russell@unturf.com fbc56da95b curl/ffmpeg: CWE-407 findings — awssigv4 bubble sort + filtergraph format merge ... curl-0001 (UNDF-2026-000000040): lib/http_aws_sigv4.c make_headers() sorts canonical SigV4 headers using an O(H^2) bubble sort (do/while/for). Every SigV4 HTTP request pays H^2 comparisons. At H=200: 35,024 vs 794 (44x). Fix: qsort on a temporary pointer array, O(H log H). ffmpeg-0001 (UNDF-2026-000000070): libavfilter/formats.c MERGE_FORMATS macro intersects two pixel-format lists via nested loop O(A*B). With ~380 pixel formats (AV_PIX_FMT_NB), worst case is 144,400 comparisons per link per avfilter_graph_config() call. At A=B=380: 72,390 vs 3,420 (21x). Fix: sort b, bsearch for membership, O((A+B) log B). Unit tests: CurlTest.java, FFmpegTest.java — both PASS.		2026-03-30 09:38:07 -04:00
..
patch	curl/ffmpeg: CWE-407 findings — awssigv4 bubble sort + filtergraph format merge	2026-03-30 09:38:07 -04:00
unit	curl/ffmpeg: CWE-407 findings — awssigv4 bubble sort + filtergraph format merge	2026-03-30 09:38:07 -04:00