russell@unturf.com
3986d8dc50
New diamond recursion defects (O(2^D) → O(N)): - godot-0009: Font::_is_cyclic no visited set — CJK fallback diamond, 2648x at F=4,D=8 - godot-0010: Font::_update_rids_fb no visited set — duplicate RIDs + O(N^2) hot path - meson-0002: get_internal_static_libraries_recurse link_whole guard missing — 132x at D=10 - typescript-0003: hasBaseType inner check() no visited set — 1024x at D=10; hot on instanceof New O(N²) defects: - typeorm-0004: SubjectTopologicalSorter Array.indexOf dedup — 200x at N=400 - typeorm-0005: DepGraph.createDFS result.indexOf + addDependency edge dedup — 300x at N=600 CLEAN confirmed (diamond recursion sweep): bazel, cargo, cmake, composer, dgl, diesel, doctrine-orm, efcore, helm, mybatis, networkx-deeper, ninja, npm-arborist, peewee, pip, rubygems, seaorm, sqlalchemy, swift UNDF: 571→578 assigned; MOAD count: 629→635
19 lines
994 B
Diff
19 lines
994 B
Diff
# UNDF: UNDF-2026-000000412
|
|
--- a/mesonbuild/build.py
|
|
+++ b/mesonbuild/build.py
|
|
@@ -1625,9 +1625,13 @@ class BuildTarget(Target):
|
|
def get_internal_static_libraries_recurse(self, result: OrderedSet[StaticTargetTypes]) -> None:
|
|
for t in self.link_targets:
|
|
if t.is_internal() and t not in result:
|
|
result.add(t)
|
|
t.get_internal_static_libraries_recurse(result)
|
|
for t in self.link_whole_targets:
|
|
- if t.is_internal():
|
|
- t.get_internal_static_libraries_recurse(result)
|
|
+ # CWE-407 fix: add the same visited guard used for link_targets.
|
|
+ # Without this guard, a diamond link_whole graph causes O(2^D)
|
|
+ # recursive traversal — each shared library is re-entered once
|
|
+ # per distinct path from the root target.
|
|
+ if t.is_internal() and t not in result:
|
|
+ result.add(t)
|
|
+ t.get_internal_static_libraries_recurse(result)
|