcodecs.c` | `find_codec_by_name`: single O(N) scan, not nested — CLEAN |
|
||
| `libavcodec/allcodecs.c` | `find_codec` by ID: single O(N) scan — CLEAN |
|
||
| `libavfilter/allfilters.c` | `avfilter_get_by_name`: single O(F) scan over 593 filters — CLEAN |
|
||
| `libavfilter/graphparser.c` | `avfilter_get_by_name` called inside `for chains × for filters` loop |
|
||
| `libavformat/format.c` | `av_demuxer_iterate` / `av_muxer_iterate`: single O(N) pass — CLEAN |
|
||
|
||
## Near-miss: graphparser.c
|
||
|
||
`libavfilter/graphparser.c` lines 533–535:
|
||
|
||
```c
|
||
for (size_t j = 0; j < ch->nb_filters; j++) {
|
||
AVFilterParams *p = ch->filters[j];
|
||
const AVFilter *f = avfilter_get_by_name(p->filter_name); // O(593)
|
||
…
|
||
}
|
||
```
|
||
|
||
`avfilter_get_by_name` is O(F) where F ≈ 593 registered filters (compile-time constant).
|
||
For a filtergraph with N filter instances: total work is O(N × 593) = O(N).
|
||
|
||
This is **not CWE-407**: F is a fixed compile-time constant, not a runtime-growing
|
||
collection. The complexity scales linearly with N (filter instances), not quadratically.
|
||
If FFmpeg ever moves to dynamic filter registration where F grows at runtime alongside N,
|
||
this would become O(N²) and would need a hash table. Currently CLEAN.
|
||
|
||
## Conclusion
|
||
|
||
No new CWE-407 defects found in this deeper FFmpeg scan.
|
||
`ffmpeg-0001` (codec tag linear scans in `libavformat/utils.c`) remains the only confirmed
|
||
defect.
|