java-topology/whitepaper/outreach/libopenshot-0001.md

libopenshot — CWE-407 Disclosure Brief (libopenshot-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(DC) defect in libopenshot's ObjectDetection effect. The display_classes filter uses std::find on a std::vector<std::string> inside the per-detection loop that runs every rendered frame, producing O(DC) total cost where D = detections per frame and C = filter class count.

The Defect

libopenshot-0001 (PATCHED — MEDIUM): src/effects/ObjectDetection.cpp:76 (two sites)

// Site 1 — GetFrame hot path:
for (int i = 0; i < detections.boxes.size(); i++) {
    if (!display_classes.empty() &&
        std::find(display_classes.begin(), display_classes.end(),
                  classNames[detections.classIds.at(i)]) == display_classes.end())
        continue;
}

// Site 2 — GetPropertiesJSON:
auto it = std::find(display_classes.begin(), display_classes.end(), className);

display_classes is std::vector<std::string>. std::find performs O(C) string comparisons per detection. Both sites fire for every detection on every frame.

Complexity Proof

At D=50 detections, C=20 filter classes, 30 fps:

• Defective: 50 × 20 × 30 fps = 30,000 string comparisons per second
• Fixed: 50 × O(1) × 30 fps = 1,500 hash lookups per second
• ~20× op reduction. Over a 1-minute video: 1,800,000 vs 90,000.

Impact

libopenshot is the video editing library behind OpenShot, a popular open-source video editor. Object detection effects run on every rendered frame during preview and export. Videos with ML-detected objects and class filters hit this path continuously.

The Fix

Replace std::vector<std::string> with std::unordered_set<std::string>:

// Before
std::vector<std::string> display_classes;
std::find(display_classes.begin(), display_classes.end(), className)

// After
std::unordered_set<std::string> display_classes;
display_classes.find(className)

Patch

Fix available: defects/libopenshot-0001/patch/libopenshot-0001.patch

Two-file patch across ObjectDetection.h and ObjectDetection.cpp. Type change + .find() and .insert() calls. ~20× speedup at 20 filter classes.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (OpenShot/libopenshot).
2. Assess severity — fires on every rendered frame during object detection.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the libopenshot team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.