java-topology/whitepaper/outreach/ruffle-0001.md

Ruffle — CWE-407 Disclosure Brief (ruffle-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(B²) dedup scan in the AVM2 type-aware optimizer at core/src/avm2/optimizer/type_aware.rs. The worklist uses Vec::contains() (O(B) linear scan) to check for duplicate block indices before pushing, giving O(B²) total where B = number of basic blocks in the function being optimized.

The Defect

ruffle-0001 (PATCHED — MEDIUM): core/src/avm2/optimizer/type_aware.rs

let mut worklist = vec![0];
// ...
// In process_jump():
if !worklist.contains(&target_block_id) {  // O(B) linear scan
    worklist.push(target_block_id);
}

Complexity Proof

At B=1,000 basic blocks:

• Defective: up to 1,000 × 1,000 = 1,000,000 comparisons
• Fixed: 1,000 × O(1) HashSet lookups = 1,000 probes
• Up to 1,000× op reduction

Impact

Ruffle emulates Adobe Flash content in the browser. The AVM2 optimizer runs on every ActionScript 3 function during JIT compilation. Complex SWF files (games, interactive applications) contain functions with hundreds of basic blocks. This path fires during initial load of every Flash game/app.

The Fix

Add a companion HashSet<usize> alongside the worklist Vec. All membership checks use the HashSet (O(1)); insertions and removals update both structures.

Patch

Fix available: defects/ruffle-0001/patch/ruffle-0001.patch

Up to 1,000× op reduction at B=1,000 blocks.

What We Ask

1. Confirm receipt and assign a GitHub issue reference (ruffle-rs/ruffle).
2. Assess severity — fires during JIT compilation of every AVM2 function.
3. Coordinate a disclosure date — targeting 90 days from first contact.
4. We will credit the Ruffle team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.