imprimatur 0.1.0 → 0.3.0

data/ext/imprimatur_native/core/src/docx/picture.rs

@@ -0,0 +1,72 @@
+//! Pictures as inline drawings, their files in `word/media`.
+
+use crate::doc::Picture;
+use crate::doc::picture::Kind;
+use crate::xml::XmlWriter;
+
+pub const WP_NS: &str = "http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing";
+pub const A_NS: &str = "http://schemas.openxmlformats.org/drawingml/2006/main";
+pub const PIC_NS: &str = "http://schemas.openxmlformats.org/drawingml/2006/picture";
+/// English Metric Units a point, as drawings measure.
+const EMU_PER_POINT: f64 = 12_700.0;
+
+/// Its file's extension.
+pub const fn extension(picture: &Picture) -> &'static str {
+    match picture.kind {
+        Kind::Png(_) => "png",
+        Kind::Jpeg { .. } => "jpeg",
+    }
+}
+
+/// Its part in `word/media`, by its number from 1.
+pub fn file_name(picture: &Picture, number: usize) -> String {
+    format!("media/image{number}.{}", extension(picture))
+}
+
+/// A paragraph holding picture `number`, its file `relationship`, at its
+/// size within `room`.
+pub fn paragraph(
+    xml: &mut XmlWriter,
+    picture: &Picture,
+    room: (f64, f64),
+    number: usize,
+    relationship: &str,
+) {
+    let (width, height) = picture.size(room);
+    #[expect(clippy::cast_possible_truncation, clippy::cast_sign_loss, reason = "under 2**31")]
+    let emu = |points: f64| ((points * EMU_PER_POINT).round() as u64).to_string();
+    let (cx, cy, id, name) =
+        (emu(width), emu(height), number.to_string(), format!("Picture {number}"));
+    let extent = [("cx", cx.as_str()), ("cy", cy.as_str())];
+    super::open_paragraph(xml, None, false, picture.align);
+    xml.open("w:r", &[]);
+    xml.open("w:drawing", &[]);
+    xml.open("wp:inline", &[("distT", "0"), ("distB", "0"), ("distL", "0"), ("distR", "0")]);
+    xml.empty("wp:extent", &extent);
+    xml.empty("wp:docPr", &[("id", &id), ("name", &name)]);
+    xml.open("a:graphic", &[]);
+    xml.open("a:graphicData", &[("uri", PIC_NS)]);
+    xml.open("pic:pic", &[]);
+    xml.open("pic:nvPicPr", &[]);
+    xml.empty("pic:cNvPr", &[("id", &id), ("name", &name)]);
+    xml.empty("pic:cNvPicPr", &[]);
+    xml.close("pic:nvPicPr");
+    xml.open("pic:blipFill", &[]);
+    xml.empty("a:blip", &[("r:embed", relationship)]);
+    xml.open("a:stretch", &[]);
+    xml.empty("a:fillRect", &[]);
+    xml.close("a:stretch");
+    xml.close("pic:blipFill");
+    xml.open("pic:spPr", &[]);
+    xml.open("a:xfrm", &[]);
+    xml.empty("a:off", &[("x", "0"), ("y", "0")]);
+    xml.empty("a:ext", &extent);
+    xml.close("a:xfrm");
+    xml.open("a:prstGeom", &[("prst", "rect")]);
+    xml.empty("a:avLst", &[]);
+    xml.close("a:prstGeom");
+    xml.close("pic:spPr");
+    for tag in ["pic:pic", "a:graphicData", "a:graphic", "wp:inline", "w:drawing", "w:r", "w:p"] {
+        xml.close(tag);
+    }
+}

data/ext/imprimatur_native/core/src/docx.rs

@@ -2,13 +2,14 @@
 //! Word paragraphs, runs and tables, with real Heading 1-3 styles so Word's
 //! navigation pane and table of contents see them.
 
+mod picture;
 #[cfg(test)]
 mod tests;
 
 use std::io::Write;
 
 use crate::Result;
-use crate::doc::{Block, Document, Paragraph, Run, Table};
+use crate::doc::{Block, Document, Paragraph, Picture, Run, Table};
 use crate::opc;
 use crate::style::{Align, Color, TextDirection};
 use crate::xml::XmlWriter;
@@ -16,39 +17,58 @@ use crate::zip::ZipWriter;
 
 const W_NS: &str = "http://schemas.openxmlformats.org/wordprocessingml/2006/main";
 const WORD_TYPE: &str = "application/vnd.openxmlformats-officedocument.wordprocessingml";
-/// One inch, Word's default margin, in twips.
-const MARGIN: u32 = 1_440;
 /// A header row's shading.
 const HEADER_FILL: &str = "D9E2F3";
 
 pub fn write<W: Write>(document: &Document, out: W) -> Result<W> {
+    let room = document.room()?;
     let footer = document.has_page_numbers();
-    let mut parts = vec![("styles", "styles.xml")];
+    let mut parts = vec![("styles", "styles.xml".to_owned())];
     if footer {
-        parts.push(("footer", "footer1.xml"));
+        parts.push(("footer", "footer1.xml".to_owned()));
+    }
+    // Pictures' files follow, their relationships numbered from here.
+    let first_media = parts.len() + 1;
+    let pictures: Vec<&Picture> = document
+        .blocks()
+        .iter()
+        .filter_map(|block| if let Block::Picture(picture) = block { Some(picture) } else { None })
+        .collect();
+    for (number, picture) in (1..).zip(&pictures) {
+        parts.push(("image", picture::file_name(picture, number)));
     }
     let mut zip = ZipWriter::new(out);
-    zip.add("[Content_Types].xml", content_types(footer).as_bytes())?;
+    zip.add("[Content_Types].xml", content_types(footer, &pictures).as_bytes())?;
     let package = opc::relationships(&[("officeDocument", "word/document.xml")]);
     zip.add("_rels/.rels", package.as_bytes())?;
-    zip.add("word/document.xml", body(document).as_bytes())?;
+    zip.add("word/document.xml", body(document, room, first_media).as_bytes())?;
     zip.add("word/_rels/document.xml.rels", opc::relationships(&parts).as_bytes())?;
     zip.add("word/styles.xml", styles().as_bytes())?;
     if footer {
         zip.add("word/footer1.xml", page_number_footer().as_bytes())?;
     }
+    for (number, picture) in (1..).zip(&pictures) {
+        zip.add(&format!("word/{}", picture::file_name(picture, number)), &picture.data)?;
+    }
     zip.finish()
 }
 
-/// One override per part: the document, its styles and the footer.
-fn content_types(footer: bool) -> String {
+/// One override per part: the document, its styles and the footer; the
+/// pictures' types by extension.
+fn content_types(footer: bool, pictures: &[&Picture]) -> String {
     let mut parts = vec![("/word/document.xml", "document.main"), ("/word/styles.xml", "styles")];
     if footer {
         parts.push(("/word/footer1.xml", "footer"));
     }
     let overrides: Vec<(&str, String)> =
         parts.into_iter().map(|(part, kind)| (part, format!("{WORD_TYPE}.{kind}+xml"))).collect();
-    opc::content_types(&[], &overrides)
+    let mut defaults = Vec::new();
+    for (extension, content_type) in [("png", "image/png"), ("jpeg", "image/jpeg")] {
+        if pictures.iter().any(|picture| picture::extension(picture) == extension) {
+            defaults.push((extension, content_type));
+        }
+    }
+    opc::content_types(&defaults, &overrides)
 }
 
 /// `word/footer1.xml`: a centered `PAGE / NUMPAGES`, which Word computes.
@@ -82,18 +102,34 @@ fn page_number_footer() -> String {
     xml.finish()
 }
 
-fn body(document: &Document) -> String {
+fn body(document: &Document, room: (f64, f64), first_media: usize) -> String {
+    // What reads in no direction of its own (figures, punctuation) takes the
+    // document's.
+    let rtl = document.reads_right_to_left();
     let mut xml = XmlWriter::new();
-    xml.open("w:document", &[("xmlns:w", W_NS), ("xmlns:r", opc::RELATIONSHIPS)]);
+    let namespaces = [
+        ("xmlns:w", W_NS),
+        ("xmlns:r", opc::RELATIONSHIPS),
+        ("xmlns:wp", picture::WP_NS),
+        ("xmlns:a", picture::A_NS),
+        ("xmlns:pic", picture::PIC_NS),
+    ];
+    xml.open("w:document", &namespaces);
     xml.open("w:body", &[]);
+    let mut pictures = 0;
     for block in document.blocks() {
         match block {
             Block::Heading { level, text } => {
                 let style = format!("Heading{level}");
-                simple_paragraph(&mut xml, Some(&style), text, Look::default());
+                simple_paragraph(&mut xml, Some(&style), text, Look::default(), rtl);
+            }
+            Block::Paragraph(content) => paragraph(&mut xml, content, rtl),
+            Block::Table(content) => table(&mut xml, content, document, rtl),
+            Block::Picture(content) => {
+                pictures += 1;
+                let relationship = format!("rId{}", first_media + pictures - 1);
+                picture::paragraph(&mut xml, content, room, pictures, &relationship);
             }
-            Block::Paragraph(content) => paragraph(&mut xml, content),
-            Block::Table(content) => table(&mut xml, content, document),
             Block::PageBreak => {
                 xml.open("w:p", &[]);
                 xml.open("w:r", &[]);
@@ -107,25 +143,37 @@ fn body(document: &Document) -> String {
     if matches!(document.blocks().last(), Some(Block::Table(_))) {
         xml.empty("w:p", &[]);
     }
-    section(&mut xml, document);
+    section(&mut xml, document, rtl);
     xml.close("w:body");
     xml.close("w:document");
     xml.finish()
 }
 
-fn paragraph(xml: &mut XmlWriter, content: &Paragraph) {
-    let rtl = content.direction == Some(TextDirection::RightToLeft);
+/// Each run reads in the direction of its own first letter, as Word sets
+/// them: the Latin runs of a Hebrew paragraph left to right, the Arabic
+/// ones of an English paragraph right to left.
+fn paragraph(xml: &mut XmlWriter, content: &Paragraph, document_rtl: bool) {
+    let rtl = right_to_left(content.effective_direction(), document_rtl);
     open_paragraph(xml, None, rtl, content.align);
     for item in &content.runs {
-        run(xml, &item.text, Look::of(item), rtl);
+        run(xml, &item.text, Look::of(item), right_to_left(TextDirection::of(&item.text), rtl));
     }
     xml.close("w:p");
 }
 
-/// A one-run paragraph straight from borrowed text: headings and table cells.
-fn simple_paragraph(xml: &mut XmlWriter, style: Option<&str>, text: &str, look: Look) {
-    open_paragraph(xml, style, false, None);
-    run(xml, text, look, false);
+/// Whether `direction` is right to left; `otherwise` when there is none:
+/// text with no letter (figures, punctuation) takes the direction of what
+/// holds it.
+fn right_to_left(direction: Option<TextDirection>, otherwise: bool) -> bool {
+    direction.map_or(otherwise, |direction| direction == TextDirection::RightToLeft)
+}
+
+/// A one-run paragraph straight from borrowed text: headings and table
+/// cells, in the direction of their first letter, or of what holds them.
+fn simple_paragraph(xml: &mut XmlWriter, style: Option<&str>, text: &str, look: Look, rtl: bool) {
+    let rtl = right_to_left(TextDirection::of(text), rtl);
+    open_paragraph(xml, style, rtl, None);
+    run(xml, text, look, rtl);
     xml.close("w:p");
 }
 
@@ -207,16 +255,20 @@ fn run(xml: &mut XmlWriter, text: &str, look: Look, rtl: bool) {
     xml.close("w:r");
 }
 
-fn table(xml: &mut XmlWriter, content: &Table, document: &Document) {
+fn table(xml: &mut XmlWriter, content: &Table, document: &Document, document_rtl: bool) {
+    let rtl = right_to_left(content.direction(), document_rtl);
     let columns = content.columns();
     let (page_width, _) = document.page_size().twips();
-    let usable = page_width - 2 * MARGIN;
+    let usable = page_width - 2 * margin(document);
     // Never 0: a table has at least one column.
     let column_width = (usable / u32::try_from(columns).unwrap_or(1).max(1)).to_string();
 
     xml.open("w:tbl", &[]);
     xml.open("w:tblPr", &[]);
     xml.empty("w:tblStyle", &[("w:val", "TableGrid")]);
+    if rtl {
+        xml.empty("w:bidiVisual", &[]);
+    }
     xml.empty("w:tblW", &[("w:w", "5000"), ("w:type", "pct")]);
     xml.close("w:tblPr");
     xml.open("w:tblGrid", &[]);
@@ -244,7 +296,7 @@ fn table(xml: &mut XmlWriter, content: &Table, document: &Document) {
             }
             xml.close("w:tcPr");
             let text = row.get(column).map_or("", String::as_str);
-            simple_paragraph(xml, None, text, Look { bold: header, ..Look::default() });
+            simple_paragraph(xml, None, text, Look { bold: header, ..Look::default() }, rtl);
             xml.close("w:tc");
         }
         xml.close("w:tr");
@@ -252,9 +304,17 @@ fn table(xml: &mut XmlWriter, content: &Table, document: &Document) {
     xml.close("w:tbl");
 }
 
-fn section(xml: &mut XmlWriter, document: &Document) {
+/// The document's margin in twips.
+fn margin(document: &Document) -> u32 {
+    #[expect(clippy::cast_possible_truncation, clippy::cast_sign_loss, reason = "0 to 2880")]
+    let twips = (document.margin() * 20.0).round() as u32;
+    twips
+}
+
+fn section(xml: &mut XmlWriter, document: &Document, rtl: bool) {
     let (width, height) = document.page_size().twips();
-    let (width, height, margin) = (width.to_string(), height.to_string(), MARGIN.to_string());
+    let (width, height, margin) =
+        (width.to_string(), height.to_string(), margin(document).to_string());
     xml.open("w:sectPr", &[]);
     if document.has_page_numbers() {
         // rId2: the footer, after the styles (see `write`).
@@ -264,6 +324,9 @@ fn section(xml: &mut XmlWriter, document: &Document) {
     let margins =
         [("w:top", &margin), ("w:right", &margin), ("w:bottom", &margin), ("w:left", &margin)];
     xml.empty("w:pgMar", &margins.map(|(key, value)| (key, value.as_str())));
+    if rtl {
+        xml.empty("w:bidi", &[]);
+    }
     xml.close("w:sectPr");
 }
 

data/ext/imprimatur_native/core/src/error.rs

@@ -45,6 +45,9 @@ pub enum Error {
     #[error("font size {0} is out of range (1 to 409 points, in steps of 0.5)")]
     InvalidFontSize(f64),
 
+    #[error("unsupported font: {0}")]
+    UnsupportedFont(&'static str),
+
     #[error("invalid cell range {0:?}: expected a reference such as B2 or B2:D9")]
     InvalidRange(String),
 
@@ -66,6 +69,15 @@ pub enum Error {
     #[error("a table needs at least one row and one column")]
     EmptyTable,
 
+    #[error("invalid picture: {0}")]
+    InvalidImage(&'static str),
+
+    #[error("page size {0} x {1} points is out of range (36 to 1584 points a side)")]
+    InvalidPageSize(f64, f64),
+
+    #[error("margin {0} points is out of range (0 to 144), or leaves no room on the page")]
+    InvalidMargin(f64),
+
     #[error(
         "{character:?} (U+{code:04X}) cannot be written with the PDF standard font {font}: \
          only Windows-1252 (Latin) text is supported until embedded fonts land",
@@ -97,7 +109,7 @@ pub enum Error {
     #[error("the PDF has no text layer: its pages are images, which need OCR")]
     NoTextLayer,
 
-    #[error("the PDF is encrypted with a password")]
+    #[error("the document is encrypted with a password")]
     PasswordRequired,
 
     #[error(transparent)]

data/ext/imprimatur_native/core/src/font.rs

@@ -0,0 +1,229 @@
+//! Static TrueType font data, Unicode glyph lookup and unscaled metrics.
+//!
+//! This does not select or embed fonts in documents, shape text, or perform
+//! bidirectional layout. A character's nominal glyph is not necessarily the
+//! glyph used when shaping a script such as Arabic.
+
+#[cfg(test)]
+mod tests;
+
+use read_fonts::{
+    FontRead, FontRef, MinByteRange, TableProvider,
+    tables::{
+        cmap::{Cmap, CmapSubtable, PlatformId},
+        hmtx::Hmtx,
+    },
+    types::{GlyphId, Tag, Version16Dot16},
+};
+
+use crate::{Error, Result};
+
+/// Horizontal line metrics in font design units, taken from `head` and `hhea`.
+///
+/// Multiply a metric by the point size and divide by `units_per_em` to convert
+/// it to points. These are the raw `hhea` metrics, not an OS/2 line-height policy.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FontMetrics {
+    pub units_per_em: u16,
+    pub ascender: i16,
+    /// Usually negative: the position below the baseline.
+    pub descender: i16,
+    pub line_gap: i16,
+}
+
+/// A borrowed, standalone static TrueType font with a Unicode character map.
+///
+/// Loading checks table bounds and the data needed for glyph lookup and metrics,
+/// including the `loca` offsets into `glyf`. It is not a full font sanitizer:
+/// checksums, outline programs and shaping tables are not validated.
+#[derive(Clone)]
+pub struct TrueTypeFont<'a> {
+    data: &'a [u8],
+    cmap: CmapSubtable<'a>,
+    hmtx: Hmtx<'a>,
+    metrics: FontMetrics,
+    glyph_count: u16,
+}
+
+impl<'a> TrueTypeFont<'a> {
+    /// Load font data without copying it or accessing system fonts.
+    ///
+    /// # Errors
+    /// [`Error::UnsupportedFont`] for collections, WOFF, CFF, variable fonts or
+    /// fonts without a supported Unicode cmap. [`Error::Malformed`] for invalid
+    /// headers, missing required tables or inconsistent metrics/outline offsets.
+    pub fn from_bytes(data: &'a [u8]) -> Result<Self> {
+        match data.get(..4) {
+            Some(b"\0\x01\0\0" | b"true") => {}
+            Some(b"ttcf") => return Err(Error::UnsupportedFont("font collections")),
+            Some(b"wOFF" | b"wOF2") => return Err(Error::UnsupportedFont("WOFF/WOFF2")),
+            Some(b"OTTO") => return Err(Error::UnsupportedFont("CFF outlines")),
+            _ => return Err(invalid("invalid or truncated sfnt header")),
+        }
+        let font = FontRef::new(data).map_err(invalid)?;
+        for record in font.table_directory().table_records() {
+            if u64::from(record.offset()) + u64::from(record.length()) > data.len() as u64 {
+                return Err(invalid(format!(
+                    "{} table extends beyond the font data",
+                    record.tag()
+                )));
+            }
+            match record.tag() {
+                tag if tag == Tag::new(b"fvar") || tag == Tag::new(b"gvar") => {
+                    return Err(Error::UnsupportedFont("variable fonts"));
+                }
+                tag if tag == Tag::new(b"CFF ") || tag == Tag::new(b"CFF2") => {
+                    return Err(Error::UnsupportedFont("CFF outlines"));
+                }
+                _ => {}
+            }
+        }
+
+        let head = font.head().map_err(invalid)?;
+        if head.magic_number() != 0x5F0F_3CF5 || !(16..=16384).contains(&head.units_per_em()) {
+            return Err(invalid("invalid head magic number or units per em"));
+        }
+        let maxp = font.maxp().map_err(invalid)?;
+        let glyph_count = maxp.num_glyphs();
+        if maxp.version() != Version16Dot16::VERSION_1_0
+            || maxp.max_component_depth().is_none()
+            || glyph_count == 0
+        {
+            return Err(invalid("expected a complete TrueType maxp table with at least one glyph"));
+        }
+        let hhea = font.hhea().map_err(invalid)?;
+        let count = hhea.number_of_h_metrics();
+        if count == 0 || count > glyph_count {
+            return Err(invalid("hhea metric count is outside the glyph range"));
+        }
+        let hmtx = font.hmtx().map_err(invalid)?;
+        if hmtx.h_metrics().len() != usize::from(count)
+            || hmtx.left_side_bearings().len() < usize::from(glyph_count - count)
+        {
+            return Err(invalid("truncated hmtx table"));
+        }
+        validate_outlines(&font, head.index_to_loc_format(), glyph_count)?;
+        let cmap = font.cmap().map_err(invalid)?;
+        if cmap.version() != 0 || cmap.encoding_records().len() != usize::from(cmap.num_tables()) {
+            return Err(invalid("invalid or truncated cmap header"));
+        }
+        Ok(Self {
+            data,
+            cmap: unicode_cmap(&cmap)?,
+            hmtx,
+            metrics: FontMetrics {
+                units_per_em: head.units_per_em(),
+                ascender: hhea.ascender().into(),
+                descender: hhea.descender().into(),
+                line_gap: hhea.line_gap().into(),
+            },
+            glyph_count,
+        })
+    }
+
+    /// The original font bytes.
+    #[must_use]
+    pub const fn as_bytes(&self) -> &'a [u8] {
+        self.data
+    }
+
+    /// Unscaled horizontal line metrics.
+    #[must_use]
+    pub const fn metrics(&self) -> FontMetrics {
+        self.metrics
+    }
+
+    /// The number of glyphs, including glyph zero (`.notdef`).
+    #[must_use]
+    pub const fn glyph_count(&self) -> u16 {
+        self.glyph_count
+    }
+
+    /// The nominal glyph for a Unicode character, without shaping or fallback.
+    ///
+    /// Returns `None` for missing characters, mappings to `.notdef`, or mappings
+    /// outside the font's glyph range. Symbol and legacy cmaps are never used as
+    /// Unicode mappings; full-repertoire Unicode cmaps take priority over BMP ones.
+    #[must_use]
+    pub fn glyph_id(&self, character: char) -> Option<u16> {
+        let glyph = self.cmap.map_codepoint(character)?.to_u32();
+        u16::try_from(glyph).ok().filter(|&id| id != 0 && id < self.glyph_count)
+    }
+
+    /// The horizontal advance in font design units, without kerning or shaping.
+    ///
+    /// Glyph zero is allowed; an out-of-range glyph returns `None`. A valid
+    /// zero-width glyph returns `Some(0)`.
+    #[must_use]
+    pub fn advance_width(&self, glyph_id: u16) -> Option<u16> {
+        if glyph_id >= self.glyph_count {
+            return None;
+        }
+        self.hmtx.advance(GlyphId::new(u32::from(glyph_id)))
+    }
+}
+
+fn validate_outlines(font: &FontRef<'_>, loca_format: i16, glyph_count: u16) -> Result<()> {
+    if !matches!(loca_format, 0 | 1) {
+        return Err(invalid("invalid head indexToLocFormat"));
+    }
+    let loca = font.loca(loca_format == 1).map_err(invalid)?;
+    let glyf = font.glyf().map_err(invalid)?;
+    if loca.len() != usize::from(glyph_count)
+        || !loca.all_offsets_are_ascending()
+        || loca
+            .get_raw(usize::from(glyph_count))
+            .is_none_or(|end| u64::from(end) > glyf.offset_data().len() as u64)
+    {
+        return Err(invalid("invalid loca offsets or truncated glyf table"));
+    }
+    Ok(())
+}
+
+fn unicode_cmap<'a>(cmap: &Cmap<'a>) -> Result<CmapSubtable<'a>> {
+    // Fontations' best_subtable also accepts symbol and MacRoman maps. Only
+    // Unicode encodings belong here; prefer full repertoire over BMP mappings.
+    let encodings = [
+        (PlatformId::Windows, 10),
+        (PlatformId::Unicode, 6),
+        (PlatformId::Unicode, 4),
+        (PlatformId::Windows, 1),
+        (PlatformId::Unicode, 3),
+        (PlatformId::Unicode, 2),
+        (PlatformId::Unicode, 1),
+        (PlatformId::Unicode, 0),
+    ];
+    for (platform, encoding) in encodings {
+        for record in cmap.encoding_records() {
+            if record.platform_id() != platform || record.encoding_id() != encoding {
+                continue;
+            }
+            let subtable = record.subtable(cmap.offset_data()).map_err(invalid)?;
+            let length = match &subtable {
+                CmapSubtable::Format0(table) => u32::from(table.length()),
+                CmapSubtable::Format4(table) => u32::from(table.length()),
+                CmapSubtable::Format6(table) => u32::from(table.length()),
+                CmapSubtable::Format10(table) => table.length(),
+                CmapSubtable::Format12(table) => table.length(),
+                CmapSubtable::Format13(table) => table.length(),
+                _ => continue,
+            };
+            let length = usize::try_from(length).map_err(|_| invalid("cmap subtable too large"))?;
+            let data = subtable
+                .offset_data()
+                .slice(0..length)
+                .ok_or_else(|| invalid("truncated cmap subtable"))?;
+            // Constrain lazy array reads to this subtable's declared extent.
+            let subtable = CmapSubtable::read(data).map_err(invalid)?;
+            if subtable.min_byte_range().end > length {
+                return Err(invalid("truncated cmap arrays"));
+            }
+            return Ok(subtable);
+        }
+    }
+    Err(Error::UnsupportedFont("no supported Unicode cmap"))
+}
+
+fn invalid(reason: impl std::fmt::Display) -> Error {
+    Error::malformed("TrueType font", reason.to_string())
+}

data/ext/imprimatur_native/core/src/lib.rs

@@ -18,12 +18,17 @@
 //! # Ok::<(), imprimatur::Error>(())
 //! ```
 
+#[cfg(feature = "archive")]
+pub mod archive;
 pub mod doc;
 mod docx;
 mod error;
+#[cfg(feature = "fonts")]
+pub mod font;
 mod opc;
 mod pdf;
 pub mod read;
+mod script;
 pub mod style;
 #[cfg(test)]
 mod test_support;