imprimatur 0.4.0 → 0.6.0

data/ext/imprimatur_native/core/src/read/ole.rs

@@ -5,6 +5,7 @@
 #[cfg(test)]
 mod tests;
 
+use crate::bytes::{u16_le as u16_at, u32_le as u32_at};
 use crate::read::Budget;
 use crate::{Error, Result};
 
@@ -38,14 +39,6 @@ fn words(bytes: &[u8]) -> impl Iterator<Item = u32> + '_ {
     bytes.as_chunks::<4>().0.iter().map(|word| u32::from_le_bytes(*word))
 }
 
-fn u16_at(bytes: &[u8], at: usize) -> Option<u16> {
-    Some(u16::from_le_bytes(bytes.get(at..at.checked_add(2)?)?.try_into().ok()?))
-}
-
-fn u32_at(bytes: &[u8], at: usize) -> Option<u32> {
-    Some(u32::from_le_bytes(bytes.get(at..at.checked_add(4)?)?.try_into().ok()?))
-}
-
 impl<'a> Ole<'a> {
     /// Reads the header, the allocation tables and the directory.
     ///

data/ext/imprimatur_native/core/src/read/pdf/bounded.rs

@@ -0,0 +1,190 @@
+//! PDF inspection and bounded reads without losing individual page failures.
+
+#[cfg(test)]
+mod tests;
+
+use super::content::{Fonts, PageText, page_text};
+use super::document::Document;
+use super::{is_pdf, layout, xref};
+use crate::read::{Budget, Limits};
+use crate::{Error, Result};
+
+/// Metadata read without interpreting page content.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Info {
+    pub page_count: u32,
+    /// Opened with the empty password: permissions, not a locked document.
+    pub encrypted: bool,
+}
+
+/// A contiguous, one-based page selection and its output limits.
+#[derive(Debug, Clone)]
+pub struct ReadOptions {
+    pub first_page: u32,
+    pub last_page: u32,
+    pub max_pages: usize,
+    pub max_page_bytes: usize,
+    pub max_output_bytes: usize,
+}
+
+impl Default for ReadOptions {
+    fn default() -> Self {
+        Self {
+            first_page: 1,
+            last_page: u32::MAX,
+            max_pages: 500,
+            max_page_bytes: 256 * 1024,
+            max_output_bytes: 8 * 1024 * 1024,
+        }
+    }
+}
+
+impl ReadOptions {
+    const fn validate(&self) -> Result<()> {
+        if self.first_page == 0 || self.last_page < self.first_page {
+            return Err(Error::InvalidPdfOption("pages must be an ascending one-based range"));
+        }
+        if self.max_page_bytes == 0 || self.max_output_bytes == 0 {
+            return Err(Error::InvalidPdfOption("text limits must be positive"));
+        }
+        Ok(())
+    }
+}
+
+/// What is known about a page; failure is never reported as empty.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Status {
+    Text,
+    Empty,
+    Failed,
+    Skipped,
+}
+
+impl Status {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Text => "text",
+            Self::Empty => "empty",
+            Self::Failed => "failed",
+            Self::Skipped => "skipped",
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct PageResult {
+    pub number: u32,
+    pub status: Status,
+    pub text: String,
+    /// Unknown if the page could not be interpreted.
+    pub images: Option<u32>,
+    pub truncated: bool,
+    pub reason: Option<String>,
+}
+
+#[derive(Debug)]
+pub struct Pages {
+    pub info: Info,
+    pub pages: Vec<PageResult>,
+}
+
+/// Counts actual leaves, not the page tree's advertised `/Count`.
+///
+/// # Errors
+/// A malformed, locked, unsupported or over-budget document.
+pub fn info(data: &[u8], limits: &Limits) -> Result<Info> {
+    let budget = Budget::new(limits, data.len())?;
+    let document = open(data, &budget)?;
+    let selected = document.select_pages(1, u32::MAX, 0)?;
+    Ok(Info { page_count: selected.count, encrypted: document.encrypted() })
+}
+
+/// Reads only selected page streams. Page failures are retained alongside
+/// successes; cancellation and exhausted document budgets remain errors.
+///
+/// # Errors
+/// As [`info`], and invalid options.
+pub fn pages(data: &[u8], options: &ReadOptions, limits: &Limits) -> Result<Pages> {
+    options.validate()?;
+    let budget = Budget::new(limits, data.len())?;
+    let document = open(data, &budget)?;
+    let selected =
+        document.select_pages(options.first_page, options.last_page, options.max_pages)?;
+    let mut fonts = Fonts::new();
+    let mut text = PageText { strict: true, ..PageText::default() };
+    let mut remaining = options.max_output_bytes;
+    let mut results = Vec::with_capacity(selected.pages.len());
+    for (number, page) in selected.pages {
+        budget.check()?;
+        if remaining == 0 {
+            results.push(unread(
+                number,
+                Status::Skipped,
+                "the text output limit was reached".into(),
+            ));
+            continue;
+        }
+        text.max_bytes = Some(options.max_page_bytes.min(remaining));
+        let read = page.and_then(|page| page_text(&document, &page, &mut fonts, &mut text));
+        match read {
+            Ok(()) => {
+                let lines = layout::lines(&text);
+                let mut output = String::new();
+                for line in &lines.lines {
+                    if !output.is_empty() {
+                        output.push('\n');
+                    }
+                    output.push_str(lines.text(line));
+                }
+                let limit = options.max_page_bytes.min(remaining);
+                let truncated = text.truncated || output.len() > limit;
+                truncate(&mut output, limit);
+                remaining -= output.len();
+                results.push(PageResult {
+                    number,
+                    status: if output.trim().is_empty() { Status::Empty } else { Status::Text },
+                    text: output,
+                    images: Some(u32::try_from(text.images).unwrap_or(u32::MAX)),
+                    truncated,
+                    reason: truncated.then(|| "the page text limit was reached".into()),
+                });
+            }
+            Err(error) if xref::is_limit(&error) || matches!(error, Error::PasswordRequired) => {
+                return Err(error);
+            }
+            Err(error) => results.push(unread(number, Status::Failed, error.to_string())),
+        }
+    }
+    Ok(Pages {
+        info: Info { page_count: selected.count, encrypted: document.encrypted() },
+        pages: results,
+    })
+}
+
+pub(super) fn open<'a>(data: &'a [u8], budget: &'a Budget<'a>) -> Result<Document<'a>> {
+    if !is_pdf(data) {
+        return Err(Error::UnsupportedDocument("not a PDF file".into()));
+    }
+    budget.check()?;
+    Document::open(data, budget).map(Document::strict)
+}
+
+const fn unread(number: u32, status: Status, reason: String) -> PageResult {
+    PageResult {
+        number,
+        status,
+        reason: Some(reason),
+        text: String::new(),
+        images: None,
+        truncated: false,
+    }
+}
+
+fn truncate(text: &mut String, maximum: usize) {
+    let mut end = text.len().min(maximum);
+    while !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    text.truncate(end);
+}

data/ext/imprimatur_native/core/src/read/pdf/content/state.rs

@@ -0,0 +1,50 @@
+//! Graphics and text state for a content stream.
+
+use std::rc::Rc;
+
+use super::Font;
+use super::geometry::{IDENTITY, Matrix, multiply};
+
+#[derive(Clone, Copy)]
+pub(super) struct Cursor {
+    pub matrix: Matrix,
+    line: Matrix,
+}
+
+impl Cursor {
+    pub const START: Self = Self { matrix: IDENTITY, line: IDENTITY };
+
+    pub const fn at(matrix: Matrix) -> Self {
+        Self { matrix, line: matrix }
+    }
+
+    pub fn next_line(&mut self, x: f64, y: f64) {
+        self.line = multiply(&[1.0, 0.0, 0.0, 1.0, x, y], &self.line);
+        self.matrix = self.line;
+    }
+}
+
+#[derive(Clone)]
+pub(super) struct State {
+    pub ctm: Matrix,
+    pub font: Option<Rc<Font>>,
+    pub size: f64,
+    pub char_spacing: f64,
+    pub word_spacing: f64,
+    pub scale: f64,
+    pub leading: f64,
+    pub rise: f64,
+}
+
+impl State {
+    pub const START: Self = Self {
+        ctm: IDENTITY,
+        font: None,
+        size: 0.0,
+        char_spacing: 0.0,
+        word_spacing: 0.0,
+        scale: 1.0,
+        leading: 0.0,
+        rise: 0.0,
+    };
+}

data/ext/imprimatur_native/core/src/read/pdf/content.rs

@@ -5,6 +5,7 @@
 
 mod geometry;
 mod operands;
+mod state;
 #[cfg(test)]
 mod tests;
 
@@ -17,10 +18,11 @@ use super::font::Font;
 use super::glyphs::push_clean;
 use super::lexer::{Lexer, Token, hex_into, literal_into, name_bytes};
 use super::object::{Dict, Object};
-use crate::Result;
 use crate::read::span;
+use crate::{Error, Result};
 use geometry::{Frame, IDENTITY, Matrix, multiply, quarter_turns};
 use operands::{Operand, inline_image, operand};
+use state::{Cursor, State};
 
 /// A glyph where it shows: its origin and advance along the baseline, in
 /// the page's displayed frame (rotation applied), and its text.
@@ -56,52 +58,9 @@ pub struct PageText {
     pub images: usize,
     /// The displayed page: width and height.
     pub size: (f64, f64),
-}
-
-/// The text matrix and the text line matrix (ISO 32000-1, 9.4.2).
-#[derive(Clone, Copy)]
-struct Cursor {
-    matrix: Matrix,
-    line: Matrix,
-}
-
-impl Cursor {
-    const START: Self = Self { matrix: IDENTITY, line: IDENTITY };
-
-    const fn at(matrix: Matrix) -> Self {
-        Self { matrix, line: matrix }
-    }
-
-    /// `Td`: the start of a new line, offset from the current line's start.
-    fn next_line(&mut self, x: f64, y: f64) {
-        self.line = multiply(&[1.0, 0.0, 0.0, 1.0, x, y], &self.line);
-        self.matrix = self.line;
-    }
-}
-
-#[derive(Clone)]
-struct State {
-    ctm: Matrix,
-    font: Option<Rc<Font>>,
-    size: f64,
-    char_spacing: f64,
-    word_spacing: f64,
-    scale: f64,
-    leading: f64,
-    rise: f64,
-}
-
-impl State {
-    const START: Self = Self {
-        ctm: IDENTITY,
-        font: None,
-        size: 0.0,
-        char_spacing: 0.0,
-        word_spacing: 0.0,
-        scale: 1.0,
-        leading: 0.0,
-        rise: 0.0,
-    };
+    pub max_bytes: Option<usize>,
+    pub truncated: bool,
+    pub strict: bool,
 }
 
 /// Fonts by the object number of their dictionary, shared across pages.
@@ -150,14 +109,23 @@ fn run(
     out.text.clear();
     out.glyphs.clear();
     out.images = 0;
+    out.truncated = false;
     let content = match page.contents.as_slice() {
-        [single] => document.stream_data(single)?.unwrap_or_default(),
+        [single] => match document.stream_data(single)? {
+            Some(data) => data,
+            None if out.strict => {
+                return Err(Error::malformed("PDF", "missing page content stream"));
+            }
+            None => Vec::new(),
+        },
         parts => {
             let mut content = Vec::new();
             for part in parts {
                 if let Some(data) = document.stream_data(part)? {
                     content.extend_from_slice(&data);
                     content.push(b'\n');
+                } else if out.strict {
+                    return Err(Error::malformed("PDF", "missing page content stream"));
                 }
             }
             content
@@ -256,7 +224,7 @@ impl Run<'_, '_> {
                     if operator == b"'" || operator == b"\"" {
                         cursor.next_line(0.0, -state.leading);
                     }
-                    self.show_operand(operands.last(), &items, &state, &mut cursor.matrix);
+                    self.show_operand(operands.last(), &items, &state, &mut cursor.matrix)?;
                 }
                 b"Do" => {
                     if let Some(name) = name(0) {
@@ -287,7 +255,7 @@ impl Run<'_, '_> {
         items: &[Operand<'_>],
         state: &State,
         matrix: &mut Matrix,
-    ) {
+    ) -> Result<()> {
         let shown = match operand {
             Some(&Operand::Array(start, end)) => items.get(start..end).unwrap_or_default(),
             Some(single) => std::slice::from_ref(single),
@@ -303,7 +271,7 @@ impl Run<'_, '_> {
                     } else {
                         literal_into(raw, &mut bytes);
                     }
-                    self.show(&bytes, state, matrix);
+                    self.show(&bytes, state, matrix)?;
                 }
                 Operand::Number(adjustment) => {
                     let shift = -adjustment / 1000.0 * state.size * state.scale;
@@ -314,6 +282,7 @@ impl Run<'_, '_> {
             }
         }
         self.bytes = bytes;
+        Ok(())
     }
 
     /// A font resource, loaded once per document.
@@ -338,8 +307,14 @@ impl Run<'_, '_> {
     }
 
     /// Emits a string's glyphs and advances the text matrix past them.
-    fn show(&mut self, bytes: &[u8], state: &State, matrix: &mut Matrix) {
-        let Some(font) = state.font.clone() else { return };
+    fn show(&mut self, bytes: &[u8], state: &State, matrix: &mut Matrix) -> Result<()> {
+        let Some(font) = state.font.clone() else {
+            return if self.page.strict && !bytes.is_empty() {
+                Err(Error::malformed("PDF", "missing font for page text"))
+            } else {
+                Ok(())
+            };
+        };
         let device = multiply(matrix, &state.ctm);
         let shown = multiply(&device, &self.rotation);
         let along = shown[0].hypot(shown[1]);
@@ -350,6 +325,7 @@ impl Run<'_, '_> {
         let mut scratch = std::mem::take(&mut self.scratch);
         let bounds = self.bounds;
         font.glyphs(bytes, &mut scratch, |text, width, space| {
+            self.document.budget().tick()?;
             let x = f64::mul_add(advance, shown[0], shown[4]) + rise.0;
             let y = f64::mul_add(advance, shown[1], shown[5]) + rise.1;
             let user = (
@@ -361,6 +337,17 @@ impl Run<'_, '_> {
                 && user.1 >= bounds[1] - 1.0
                 && user.1 <= bounds[3] + 1.0;
             if visible && !text.is_empty() {
+                if self.page.truncated {
+                    return Ok(());
+                }
+                if self
+                    .page
+                    .max_bytes
+                    .is_some_and(|limit| self.page.text.len().saturating_add(text.len()) > limit)
+                {
+                    self.page.truncated = true;
+                    return Ok(());
+                }
                 let span = span::append(&mut self.page.text, |page| push_clean(page, text));
                 if !span.is_empty() {
                     let width = width * state.size * state.scale * along;
@@ -381,10 +368,12 @@ impl Run<'_, '_> {
                 state.scale,
                 advance,
             );
-        });
+            Ok(())
+        })?;
         self.scratch = scratch;
         matrix[4] = f64::mul_add(advance, matrix[0], matrix[4]);
         matrix[5] = f64::mul_add(advance, matrix[1], matrix[5]);
+        Ok(())
     }
 
     /// `Do`: a form `XObject`'s content, in its own matrix and resources;

data/ext/imprimatur_native/core/src/read/pdf/document/pages.rs

@@ -0,0 +1,140 @@
+//! Count the real page tree; only materialize the requested page descriptors.
+
+use std::collections::HashSet;
+
+use super::{Dict, Document, Error, Object, Page, Rc, Result, malformed};
+
+pub struct Selection {
+    pub count: u32,
+    pub pages: Vec<(u32, Result<Page>)>,
+    first: u32,
+    last: u32,
+    maximum: usize,
+}
+
+impl Selection {
+    fn add(&mut self, page: impl FnOnce() -> Result<Page>) -> Result<()> {
+        self.count = self.count.checked_add(1).ok_or(Error::LimitExceeded("page count"))?;
+        if (self.first..=self.last).contains(&self.count) && self.pages.len() < self.maximum {
+            self.pages.push((self.count, page()));
+        }
+        Ok(())
+    }
+}
+
+impl Document<'_> {
+    pub fn pages(&self) -> Result<Vec<Page>> {
+        self.select_pages(1, u32::MAX, usize::MAX)?
+            .pages
+            .into_iter()
+            .map(|(_, page)| page)
+            .collect()
+    }
+
+    pub fn select_pages(&self, first: u32, last: u32, maximum: usize) -> Result<Selection> {
+        let mut selected = Selection { count: 0, pages: Vec::new(), first, last, maximum };
+        if let Some(root) = self.trailer().get(b"Root") {
+            let root = self.resolve(root)?;
+            if let Some(tree) = root.as_dict().and_then(|root| root.get(b"Pages")) {
+                self.walk(tree, &Inherited::default(), 0, &mut HashSet::new(), &mut selected)?;
+            }
+        }
+        if selected.count == 0 {
+            let mut numbers: Vec<u32> = self.xref.entries.keys().copied().collect();
+            numbers.sort_unstable();
+            for number in numbers {
+                self.budget.check()?;
+                let object = self.get(number)?;
+                if let Some(dict) = object.as_dict()
+                    && dict.has_name(b"Type", b"Page")
+                {
+                    selected.add(|| self.page(dict, &Inherited::default()))?;
+                }
+            }
+        }
+        if selected.count == 0 {
+            return Err(malformed("the document has no pages"));
+        }
+        Ok(selected)
+    }
+
+    fn walk(
+        &self,
+        node: &Object,
+        inherited: &Inherited,
+        depth: usize,
+        visited: &mut HashSet<u32>,
+        selected: &mut Selection,
+    ) -> Result<()> {
+        self.budget.check()?;
+        self.budget.nest(depth)?;
+        if let Some((number, _)) = node.as_reference()
+            && !visited.insert(number)
+        {
+            return Ok(());
+        }
+        let node = self.resolve(node)?;
+        let Some(dict) = node.as_dict() else { return Ok(()) };
+        if dict.has_name(b"Type", b"Page") {
+            return selected.add(|| self.page(dict, inherited));
+        }
+        let inherited = self.inherit(dict, inherited)?;
+        if let Some(Object::Array(kids)) = self.entry(dict, b"Kids")?.as_deref() {
+            for kid in kids {
+                self.walk(kid, &inherited, depth + 1, visited, selected)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn inherit(&self, dict: &Dict, inherited: &Inherited) -> Result<Inherited> {
+        let resources = match dict.get(b"Resources") {
+            Some(object) => Some(self.resolve(object)?.into_shared()),
+            None => inherited.resources.clone(),
+        };
+        let media_box = match self.entry(dict, b"MediaBox")?.as_deref().and_then(Object::as_array) {
+            Some(corners) if corners.len() == 4 => {
+                let mut media_box = [0.0; 4];
+                for (slot, corner) in media_box.iter_mut().zip(corners) {
+                    *slot = self.resolve(corner)?.as_number().unwrap_or(0.0);
+                }
+                media_box
+            }
+            _ => inherited.media_box,
+        };
+        let rotate =
+            self.entry(dict, b"Rotate")?.and_then(|it| it.as_integer()).unwrap_or(inherited.rotate);
+        Ok(Inherited { resources, media_box, rotate })
+    }
+
+    fn page(&self, dict: &Dict, inherited: &Inherited) -> Result<Page> {
+        let inherited = self.inherit(dict, inherited)?;
+        let contents = match dict.get(b"Contents") {
+            Some(reference @ Object::Ref(..)) => match &*self.resolve(reference)? {
+                Object::Array(parts) => parts.clone(),
+                _ => vec![reference.clone()],
+            },
+            Some(Object::Array(parts)) => parts.clone(),
+            Some(other) => vec![other.clone()],
+            None => Vec::new(),
+        };
+        Ok(Page {
+            resources: inherited.resources,
+            contents,
+            media_box: inherited.media_box,
+            rotate: inherited.rotate,
+        })
+    }
+}
+
+struct Inherited {
+    resources: Option<Rc<Object>>,
+    media_box: [f64; 4],
+    rotate: i64,
+}
+
+impl Default for Inherited {
+    fn default() -> Self {
+        Self { resources: None, media_box: [0.0, 0.0, 612.0, 792.0], rotate: 0 }
+    }
+}