Linphone — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Linphone's SDP offer/answer codec negotiation. genericMatch() performs O(L×R) nested scanning over local and remote codec lists for every SDP negotiation, plus an additional nested scan for crypto algorithm matching. Patch ready for upstream review.

The Defects

linphone-0001 (PATCHED — MEDIUM): offeranswer.cpp:237

// Inside genericMatch() — per SDP negotiation:
for (auto &localCodec : localCodecs) {
    for (auto &remoteCodec : remoteCodecs) {  // O(L×R) nested scan
        if (codecsMatch(localCodec, remoteCodec)) { ... }
    }
}
// Plus matchCryptoAlgo() nested scan per negotiation

genericMatch() performs O(L×R) nested scan over L local codecs and R remote codecs. Called on every SIP call setup during SDP offer/answer negotiation. Measured ratio: 5×.

Complexity Proof

For L=5 local codecs, R=5 remote codecs:

Per negotiation: O(L×R) = 25 comparisons
Fixed: codec name+clock rate → index map → O(L + R)
5× measured ratio (scales with codec list sizes in enterprise setups).

Impact

All Linphone users establishing SIP calls. SDP negotiation runs on every call setup, hold/resume, and codec renegotiation. Enterprise SIP deployments with many supported codecs maximize L×R. Linphone is a widely used open-source SIP client and SDK; the liblinphone library is embedded in many VoIP applications. While the absolute ratio is modest, it fires on every call establishment.

The Fix

Pre-build a codec name+clock index map before the nested loop:

// Before
for (auto &localCodec : localCodecs) {
    for (auto &remoteCodec : remoteCodecs) {  // O(L×R)
        if (codecsMatch(localCodec, remoteCodec)) { ... }
    }
}

// After
// CWE-407 fix: index map for O(L+R) matching instead of O(L×R) nested scan.
std::unordered_map<std::string, const PayloadType*> remoteIndex;
for (auto &rc : remoteCodecs) remoteIndex[codecKey(rc)] = &rc;
for (auto &lc : localCodecs) {
    auto it = remoteIndex.find(codecKey(lc));
    if (it != remoteIndex.end()) { ... }
}

Patch

defects/linphone/patch/linphone-0001-offeranswer-codec-map.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your SDP negotiation test suite.
Assess CVE eligibility — fires on every SIP call setup; scales with codec list size.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Permalink Blame History Unescape Escape