imprimatur 0.4.0 → 0.6.0

data/ext/imprimatur_native/core/src/read/pdf/document.rs

@@ -1,6 +1,8 @@
 //! A PDF file's objects on demand: loaded once and shared, decrypted, and
 //! their streams decoded; then the pages, with what they inherit.
 
+mod pages;
+
 use std::borrow::Cow;
 use std::cell::RefCell;
 use std::collections::HashMap;
@@ -67,6 +69,7 @@ pub struct Document<'a> {
     objects: RefCell<HashMap<u32, Rc<Object>>>,
     streams: RefCell<HashMap<u32, Rc<ObjectStream>>>,
     loading: RefCell<Vec<u32>>,
+    strict: bool,
 }
 
 impl<'a> Document<'a> {
@@ -81,6 +84,7 @@ impl<'a> Document<'a> {
             objects: RefCell::default(),
             streams: RefCell::default(),
             loading: RefCell::default(),
+            strict: false,
         };
         if let Some(encrypt) = document.xref.trailer.get(b"Encrypt").cloned() {
             let encrypt = document.resolve(&encrypt)?;
@@ -100,6 +104,11 @@ impl<'a> Document<'a> {
         self.budget
     }
 
+    pub const fn strict(mut self) -> Self {
+        self.strict = true;
+        self
+    }
+
     pub const fn trailer(&self) -> &Dict {
         &self.xref.trailer
     }
@@ -221,6 +230,9 @@ impl<'a> Document<'a> {
     pub fn decode(&self, stream: &Stream, number: Option<u32>) -> Result<Vec<u8>> {
         let raw = self.raw(stream, number)?;
         let filters = self.filters(&stream.dict)?;
+        if self.strict {
+            return filter::decode_strict(&raw, &filter_params(&filters), self.budget);
+        }
         decode_with(&raw, &filters, self.budget)
     }
 
@@ -285,107 +297,8 @@ impl<'a> Document<'a> {
         }
     }
 
-    /// The pages in order. When the page tree is broken, every object of
-    /// type `/Page`, by object number.
-    pub fn pages(&self) -> Result<Vec<Page>> {
-        let mut pages = Vec::new();
-        if let Some(root) = self.trailer().get(b"Root").cloned() {
-            let root = self.resolve(&root)?;
-            if let Some(tree) = root.as_dict().and_then(|root| root.get(b"Pages")).cloned() {
-                let inherited =
-                    Inherited { resources: None, media_box: [0.0, 0.0, 612.0, 792.0], rotate: 0 };
-                let mut visited = Vec::new();
-                self.walk(&tree, &inherited, 0, &mut visited, &mut pages)?;
-            }
-        }
-        if pages.is_empty() {
-            let mut numbers: Vec<u32> = self.xref.entries.keys().copied().collect();
-            numbers.sort_unstable();
-            for number in numbers {
-                let object = self.get(number)?;
-                if let Some(dict) = object.as_dict()
-                    && dict.has_name(b"Type", b"Page")
-                {
-                    let inherited = Inherited {
-                        resources: None,
-                        media_box: [0.0, 0.0, 612.0, 792.0],
-                        rotate: 0,
-                    };
-                    pages.push(self.page(dict, &inherited)?);
-                }
-            }
-        }
-        Ok(pages)
-    }
-
-    fn walk(
-        &self,
-        node: &Object,
-        inherited: &Inherited,
-        depth: usize,
-        visited: &mut Vec<u32>,
-        pages: &mut Vec<Page>,
-    ) -> Result<()> {
-        self.budget.nest(depth)?;
-        if let Some((number, _)) = node.as_reference() {
-            if visited.contains(&number) {
-                return Ok(());
-            }
-            visited.push(number);
-        }
-        let node = self.resolve(node)?;
-        let Some(dict) = node.as_dict() else { return Ok(()) };
-        let inherited = self.inherit(dict, inherited)?;
-        match self.entry(dict, b"Kids")?.as_deref() {
-            Some(Object::Array(kids)) if !dict.has_name(b"Type", b"Page") => {
-                for kid in kids {
-                    self.walk(kid, &inherited, depth + 1, visited, pages)?;
-                }
-            }
-            _ => pages.push(self.page(dict, &inherited)?),
-        }
-        Ok(())
-    }
-
-    fn inherit(&self, dict: &Dict, inherited: &Inherited) -> Result<Inherited> {
-        let resources = match dict.get(b"Resources") {
-            Some(object) => Some(self.resolve(object)?.into_shared()),
-            None => inherited.resources.clone(),
-        };
-        let media_box = match self.entry(dict, b"MediaBox")?.as_deref().and_then(Object::as_array) {
-            Some(corners) if corners.len() == 4 => {
-                let mut media_box = [0.0; 4];
-                for (slot, corner) in media_box.iter_mut().zip(corners) {
-                    *slot = self.resolve(corner)?.as_number().unwrap_or(0.0);
-                }
-                media_box
-            }
-            _ => inherited.media_box,
-        };
-        let rotate = self
-            .entry(dict, b"Rotate")?
-            .and_then(|rotate| rotate.as_integer())
-            .unwrap_or(inherited.rotate);
-        Ok(Inherited { resources, media_box, rotate })
-    }
-
-    fn page(&self, dict: &Dict, inherited: &Inherited) -> Result<Page> {
-        let inherited = self.inherit(dict, inherited)?;
-        let contents = match dict.get(b"Contents") {
-            Some(reference @ Object::Ref(..)) => match &*self.resolve(reference)? {
-                Object::Array(parts) => parts.clone(),
-                _ => vec![reference.clone()],
-            },
-            Some(Object::Array(parts)) => parts.clone(),
-            Some(other) => vec![other.clone()],
-            None => Vec::new(),
-        };
-        Ok(Page {
-            resources: inherited.resources,
-            contents,
-            media_box: inherited.media_box,
-            rotate: inherited.rotate,
-        })
+    pub const fn encrypted(&self) -> bool {
+        self.crypt.is_some()
     }
 }
 
@@ -394,17 +307,14 @@ pub type Filter = (Name, Option<Rc<Object>>);
 
 /// `raw` through `filters`, in order.
 pub fn decode_with(raw: &[u8], filters: &[Filter], budget: &Budget<'_>) -> Result<Vec<u8>> {
-    let filters: Vec<(&[u8], Option<&Dict>)> = filters
-        .iter()
-        .map(|(name, params)| (&**name, params.as_deref().and_then(Object::as_dict)))
-        .collect();
-    filter::decode(raw, &filters, budget)
+    filter::decode(raw, &filter_params(filters), budget)
 }
 
-struct Inherited {
-    resources: Option<Rc<Object>>,
-    media_box: [f64; 4],
-    rotate: i64,
+fn filter_params(filters: &[Filter]) -> Vec<(&[u8], Option<&Dict>)> {
+    filters
+        .iter()
+        .map(|(name, params)| (&**name, params.as_deref().and_then(Object::as_dict)))
+        .collect()
 }
 
 /// Decrypts every string in an object freshly read from the file.

data/ext/imprimatur_native/core/src/read/pdf/filter.rs

@@ -13,12 +13,29 @@ pub fn decode(
     data: &[u8],
     filters: &[(&[u8], Option<&Dict>)],
     budget: &Budget<'_>,
+) -> Result<Vec<u8>> {
+    decode_stream(data, filters, budget, false)
+}
+
+pub fn decode_strict(
+    data: &[u8],
+    filters: &[(&[u8], Option<&Dict>)],
+    budget: &Budget<'_>,
+) -> Result<Vec<u8>> {
+    decode_stream(data, filters, budget, true)
+}
+
+fn decode_stream(
+    data: &[u8],
+    filters: &[(&[u8], Option<&Dict>)],
+    budget: &Budget<'_>,
+    strict: bool,
 ) -> Result<Vec<u8>> {
     let mut current: Option<Vec<u8>> = None;
     for &(name, params) in filters {
         let input = current.as_deref().unwrap_or(data);
         let output = match name {
-            b"FlateDecode" | b"Fl" => predict(inflate(input, budget)?, params)?,
+            b"FlateDecode" | b"Fl" => predict(inflate(input, budget, strict)?, params)?,
             b"LZWDecode" | b"LZW" => {
                 let early = params
                     .and_then(|params| params.get(b"EarlyChange"))
@@ -48,25 +65,20 @@ pub fn decode(
 
 /// zlib, or raw deflate when the header is missing. A truncated or
 /// corrupt stream yields what inflated before the damage, as viewers show.
-fn inflate(data: &[u8], budget: &Budget<'_>) -> Result<Vec<u8>> {
+fn inflate(data: &[u8], budget: &Budget<'_>, strict: bool) -> Result<Vec<u8>> {
     let zlib = data.len() > 2
         && data[0] & 0x0F == 8
         && (u16::from(data[0]) << 8 | u16::from(data[1])).is_multiple_of(31);
     let expected = data.len().saturating_mul(4);
-    let (output, complete) =
-        crate::read::inflate::inflate(data, zlib, expected, budget.inflatable())?;
-    if complete || !output.is_empty() {
-        return Ok(output);
-    }
-    if zlib {
-        // A header that only looked like zlib's: try the bytes as raw deflate.
-        let (output, _) =
-            crate::read::inflate::inflate(data, false, expected, budget.inflatable())?;
-        if !output.is_empty() {
+    // Retry apparent zlib data as raw deflate.
+    for header in std::iter::once(zlib).chain(zlib.then_some(false)) {
+        let (output, complete) =
+            crate::read::inflate::inflate(data, header, expected, budget.inflatable())?;
+        if complete || (!strict && !output.is_empty()) {
             return Ok(output);
         }
     }
-    Err(malformed("a stream does not inflate"))
+    Err(malformed("an incomplete or corrupt Flate stream"))
 }
 
 /// Undoes a PNG (10 and up) or TIFF (2) predictor.

data/ext/imprimatur_native/core/src/read/pdf/font.rs

@@ -125,8 +125,8 @@ impl Font {
         &self,
         bytes: &[u8],
         scratch: &mut String,
-        mut glyph: impl FnMut(&str, f64, bool),
-    ) {
+        mut glyph: impl FnMut(&str, f64, bool) -> Result<()>,
+    ) -> Result<()> {
         let mut at = 0;
         while at < bytes.len() {
             let length = match &self.codes {
@@ -171,8 +171,9 @@ impl Font {
                     .unwrap_or(*default)
                 }
             };
-            glyph(scratch, width * self.scale, length == 1 && code == 32);
+            glyph(scratch, width * self.scale, length == 1 && code == 32)?;
         }
+        Ok(())
     }
 }
 

data/ext/imprimatur_native/core/src/read/pdf/isolation/protocol.rs

@@ -0,0 +1,155 @@
+//! A versioned, bounded reply and numeric-only worker arguments.
+
+use std::ffi::OsString;
+use std::io::Write;
+
+use super::ProcessLimits;
+use crate::read::Limits;
+use crate::read::pdf::RenderOptions;
+use crate::{Error, Result};
+
+pub(super) const HEADER: &[u8; 6] = b"IMPR\x01\0";
+pub(super) const MAX_ERROR_BYTES: usize = 4096;
+
+pub(super) struct Request {
+    pub number: u32,
+    pub options: RenderOptions,
+    pub limits: Limits,
+    pub memory: u64,
+    pub cpu_seconds: u64,
+}
+
+impl Request {
+    pub fn new(
+        number: u32,
+        options: &RenderOptions,
+        limits: &Limits,
+        process: &ProcessLimits,
+    ) -> Result<Self> {
+        options
+            .max_output_bytes
+            .checked_add(HEADER.len())
+            .ok_or(Error::InvalidPdfOption("output limit is too large"))?;
+        if process.memory_bytes == 0 || process.memory_bytes >= i64::MAX as u64 {
+            return Err(Error::InvalidPdfOption("memory limit must be positive and finite"));
+        }
+        let cpu_seconds = process
+            .wall_time
+            .as_secs()
+            .checked_add(u64::from(process.wall_time.subsec_nanos() != 0))
+            .filter(|&seconds| seconds != 0 && seconds < i64::MAX as u64)
+            .ok_or(Error::InvalidPdfOption("worker wall time must be positive and finite"))?;
+        Ok(Self {
+            number,
+            options: options.clone(),
+            limits: limits.clone(),
+            memory: process.memory_bytes,
+            cpu_seconds,
+        })
+    }
+
+    pub fn arguments(&self) -> Vec<OsString> {
+        [
+            u64::from(self.number),
+            u64::from(self.options.max_side),
+            self.options.max_pixels,
+            self.options.max_output_bytes as u64,
+            u64::from(self.options.grayscale),
+            self.limits.max_input as u64,
+            self.limits.max_inflated,
+            self.limits.max_depth as u64,
+            self.memory,
+            self.cpu_seconds,
+        ]
+        .map(|number| OsString::from(number.to_string()))
+        .to_vec()
+    }
+
+    pub fn parse() -> Result<Self> {
+        let invalid = || Error::InvalidPdfOption("invalid render worker arguments");
+        let values: Vec<u64> = std::env::args()
+            .skip(1)
+            .map(|value| value.parse().map_err(|_| invalid()))
+            .collect::<Result<_>>()?;
+        let [number, side, pixels, output, gray, input, inflated, depth, memory, cpu] =
+            values.as_slice()
+        else {
+            return Err(invalid());
+        };
+        if *gray > 1
+            || *memory == 0
+            || *memory >= i64::MAX as u64
+            || *cpu == 0
+            || *cpu >= i64::MAX as u64
+        {
+            return Err(invalid());
+        }
+        Ok(Self {
+            number: u32::try_from(*number).map_err(|_| invalid())?,
+            options: RenderOptions {
+                max_side: u16::try_from(*side).map_err(|_| invalid())?,
+                max_pixels: *pixels,
+                max_output_bytes: usize::try_from(*output).map_err(|_| invalid())?,
+                grayscale: *gray == 1,
+            },
+            limits: Limits::default()
+                .max_input(usize::try_from(*input).map_err(|_| invalid())?)
+                .max_inflated(*inflated)
+                .max_depth(usize::try_from(*depth).map_err(|_| invalid())?)
+                .timeout(None),
+            memory: *memory,
+            cpu_seconds: *cpu,
+        })
+    }
+}
+
+pub(super) fn write_reply(mut out: impl Write, result: Result<Vec<u8>>) -> Result<()> {
+    let mut header = *HEADER;
+    match result {
+        Ok(data) => {
+            out.write_all(&header)?;
+            out.write_all(&data)?;
+        }
+        Err(error) => {
+            header[5] = match &error {
+                Error::PasswordRequired => 1,
+                Error::UnsupportedDocument(_) => 2,
+                Error::LimitExceeded(_) | Error::Cancelled => 3,
+                Error::InvalidPdfOption(_) => 4,
+                _ => 5,
+            };
+            let message = error.to_string();
+            let mut end = message.len().min(MAX_ERROR_BYTES);
+            while !message.is_char_boundary(end) {
+                end -= 1;
+            }
+            out.write_all(&header)?;
+            out.write_all(&message.as_bytes()[..end])?;
+        }
+    }
+    out.flush()?;
+    Ok(())
+}
+
+pub(super) fn decode(mut data: Vec<u8>, maximum: usize) -> Result<Vec<u8>> {
+    if data.len() < HEADER.len() || data[..5] != HEADER[..5] {
+        return Err(Error::malformed("render worker", "missing or incompatible response"));
+    }
+    let status = data[5];
+    data.drain(..HEADER.len());
+    if status == 0 {
+        return if data.len() > maximum {
+            Err(Error::LimitExceeded("rendered bytes"))
+        } else {
+            Ok(data)
+        };
+    }
+    let message = String::from_utf8_lossy(&data[..data.len().min(MAX_ERROR_BYTES)]).into_owned();
+    Err(match status {
+        1 => Error::PasswordRequired,
+        2 => Error::UnsupportedDocument(message),
+        3 => Error::LimitExceeded("render worker limit"),
+        4 => Error::InvalidPdfOption("the render worker rejected the rendering options"),
+        _ => Error::malformed("render worker", message),
+    })
+}

data/ext/imprimatur_native/core/src/read/pdf/isolation/system.rs

@@ -0,0 +1,71 @@
+//! OS resource enforcement. macOS uses the supervisor's RSS watchdog.
+
+#[cfg(test)]
+mod tests;
+
+use std::process::Child;
+
+use nix::errno::Errno;
+use nix::sys::resource::{Resource, getrlimit, rlim_t, setrlimit};
+use nix::sys::signal::{Signal, killpg};
+use nix::unistd::Pid;
+
+use crate::{Error, Result};
+
+pub(super) fn apply_limits(memory: u64, cpu: u64, output: u64) -> Result<()> {
+    if memory == 0 {
+        return Err(Error::InvalidPdfOption("memory limit must be positive"));
+    }
+    #[cfg(target_os = "linux")]
+    lower(Resource::RLIMIT_AS, memory)?;
+    #[cfg(target_os = "freebsd")]
+    lower(Resource::RLIMIT_VMEM, memory)?;
+    #[cfg(not(any(target_os = "linux", target_os = "freebsd", target_os = "macos")))]
+    return Err(Error::UnsupportedDocument("process limits are unsupported on this OS".into()));
+    lower(Resource::RLIMIT_CORE, 0)?;
+    lower(Resource::RLIMIT_CPU, cpu)?;
+    lower(Resource::RLIMIT_FSIZE, output)?;
+    Ok(())
+}
+
+fn lower(resource: Resource, value: u64) -> Result<()> {
+    let (soft, hard) = getrlimit(resource).map_err(std::io::Error::from)?;
+    let value = bounded_limit(value, soft, hard)?;
+    setrlimit(resource, value, value).map_err(std::io::Error::from)?;
+    Ok(())
+}
+
+fn bounded_limit(value: u64, soft: rlim_t, hard: rlim_t) -> Result<rlim_t> {
+    let value = i128::from(value).min(i128::from(soft)).min(i128::from(hard));
+    value.try_into().map_err(|_| Error::InvalidPdfOption("resource limit is out of range"))
+}
+
+#[cfg(target_os = "macos")]
+pub(super) fn check_memory(pid: u32, maximum: u64) -> Result<()> {
+    let pid = i32::try_from(pid).map_err(|_| Error::InvalidPdfOption("invalid worker PID"))?;
+    let usage = libproc::proc_pid::pidinfo::<libproc::task_info::TaskInfo>(pid, 0)
+        .map_err(|error| std::io::Error::other(format!("cannot monitor render worker: {error}")))?;
+    if usage.pti_resident_size > maximum {
+        return Err(Error::LimitExceeded("render worker memory"));
+    }
+    Ok(())
+}
+
+pub(super) fn terminate(child: &mut Child) {
+    if let Ok(pid) = i32::try_from(child.id())
+        && let Err(error) = killpg(Pid::from_raw(pid), Signal::SIGKILL)
+        && error != Errno::ESRCH
+    {
+        eprintln!("imprimatur: could not kill render worker group: {error}");
+    }
+    // Also handle a child that failed before joining its new process group.
+    if let Err(error) = child.kill()
+        && error.kind() != std::io::ErrorKind::InvalidInput
+        && error.raw_os_error() != Some(Errno::ESRCH as i32)
+    {
+        eprintln!("imprimatur: could not kill render worker: {error}");
+    }
+    if let Err(error) = child.wait() {
+        eprintln!("imprimatur: could not reap render worker: {error}");
+    }
+}

data/ext/imprimatur_native/core/src/read/pdf/isolation/worker.rs

@@ -0,0 +1,43 @@
+//! The companion worker sets limits before touching the document.
+
+use std::io::Read;
+use std::process::ExitCode;
+
+use super::{protocol, system};
+use crate::read::pdf::render_page;
+use crate::{Error, Result};
+
+/// Internal entry point for the bundled worker executable.
+#[doc(hidden)]
+#[must_use]
+pub fn worker_main() -> ExitCode {
+    match protocol::write_reply(std::io::stdout().lock(), run()) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("imprimatur render worker: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<Vec<u8>> {
+    let request = protocol::Request::parse()?;
+    let output = request
+        .options
+        .max_output_bytes
+        .max(protocol::MAX_ERROR_BYTES)
+        .checked_add(protocol::HEADER.len())
+        .and_then(|value| u64::try_from(value).ok())
+        .ok_or(Error::InvalidPdfOption("output limit is too large"))?;
+    system::apply_limits(request.memory, request.cpu_seconds, output)?;
+    let mut bytes = Vec::new();
+    let maximum = u64::try_from(request.limits.max_input)
+        .ok()
+        .and_then(|value| value.checked_add(1))
+        .ok_or(Error::InvalidPdfOption("input limit is too large"))?;
+    std::io::stdin().lock().take(maximum).read_to_end(&mut bytes)?;
+    if bytes.len() > request.limits.max_input {
+        return Err(Error::LimitExceeded("input size"));
+    }
+    render_page(&bytes, request.number, &request.options, &request.limits).map(|image| image.data)
+}