imprimatur 0.1.0

data/ext/imprimatur_native/core/src/read/pdf/document.rs

@@ -0,0 +1,420 @@
+//! A PDF file's objects on demand: loaded once and shared, decrypted, and
+//! their streams decoded; then the pages, with what they inherit.
+
+use std::borrow::Cow;
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::ops::Deref;
+use std::rc::Rc;
+
+use super::crypt::Crypt;
+use super::filter;
+use super::lexer::{Lexer, Token};
+use super::object::{Dict, Name, Object, Parser, Stream, malformed};
+use super::xref::{Entry, Xref, is_limit};
+use crate::read::Budget;
+use crate::{Error, Result};
+
+/// How many references in a row resolve before giving up on a cycle.
+const MAX_HOPS: usize = 16;
+
+/// An object borrowed from its container, or a loaded indirect one.
+pub enum Resolved<'a> {
+    Borrowed(&'a Object),
+    Shared(Rc<Object>),
+}
+
+impl Resolved<'_> {
+    /// Shared ownership of the object: the loaded one, or a copy of a
+    /// borrowed direct one.
+    pub fn into_shared(self) -> Rc<Object> {
+        match self {
+            Self::Borrowed(object) => Rc::new(object.clone()),
+            Self::Shared(object) => object,
+        }
+    }
+}
+
+impl Deref for Resolved<'_> {
+    type Target = Object;
+
+    fn deref(&self) -> &Object {
+        match self {
+            Self::Borrowed(object) => object,
+            Self::Shared(object) => object,
+        }
+    }
+}
+
+/// An object stream's decoded data and where each of its objects starts.
+struct ObjectStream {
+    data: Vec<u8>,
+    offsets: Vec<(u32, usize)>,
+}
+
+pub struct Page {
+    pub resources: Option<Rc<Object>>,
+    pub contents: Vec<Object>,
+    pub media_box: [f64; 4],
+    pub rotate: i64,
+}
+
+pub struct Document<'a> {
+    data: &'a [u8],
+    budget: &'a Budget<'a>,
+    xref: Xref,
+    crypt: Option<Crypt>,
+    objects: RefCell<HashMap<u32, Rc<Object>>>,
+    streams: RefCell<HashMap<u32, Rc<ObjectStream>>>,
+    loading: RefCell<Vec<u32>>,
+}
+
+impl<'a> Document<'a> {
+    /// Reads the cross-reference table and opens the encryption, if any.
+    pub fn open(data: &'a [u8], budget: &'a Budget<'a>) -> Result<Self> {
+        let xref = Xref::read(data, budget)?;
+        let mut document = Self {
+            data,
+            budget,
+            xref,
+            crypt: None,
+            objects: RefCell::default(),
+            streams: RefCell::default(),
+            loading: RefCell::default(),
+        };
+        if let Some(encrypt) = document.xref.trailer.get(b"Encrypt").cloned() {
+            let encrypt = document.resolve(&encrypt)?;
+            if let Some(encrypt) = encrypt.as_dict() {
+                let ids = document.xref.trailer.get(b"ID").and_then(Object::as_array);
+                let id =
+                    ids.and_then(|ids| ids.first()).and_then(Object::as_bytes).unwrap_or_default();
+                document.crypt = Some(Crypt::new(encrypt, id)?);
+                // Objects read while opening it were not decrypted.
+                document.objects.borrow_mut().clear();
+            }
+        }
+        Ok(document)
+    }
+
+    pub const fn budget(&self) -> &'a Budget<'a> {
+        self.budget
+    }
+
+    pub const fn trailer(&self) -> &Dict {
+        &self.xref.trailer
+    }
+
+    /// Object `number`, `Null` when it is missing or unreadable.
+    pub fn get(&self, number: u32) -> Result<Rc<Object>> {
+        if let Some(found) = self.objects.borrow().get(&number) {
+            return Ok(Rc::clone(found));
+        }
+        if self.loading.borrow().contains(&number) || self.loading.borrow().len() > MAX_HOPS * 4 {
+            return Ok(Rc::new(Object::Null));
+        }
+        self.budget.tick()?;
+        self.loading.borrow_mut().push(number);
+        let loaded = self.load(number);
+        self.loading.borrow_mut().pop();
+        let object = match loaded {
+            Ok(object) => Rc::new(object),
+            Err(error) if is_limit(&error) || matches!(error, Error::PasswordRequired) => {
+                return Err(error);
+            }
+            Err(_) => Rc::new(Object::Null),
+        };
+        self.objects.borrow_mut().insert(number, Rc::clone(&object));
+        Ok(object)
+    }
+
+    /// `object`, or what it refers to (through references to references).
+    pub fn resolve<'b>(&self, object: &'b Object) -> Result<Resolved<'b>> {
+        let Object::Ref(mut number, _) = *object else {
+            return Ok(Resolved::Borrowed(object));
+        };
+        for _ in 0..MAX_HOPS {
+            let found = self.get(number)?;
+            match *found {
+                Object::Ref(next, _) => number = next,
+                _ => return Ok(Resolved::Shared(found)),
+            }
+        }
+        Ok(Resolved::Shared(Rc::new(Object::Null)))
+    }
+
+    /// A dictionary entry, resolved.
+    pub fn entry<'b>(&self, dict: &'b Dict, key: &[u8]) -> Result<Option<Resolved<'b>>> {
+        dict.get(key).map(|value| self.resolve(value)).transpose()
+    }
+
+    fn load(&self, number: u32) -> Result<Object> {
+        match self.xref.entries.get(&number) {
+            Some(&Entry::Offset { offset, generation }) => {
+                let mut parser = Parser::new(self.data, offset, self.budget.max_depth());
+                let length = |length: &Object| match *length {
+                    Object::Integer(length) => usize::try_from(length).ok(),
+                    Object::Ref(number, _) => self
+                        .get(number)
+                        .ok()?
+                        .as_integer()
+                        .and_then(|length| usize::try_from(length).ok()),
+                    _ => None,
+                };
+                let (found, _, mut object) = parser.indirect(&length)?;
+                if found != number {
+                    return Err(malformed("the cross-reference table points at the wrong object"));
+                }
+                if let Some(crypt) = &self.crypt {
+                    decrypt_strings(&mut object, crypt, (number, generation));
+                }
+                Ok(object)
+            }
+            Some(&Entry::Compressed { stream, index }) => self.compressed(stream, number, index),
+            _ => Ok(Object::Null),
+        }
+    }
+
+    /// An object inside an object stream (never encrypted on its own: the
+    /// stream is).
+    fn compressed(&self, stream_number: u32, number: u32, index: u32) -> Result<Object> {
+        let stream = self.object_stream(stream_number)?;
+        let at = usize::try_from(index)
+            .ok()
+            .and_then(|index| stream.offsets.get(index))
+            .filter(|(found, _)| *found == number)
+            .or_else(|| stream.offsets.iter().find(|(found, _)| *found == number));
+        let Some(&(_, offset)) = at else { return Ok(Object::Null) };
+        Parser::new(&stream.data, offset, self.budget.max_depth()).object()
+    }
+
+    fn object_stream(&self, number: u32) -> Result<Rc<ObjectStream>> {
+        if let Some(found) = self.streams.borrow().get(&number) {
+            return Ok(Rc::clone(found));
+        }
+        let object = self.get(number)?;
+        let Object::Stream(stream) = &*object else {
+            return Err(malformed("an object stream that is not a stream"));
+        };
+        let data = self.decode(stream, Some(number))?;
+        let size = |key: &[u8]| {
+            stream.dict.get(key).and_then(Object::as_integer).and_then(|n| usize::try_from(n).ok())
+        };
+        let (count, first) = (size(b"N").unwrap_or(0), size(b"First").unwrap_or(0));
+        let mut lexer = Lexer::new(&data, 0);
+        let mut offsets = Vec::with_capacity(count.min(100_000));
+        for _ in 0..count {
+            let (Some(Token::Integer(number)), Some(Token::Integer(offset))) =
+                (lexer.next(), lexer.next())
+            else {
+                break;
+            };
+            if let (Ok(number), Ok(offset)) = (u32::try_from(number), usize::try_from(offset)) {
+                offsets.push((number, first.saturating_add(offset)));
+            }
+        }
+        let stream = Rc::new(ObjectStream { data, offsets });
+        self.streams.borrow_mut().insert(number, Rc::clone(&stream));
+        Ok(stream)
+    }
+
+    /// A stream's data: decrypted (with its object's key) and decoded.
+    pub fn decode(&self, stream: &Stream, number: Option<u32>) -> Result<Vec<u8>> {
+        let raw = self.raw(stream, number)?;
+        let filters = self.filters(&stream.dict)?;
+        decode_with(&raw, &filters, self.budget)
+    }
+
+    /// A stream's data decrypted, not yet decoded.
+    pub fn raw(&self, stream: &Stream, number: Option<u32>) -> Result<Cow<'a, [u8]>> {
+        let raw = self
+            .data
+            .get(stream.data.clone())
+            .ok_or_else(|| malformed("stream data past the end"))?;
+        Ok(match (&self.crypt, number) {
+            (Some(crypt), Some(number)) if !stream.dict.has_name(b"Type", b"XRef") => {
+                let generation = match self.xref.entries.get(&number) {
+                    Some(&Entry::Offset { generation, .. }) => generation,
+                    _ => 0,
+                };
+                Cow::Owned(crypt.decrypt(true, (number, generation), raw))
+            }
+            _ => Cow::Borrowed(raw),
+        })
+    }
+
+    /// A stream's filters in order, each with its decode parameters.
+    pub fn filters(&self, dict: &Dict) -> Result<Vec<Filter>> {
+        let filter = self.entry(dict, b"Filter")?;
+        let params = self.entry(dict, b"DecodeParms")?;
+        let mut filters = Vec::new();
+        match filter.as_deref() {
+            Some(Object::Name(name)) => {
+                filters.push((name.clone(), self.params(params.as_deref(), None)?));
+            }
+            Some(Object::Array(names)) => {
+                for (index, name) in names.iter().enumerate() {
+                    if let Object::Name(name) = name {
+                        filters.push((name.clone(), self.params(params.as_deref(), Some(index))?));
+                    }
+                }
+            }
+            _ => {}
+        }
+        Ok(filters)
+    }
+
+    /// The decode parameters of one filter: the dictionary, or the
+    /// `index`th of an array of them.
+    fn params(&self, params: Option<&Object>, index: Option<usize>) -> Result<Option<Rc<Object>>> {
+        let chosen = match (params, index) {
+            (Some(Object::Array(all)), Some(index)) => all.get(index),
+            (Some(Object::Array(_)), None) | (None, _) => None,
+            (Some(single), _) => Some(single),
+        };
+        chosen.map(|object| self.resolve(object).map(Resolved::into_shared)).transpose()
+    }
+
+    /// A stream given by reference (or directly), decoded; `None` when it is
+    /// not a stream.
+    pub fn stream_data(&self, object: &Object) -> Result<Option<Vec<u8>>> {
+        let number = object.as_reference().map(|(number, _)| number);
+        let resolved = self.resolve(object)?;
+        match &*resolved {
+            Object::Stream(stream) => self.decode(stream, number).map(Some),
+            _ => Ok(None),
+        }
+    }
+
+    /// The pages in order. When the page tree is broken, every object of
+    /// type `/Page`, by object number.
+    pub fn pages(&self) -> Result<Vec<Page>> {
+        let mut pages = Vec::new();
+        if let Some(root) = self.trailer().get(b"Root").cloned() {
+            let root = self.resolve(&root)?;
+            if let Some(tree) = root.as_dict().and_then(|root| root.get(b"Pages")).cloned() {
+                let inherited =
+                    Inherited { resources: None, media_box: [0.0, 0.0, 612.0, 792.0], rotate: 0 };
+                let mut visited = Vec::new();
+                self.walk(&tree, &inherited, 0, &mut visited, &mut pages)?;
+            }
+        }
+        if pages.is_empty() {
+            let mut numbers: Vec<u32> = self.xref.entries.keys().copied().collect();
+            numbers.sort_unstable();
+            for number in numbers {
+                let object = self.get(number)?;
+                if let Some(dict) = object.as_dict()
+                    && dict.has_name(b"Type", b"Page")
+                {
+                    let inherited = Inherited {
+                        resources: None,
+                        media_box: [0.0, 0.0, 612.0, 792.0],
+                        rotate: 0,
+                    };
+                    pages.push(self.page(dict, &inherited)?);
+                }
+            }
+        }
+        Ok(pages)
+    }
+
+    fn walk(
+        &self,
+        node: &Object,
+        inherited: &Inherited,
+        depth: usize,
+        visited: &mut Vec<u32>,
+        pages: &mut Vec<Page>,
+    ) -> Result<()> {
+        self.budget.nest(depth)?;
+        if let Some((number, _)) = node.as_reference() {
+            if visited.contains(&number) {
+                return Ok(());
+            }
+            visited.push(number);
+        }
+        let node = self.resolve(node)?;
+        let Some(dict) = node.as_dict() else { return Ok(()) };
+        let inherited = self.inherit(dict, inherited)?;
+        match self.entry(dict, b"Kids")?.as_deref() {
+            Some(Object::Array(kids)) if !dict.has_name(b"Type", b"Page") => {
+                for kid in kids {
+                    self.walk(kid, &inherited, depth + 1, visited, pages)?;
+                }
+            }
+            _ => pages.push(self.page(dict, &inherited)?),
+        }
+        Ok(())
+    }
+
+    fn inherit(&self, dict: &Dict, inherited: &Inherited) -> Result<Inherited> {
+        let resources = match dict.get(b"Resources") {
+            Some(object) => Some(self.resolve(object)?.into_shared()),
+            None => inherited.resources.clone(),
+        };
+        let media_box = match self.entry(dict, b"MediaBox")?.as_deref().and_then(Object::as_array) {
+            Some(corners) if corners.len() == 4 => {
+                let mut media_box = [0.0; 4];
+                for (slot, corner) in media_box.iter_mut().zip(corners) {
+                    *slot = self.resolve(corner)?.as_number().unwrap_or(0.0);
+                }
+                media_box
+            }
+            _ => inherited.media_box,
+        };
+        let rotate = self
+            .entry(dict, b"Rotate")?
+            .and_then(|rotate| rotate.as_integer())
+            .unwrap_or(inherited.rotate);
+        Ok(Inherited { resources, media_box, rotate })
+    }
+
+    fn page(&self, dict: &Dict, inherited: &Inherited) -> Result<Page> {
+        let inherited = self.inherit(dict, inherited)?;
+        let contents = match dict.get(b"Contents") {
+            Some(reference @ Object::Ref(..)) => match &*self.resolve(reference)? {
+                Object::Array(parts) => parts.clone(),
+                _ => vec![reference.clone()],
+            },
+            Some(Object::Array(parts)) => parts.clone(),
+            Some(other) => vec![other.clone()],
+            None => Vec::new(),
+        };
+        Ok(Page {
+            resources: inherited.resources,
+            contents,
+            media_box: inherited.media_box,
+            rotate: inherited.rotate,
+        })
+    }
+}
+
+/// A filter's name and its decode parameters.
+pub type Filter = (Name, Option<Rc<Object>>);
+
+/// `raw` through `filters`, in order.
+pub fn decode_with(raw: &[u8], filters: &[Filter], budget: &Budget<'_>) -> Result<Vec<u8>> {
+    let filters: Vec<(&[u8], Option<&Dict>)> = filters
+        .iter()
+        .map(|(name, params)| (&**name, params.as_deref().and_then(Object::as_dict)))
+        .collect();
+    filter::decode(raw, &filters, budget)
+}
+
+struct Inherited {
+    resources: Option<Rc<Object>>,
+    media_box: [f64; 4],
+    rotate: i64,
+}
+
+/// Decrypts every string in an object freshly read from the file.
+fn decrypt_strings(object: &mut Object, crypt: &Crypt, id: (u32, u16)) {
+    match object {
+        Object::String(bytes) => *bytes = crypt.decrypt(false, id, bytes),
+        Object::Array(items) => items.iter_mut().for_each(|item| decrypt_strings(item, crypt, id)),
+        Object::Dict(dict) | Object::Stream(Stream { dict, .. }) => {
+            dict.0.iter_mut().for_each(|(_, value)| decrypt_strings(value, crypt, id));
+        }
+        _ => {}
+    }
+}

data/ext/imprimatur_native/core/src/read/pdf/filter.rs

@@ -0,0 +1,258 @@
+//! Stream filters (ISO 32000-1, 7.4): what text and fonts are compressed
+//! with. Image codecs are not decoded; nothing here reads images.
+
+#[cfg(test)]
+mod tests;
+
+use super::object::{Dict, Object, malformed};
+use crate::read::Budget;
+use crate::{Error, Result};
+
+/// Applies `filters` in order, each with its parameters.
+pub fn decode(
+    data: &[u8],
+    filters: &[(&[u8], Option<&Dict>)],
+    budget: &Budget<'_>,
+) -> Result<Vec<u8>> {
+    let mut current: Option<Vec<u8>> = None;
+    for &(name, params) in filters {
+        let input = current.as_deref().unwrap_or(data);
+        let output = match name {
+            b"FlateDecode" | b"Fl" => predict(inflate(input, budget)?, params)?,
+            b"LZWDecode" | b"LZW" => {
+                let early = params
+                    .and_then(|params| params.get(b"EarlyChange"))
+                    .and_then(Object::as_integer)
+                    != Some(0);
+                predict(lzw(input, early, budget)?, params)?
+            }
+            b"ASCII85Decode" | b"A85" => ascii85(input),
+            b"ASCIIHexDecode" | b"AHx" => super::lexer::hex_bytes(
+                input.split(|&byte| byte == b'>').next().unwrap_or_default(),
+            ),
+            b"RunLengthDecode" | b"RL" => run_length(input),
+            b"Crypt" => continue,
+            _ => {
+                return Err(Error::UnsupportedDocument(format!(
+                    "the {} stream filter",
+                    String::from_utf8_lossy(name)
+                )));
+            }
+        };
+        budget.inflate(output.len())?;
+        budget.check()?;
+        current = Some(output);
+    }
+    Ok(current.unwrap_or_else(|| data.to_vec()))
+}
+
+/// zlib, or raw deflate when the header is missing. A truncated or
+/// corrupt stream yields what inflated before the damage, as viewers show.
+fn inflate(data: &[u8], budget: &Budget<'_>) -> Result<Vec<u8>> {
+    let zlib = data.len() > 2
+        && data[0] & 0x0F == 8
+        && (u16::from(data[0]) << 8 | u16::from(data[1])).is_multiple_of(31);
+    let expected = data.len().saturating_mul(4);
+    let (output, complete) =
+        crate::read::inflate::inflate(data, zlib, expected, budget.inflatable())?;
+    if complete || !output.is_empty() {
+        return Ok(output);
+    }
+    if zlib {
+        // A header that only looked like zlib's: try the bytes as raw deflate.
+        let (output, _) =
+            crate::read::inflate::inflate(data, false, expected, budget.inflatable())?;
+        if !output.is_empty() {
+            return Ok(output);
+        }
+    }
+    Err(malformed("a stream does not inflate"))
+}
+
+/// Undoes a PNG (10 and up) or TIFF (2) predictor.
+fn predict(data: Vec<u8>, params: Option<&Dict>) -> Result<Vec<u8>> {
+    let Some(params) = params else { return Ok(data) };
+    let number =
+        |key: &[u8], default: i64| params.get(key).and_then(Object::as_integer).unwrap_or(default);
+    let predictor = number(b"Predictor", 1);
+    if predictor < 2 {
+        return Ok(data);
+    }
+    let (colors, bits, columns) =
+        (number(b"Colors", 1), number(b"BitsPerComponent", 8), number(b"Columns", 1));
+    let invalid = || malformed("bad predictor parameters");
+    let bits_per_pixel =
+        usize::try_from(colors.checked_mul(bits).ok_or_else(invalid)?).map_err(|_| invalid())?;
+    let columns = usize::try_from(columns).map_err(|_| invalid())?;
+    let pixel = bits_per_pixel.div_ceil(8).max(1);
+    let row = (bits_per_pixel.checked_mul(columns).ok_or_else(invalid)?).div_ceil(8);
+    if row == 0 {
+        return Err(invalid());
+    }
+    if predictor == 2 {
+        let mut data = data;
+        if bits == 8 {
+            for line in data.chunks_mut(row) {
+                for at in pixel..line.len() {
+                    line[at] = line[at].wrapping_add(line[at - pixel]);
+                }
+            }
+        }
+        return Ok(data);
+    }
+    let mut out = Vec::with_capacity(data.len());
+    let mut previous = vec![0_u8; row];
+    for chunk in data.chunks(row + 1) {
+        let (&kind, line) = chunk.split_first().ok_or_else(invalid)?;
+        let mut current = line.to_vec();
+        current.resize(row, 0);
+        for at in 0..row {
+            let left = if at >= pixel { current[at - pixel] } else { 0 };
+            let up = previous[at];
+            let up_left = if at >= pixel { previous[at - pixel] } else { 0 };
+            current[at] = current[at].wrapping_add(match kind {
+                1 => left,
+                2 => up,
+                3 => left.midpoint(up),
+                4 => paeth(left, up, up_left),
+                _ => 0,
+            });
+        }
+        out.extend_from_slice(&current[..line.len().min(row)]);
+        previous = current;
+    }
+    Ok(out)
+}
+
+fn paeth(left: u8, up: u8, up_left: u8) -> u8 {
+    let estimate = i16::from(left) + i16::from(up) - i16::from(up_left);
+    let (a, b, c) = (
+        (estimate - i16::from(left)).abs(),
+        (estimate - i16::from(up)).abs(),
+        (estimate - i16::from(up_left)).abs(),
+    );
+    if a <= b && a <= c {
+        left
+    } else if b <= c {
+        up
+    } else {
+        up_left
+    }
+}
+
+/// LZW with 9 to 12 bit codes; `early` is the usual `EarlyChange 1`.
+fn lzw(data: &[u8], early: bool, budget: &Budget<'_>) -> Result<Vec<u8>> {
+    const CLEAR: u16 = 256;
+    const END: u16 = 257;
+    // Each code: the code it extends, its last byte, its length.
+    let mut prefix = vec![0_u16; 4096];
+    let mut last = vec![0_u8; 4096];
+    let mut length = vec![0_u16; 4096];
+    for (code, byte) in (0..=255_u8).enumerate() {
+        last[code] = byte;
+        length[code] = 1;
+    }
+    let (mut next, mut width, mut previous): (u16, u32, Option<u16>) = (258, 9, None);
+    let (mut buffer, mut buffered) = (0_u32, 0_u32);
+    let mut out = Vec::with_capacity(data.len() * 3);
+    let limit = budget.inflatable();
+    for &byte in data {
+        buffer = buffer << 8 | u32::from(byte);
+        buffered += 8;
+        while buffered >= width {
+            buffered -= width;
+            let code = u16::try_from((buffer >> buffered) & ((1 << width) - 1)).unwrap_or(END);
+            if code == CLEAR {
+                (next, width, previous) = (258, 9, None);
+                continue;
+            }
+            if code == END {
+                return Ok(out);
+            }
+            let known = code < next;
+            let source =
+                if known { code } else { previous.ok_or_else(|| malformed("bad LZW code"))? };
+            let start = out.len();
+            let size = usize::from(length[usize::from(source)]);
+            out.resize(start + size, 0);
+            let mut walk = source;
+            for at in (start..start + size).rev() {
+                out[at] = last[usize::from(walk)];
+                walk = prefix[usize::from(walk)];
+            }
+            let first = out[start];
+            if !known {
+                out.push(first);
+            }
+            if let Some(previous) = previous
+                && next < 4096
+            {
+                prefix[usize::from(next)] = previous;
+                last[usize::from(next)] = first;
+                length[usize::from(next)] = length[usize::from(previous)].saturating_add(1);
+                next += 1;
+            }
+            previous = Some(code);
+            let threshold = u32::from(next) + u32::from(early);
+            width = match threshold {
+                0..=511 => 9,
+                512..=1023 => 10,
+                1024..=2047 => 11,
+                _ => 12,
+            };
+            if out.len() > limit {
+                return Err(Error::LimitExceeded("decompressed size"));
+            }
+        }
+    }
+    Ok(out)
+}
+
+fn ascii85(data: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(data.len() * 4 / 5 + 4);
+    let (mut group, mut count) = (0_u32, 0);
+    for &byte in data {
+        match byte {
+            b'~' => break,
+            b'z' if count == 0 => out.extend_from_slice(&[0; 4]),
+            b'!'..=b'u' => {
+                group = group.wrapping_mul(85).wrapping_add(u32::from(byte - b'!'));
+                count += 1;
+                if count == 5 {
+                    out.extend_from_slice(&group.to_be_bytes());
+                    (group, count) = (0, 0);
+                }
+            }
+            _ => {}
+        }
+    }
+    if count > 1 {
+        for _ in count..5 {
+            group = group.wrapping_mul(85).wrapping_add(84);
+        }
+        out.extend_from_slice(&group.to_be_bytes()[..count - 1]);
+    }
+    out
+}
+
+fn run_length(data: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(data.len() * 2);
+    let mut at = 0;
+    while let Some(&length) = data.get(at) {
+        match length {
+            128 => break,
+            0..=127 => {
+                let run = usize::from(length) + 1;
+                out.extend_from_slice(&data[at + 1..(at + 1 + run).min(data.len())]);
+                at += 1 + run;
+            }
+            _ => {
+                if let Some(&byte) = data.get(at + 1) {
+                    out.resize(out.len() + 257 - usize::from(length), byte);
+                }
+                at += 2;
+            }
+        }
+    }
+    out
+}