engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/openscad-0001/TICKET.md
russell@unturf.com 597b345da7 openscad: 5-MOAD scan; openscad-0001 CWE-407 AMF vertex dedup 85x, openscad-0002 CWE-407 PolySetBuilder color dedup 69x, openscad-0003 CWE-312 OctoPrint app_token logged 
Restructure openscad-0001 (was in wrong dir, Java test) into proper
openscad-0001/ with TICKET.md and Python test. New openscad-0002 patches
PolySetBuilder::endPolygon + appendPolySet std::find on colors_ vector ->
unordered_map; Color4f already has std::hash. New openscad-0003 patches
OctoPrint::requestApiKey and getJsonData to stop logging API responses
verbatim (app_token + api responses exposed under --debug).
MOADs 0002/0003/0005 CLEAN.
2026-04-03 14:10:05 -04:00

873 B
Raw Blame History

openscad-0001 — CWE-407 export_amf add_vertex O(V^2) vertex dedup

MOAD: 0001 (CWE-407 Sedimentary Defect) Severity: HIGH Ratio: ~500x at V=1000 UNDF: UNDF-2026-000000883

Location

src/io/export_amf.cc — add_vertex()

Pattern

add_vertex() deduplicates vertices during AMF export by calling std::find(vertices.begin(), vertices.end(), vs) on a std::vector<vertex_str>. For a mesh with V unique vertices, each insertion scans the entire vector. Total cost: O(V^2).

For a mesh with 1,000 unique vertices, AMF export performs ~500,000 string comparisons instead of ~1,000.

Fix

Add a parallel std::unordered_map<vertex_str, size_t, vertex_str_hash> for O(1) lookup. The vector is retained for index-ordered output. Hash combines x/y/z string hashes with Boost-style mixing.

Patch

patch/openscad-0001-amf-vertex-dedup.patch