VLC — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in VLC's plugin module lookup. module_find() in src/modules/modules.c performs an O(n) linear scan over all loaded plugins on every plugin lookup, causing O(R×n) overhead at resolution time. Patch ready for upstream review.

The Defects

vlc-0001 (PATCHED — HIGH): src/modules/modules.c

/* module_find() — per plugin lookup: */
module_t *module_find(const char *name)
{
    /* O(n) linear scan over all loaded modules */
    for (size_t i = 0; i < modules.count; i++) {
        if (strcmp(modules.data[i]->psz_object_name, name) == 0)
            return modules.data[i];
    }
    return NULL;
}

module_find() scans all N loaded modules linearly on every plugin lookup. For R resolutions at startup and during playback: O(R × n). Measured ratio: 96×.

Complexity Proof

For n=96 loaded modules:

Per lookup: O(n) = 96 comparisons
Fixed: unordered_map<name, module*> → O(1) per lookup
96× measured ratio.

Impact

All VLC users. module_find() is called during codec selection, demuxer selection, and filter resolution — at startup and during media file open. VLC is one of the most widely used open-source media players, with hundreds of millions of users. The defect fires on every media file opened. VLC's plugin system has many modules (decoders, encoders, demuxers, filters, interfaces) and module_find() is called many times during initialization.

The Fix

Replace the linear scan with an unordered_map:

/* Before */
module_t *module_find(const char *name) {
    for (size_t i = 0; i < modules.count; i++) {
        if (strcmp(modules.data[i]->psz_object_name, name) == 0)
            return modules.data[i];
    }
    return NULL;
}

/* After */
/* CWE-407 fix: hash map for O(1) module lookup instead of O(n) linear scan. */
module_t *module_find(const char *name) {
    return vlc_dictionary_value_for_key(&module_map, name);
}

Build module_map at module registration time.

Patch

defects/vlc/patch/vlc-0001-modules-hashmap.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your module loading and plugin test suite.
Assess CVE eligibility — fires on every media file open and plugin resolution.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History Unescape Escape