engineering/java-topology

russell@unturf.com e06902c99a freecad/retroarch/mpv: CWE-407 scan — 3 defects, mpv CLEAN

freecad-0001: ifc_generator.py done-list O(N^2) dedup MEDIUM-HIGH 499x
freecad-0002: importDXF.py processededges list O(E^2) MEDIUM 469x
retroarch-0001: playlist_entry_exists O(R*P) linear scan in content scanner HIGH 749x
mpv: CLEAN (all data structures naturally bounded)

3/3 unit tests PASS.

2026-03-30 14:53:03 -04:00

863 B

Raw Blame History

mpv: CWE-407 scan result — CLEAN

Scanned 2026-03-30.

Areas inspected

player/ — playlist, command, loadfile, external_files, client
options/ — m_config_core, m_config_frontend, m_property, m_option
filters/ — f_output_chain, filter, f_lavfi, f_decoder_wrapper
demux/ — demux_timeline (stream mapping), demux_mkv (track matching)
input/ — input bindings, section management
common/ — playlist.c

Findings

mpv uses small, bounded data structures throughout:

Playlists: no dedup/membership checks (just appends)
Filter chains: typically <10 filters
Input bindings: <100 per section
Media tracks: <20 per file
Option lists: ~300-500 (compile-time constant)
Client list: <10

All linear scans operate on data sets with natural bounds well below the threshold where O(N^2) matters. No CWE-407 defects found.