russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.2 KiB

Raw Permalink Blame History

Ruffle — CWE-407 Disclosure Brief (ruffle-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

An O(F×D²) linear scan in MovieClip goto handling at core/src/display_object/movie_clip.rs. Both goto_place_object() and goto_remove_object() use iter().position() to find matching depths in goto_commands (a Vec<GotoPlaceObject>), performing O(D) per SWF tag where D = display objects per frame. A gotoAndPlay spanning F frames with D objects costs O(F×D²).

The Defect

ruffle-0002 (PATCHED — HIGH): core/src/display_object/movie_clip.rs

// In goto_place_object():
if let Some(i) = goto_commands.iter().position(|o| o.depth() == depth) {
    goto_commands[i].merge(&mut goto_place);  // O(D) linear scan per tag
// In goto_remove_object():
if let Some(i) = goto_commands.iter().position(|o| o.depth() == depth) {
    goto_commands.swap_remove(i);  // O(D) linear scan per tag

Complexity Proof

At F=100 frames, D=200 display objects:

Defective: 100 × 200 × 200/2 = 2,000,000 comparisons
Fixed: 100 × 200 × O(1) = 20,000 lookups
100× op reduction

Impact

Ruffle emulates Flash content in browsers. gotoAndPlay/gotoAndStop are fundamental ActionScript operations used heavily in Flash animations, games, and interactive media. Complex SWF timelines with many display objects and large frame jumps trigger the worst case. This fires during runtime playback, not just loading.

The Fix

Add a HashMap<swf::Depth, usize> index mapping depth to position in goto_commands. Both goto_place_object and goto_remove_object use the HashMap for O(1) lookups. On swap_remove, the displaced element's index entry updates to maintain consistency.

Patch

Fix available: defects/ruffle-0002/patch/ruffle-0002.patch

100× op reduction at F=100, D=200.

What We Ask

Confirm receipt and assign a GitHub issue reference (ruffle-rs/ruffle).
Assess severity — fires during runtime gotoAndPlay operations in Flash content.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Ruffle team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.2 KiB Raw Permalink Blame History Unescape Escape