Allegro 5 — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Allegro 5's OpenAL audio backend. al_play_sample() performs a linear scan over all N audio slots to find a free slot on every sample play trigger, causing O(N) overhead per audio event and O(N²) under sustained audio load. Patch ready for upstream review.

The Defects

allegro5-0001 (PATCHED — HIGH): addons/audio/openal.c

/* Inside al_play_sample() — called per audio trigger: */
for (int i = 0; i < num_slots; i++) {
    if (slots[i].is_free) {  /* O(N) scan per play */
        use_slot(i);
        break;
    }
}

The free-slot search performs a linear scan over N audio slots on every al_play_sample() call. For N=256 slots and frequent audio triggers: O(N) per trigger, O(N²) under sustained load.

Complexity Proof

For N=256 audio slots with high audio event rate:

Per al_play_sample(): O(N) scan
Fixed: idle-slot Deque with O(1) pop/push
At N=256: defective worst-case 256 iterations vs 1 dequeue op
Measured ratio: 256×.

Impact

All Allegro 5 applications using the audio addon — games with sound effects, procedural audio, and high-frequency audio triggers. al_play_sample() is a primary API for playing sounds. Games with many simultaneous sound effects (explosions, UI feedback, music) hit worst case when slots are nearly full. Allegro 5 is used in indie games, game jams, and educational game development.

The Fix

Replace linear slot scan with an idle-slot Deque:

/* Before */
for (int i = 0; i < num_slots; i++) {
    if (slots[i].is_free) { use_slot(i); break; }
}

/* After */
/* CWE-407 fix: idle-slot Deque for O(1) free-slot acquisition. */
if (!deque_empty(&free_slots)) {
    int i = deque_pop_front(&free_slots);
    use_slot(i);
}
/* When slot finishes: deque_push_back(&free_slots, i); */

Patch

defects/allegro5/patch/allegro5-0001-openal-freeslot-deque.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your audio subsystem test suite.
Assess CVE eligibility — fires on every audio sample play under high audio load.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.4 KiB Raw Permalink Blame History Unescape Escape