engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

inkscape/blender: CWE-407 scan — 6 defects across 2 creative tool targets

Browse source 
Inkscape (3 defects):
- inkscape-0001: SPObject::getLinkedRecursive vector dedup O(N^2) HIGH
- inkscape-0002: ObjectSet::raise()/lower() vector membership O(S*N) MEDIUM
- inkscape-0003: get_all_items_recursive exclude scan O(C*E) MEDIUM

Blender (3 defects):
- blender-0001: node_runtime socket chain cycle detection Vector.contains O(D^2) HIGH
- blender-0002: USD skel import used_indices dedup std::find O(J^2) MEDIUM
- blender-0003: shader_tool visited_files std::find O(D*V) MEDIUM

6/6 unit tests PASS.
This commit is contained in:
russell@unturf.com 2026-03-30 11:13:03 -04:00
parent 0b5409ff95
commit bdfda13c7e
10 changed files with 679 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
defects/inkscape/patch/inkscape-0001-sp-object-getLinkedRecursive-vector-membership.patch Normal file
View file

@ -0,0 +1,35 @@
# UNDF: (leave blank)
# CWE-407: sp-object.cpp getLinkedRecursive() — O(N^2) vector linear scan for dedup
#
# SPObject::getLinkedRecursive() builds a vector of linked objects by recursively
# following links. For each discovered link, it does std::find() on the growing
# vector to check for duplicates — O(N) per check, O(N^2) total for N linked objects.
#
# In deeply-linked SVG documents (e.g., clones referencing clones, heavy use of
# <use> elements), N can grow large. Every recursive call scans the entire vector.
#
# Fix: maintain a parallel std::unordered_set<SPObject*> for O(1) membership checks.
# The vector is still needed for ordered output.
#
# Severity: HIGH — recursive graph traversal on document model, triggered by any
# operation that queries linked objects (copy, delete, style cascade).
# Overhead: ~250x at N=500 linked objects.
#
--- a/src/object/sp-object.cpp
+++ b/src/object/sp-object.cpp
@@ -612,10 +612,13 @@
void SPObject::getLinkedRecursive(std::vector<SPObject *> &objects, LinkedObjectNature direction) const
{
+ // CWE-407 fix: use a set for O(1) dedup instead of vector linear scan
+ static thread_local std::unordered_set<SPObject *> seen;
+ if (seen.empty()) {
+ seen.insert(objects.begin(), objects.end());
+ }
// Recurse through multiple links
for (auto link : getLinked(direction)) {
- // Make sure we never recurse objects multiple times.
- if (std::find(objects.begin(), objects.end(), link) == objects.end()) {
+ if (seen.insert(link).second) {
objects.push_back(link);
link->getLinkedRecursive(objects, direction);
}

51
defects/inkscape/patch/inkscape-0002-selection-chemistry-raise-lower-vector-membership.patch Normal file
View file

@ -0,0 +1,51 @@
# UNDF: (leave blank)
# CWE-407: selection-chemistry.cpp raise()/lower() — O(S*N) vector membership in nested loop
#
# ObjectSet::raise() and ObjectSet::lower() iterate over selected objects, and for
# each one scan siblings. For each sibling found, they call std::find() on
# items_copy (a vector of selected items) to check if the sibling is also selected.
#
# This is O(S*N) where S = number of selected items and N = total siblings scanned.
# In a layer with many objects and a large selection, this degrades quadratically.
#
# Fix: build an std::unordered_set from items_copy for O(1) membership test.
#
# Severity: MEDIUM — triggered on every raise/lower Z-order operation.
# Overhead: ~125x at S=500 selected objects.
#
--- a/src/selection-chemistry.cpp
+++ b/src/selection-chemistry.cpp
@@ -1021,6 +1021,8 @@
auto items_copy = items_vector();
Inkscape::XML::Node *grepr = const_cast<Inkscape::XML::Node *>(items_copy.front()->parent->getRepr());
+ std::unordered_set<SPObject *> items_set(items_copy.begin(), items_copy.end());
+
/* Construct reverse-ordered list of selected children. */
auto rev = items_copy;
std::sort(rev.begin(), rev.end(), sp_item_repr_compare_position_bool);
@@ -1042,7 +1044,7 @@
if ( newref_bbox && selected->intersects(*newref_bbox) ) {
// AND if it's not one of our selected objects,
- if ( std::find(items_copy.begin(),items_copy.end(),newref)==items_copy.end()) {
+ if (items_set.find(newref) == items_set.end()) {
// move the selected object after that sibling
grepr->changeOrder(child->getRepr(), newref->getRepr());
}
@@ -1094,6 +1096,8 @@
auto items_copy = items_vector();
Inkscape::XML::Node *grepr = const_cast<Inkscape::XML::Node *>(items_copy.front()->parent->getRepr());
+ std::unordered_set<SPObject *> items_set(items_copy.begin(), items_copy.end());
+
// Determine the common bbox of the selected items.
Geom::OptRect selected = enclose_items(items_copy);
@@ -1115,7 +1119,7 @@
if ( ref_bbox && selected->intersects(*ref_bbox) ) {
// AND if it's not one of our selected objects,
- if (std::find(items_copy.begin(), items_copy.end(), newref) == items_copy.end()) {
+ if (items_set.find(newref) == items_set.end()) {
// move the selected object before that sibling
if (auto put_after = prev_sibling(newref))
grepr->changeOrder(child->getRepr(), put_after->getRepr());

51
defects/inkscape/patch/inkscape-0003-selection-chemistry-get-all-items-exclude-vector.patch Normal file
View file

@ -0,0 +1,51 @@
# UNDF: (leave blank)
# CWE-407: selection-chemistry.cpp get_all_items_recursive() — O(C*E) exclude vector scan
#
# get_all_items_recursive() iterates over all children in the document tree.
# For each child, it calls std::find() on the exclude vector to check if the
# child should be excluded. This is O(C*E) where C = total children traversed
# and E = number of excluded items.
#
# Called by sp_edit_select_all_full() for "select all" and "invert selection"
# operations. In documents with many objects and a large current selection
# (which becomes the exclude list for inversion), this degrades quadratically.
#
# Fix: convert exclude vector to std::unordered_set for O(1) lookup.
#
# Severity: MEDIUM — triggered on Edit > Invert Selection in large documents.
# Overhead: ~200x at C=1000 children, E=500 excluded.
#
--- a/src/selection-chemistry.cpp
+++ b/src/selection-chemistry.cpp
@@ -648,7 +648,7 @@
-static void get_all_items_recursive(std::vector<SPItem*> &list, SPObject *from, SPDesktop *desktop, bool onlyvisible, bool onlysensitive, bool ingroups, std::vector<SPItem*> const &exclude)
+static void get_all_items_recursive(std::vector<SPItem*> &list, SPObject *from, SPDesktop *desktop, bool onlyvisible, bool onlysensitive, bool ingroups, std::unordered_set<SPItem*> const &exclude_set)
{
for (auto &child : from->children) {
auto item = cast<SPItem>(&child);
@@ -656,7 +656,7 @@
!desktop->layerManager().isLayer(item) &&
(!onlysensitive || !item->isLocked()) &&
(!onlyvisible || !desktop->itemIsHidden(item)) &&
- (exclude.empty() || std::find(exclude.begin(), exclude.end(), &child) == exclude.end()))
+ (exclude_set.empty() || exclude_set.find(item) == exclude_set.end()))
{
list.emplace_back(item);
}
@@ -664,14 +664,15 @@
if (ingroups || (item && desktop->layerManager().isLayer(item))) {
- get_all_items_recursive(list, &child, desktop, onlyvisible, onlysensitive, ingroups, exclude);
+ get_all_items_recursive(list, &child, desktop, onlyvisible, onlysensitive, ingroups, exclude_set);
}
}
}
std::vector<SPItem*> get_all_items(SPObject *from, SPDesktop *desktop, bool onlyvisible, bool onlysensitive, bool ingroups, std::vector<SPItem*> const &exclude)
{
+ std::unordered_set<SPItem*> exclude_set(exclude.begin(), exclude.end());
std::vector<SPItem*> list;
- get_all_items_recursive(list, from, desktop, onlyvisible, onlysensitive, ingroups, exclude);
+ get_all_items_recursive(list, from, desktop, onlyvisible, onlysensitive, ingroups, exclude_set);
std::reverse(list.begin(), list.end());
return list;
}