java-topology/defects/redot/patch/redot-0008-gltf-extensions-used-hashset.patch
russell@unturf.com fdbb9a1aa9 redot: 12 CWE-407 defects, patches, outreach brief, UNDF-2026-000001231..1242
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.

Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.

Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.

Strategy: patch Redot first, Godot follows our lead.
2026-04-03 21:00:29 -04:00

55 lines
2.6 KiB
Diff
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# UNDF: UNDF-2026-000001238
# CWE-407: Algorithmic Complexity — O(N×E) → O(N) in GLTFDocument::_serialize_nodes() / _serialize_animations()
#
# Defect: extensions_used.has("...") is O(E) — Vector linear scan — inside loops
# over N nodes and animation tracks. Fires during every GLTF export/import operation.
# Total cost: O(N × E). For a complex scene (N=10000 nodes, E=20 extensions): 200,000 scans.
#
# Fix: change extensions_used in GLTFState from Vector<String> to HashSet<String>.
# has() and insert() are O(1). Idempotent insert() replaces has()+push_back() pattern.
# Total cost after: O(N). E× speedup per extension check.
#
# Complexity gate (unit/test-redot-0008-gltf-extensions.cpp):
# N=1000 nodes, E=20 extensions: time ratio on 5× scale must be <17.5×
--- a/modules/gltf/gltf_state.h
+++ b/modules/gltf/gltf_state.h
@@ -93,7 +93,7 @@ class GLTFState : public Resource {
Vector<String> extensions_required;
- Vector<String> extensions_used;
+ HashSet<String> extensions_used; // FIX redot-0008: was Vector<String> — O(E) .has() per node/animation
--- a/modules/gltf/gltf_document.cpp
+++ b/modules/gltf/gltf_document.cpp
@@ -248,7 +248,7 @@ Error GLTFDocument::_serialize_asset_header(Ref<GLTFState> p_state) {
- Vector<String> extensions_used = p_state->extensions_used;
+ // FIX redot-0008: extensions_used is now HashSet; convert to sorted Vector for JSON
+ Vector<String> extensions_used;
+ for (const String &ext : p_state->extensions_used) {
+ extensions_used.push_back(ext);
+ }
@@ -441,7 +441,7 @@ Error GLTFDocument::_serialize_nodes(Ref<GLTFState> p_state) {
if (!gltf_node->visible) {
- if (!p_state->extensions_used.has("KHR_node_visibility")) {
- p_state->extensions_used.push_back("KHR_node_visibility");
- }
+ // FIX redot-0008: HashSet.insert() is idempotent and O(1) — was O(E) Vector scan
+ p_state->extensions_used.insert("KHR_node_visibility");
@@ -5494,7 +5494,7 @@ void GLTFDocument::_serialize_animations(Ref<GLTFState> p_state) {
if (!gltf_animation->get_pointer_tracks().is_empty()) {
- if (!p_state->extensions_used.has("KHR_animation_pointer")) {
- p_state->extensions_used.push_back("KHR_animation_pointer");
- }
+ // FIX redot-0008: HashSet.insert() is idempotent O(1)
+ p_state->extensions_used.insert("KHR_animation_pointer");
@@ -8957,7 +8957,7 @@ void GLTFDocument::_parse_extensions(Ref<GLTFState> p_state) {
- p_state->extensions_used = ext_array;
+ // FIX redot-0008: populate HashSet from parsed JSON array
+ p_state->extensions_used.clear();
+ for (int i = 0; i < ext_array.size(); i++) {
+ p_state->extensions_used.insert(ext_array[i]);
+ }