java-topology/defects/redot/patch/redot-0007-rest-fixer-bones-hashset.patch
russell@unturf.com fdbb9a1aa9 redot: 12 CWE-407 defects, patches, outreach brief, UNDF-2026-000001231..1242
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.

Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.

Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.

Strategy: patch Redot first, Godot follows our lead.
2026-04-03 21:00:29 -04:00

53 lines
2.7 KiB
Diff
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# UNDF: UNDF-2026-000001237
# CWE-407: Algorithmic Complexity — O(T×K) → O(T+K) in PostImportPluginSkeletonRestFixer
#
# Defect: bones_to_process.has(bone_idx) is O(K) — Vector linear scan —
# inside a loop over T animation tracks. Two separate Vector<int> instances:
# one for initial parentless-bone set and one for keep_bone_rest accumulator.
# Total cost: O(T × K). Fires at GLTF/FBX import time for animated skeletal meshes.
#
# Fix: convert both to HashSet<int>.
# has() is O(1). keep_bone_rest.push_back() becomes insert().
# Total cost after: O(T + K). T× speedup for large animation sets.
#
# Complexity gate (unit/test-redot-0007-rest-fixer.cpp):
# T=500 tracks, K=200 bones: time ratio on 5× scale must be <17.5×
--- a/editor/import/3d/post_import_plugin_skeleton_rest_fixer.cpp
+++ b/editor/import/3d/post_import_plugin_skeleton_rest_fixer.cpp
@@ -162,7 +162,8 @@ void PostImportPluginSkeletonRestFixer::internal_process(InternalImportCategory
// Fix animation by changing node transform.
- bones_to_process = src_skeleton->get_parentless_bones();
+ // FIX redot-0007: convert to HashSet<int> for O(1) .has() — was O(B) Vector scan per track
+ Vector<int> bones_to_process_vec = src_skeleton->get_parentless_bones();
+ HashSet<int> bones_to_process(bones_to_process_vec.begin(), bones_to_process_vec.end());
{
TypedArray<Node> nodes = p_base_scene->find_children("*", "AnimationPlayer");
while (nodes.size()) {
@@ -197,7 +197,7 @@ void PostImportPluginSkeletonRestFixer::internal_process(InternalImportCategory
int bone_idx = src_skeleton->find_bone(bn);
int key_len = anim->track_get_key_count(i);
if (anim->track_get_type(i) == Animation::TYPE_POSITION_3D) {
- if (bones_to_process.has(bone_idx)) {
+ if (bones_to_process.has(bone_idx)) { // now O(1) via HashSet
for (int j = 0; j < key_len; j++) {
@@ -613,7 +613,8 @@ void PostImportPluginSkeletonRestFixer::internal_process(InternalImportCategory
- Vector<int> keep_bone_rest;
+ // FIX redot-0007: was Vector<int> — .has() O(K) inside O(T) track loop = O(T×K)
+ HashSet<int> keep_bone_rest;
if (is_using_modifier || keep_global_rest_leftovers) {
...
if (!found_mapped) {
- keep_bone_rest.push_back(src_idx);
+ keep_bone_rest.insert(src_idx);
}
}
@@ -678,7 +678,7 @@ void PostImportPluginSkeletonRestFixer::internal_process(InternalImportCategory
- } else if (keep_global_rest_leftovers && keep_bone_rest.has(src_idx)) {
+ } else if (keep_global_rest_leftovers && keep_bone_rest.has(src_idx)) { // O(1)
@@ -739,7 +739,7 @@ void PostImportPluginSkeletonRestFixer::internal_process(InternalImportCategory
- if (keep_bone_rest.has(bone_idx)) {
+ if (keep_bone_rest.has(bone_idx)); // O(1) via HashSet