|
|
7786adc4c0
|
ruffle: 2 CWE-407 defects, MOADs 0002-0005 documented
ruffle-0001: AVM2 optimizer type_aware.rs process_jump() worklist dedup
Vec<usize>.contains() inside while-loop over basic blocks -> O(B^2).
Fix: companion HashSet<usize> for O(1) dedup. 249.5x at fanWidth=500.
ruffle-0002: MovieClip goto_commands depth lookup O(F*D^2) -> O(F*D).
goto_place_object/goto_remove_object use iter().position(|o| o.depth()==d)
inside frame-scan while-loop. Fix: HashMap<Depth, usize> index alongside
Vec; swap_remove displacement handled correctly. 51.5x at F=500 D=100.
MOAD-0002 (Intertangle): UpdateContext god-object couples GC/AVM1/AVM2/
audio/video/renderer/navigator/UI/storage/log/timers/input in one struct.
Architectural, not a single-patch fix.
MOAD-0003 (Leaked Context): CURRENT_CONTEXT thread_local in web/src/lib.rs
holds raw *mut UpdateContext<'static> (request-scoped in thread scope).
Desktop thread_locals CALLSTACK/RENDER_INFO/SWF_INFO carry per-SWF state.
MOAD-0004: CLEAN. No verbatim credential logging found.
MOAD-0005: CLEAN. Arc<Mutex<Player>> used consistently, no unsynchronized
cache double-check pattern.
2/2 unit tests PASS.
|
2026-03-31 19:57:30 -04:00 |
|
