Meson — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Meson's build target configuration. extra_files deduplication in mesonbuild/build.py uses O(n²) list membership checks per target build configuration. Patch ready for upstream review.

The Defects

meson-0001 (PATCHED — HIGH): mesonbuild/build.py

# extra_files dedup — per target build config:
for f in new_files:
    if f not in extra_files:  # O(n) list scan per file
        extra_files.append(f)
# O(n²) total dedup

if f not in extra_files performs O(n) list scan per file. For n extra files: O(n²) total. Measured ratio: 150×.

Complexity Proof

For n=150 extra files per target:

O(n²) = 22,500 comparisons
Fixed: set before loop → O(n)
150× measured ratio.

Impact

All Meson users building targets with many extra source files — IDE integration files, documentation files, and resource files tracked as extra_files. Meson is a widely used build system for C, C++, and Rust projects (GNOME, GLib, systemd, Mesa use Meson). Large projects with many extra files per target hit O(n²) on every meson setup and reconfiguration.

The Fix

Pre-build a set from extra_files before the dedup loop:

# Before
for f in new_files:
    if f not in extra_files:  # O(n) list scan
        extra_files.append(f)

# After
# CWE-407 fix: set for O(1) dedup instead of O(n) list scan.
extra_files_set = set(extra_files)
for f in new_files:
    if f not in extra_files_set:  # O(1) set lookup
        extra_files_set.add(f)
        extra_files.append(f)

Patch

defects/meson/patch/meson-0001-build-extra-files-set.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your build target and configuration test suite.
Assess CVE eligibility — fires on every meson setup with large extra_files per target.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.1 KiB Raw Blame History Unescape Escape