russell@unturf.com
bbc12a3ca6
libtiff-0001: TIFFReadDirectory + TIFFReadCustomDirectory both contain identical O(D^2) nested loops to detect duplicate IFD tags (bugzilla 1994 dedup block, tif_dirread.c). Adversarial TIFF with D=65535 entries causes ~2.1B comparisons per IFD open. Fix: sorted seen-array with binary-search insert, O(D log D). Java model confirms 37x at D=8000; asymptotic ~3900x at D=65535. libpng: all 5 MOADs CLEAN. add_one_chunk O(new*old) in pngset.c is bounded by a ~30-entry fixed chunk list; chunk dedup during read uses a bitmask O(1). |
||
|---|---|---|
| .. | ||
| LibtiffDirDedupTest.java | ||