mirror of
https://github.com/storytold/cadcraft.git
synced 2026-10-24 10:56:51 -06:00
Dylan M. Taylorandskylartaylor
8085745a22
* security: bound native DXF/SVG/PDF import allocation and quadratic work (CWE-400/407/789) Several native import paths let a crafted drawing cause quadratic CPU work or unbounded allocation: - DXF layer decoding scanned the whole layer list for every LAYER record (`d.layer_mut`), so many distinct layer names made import quadratic. Keep a case-normalised name→index map and update/append in O(1) (row 29). - ACAD_TABLE cells were materialised per table under a per-table cap, but many small tables could still add up. Add a document-wide table-cell budget in parse_entities; a table that would overflow it is reduced to empty (row 8). - DXF image name allocation restarted its `_2, _3…` suffix probe for every definition sharing a base name (quadratic). Keep a per-base next-suffix counter so probing resumes where it left off (row 13). - Image resolution cloned each definition's path/name into every referring image. Add an aggregate byte budget; once spent, string copies stop while geometry fields are still applied (row 42). - PDF link annotation scanned the whole selected-link vector for every primitive. Build a HashSet of linked handles once for O(1) membership (row 15). - SVG arc/curve flattening retained each flushed run with only a per-run cap, so repeated arcs amplified a compact path into unbounded geometry. Add a document-wide generated-vertex budget charged in `add` (row 31). New test `svg_arc_budget` covers the SVG budget. All `cadcraft-io` tests pass; clippy adds no new warnings. Addresses findings rows 8, 13, 15, 29, 31, 42. * fix: share DXF table budgets before allocation --------- Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>