imprimatur 0.1.0

data/ext/imprimatur_native/core/src/read/pdf/lexer.rs

@@ -0,0 +1,255 @@
+//! PDF tokens (ISO 32000-1, 7.2), for the file's objects and for content
+//! streams alike. Tokens borrow from the input; strings and names are
+//! decoded only when asked.
+
+#[cfg(test)]
+mod tests;
+
+use std::borrow::Cow;
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Token<'a> {
+    Integer(i64),
+    Real(f64),
+    /// A name without its slash, `#xx` escapes still in place.
+    Name(&'a [u8]),
+    /// A literal string's bytes between its parentheses, escapes in place.
+    String(&'a [u8]),
+    /// A hexadecimal string's digits between `<` and `>`.
+    Hex(&'a [u8]),
+    ArrayStart,
+    ArrayEnd,
+    DictStart,
+    DictEnd,
+    /// `true`, `obj`, `R`, `Tj`...: anything else made of regular characters.
+    Keyword(&'a [u8]),
+}
+
+pub const fn is_whitespace(byte: u8) -> bool {
+    matches!(byte, b'\0' | b'\t' | b'\n' | b'\x0C' | b'\r' | b' ')
+}
+
+pub const fn is_delimiter(byte: u8) -> bool {
+    matches!(byte, b'(' | b')' | b'<' | b'>' | b'[' | b']' | b'{' | b'}' | b'/' | b'%')
+}
+
+const fn is_regular(byte: u8) -> bool {
+    !is_whitespace(byte) && !is_delimiter(byte)
+}
+
+#[derive(Clone)]
+pub struct Lexer<'a> {
+    pub pos: usize,
+    data: &'a [u8],
+}
+
+impl<'a> Lexer<'a> {
+    pub const fn new(data: &'a [u8], pos: usize) -> Self {
+        Self { pos, data }
+    }
+
+    pub const fn data(&self) -> &'a [u8] {
+        self.data
+    }
+
+    /// Skips whitespace and comments.
+    pub fn skip_space(&mut self) {
+        while let Some(&byte) = self.data.get(self.pos) {
+            if is_whitespace(byte) {
+                self.pos += 1;
+            } else if byte == b'%' {
+                while self.data.get(self.pos).is_some_and(|&byte| byte != b'\n' && byte != b'\r') {
+                    self.pos += 1;
+                }
+            } else {
+                break;
+            }
+        }
+    }
+
+    /// The next token, `None` at the end. Stray closing delimiters are
+    /// skipped: broken files have them, and nothing reads them.
+    pub fn next(&mut self) -> Option<Token<'a>> {
+        loop {
+            self.skip_space();
+            let &byte = self.data.get(self.pos)?;
+            self.pos += 1;
+            return Some(match byte {
+                b'[' => Token::ArrayStart,
+                b']' => Token::ArrayEnd,
+                b'<' if self.data.get(self.pos) == Some(&b'<') => {
+                    self.pos += 1;
+                    Token::DictStart
+                }
+                b'>' if self.data.get(self.pos) == Some(&b'>') => {
+                    self.pos += 1;
+                    Token::DictEnd
+                }
+                b'<' => {
+                    let start = self.pos;
+                    let end = self.data[start..]
+                        .iter()
+                        .position(|&byte| byte == b'>')
+                        .map_or(self.data.len(), |at| start + at);
+                    self.pos = (end + 1).min(self.data.len());
+                    Token::Hex(&self.data[start..end])
+                }
+                b'(' => self.literal(),
+                b'/' => {
+                    let start = self.pos;
+                    self.regular();
+                    Token::Name(&self.data[start..self.pos])
+                }
+                b')' | b'>' | b'{' | b'}' => continue,
+                _ => {
+                    let start = self.pos - 1;
+                    self.regular();
+                    let word = &self.data[start..self.pos];
+                    number(word).unwrap_or(Token::Keyword(word))
+                }
+            });
+        }
+    }
+
+    fn regular(&mut self) {
+        while self.data.get(self.pos).is_some_and(|&byte| is_regular(byte)) {
+            self.pos += 1;
+        }
+    }
+
+    /// A literal string: parentheses balance unless escaped.
+    fn literal(&mut self) -> Token<'a> {
+        let start = self.pos;
+        let mut depth = 1_usize;
+        while let Some(&byte) = self.data.get(self.pos) {
+            self.pos += 1;
+            match byte {
+                b'\\' => self.pos += 1,
+                b'(' => depth += 1,
+                b')' => {
+                    depth -= 1;
+                    if depth == 0 {
+                        return Token::String(&self.data[start..self.pos - 1]);
+                    }
+                }
+                _ => {}
+            }
+        }
+        self.pos = self.data.len();
+        Token::String(&self.data[start..])
+    }
+}
+
+/// An integer or a real (`+1`, `-.5`, `3.`), or `None` for anything else.
+fn number(word: &[u8]) -> Option<Token<'static>> {
+    let first = *word.first()?;
+    if !(first.is_ascii_digit() || matches!(first, b'+' | b'-' | b'.')) {
+        return None;
+    }
+    let text = std::str::from_utf8(word).ok()?;
+    if let Ok(integer) = text.parse::<i64>() {
+        return Some(Token::Integer(integer));
+    }
+    let digits = text.trim_start_matches(['+', '-']);
+    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit() || byte == b'.') {
+        // `--5` and the like: Acrobat reads the number, so do we.
+        return digits.trim_start_matches('-').parse::<f64>().ok().map(Token::Real);
+    }
+    let value = if digits == "." { 0.0 } else { digits.parse::<f64>().ok()? };
+    Some(Token::Real(if text.starts_with('-') { -value } else { value }))
+}
+
+/// A literal string's bytes with its escapes resolved (ISO 32000-1, 7.3.4.2).
+pub fn literal_bytes(raw: &[u8]) -> Cow<'_, [u8]> {
+    if !raw.iter().any(|&byte| byte == b'\\' || byte == b'\r') {
+        return Cow::Borrowed(raw);
+    }
+    let mut out = Vec::with_capacity(raw.len());
+    literal_into(raw, &mut out);
+    Cow::Owned(out)
+}
+
+/// As [`literal_bytes`], appended to `out`.
+pub fn literal_into(raw: &[u8], out: &mut Vec<u8>) {
+    let mut bytes = raw.iter().copied().peekable();
+    while let Some(byte) = bytes.next() {
+        match byte {
+            b'\r' => {
+                bytes.next_if_eq(&b'\n');
+                out.push(b'\n');
+            }
+            b'\\' => match bytes.next() {
+                Some(b'n') => out.push(b'\n'),
+                Some(b'r') => out.push(b'\r'),
+                Some(b't') => out.push(b'\t'),
+                Some(b'b') => out.push(0x08),
+                Some(b'f') => out.push(0x0C),
+                Some(b'\r') => {
+                    bytes.next_if_eq(&b'\n');
+                }
+                Some(digit @ b'0'..=b'7') => {
+                    let mut value = u32::from(digit - b'0');
+                    for _ in 0..2 {
+                        let Some(next) = bytes.next_if(|byte| (b'0'..=b'7').contains(byte)) else {
+                            break;
+                        };
+                        value = value * 8 + u32::from(next - b'0');
+                    }
+                    out.push(value.to_le_bytes()[0]);
+                }
+                Some(b'\n') | None => {}
+                Some(other) => out.push(other),
+            },
+            byte => out.push(byte),
+        }
+    }
+}
+
+/// A hexadecimal string's bytes; whitespace is ignored and a final odd
+/// digit counts as followed by 0.
+pub fn hex_bytes(raw: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(raw.len() / 2 + 1);
+    hex_into(raw, &mut out);
+    out
+}
+
+/// As [`hex_bytes`], appended to `out`.
+pub fn hex_into(raw: &[u8], out: &mut Vec<u8>) {
+    let mut high = None;
+    for digit in raw.iter().filter_map(|&byte| char::from(byte).to_digit(16)) {
+        let digit = digit.to_le_bytes()[0];
+        match high.take() {
+            Some(high) => out.push(high << 4 | digit),
+            None => high = Some(digit),
+        }
+    }
+    if let Some(high) = high {
+        out.push(high << 4);
+    }
+}
+
+/// A name's bytes with its `#xx` escapes resolved.
+pub fn name_bytes(raw: &[u8]) -> Cow<'_, [u8]> {
+    if !raw.contains(&b'#') {
+        return Cow::Borrowed(raw);
+    }
+    let mut out = Vec::with_capacity(raw.len());
+    let mut at = 0;
+    while at < raw.len() {
+        let escaped = raw
+            .get(at + 1..at + 3)
+            .and_then(|hex| std::str::from_utf8(hex).ok())
+            .and_then(|hex| u8::from_str_radix(hex, 16).ok());
+        match (raw[at], escaped) {
+            (b'#', Some(byte)) => {
+                out.push(byte);
+                at += 3;
+            }
+            (byte, _) => {
+                out.push(byte);
+                at += 1;
+            }
+        }
+    }
+    Cow::Owned(out)
+}

data/ext/imprimatur_native/core/src/read/pdf/object/name.rs

@@ -0,0 +1,44 @@
+//! PDF names: `Type`, `Font`, `F1`. Nearly all fit in a few bytes, so they
+//! live inline; a long one goes to the heap.
+
+use std::fmt;
+use std::ops::Deref;
+
+/// The bytes a name keeps inline: its enum is no larger than a `Vec`.
+const INLINE: usize = 22;
+
+#[derive(Clone, PartialEq, Eq)]
+pub enum Name {
+    Inline { length: u8, bytes: [u8; INLINE] },
+    Heap(Box<[u8]>),
+}
+
+impl Name {
+    pub fn new(bytes: &[u8]) -> Self {
+        u8::try_from(bytes.len()).ok().filter(|&length| usize::from(length) <= INLINE).map_or_else(
+            || Self::Heap(bytes.into()),
+            |length| {
+                let mut inline = [0; INLINE];
+                inline[..bytes.len()].copy_from_slice(bytes);
+                Self::Inline { length, bytes: inline }
+            },
+        )
+    }
+}
+
+impl Deref for Name {
+    type Target = [u8];
+
+    fn deref(&self) -> &[u8] {
+        match self {
+            Self::Inline { length, bytes } => &bytes[..usize::from(*length)],
+            Self::Heap(bytes) => bytes,
+        }
+    }
+}
+
+impl fmt::Debug for Name {
+    fn fmt(&self, out: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(out, "/{}", String::from_utf8_lossy(self))
+    }
+}

data/ext/imprimatur_native/core/src/read/pdf/object.rs

@@ -0,0 +1,261 @@
+//! PDF objects (ISO 32000-1, 7.3) and the parser that reads them.
+
+mod name;
+#[cfg(test)]
+mod tests;
+
+use std::ops::Range;
+
+pub use name::Name;
+
+use super::lexer::{Lexer, Token, hex_bytes, literal_bytes, name_bytes};
+use crate::{Error, Result};
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Object {
+    Null,
+    Bool(bool),
+    Integer(i64),
+    Real(f64),
+    Name(Name),
+    String(Vec<u8>),
+    Array(Vec<Self>),
+    Dict(Dict),
+    Stream(Stream),
+    Ref(u32, u16),
+}
+
+/// A dictionary: a handful of keys, so a vector beats a map.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct Dict(pub Vec<(Name, Object)>);
+
+/// A stream: its dictionary and where its raw (encoded, maybe encrypted)
+/// bytes lie in the file.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Stream {
+    pub dict: Dict,
+    pub data: Range<usize>,
+}
+
+impl Dict {
+    pub fn get(&self, key: &[u8]) -> Option<&Object> {
+        self.0.iter().find(|(name, _)| **name == *key).map(|(_, value)| value)
+    }
+
+    pub fn has_name(&self, key: &[u8], name: &[u8]) -> bool {
+        self.get(key).and_then(Object::as_name) == Some(name)
+    }
+}
+
+impl Object {
+    pub const fn as_integer(&self) -> Option<i64> {
+        match *self {
+            Self::Integer(value) => Some(value),
+            _ => None,
+        }
+    }
+
+    #[expect(clippy::cast_precision_loss, reason = "PDF numbers fit an f64 in practice")]
+    pub const fn as_number(&self) -> Option<f64> {
+        match *self {
+            Self::Integer(value) => Some(value as f64),
+            Self::Real(value) => Some(value),
+            _ => None,
+        }
+    }
+
+    pub fn as_name(&self) -> Option<&[u8]> {
+        match self {
+            Self::Name(name) => Some(name),
+            _ => None,
+        }
+    }
+
+    pub fn as_bytes(&self) -> Option<&[u8]> {
+        match self {
+            Self::String(bytes) => Some(bytes),
+            _ => None,
+        }
+    }
+
+    pub fn as_array(&self) -> Option<&[Self]> {
+        match self {
+            Self::Array(items) => Some(items),
+            _ => None,
+        }
+    }
+
+    /// A dictionary, or a stream's.
+    pub const fn as_dict(&self) -> Option<&Dict> {
+        match self {
+            Self::Dict(dict) | Self::Stream(Stream { dict, .. }) => Some(dict),
+            _ => None,
+        }
+    }
+
+    pub const fn as_reference(&self) -> Option<(u32, u16)> {
+        match *self {
+            Self::Ref(number, generation) => Some((number, generation)),
+            _ => None,
+        }
+    }
+}
+
+/// Reads objects from a lexer, refusing to nest deeper than `max_depth`.
+pub struct Parser<'a> {
+    pub lexer: Lexer<'a>,
+    max_depth: usize,
+}
+
+impl<'a> Parser<'a> {
+    pub const fn new(data: &'a [u8], pos: usize, max_depth: usize) -> Self {
+        Self { lexer: Lexer::new(data, pos), max_depth }
+    }
+
+    /// The next whole object.
+    ///
+    /// # Errors
+    /// [`Error::Malformed`] at the end of the input or on a stray token, and
+    /// [`Error::LimitExceeded`] past the nesting limit.
+    pub fn object(&mut self) -> Result<Object> {
+        let token = self.lexer.next().ok_or_else(|| malformed("an object is cut short"))?;
+        self.value(token, 0)
+    }
+
+    /// The object a token starts. Integers look ahead for `N G R`.
+    pub fn value(&mut self, token: Token<'a>, depth: usize) -> Result<Object> {
+        if depth > self.max_depth {
+            return Err(Error::LimitExceeded("PDF object nesting depth"));
+        }
+        Ok(match token {
+            Token::Integer(number) => {
+                let saved = self.lexer.pos;
+                if let (Ok(number), Some(Token::Integer(generation)), Some(Token::Keyword(b"R"))) =
+                    (u32::try_from(number), self.lexer.next(), self.lexer.next())
+                {
+                    Object::Ref(number, u16::try_from(generation).unwrap_or(0))
+                } else {
+                    self.lexer.pos = saved;
+                    Object::Integer(number)
+                }
+            }
+            Token::Real(number) => Object::Real(number),
+            Token::Name(raw) => Object::Name(Name::new(&name_bytes(raw))),
+            Token::String(raw) => Object::String(literal_bytes(raw).into_owned()),
+            Token::Hex(raw) => Object::String(hex_bytes(raw)),
+            Token::ArrayStart => {
+                let mut items = Vec::new();
+                loop {
+                    match self.lexer.next() {
+                        Some(Token::ArrayEnd) | None => break,
+                        Some(token) => items.push(self.value(token, depth + 1)?),
+                    }
+                }
+                Object::Array(items)
+            }
+            Token::DictStart => Object::Dict(self.dict(depth)?),
+            Token::Keyword(b"true") => Object::Bool(true),
+            Token::Keyword(b"false") => Object::Bool(false),
+            Token::Keyword(_) | Token::ArrayEnd | Token::DictEnd => Object::Null,
+        })
+    }
+
+    /// A dictionary's entries, after its `<<`. A key without a value, as
+    /// broken files have, is dropped.
+    fn dict(&mut self, depth: usize) -> Result<Dict> {
+        let mut entries = Vec::new();
+        loop {
+            match self.lexer.next() {
+                Some(Token::DictEnd) | None => return Ok(Dict(entries)),
+                Some(Token::Name(raw)) => {
+                    let saved = self.lexer.pos;
+                    match self.lexer.next() {
+                        Some(Token::DictEnd) | None => {
+                            self.lexer.pos = saved;
+                        }
+                        Some(token) => {
+                            let value = self.value(token, depth + 1)?;
+                            entries.push((Name::new(&name_bytes(raw)), value));
+                        }
+                    }
+                }
+                Some(_) => {}
+            }
+        }
+    }
+
+    /// An indirect object at the lexer's position: `N G obj ... endobj`,
+    /// with its stream data located when it is a stream. `length` resolves
+    /// a `/Length` given by reference.
+    pub fn indirect(
+        &mut self,
+        length: &dyn Fn(&Object) -> Option<usize>,
+    ) -> Result<(u32, u16, Object)> {
+        let header = (self.lexer.next(), self.lexer.next(), self.lexer.next());
+        let (
+            Some(Token::Integer(number)),
+            Some(Token::Integer(generation)),
+            Some(Token::Keyword(b"obj")),
+        ) = header
+        else {
+            return Err(malformed("no object where the cross-reference table points"));
+        };
+        let number = u32::try_from(number).map_err(|_| malformed("a negative object number"))?;
+        let generation = u16::try_from(generation).unwrap_or(0);
+        let object = self.object()?;
+        let Object::Dict(dict) = object else {
+            return Ok((number, generation, object));
+        };
+        let saved = self.lexer.pos;
+        if self.lexer.next() != Some(Token::Keyword(b"stream")) {
+            self.lexer.pos = saved;
+            return Ok((number, generation, Object::Dict(dict)));
+        }
+        let data = self.lexer.data();
+        let mut start = self.lexer.pos;
+        if data.get(start) == Some(&b'\r') {
+            start += 1;
+        }
+        if data.get(start) == Some(&b'\n') {
+            start += 1;
+        }
+        let declared = dict.get(b"Length").and_then(length).filter(|&length| {
+            let end = start.saturating_add(length);
+            data.get(end..).is_some_and(|rest| {
+                let rest = &rest
+                    [rest.iter().take_while(|&&byte| super::lexer::is_whitespace(byte)).count()..];
+                rest.starts_with(b"endstream")
+            })
+        });
+        let end = declared.map_or_else(
+            || {
+                let found = find(&data[start..], b"endstream").map_or(data.len(), |at| start + at);
+                let mut end = found;
+                if end > start && data[end - 1] == b'\n' {
+                    end -= 1;
+                }
+                if end > start && data[end - 1] == b'\r' {
+                    end -= 1;
+                }
+                end
+            },
+            |length| start + length,
+        );
+        self.lexer.pos = find(&data[end..], b"endstream").map_or(data.len(), |at| end + at + 9);
+        Ok((number, generation, Object::Stream(Stream { dict, data: start..end })))
+    }
+}
+
+/// A `/Length` given directly: what the cross-reference layer, which
+/// cannot resolve references yet, passes to [`Parser::indirect`].
+pub fn direct_length(length: &Object) -> Option<usize> {
+    length.as_integer().and_then(|length| usize::try_from(length).ok())
+}
+
+pub fn find(haystack: &[u8], needle: &[u8]) -> Option<usize> {
+    haystack.windows(needle.len()).position(|window| window == needle)
+}
+
+pub fn malformed(reason: &str) -> Error {
+    Error::malformed("PDF", reason)
+}