mirror of
https://github.com/storytold/cadcraft.git
synced 2026-10-24 10:56:51 -06:00
Dylan M. Taylorandskylartaylor
0158712bfd
* security: bound geometry-kernel degree and work (CWE-407) Several geometry routines let a crafted spline or region cause quadratic or worse CPU work: - B-spline basis evaluation is O(degree²) per sample and tessellation takes O(degree) samples, so a HATCH/DXF spline edge declaring a very high degree (DXF allows up to 100 000) turned a tiny spline into billions of iterations. Add `MAX_DEGREE = 64` and treat higher-degree splines as invalid, so `eval`/`tessellate` fall back to the control polygon. The render clip boundary also rejects such degrees up front (rows 18, 28). - `Spline::derivative` re-ran the O(knots) validity scan on every call, and arc-length integration calls it once per sample, making a valid spline's measurement quadratic. Split off `derivative_unchecked` and have integration (validated once by its public entry points) use it (row 24). - `infer_knot_param` matched each fit parameter against the whole knot vector from the start. Both are ascending, so replace it with a linear merge (row 16). - Fillet seed collection did not stop the enclosing run-pair loops when the per-call candidate cap was hit, and refined duplicate candidates. Bound total seeds across pairs and deduplicate before Newton refinement (row 36). - Region grid intersection counted only distinct pairs against its budget, so a long segment replicated across many cells re-visited the same pair unbounded. Charge every candidate-pair visit against a budget (row 41). New spline degree tests added; all geom and render tests pass, clippy clean. Addresses findings rows 16, 18, 24, 28, 36, 41. * fix: preserve spline knot and fillet search behavior --------- Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>