imprimatur 0.2.0 → 0.4.0

data/ext/imprimatur_native/core/src/font.rs

@@ -0,0 +1,231 @@
+//! Static TrueType font data, Unicode glyph lookup and unscaled metrics.
+//!
+//! This does not select or embed fonts in documents, shape text, or perform
+//! bidirectional layout. A character's nominal glyph is not necessarily the
+//! glyph used when shaping a script such as Arabic.
+
+#[cfg(test)]
+mod tests;
+
+use read_fonts::{
+    FontRead, FontRef, MinByteRange, TableProvider,
+    tables::{
+        cmap::{Cmap, CmapSubtable, PlatformId},
+        hmtx::Hmtx,
+    },
+    types::{GlyphId, Tag, Version16Dot16},
+};
+
+use crate::{Error, Result};
+
+/// Horizontal line metrics in font design units, taken from `head` and `hhea`.
+///
+/// Multiply a metric by the point size and divide by `units_per_em` to convert
+/// it to points. These are the raw `hhea` metrics, not an OS/2 line-height policy.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FontMetrics {
+    pub units_per_em: u16,
+    pub ascender: i16,
+    /// Usually negative: the position below the baseline.
+    pub descender: i16,
+    pub line_gap: i16,
+}
+
+/// A borrowed, standalone static TrueType font with a Unicode character map.
+///
+/// Loading checks table bounds and the data needed for glyph lookup and metrics,
+/// including the `loca` offsets into `glyf`. It is not a full font sanitizer:
+/// checksums, outline programs and shaping tables are not validated.
+#[derive(Clone)]
+pub struct TrueTypeFont<'a> {
+    data: &'a [u8],
+    cmap: CmapSubtable<'a>,
+    hmtx: Hmtx<'a>,
+    metrics: FontMetrics,
+    glyph_count: u16,
+}
+
+impl<'a> TrueTypeFont<'a> {
+    /// Load font data without copying it or accessing system fonts.
+    ///
+    /// # Errors
+    /// [`Error::UnsupportedFont`] for collections, WOFF, CFF, variable fonts or
+    /// fonts without a supported Unicode cmap. [`Error::Malformed`] for invalid
+    /// headers, missing required tables or inconsistent metrics/outline offsets.
+    pub fn from_bytes(data: &'a [u8]) -> Result<Self> {
+        match data.get(..4) {
+            Some(b"\0\x01\0\0" | b"true") => {}
+            Some(b"ttcf") => return Err(Error::UnsupportedFont("font collections")),
+            Some(b"wOFF" | b"wOF2") => return Err(Error::UnsupportedFont("WOFF/WOFF2")),
+            Some(b"OTTO") => return Err(Error::UnsupportedFont("CFF outlines")),
+            _ => return Err(invalid("invalid or truncated sfnt header")),
+        }
+        let font = FontRef::new(data).map_err(invalid)?;
+        for record in font.table_directory().table_records() {
+            if u64::from(record.offset()) + u64::from(record.length()) > data.len() as u64 {
+                return Err(invalid(format!(
+                    "{} table extends beyond the font data",
+                    record.tag()
+                )));
+            }
+            match record.tag() {
+                tag if tag == Tag::new(b"fvar") || tag == Tag::new(b"gvar") => {
+                    return Err(Error::UnsupportedFont("variable fonts"));
+                }
+                tag if tag == Tag::new(b"CFF ") || tag == Tag::new(b"CFF2") => {
+                    return Err(Error::UnsupportedFont("CFF outlines"));
+                }
+                _ => {}
+            }
+        }
+
+        let head = font.head().map_err(invalid)?;
+        if head.magic_number() != 0x5F0F_3CF5 || !(16..=16384).contains(&head.units_per_em()) {
+            return Err(invalid("invalid head magic number or units per em"));
+        }
+        let maxp = font.maxp().map_err(invalid)?;
+        let glyph_count = maxp.num_glyphs();
+        if maxp.version() != Version16Dot16::VERSION_1_0
+            || maxp.max_component_depth().is_none()
+            || glyph_count == 0
+        {
+            return Err(invalid("expected a complete TrueType maxp table with at least one glyph"));
+        }
+        let hhea = font.hhea().map_err(invalid)?;
+        let count = hhea.number_of_h_metrics();
+        if count == 0 || count > glyph_count {
+            return Err(invalid("hhea metric count is outside the glyph range"));
+        }
+        let hmtx = font.hmtx().map_err(invalid)?;
+        if hmtx.h_metrics().len() != usize::from(count)
+            || hmtx.left_side_bearings().len() < usize::from(glyph_count - count)
+        {
+            return Err(invalid("truncated hmtx table"));
+        }
+        validate_outlines(&font, head.index_to_loc_format(), glyph_count)?;
+        let cmap = font.cmap().map_err(invalid)?;
+        if cmap.version() != 0 || cmap.encoding_records().len() != usize::from(cmap.num_tables()) {
+            return Err(invalid("invalid or truncated cmap header"));
+        }
+        Ok(Self {
+            data,
+            cmap: unicode_cmap(&cmap)?,
+            hmtx,
+            metrics: FontMetrics {
+                units_per_em: head.units_per_em(),
+                ascender: hhea.ascender().into(),
+                descender: hhea.descender().into(),
+                line_gap: hhea.line_gap().into(),
+            },
+            glyph_count,
+        })
+    }
+
+    /// The original font bytes.
+    #[must_use]
+    pub const fn as_bytes(&self) -> &'a [u8] {
+        self.data
+    }
+
+    /// Unscaled horizontal line metrics.
+    #[must_use]
+    pub const fn metrics(&self) -> FontMetrics {
+        self.metrics
+    }
+
+    /// The number of glyphs, including glyph zero (`.notdef`).
+    #[must_use]
+    pub const fn glyph_count(&self) -> u16 {
+        self.glyph_count
+    }
+
+    /// The nominal glyph for a Unicode character, without shaping or fallback.
+    ///
+    /// Returns `None` for missing characters, mappings to `.notdef`, or mappings
+    /// outside the font's glyph range. Symbol and legacy cmaps are never used as
+    /// Unicode mappings; full-repertoire Unicode cmaps take priority over BMP ones.
+    #[must_use]
+    pub fn glyph_id(&self, character: char) -> Option<u16> {
+        let glyph = self.cmap.map_codepoint(character)?.to_u32();
+        u16::try_from(glyph).ok().filter(|&id| id != 0 && id < self.glyph_count)
+    }
+
+    /// The horizontal advance in font design units, without kerning or shaping.
+    ///
+    /// Glyph zero is allowed; an out-of-range glyph returns `None`. A valid
+    /// zero-width glyph returns `Some(0)`.
+    #[must_use]
+    pub fn advance_width(&self, glyph_id: u16) -> Option<u16> {
+        if glyph_id >= self.glyph_count {
+            return None;
+        }
+        self.hmtx.advance(GlyphId::new(u32::from(glyph_id)))
+    }
+}
+
+fn validate_outlines(font: &FontRef<'_>, loca_format: i16, glyph_count: u16) -> Result<()> {
+    if !matches!(loca_format, 0 | 1) {
+        return Err(invalid("invalid head indexToLocFormat"));
+    }
+    let loca = font.loca(loca_format == 1).map_err(invalid)?;
+    let glyf = font.glyf().map_err(invalid)?;
+    if loca.len() != usize::from(glyph_count)
+        || !loca.all_offsets_are_ascending()
+        || loca
+            .get_raw(usize::from(glyph_count))
+            .is_none_or(|end| u64::from(end) > glyf.offset_data().len() as u64)
+    {
+        return Err(invalid("invalid loca offsets or truncated glyf table"));
+    }
+    Ok(())
+}
+
+fn unicode_cmap<'a>(cmap: &Cmap<'a>) -> Result<CmapSubtable<'a>> {
+    // Fontations' best_subtable also accepts symbol and MacRoman maps. Only
+    // Unicode encodings belong here; prefer full repertoire over BMP mappings.
+    let encodings = [
+        (PlatformId::Windows, 10),
+        (PlatformId::Unicode, 6),
+        (PlatformId::Unicode, 4),
+        (PlatformId::Windows, 1),
+        (PlatformId::Unicode, 3),
+        (PlatformId::Unicode, 2),
+        (PlatformId::Unicode, 1),
+        (PlatformId::Unicode, 0),
+    ];
+    for (platform, encoding) in encodings {
+        for record in cmap.encoding_records() {
+            if record.platform_id() != platform || record.encoding_id() != encoding {
+                continue;
+            }
+            let subtable = record.subtable(cmap.offset_data()).map_err(invalid)?;
+            let length = match &subtable {
+                CmapSubtable::Format0(table) => u32::from(table.length()),
+                CmapSubtable::Format4(table) => u32::from(table.length()),
+                CmapSubtable::Format6(table) => u32::from(table.length()),
+                CmapSubtable::Format10(table) => table.length(),
+                CmapSubtable::Format12(table) => table.length(),
+                CmapSubtable::Format13(table) => table.length(),
+                _ => continue,
+            };
+            let length = usize::try_from(length).map_err(|_| invalid("cmap subtable too large"))?;
+            let data = subtable
+                .offset_data()
+                .slice(0..length)
+                .ok_or_else(|| invalid("truncated cmap subtable"))?;
+            // Constrain lazy array reads to this subtable's declared extent.
+            let subtable = CmapSubtable::read(data).map_err(invalid)?;
+            if subtable.min_byte_range().end > length {
+                return Err(invalid("truncated cmap arrays"));
+            }
+            return Ok(subtable);
+        }
+    }
+    Err(Error::UnsupportedFont("no supported Unicode cmap"))
+}
+
+/// `Malformed`, categorized as TrueType font data: parsing, embedding and PDF
+/// resource errors ([`crate::pdf::truetype`]) all point at the same category.
+pub(crate) fn invalid(reason: impl std::fmt::Display) -> Error {
+    Error::malformed("TrueType font", reason.to_string())
+}

data/ext/imprimatur_native/core/src/lib.rs

@@ -3,7 +3,8 @@
 //! (deflate) and `crc32fast`.
 //!
 //! [`xlsx`] writes workbooks; [`doc`] is one document model that renders to
-//! PDF and DOCX.
+//! PDF and DOCX; [`barcode`] draws QR Code, Data Matrix, EAN, UPC and Code
+//! 128 symbols, GS1 ones included.
 //!
 //! ```
 //! use imprimatur::xlsx::{Cell, Workbook};
@@ -20,12 +21,16 @@
 
 #[cfg(feature = "archive")]
 pub mod archive;
+pub mod barcode;
 pub mod doc;
 mod docx;
 mod error;
+#[cfg(feature = "fonts")]
+pub mod font;
 mod opc;
 mod pdf;
 pub mod read;
+mod script;
 pub mod style;
 #[cfg(test)]
 mod test_support;

data/ext/imprimatur_native/core/src/pdf/layout.rs

@@ -8,13 +8,11 @@ use std::fmt::{self, Arguments, Write as _};
 
 use super::font::Face;
 use super::objects::{Num, push_string};
-use crate::doc::{PageSize, Paragraph, Table};
+use crate::doc::{Document, Paragraph, Picture, Symbol, Table};
 use crate::style::{Align, Color};
 use crate::{Error, Result};
 use wrap::{Line, Look, wrap};
 
-/// One inch on every side.
-const MARGIN: f64 = 72.0;
 const BODY_SIZE: f64 = 11.0;
 const TABLE_SIZE: f64 = 10.0;
 /// Line height as a multiple of the font size.
@@ -32,6 +30,7 @@ const HEADINGS: [(f64, f64, Option<Color>); 3] =
 pub struct Layout {
     width: f64,
     height: f64,
+    margin: f64,
     pages: Vec<Vec<u8>>,
     /// The top of the free space on the current page, from the bottom edge.
     y: f64,
@@ -39,9 +38,15 @@ pub struct Layout {
 }
 
 impl Layout {
-    pub fn new(size: PageSize) -> Self {
-        let (width, height) = size.points();
-        Self { width, height, pages: vec![Vec::new()], y: height - MARGIN, blank: true }
+    /// The document's pages, between its margins.
+    ///
+    /// # Errors
+    /// [`Error::InvalidMargin`] when the margins leave no room.
+    pub fn new(document: &Document) -> Result<Self> {
+        document.room()?;
+        let (width, height) = document.page_size().points();
+        let margin = document.margin();
+        Ok(Self { width, height, margin, pages: vec![Vec::new()], y: height - margin, blank: true })
     }
 
     pub const fn page_size(&self) -> (f64, f64) {
@@ -49,7 +54,7 @@ impl Layout {
     }
 
     const fn content_width(&self) -> f64 {
-        (-2.0f64).mul_add(MARGIN, self.width)
+        (-2.0f64).mul_add(self.margin, self.width)
     }
 
     pub fn heading(&mut self, level: u8, text: &str) -> Result<()> {
@@ -105,7 +110,7 @@ impl Layout {
         }
 
         let header_height = rows.first().filter(|row| row.2).map_or(0.0, |row| row.1);
-        let room = (-2.0f64).mul_add(MARGIN, self.height) - header_height;
+        let room = (-2.0f64).mul_add(self.margin, self.height) - header_height;
         for (index, (cells, height, header)) in rows.iter().enumerate() {
             (*height <= room || *header).ok_or(Error::RowTooTall(*height))?;
             // A header needs the first body row beside it.
@@ -121,6 +126,35 @@ impl Layout {
         Ok(())
     }
 
+    /// Draws picture `index` (`/Im{index}`), on a new page when it does not
+    /// fit, as its alignment says.
+    pub fn picture(&mut self, picture: &Picture, index: usize) {
+        let (width, height) = picture.size(self.room());
+        let (x, y) = self.place((width, height), picture.align);
+        let (width, height, x, y) = (Num(width), Num(height), Num(x), Num(y));
+        emit(self.current(), format_args!("q {width} 0 0 {height} {x} {y} cm /Im{index} Do Q\n"));
+        self.end_figure();
+    }
+
+    /// Draws a barcode as filled rectangles, one module a unit, the
+    /// coordinates flipped to run down from its top left corner.
+    pub fn symbol(&mut self, symbol: &Symbol) {
+        let (shapes, (width, height)) = symbol.placed(self.room());
+        let (x, y) = self.place((width, height), symbol.align);
+        let (columns, rows) = shapes.extent();
+        let (across, down) = (width / columns, height / rows);
+        let (fill, top, x) = (Fill(symbol.color), Num(y + height), Num(x));
+        let page = self.current();
+        // Four decimals: a module's size in hundredths of a point would be
+        // off by up to half a percent across the symbol.
+        emit(page, format_args!("q {fill} {across:.4} 0 0 {:.4} {x} {top} cm\n", -down));
+        for [x, y, run, rows] in &shapes.rects {
+            emit(page, format_args!("{x} {y} {run} {rows} re\n"));
+        }
+        page.extend_from_slice(b"f Q\n");
+        self.end_figure();
+    }
+
     pub fn page_break(&mut self) {
         self.new_page();
     }
@@ -129,24 +163,48 @@ impl Layout {
     pub fn finish(mut self, page_numbers: bool) -> Vec<Vec<u8>> {
         if page_numbers {
             let total = self.pages.len();
-            let center = self.width / 2.0;
+            let (center, margin) = (self.width / 2.0, self.margin);
             for (index, page) in self.pages.iter_mut().enumerate() {
                 let bytes = format!("{} / {total}", index + 1).into_bytes();
                 let width = Face::Regular.width(&bytes, FOOTER_SIZE);
                 let look =
                     Look { face: Face::Regular, color: Some(FOOTER_COLOR), underline: false };
                 let label = wrap::Fragment { bytes, look, width };
-                draw_fragment(page, &label, FOOTER_SIZE, center - width / 2.0, MARGIN / 2.0);
+                draw_fragment(page, &label, FOOTER_SIZE, center - width / 2.0, margin / 2.0);
             }
         }
         self.pages
     }
 
+    /// The width and height between the margins.
+    const fn room(&self) -> (f64, f64) {
+        (self.content_width(), (-2.0f64).mul_add(self.margin, self.height))
+    }
+
+    /// Makes room for a figure of `size`, on a new page when it does not
+    /// fit, and returns its bottom left corner as `align` places it.
+    fn place(&mut self, (width, height): (f64, f64), align: Option<Align>) -> (f64, f64) {
+        self.ensure_room(height);
+        let x = self.margin
+            + match align.unwrap_or(Align::Left) {
+                Align::Left => 0.0,
+                Align::Center => (self.content_width() - width) / 2.0,
+                Align::Right => self.content_width() - width,
+            };
+        self.y -= height;
+        (x, self.y)
+    }
+
+    fn end_figure(&mut self) {
+        self.y -= PARAGRAPH_GAP;
+        self.blank = false;
+    }
+
     /// Starts a new page unless `needed` points fit above the bottom margin
     /// (or the page is still blank, where nothing would fit better).
     /// Returns whether it did.
     fn ensure_room(&mut self, needed: f64) -> bool {
-        let full = !self.blank && self.y - needed < MARGIN;
+        let full = !self.blank && self.y - needed < self.margin;
         if full {
             self.new_page();
         }
@@ -155,7 +213,7 @@ impl Layout {
 
     fn new_page(&mut self) {
         self.pages.push(Vec::new());
-        self.y = self.height - MARGIN;
+        self.y = self.height - self.margin;
         self.blank = true;
     }
 
@@ -174,7 +232,7 @@ impl Layout {
             self.ensure_room(leading);
             let baseline = self.y - baseline_offset(size);
             let slack = self.content_width() - line.width;
-            let x = MARGIN
+            let x = self.margin
                 + match align {
                     Align::Left => 0.0,
                     Align::Center => slack / 2.0,
@@ -188,9 +246,8 @@ impl Layout {
 
     /// One table row from the cursor down: fill, borders, then text.
     fn row(&mut self, cells: &[Vec<Line>], height: f64, column_width: f64, header: bool) {
-        let top = self.y;
+        let (top, mut x) = (self.y, self.margin);
         let page = self.current();
-        let mut x = MARGIN;
         for lines in cells {
             let rect = format_args!(
                 "{} {} {} {} re",

data/ext/imprimatur_native/core/src/pdf/objects.rs

@@ -1,6 +1,9 @@
 //! PDF file syntax: numbered objects, compressed streams, the
 //! cross-reference table and the trailer (ISO 32000-1, section 7).
 
+#[cfg(test)]
+mod tests;
+
 use std::fmt;
 use std::io::Write;
 
@@ -34,13 +37,34 @@ impl<W: Write> PdfWriter<W> {
         self.write_fmt(format_args!("{dictionary}\nendobj\n"))
     }
 
-    /// Writes a Flate-compressed stream object.
-    pub fn stream(&mut self, id: usize, data: &[u8]) -> Result<()> {
+    /// Writes a Flate-compressed stream object with optional dictionary entries.
+    /// Names omit the leading `/`; values are already PDF syntax. For example,
+    /// embedded TrueType fonts need `Length1` to hold the decoded byte count.
+    /// The writer supplies `Length` and `Filter`; entries must not repeat them.
+    pub fn stream(
+        &mut self,
+        id: usize,
+        data: &[u8],
+        entries: &[(&str, &dyn fmt::Display)],
+    ) -> Result<()> {
         let compressed = miniz_oxide::deflate::compress_to_vec_zlib(data, LEVEL);
+        let dictionary = fmt::from_fn(|f| {
+            f.write_str("/Filter /FlateDecode")?;
+            for (name, value) in entries {
+                write!(f, " /{name} {value}")?;
+            }
+            Ok(())
+        });
+        self.stored(id, format_args!("{dictionary}"), &compressed)
+    }
+
+    /// Writes a stream object as it is stored, `dictionary` following its
+    /// `/Length`.
+    pub fn stored(&mut self, id: usize, dictionary: fmt::Arguments<'_>, data: &[u8]) -> Result<()> {
         self.begin(id)?;
-        let length = compressed.len();
-        self.write_fmt(format_args!("<< /Length {length} /Filter /FlateDecode >>\nstream\n"))?;
-        self.write(&compressed)?;
+        let length = data.len();
+        self.write_fmt(format_args!("<< /Length {length} {dictionary} >>\nstream\n"))?;
+        self.write(data)?;
         self.write(b"\nendstream\nendobj\n")
     }
 

data/ext/imprimatur_native/core/src/pdf/picture.rs

@@ -0,0 +1,197 @@
+//! Pictures as image `XObject`s: a JPEG as it is; a PNG's compressed pixels
+//! as they are, PDF reading them with the PNG predictor, unless an alpha
+//! channel needs them decoded into a soft mask.
+
+use std::borrow::Cow;
+use std::fmt::Write as _;
+
+use crate::doc::Picture;
+use crate::doc::picture::{Kind, Png};
+use crate::{Error, Result};
+
+/// The most pixels a PNG with alpha may have: it is decoded in memory.
+const MAX_DECODED: u64 = 1 << 26;
+
+/// An image stream: its dictionary after `/Length`, and its data as stored.
+pub struct Stream<'a> {
+    pub dictionary: String,
+    pub data: Cow<'a, [u8]>,
+}
+
+/// Whether the picture has a soft mask, written right after it.
+pub const fn has_mask(picture: &Picture) -> bool {
+    match &picture.kind {
+        Kind::Png(png) => alpha(png),
+        Kind::Jpeg { .. } => false,
+    }
+}
+
+/// The image, then its soft mask when it has one; `mask` is the mask's
+/// object number.
+pub fn streams(picture: &Picture, mask: usize) -> Result<Vec<Stream<'_>>> {
+    let (width, height) = picture.pixels;
+    let head = format!("/Type /XObject /Subtype /Image /Width {width} /Height {height}");
+    match &picture.kind {
+        Kind::Jpeg { components, inverted } => {
+            let space = ["DeviceGray", "", "DeviceRGB", "DeviceCMYK"][usize::from(*components) - 1];
+            let decode = if *inverted { " /Decode [1 0 1 0 1 0 1 0]" } else { "" };
+            let dictionary = format!(
+                "{head} /ColorSpace /{space} /BitsPerComponent 8 /Filter /DCTDecode{decode}"
+            );
+            Ok(vec![Stream { dictionary, data: Cow::Borrowed(&picture.data) }])
+        }
+        Kind::Png(png) if alpha(png) => decoded(png, (width, height), &head, mask),
+        Kind::Png(png) => Ok(vec![predicted(png, width, &head)]),
+    }
+}
+
+/// Alpha that only a soft mask carries: an alpha channel, or a palette's.
+const fn alpha(png: &Png) -> bool {
+    matches!(png.color, 4 | 6) || (png.color == 3 && !png.transparency.is_empty())
+}
+
+/// The compressed pixels as stored, read through the PNG predictor; a
+/// transparent color becomes a color key mask.
+fn predicted<'a>(png: &'a Png, width: u32, head: &str) -> Stream<'a> {
+    let depth = png.depth;
+    let (colors, space) = match png.color {
+        0 => (1, "/DeviceGray".to_owned()),
+        2 => (3, "/DeviceRGB".to_owned()),
+        _ => (1, indexed(&png.palette)),
+    };
+    let mut dictionary = format!(
+        "{head} /ColorSpace {space} /BitsPerComponent {depth} /Filter /FlateDecode \
+         /DecodeParms << /Predictor 15 /Colors {colors} /BitsPerComponent {depth} \
+         /Columns {width} >>"
+    );
+    if !png.transparency.is_empty() {
+        dictionary.push_str(" /Mask [");
+        for key in png.transparency.as_chunks::<2>().0 {
+            let value = u16::from_be_bytes(*key);
+            // Writing to a String cannot fail.
+            let _ = write!(dictionary, "{value} {value} ");
+        }
+        dictionary.push(']');
+    }
+    Stream { dictionary, data: Cow::Borrowed(&png.compressed) }
+}
+
+/// `[/Indexed /DeviceRGB n <palette>]`.
+fn indexed(palette: &[u8]) -> String {
+    let mut space = format!("[/Indexed /DeviceRGB {} <", palette.len() / 3 - 1);
+    for byte in palette {
+        // Writing to a String cannot fail.
+        let _ = write!(space, "{byte:02X}");
+    }
+    space.push_str(">]");
+    space
+}
+
+/// The pixels decoded into 8-bit color and alpha, both compressed again.
+fn decoded<'a>(
+    png: &Png,
+    (width, height): (u32, u32),
+    head: &str,
+    mask: usize,
+) -> Result<Vec<Stream<'a>>> {
+    let damaged = || Error::InvalidImage("a damaged PNG");
+    (u64::from(width) * u64::from(height) <= MAX_DECODED)
+        .ok_or(Error::InvalidImage("a PNG with alpha of at most 67 million pixels"))?;
+    let channels = match png.color {
+        4 => 2,
+        6 => 4,
+        _ => 1,
+    };
+    let bits = channels * usize::from(png.depth);
+    let (width, height) = (width as usize, height as usize);
+    let stride = (width * bits).div_ceil(8);
+    let filtered = miniz_oxide::inflate::decompress_to_vec_zlib_with_limit(
+        &png.compressed,
+        height * (stride + 1),
+    )
+    .map_err(|_| damaged())?;
+    let pixels = unfilter(&filtered, stride, bits.div_ceil(8), height).ok_or_else(damaged)?;
+    let gray = png.color == 4;
+    let (mut color, mut alpha) =
+        (Vec::with_capacity(width * height * 3), Vec::with_capacity(width * height));
+    for row in pixels.chunks_exact(stride) {
+        for x in 0..width {
+            if png.color == 3 {
+                let index = usize::from(sample(row, x, png.depth));
+                let rgb = png.palette.get(index * 3..index * 3 + 3).ok_or_else(damaged)?;
+                color.extend_from_slice(rgb);
+                alpha.push(png.transparency.get(index).copied().unwrap_or(u8::MAX));
+            } else {
+                // 16-bit samples keep their high byte.
+                let step = usize::from(png.depth / 8);
+                let at = |channel: usize| row[(x * channels + channel) * step];
+                color.extend((0..channels - 1).map(at));
+                alpha.push(at(channels - 1));
+            }
+        }
+    }
+    let space = if gray { "DeviceGray" } else { "DeviceRGB" };
+    let compress = |data: &[u8]| Cow::Owned(miniz_oxide::deflate::compress_to_vec_zlib(data, 6));
+    Ok(vec![
+        Stream {
+            dictionary: format!(
+                "{head} /ColorSpace /{space} /BitsPerComponent 8 /Filter /FlateDecode \
+                 /SMask {mask} 0 R"
+            ),
+            data: compress(&color),
+        },
+        Stream {
+            dictionary: format!(
+                "{head} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode"
+            ),
+            data: compress(&alpha),
+        },
+    ])
+}
+
+/// The `x`th sample of a row of `depth`-bit samples.
+fn sample(row: &[u8], x: usize, depth: u8) -> u8 {
+    let depth = usize::from(depth);
+    let (byte, shift) = (x * depth / 8, 8 - depth - x * depth % 8);
+    (row[byte] >> shift) & (u8::MAX >> (8 - depth))
+}
+
+/// PNG's filters undone (ISO/IEC 15948, 9): rows of `stride` bytes, `bpp`
+/// bytes a pixel.
+fn unfilter(data: &[u8], stride: usize, bpp: usize, rows: usize) -> Option<Vec<u8>> {
+    let mut out = vec![0_u8; stride * rows];
+    for row in 0..rows {
+        let line = data.get(row * (stride + 1)..(row + 1) * (stride + 1))?;
+        let (done, rest) = out.split_at_mut(row * stride);
+        let previous = row.checked_sub(1).map(|_| &done[done.len() - stride..]);
+        let current = &mut rest[..stride];
+        for at in 0..stride {
+            let left = at.checked_sub(bpp).map_or(0, |at| current[at]);
+            let up = previous.map_or(0, |previous| previous[at]);
+            let up_left = at.checked_sub(bpp).and_then(|at| previous.map(|previous| previous[at]));
+            let predicted = match line[0] {
+                0 => 0,
+                1 => left,
+                2 => up,
+                3 => left.midpoint(up),
+                4 => paeth(left, up, up_left.unwrap_or(0)),
+                _ => return None,
+            };
+            current[at] = line[at + 1].wrapping_add(predicted);
+        }
+    }
+    Some(out)
+}
+
+/// The neighbor nearest `left + up - up_left`.
+fn paeth(left: u8, up: u8, up_left: u8) -> u8 {
+    let estimate = i16::from(left) + i16::from(up) - i16::from(up_left);
+    let distance = |byte: u8| (estimate - i16::from(byte)).abs();
+    if distance(left) <= distance(up) && distance(left) <= distance(up_left) {
+        left
+    } else if distance(up) <= distance(up_left) {
+        up
+    } else {
+        up_left
+    }
+}