imprimatur 0.5.0 → 0.6.1

data/ext/imprimatur_native/core/src/read/pdf/document.rs

@@ -1,6 +1,8 @@
 //! A PDF file's objects on demand: loaded once and shared, decrypted, and
 //! their streams decoded; then the pages, with what they inherit.
 
+mod pages;
+
 use std::borrow::Cow;
 use std::cell::RefCell;
 use std::collections::HashMap;
@@ -67,6 +69,7 @@ pub struct Document<'a> {
     objects: RefCell<HashMap<u32, Rc<Object>>>,
     streams: RefCell<HashMap<u32, Rc<ObjectStream>>>,
     loading: RefCell<Vec<u32>>,
+    strict: bool,
 }
 
 impl<'a> Document<'a> {
@@ -81,6 +84,7 @@ impl<'a> Document<'a> {
             objects: RefCell::default(),
             streams: RefCell::default(),
             loading: RefCell::default(),
+            strict: false,
         };
         if let Some(encrypt) = document.xref.trailer.get(b"Encrypt").cloned() {
             let encrypt = document.resolve(&encrypt)?;
@@ -100,6 +104,11 @@ impl<'a> Document<'a> {
         self.budget
     }
 
+    pub const fn strict(mut self) -> Self {
+        self.strict = true;
+        self
+    }
+
     pub const fn trailer(&self) -> &Dict {
         &self.xref.trailer
     }
@@ -221,6 +230,9 @@ impl<'a> Document<'a> {
     pub fn decode(&self, stream: &Stream, number: Option<u32>) -> Result<Vec<u8>> {
         let raw = self.raw(stream, number)?;
         let filters = self.filters(&stream.dict)?;
+        if self.strict {
+            return filter::decode_strict(&raw, &filter_params(&filters), self.budget);
+        }
         decode_with(&raw, &filters, self.budget)
     }
 
@@ -285,107 +297,8 @@ impl<'a> Document<'a> {
         }
     }
 
-    /// The pages in order. When the page tree is broken, every object of
-    /// type `/Page`, by object number.
-    pub fn pages(&self) -> Result<Vec<Page>> {
-        let mut pages = Vec::new();
-        if let Some(root) = self.trailer().get(b"Root").cloned() {
-            let root = self.resolve(&root)?;
-            if let Some(tree) = root.as_dict().and_then(|root| root.get(b"Pages")).cloned() {
-                let inherited =
-                    Inherited { resources: None, media_box: [0.0, 0.0, 612.0, 792.0], rotate: 0 };
-                let mut visited = Vec::new();
-                self.walk(&tree, &inherited, 0, &mut visited, &mut pages)?;
-            }
-        }
-        if pages.is_empty() {
-            let mut numbers: Vec<u32> = self.xref.entries.keys().copied().collect();
-            numbers.sort_unstable();
-            for number in numbers {
-                let object = self.get(number)?;
-                if let Some(dict) = object.as_dict()
-                    && dict.has_name(b"Type", b"Page")
-                {
-                    let inherited = Inherited {
-                        resources: None,
-                        media_box: [0.0, 0.0, 612.0, 792.0],
-                        rotate: 0,
-                    };
-                    pages.push(self.page(dict, &inherited)?);
-                }
-            }
-        }
-        Ok(pages)
-    }
-
-    fn walk(
-        &self,
-        node: &Object,
-        inherited: &Inherited,
-        depth: usize,
-        visited: &mut Vec<u32>,
-        pages: &mut Vec<Page>,
-    ) -> Result<()> {
-        self.budget.nest(depth)?;
-        if let Some((number, _)) = node.as_reference() {
-            if visited.contains(&number) {
-                return Ok(());
-            }
-            visited.push(number);
-        }
-        let node = self.resolve(node)?;
-        let Some(dict) = node.as_dict() else { return Ok(()) };
-        let inherited = self.inherit(dict, inherited)?;
-        match self.entry(dict, b"Kids")?.as_deref() {
-            Some(Object::Array(kids)) if !dict.has_name(b"Type", b"Page") => {
-                for kid in kids {
-                    self.walk(kid, &inherited, depth + 1, visited, pages)?;
-                }
-            }
-            _ => pages.push(self.page(dict, &inherited)?),
-        }
-        Ok(())
-    }
-
-    fn inherit(&self, dict: &Dict, inherited: &Inherited) -> Result<Inherited> {
-        let resources = match dict.get(b"Resources") {
-            Some(object) => Some(self.resolve(object)?.into_shared()),
-            None => inherited.resources.clone(),
-        };
-        let media_box = match self.entry(dict, b"MediaBox")?.as_deref().and_then(Object::as_array) {
-            Some(corners) if corners.len() == 4 => {
-                let mut media_box = [0.0; 4];
-                for (slot, corner) in media_box.iter_mut().zip(corners) {
-                    *slot = self.resolve(corner)?.as_number().unwrap_or(0.0);
-                }
-                media_box
-            }
-            _ => inherited.media_box,
-        };
-        let rotate = self
-            .entry(dict, b"Rotate")?
-            .and_then(|rotate| rotate.as_integer())
-            .unwrap_or(inherited.rotate);
-        Ok(Inherited { resources, media_box, rotate })
-    }
-
-    fn page(&self, dict: &Dict, inherited: &Inherited) -> Result<Page> {
-        let inherited = self.inherit(dict, inherited)?;
-        let contents = match dict.get(b"Contents") {
-            Some(reference @ Object::Ref(..)) => match &*self.resolve(reference)? {
-                Object::Array(parts) => parts.clone(),
-                _ => vec![reference.clone()],
-            },
-            Some(Object::Array(parts)) => parts.clone(),
-            Some(other) => vec![other.clone()],
-            None => Vec::new(),
-        };
-        Ok(Page {
-            resources: inherited.resources,
-            contents,
-            media_box: inherited.media_box,
-            rotate: inherited.rotate,
-        })
+    pub const fn encrypted(&self) -> bool {
+        self.crypt.is_some()
     }
 }
 
@@ -394,17 +307,14 @@ pub type Filter = (Name, Option<Rc<Object>>);
 
 /// `raw` through `filters`, in order.
 pub fn decode_with(raw: &[u8], filters: &[Filter], budget: &Budget<'_>) -> Result<Vec<u8>> {
-    let filters: Vec<(&[u8], Option<&Dict>)> = filters
-        .iter()
-        .map(|(name, params)| (&**name, params.as_deref().and_then(Object::as_dict)))
-        .collect();
-    filter::decode(raw, &filters, budget)
+    filter::decode(raw, &filter_params(filters), budget)
 }
 
-struct Inherited {
-    resources: Option<Rc<Object>>,
-    media_box: [f64; 4],
-    rotate: i64,
+fn filter_params(filters: &[Filter]) -> Vec<(&[u8], Option<&Dict>)> {
+    filters
+        .iter()
+        .map(|(name, params)| (&**name, params.as_deref().and_then(Object::as_dict)))
+        .collect()
 }
 
 /// Decrypts every string in an object freshly read from the file.

data/ext/imprimatur_native/core/src/read/pdf/filter.rs

@@ -13,12 +13,29 @@ pub fn decode(
     data: &[u8],
     filters: &[(&[u8], Option<&Dict>)],
     budget: &Budget<'_>,
+) -> Result<Vec<u8>> {
+    decode_stream(data, filters, budget, false)
+}
+
+pub fn decode_strict(
+    data: &[u8],
+    filters: &[(&[u8], Option<&Dict>)],
+    budget: &Budget<'_>,
+) -> Result<Vec<u8>> {
+    decode_stream(data, filters, budget, true)
+}
+
+fn decode_stream(
+    data: &[u8],
+    filters: &[(&[u8], Option<&Dict>)],
+    budget: &Budget<'_>,
+    strict: bool,
 ) -> Result<Vec<u8>> {
     let mut current: Option<Vec<u8>> = None;
     for &(name, params) in filters {
         let input = current.as_deref().unwrap_or(data);
         let output = match name {
-            b"FlateDecode" | b"Fl" => predict(inflate(input, budget)?, params)?,
+            b"FlateDecode" | b"Fl" => predict(inflate(input, budget, strict)?, params)?,
             b"LZWDecode" | b"LZW" => {
                 let early = params
                     .and_then(|params| params.get(b"EarlyChange"))
@@ -48,25 +65,20 @@ pub fn decode(
 
 /// zlib, or raw deflate when the header is missing. A truncated or
 /// corrupt stream yields what inflated before the damage, as viewers show.
-fn inflate(data: &[u8], budget: &Budget<'_>) -> Result<Vec<u8>> {
+fn inflate(data: &[u8], budget: &Budget<'_>, strict: bool) -> Result<Vec<u8>> {
     let zlib = data.len() > 2
         && data[0] & 0x0F == 8
         && (u16::from(data[0]) << 8 | u16::from(data[1])).is_multiple_of(31);
     let expected = data.len().saturating_mul(4);
-    let (output, complete) =
-        crate::read::inflate::inflate(data, zlib, expected, budget.inflatable())?;
-    if complete || !output.is_empty() {
-        return Ok(output);
-    }
-    if zlib {
-        // A header that only looked like zlib's: try the bytes as raw deflate.
-        let (output, _) =
-            crate::read::inflate::inflate(data, false, expected, budget.inflatable())?;
-        if !output.is_empty() {
+    // Retry apparent zlib data as raw deflate.
+    for header in std::iter::once(zlib).chain(zlib.then_some(false)) {
+        let (output, complete) =
+            crate::read::inflate::inflate(data, header, expected, budget.inflatable())?;
+        if complete || (!strict && !output.is_empty()) {
             return Ok(output);
         }
     }
-    Err(malformed("a stream does not inflate"))
+    Err(malformed("an incomplete or corrupt Flate stream"))
 }
 
 /// Undoes a PNG (10 and up) or TIFF (2) predictor.

data/ext/imprimatur_native/core/src/read/pdf/font.rs

@@ -125,8 +125,8 @@ impl Font {
         &self,
         bytes: &[u8],
         scratch: &mut String,
-        mut glyph: impl FnMut(&str, f64, bool),
-    ) {
+        mut glyph: impl FnMut(&str, f64, bool) -> Result<()>,
+    ) -> Result<()> {
         let mut at = 0;
         while at < bytes.len() {
             let length = match &self.codes {
@@ -171,8 +171,9 @@ impl Font {
                     .unwrap_or(*default)
                 }
             };
-            glyph(scratch, width * self.scale, length == 1 && code == 32);
+            glyph(scratch, width * self.scale, length == 1 && code == 32)?;
         }
+        Ok(())
     }
 }
 

data/ext/imprimatur_native/core/src/read/pdf/isolation/protocol.rs

@@ -0,0 +1,224 @@
+//! Versioned replies and numeric-only arguments for the trusted PDF worker.
+
+use std::ffi::OsString;
+use std::io::Write;
+use std::time::Duration;
+
+use super::ProcessLimits;
+use crate::read::Limits;
+use crate::read::pdf::{ReadOptions, RenderOptions};
+use crate::{Error, Result};
+
+pub(super) const HEADER: &[u8; 6] = b"IMPR\x02\0";
+pub(super) const MAX_ERROR_BYTES: usize = 4096;
+
+pub(super) enum Operation {
+    Info,
+    Pages(ReadOptions),
+    Render(u32, RenderOptions),
+}
+
+impl Operation {
+    pub fn maximum(&self) -> Result<usize> {
+        let invalid = || Error::InvalidPdfOption("worker output limit is too large");
+        let maximum = match self {
+            Self::Info => MAX_ERROR_BYTES,
+            // JSON can escape each text byte as six ASCII bytes. Reasons and
+            // record metadata are separately bounded for every selected page.
+            Self::Pages(options) => options
+                .max_output_bytes
+                .checked_mul(6)
+                .and_then(|text| {
+                    options.max_pages.checked_mul(MAX_ERROR_BYTES * 6 + 512)?.checked_add(text)
+                })
+                .and_then(|bytes| bytes.checked_add(MAX_ERROR_BYTES * 6 + 512))
+                .ok_or_else(invalid)?,
+            Self::Render(_, options) => options.max_output_bytes,
+        };
+        maximum.max(MAX_ERROR_BYTES).checked_add(HEADER.len()).ok_or_else(invalid)
+    }
+}
+
+pub(super) struct Request {
+    pub restricted: bool,
+    pub operation: Operation,
+    pub limits: Limits,
+    pub memory: u64,
+    pub cpu_seconds: u64,
+}
+
+impl Request {
+    pub fn new(operation: Operation, limits: &Limits, process: &ProcessLimits) -> Result<Self> {
+        operation.maximum()?;
+        match &operation {
+            Operation::Pages(options) => options.validate()?,
+            Operation::Render(0, _) => {
+                return Err(Error::InvalidPdfOption("page number must be positive"));
+            }
+            _ => {}
+        }
+        if process.memory_bytes == 0 || process.memory_bytes >= i64::MAX as u64 {
+            return Err(Error::InvalidPdfOption("memory limit must be positive and finite"));
+        }
+        let wall = limits.timeout.unwrap_or(process.wall_time).min(process.wall_time);
+        let cpu_seconds = wall
+            .as_secs()
+            .checked_add(u64::from(wall.subsec_nanos() != 0))
+            .filter(|&seconds| seconds != 0 && seconds < i64::MAX as u64)
+            .ok_or(Error::InvalidPdfOption("worker wall time must be positive and finite"))?;
+        u64::try_from(wall.as_nanos())
+            .map_err(|_| Error::InvalidPdfOption("worker wall time is too large"))?;
+        Ok(Self {
+            restricted: false,
+            operation,
+            limits: limits.clone().timeout(Some(wall)),
+            memory: process.memory_bytes,
+            cpu_seconds,
+        })
+    }
+
+    pub fn arguments(&self) -> Vec<OsString> {
+        let timeout = self.limits.timeout.unwrap_or_default();
+        let mut values = vec![
+            u64::from(self.restricted),
+            self.limits.max_input as u64,
+            self.limits.max_inflated,
+            self.limits.max_depth as u64,
+            self.memory,
+            self.cpu_seconds,
+            u64::try_from(timeout.as_nanos()).unwrap_or(u64::MAX),
+        ];
+        match &self.operation {
+            Operation::Info => values.push(0),
+            Operation::Pages(options) => values.extend([
+                1,
+                u64::from(options.first_page),
+                u64::from(options.last_page),
+                options.max_pages as u64,
+                options.max_page_bytes as u64,
+                options.max_output_bytes as u64,
+            ]),
+            Operation::Render(number, options) => values.extend([
+                2,
+                u64::from(*number),
+                u64::from(options.max_side),
+                options.max_pixels,
+                options.max_output_bytes as u64,
+                u64::from(options.grayscale),
+            ]),
+        }
+        values.into_iter().map(|number| OsString::from(number.to_string())).collect()
+    }
+
+    pub fn parse() -> Result<Self> {
+        let invalid = || Error::InvalidPdfOption("invalid PDF worker arguments");
+        let values: Vec<u64> = std::env::args()
+            .skip(1)
+            .map(|value| value.parse().map_err(|_| invalid()))
+            .collect::<Result<_>>()?;
+        let [restricted, input, inflated, depth, memory, cpu, timeout, rest @ ..] =
+            values.as_slice()
+        else {
+            return Err(invalid());
+        };
+        if *restricted > 1 {
+            return Err(invalid());
+        }
+        let length = |value| usize::try_from(value).map_err(|_| invalid());
+        let operation = match rest {
+            [0] => Operation::Info,
+            [1, first, last, count, page, output] => Operation::Pages(ReadOptions {
+                first_page: u32::try_from(*first).map_err(|_| invalid())?,
+                last_page: u32::try_from(*last).map_err(|_| invalid())?,
+                max_pages: length(*count)?,
+                max_page_bytes: length(*page)?,
+                max_output_bytes: length(*output)?,
+            }),
+            [2, number, side, pixels, output, gray] if *gray <= 1 => Operation::Render(
+                u32::try_from(*number).map_err(|_| invalid())?,
+                RenderOptions {
+                    max_side: u16::try_from(*side).map_err(|_| invalid())?,
+                    max_pixels: *pixels,
+                    max_output_bytes: length(*output)?,
+                    grayscale: *gray == 1,
+                },
+            ),
+            _ => return Err(invalid()),
+        };
+        let limits = Limits::default()
+            .max_input(length(*input)?)
+            .max_inflated(*inflated)
+            .max_depth(length(*depth)?)
+            .timeout(Some(Duration::from_nanos(*timeout)));
+        let process =
+            ProcessLimits { memory_bytes: *memory, wall_time: Duration::from_nanos(*timeout) };
+        let mut request = Self::new(operation, &limits, &process)?;
+        request.restricted = *restricted == 1;
+        if request.cpu_seconds != *cpu {
+            return Err(invalid());
+        }
+        Ok(request)
+    }
+}
+
+pub(super) fn failure(error: &Error) -> (u8, String) {
+    let kind = match error {
+        Error::PasswordRequired => 1,
+        Error::UnsupportedDocument(_) => 2,
+        Error::LimitExceeded(_) | Error::Cancelled => 3,
+        Error::InvalidPdfOption(_) => 4,
+        _ => 5,
+    };
+    let mut message = error.to_string();
+    let mut end = message.len().min(MAX_ERROR_BYTES);
+    while !message.is_char_boundary(end) {
+        end -= 1;
+    }
+    message.truncate(end);
+    (kind, message)
+}
+
+pub(super) fn error(kind: u8, message: String) -> Error {
+    match kind {
+        1 => Error::PasswordRequired,
+        2 => Error::UnsupportedDocument(message),
+        3 => Error::LimitExceeded("PDF worker limit"),
+        4 => Error::InvalidPdfOption("the PDF worker rejected the options"),
+        _ => Error::malformed("PDF worker", message),
+    }
+}
+
+pub(super) fn write_reply(mut out: impl Write, result: Result<Vec<u8>>) -> Result<()> {
+    let mut header = *HEADER;
+    match result {
+        Ok(data) => {
+            out.write_all(&header)?;
+            out.write_all(&data)?;
+        }
+        Err(error) => {
+            let (kind, message) = failure(&error);
+            header[5] = kind;
+            out.write_all(&header)?;
+            out.write_all(message.as_bytes())?;
+        }
+    }
+    out.flush()?;
+    Ok(())
+}
+
+pub(super) fn decode(mut data: Vec<u8>, maximum: usize) -> Result<Vec<u8>> {
+    if data.len() < HEADER.len() || data[..5] != HEADER[..5] {
+        return Err(Error::malformed("PDF worker", "missing or incompatible response"));
+    }
+    let status = data[5];
+    data.drain(..HEADER.len());
+    if status == 0 {
+        return if data.len() > maximum {
+            Err(Error::LimitExceeded("PDF worker output"))
+        } else {
+            Ok(data)
+        };
+    }
+    let message = String::from_utf8_lossy(&data[..data.len().min(MAX_ERROR_BYTES)]).into_owned();
+    Err(error(status, message))
+}

data/ext/imprimatur_native/core/src/read/pdf/isolation/stream.rs

@@ -0,0 +1,113 @@
+//! Flushed page records survive a worker timeout or resource termination.
+
+use std::io::Write;
+
+use serde::{Deserialize, Serialize};
+
+use super::{Output, protocol};
+use crate::read::pdf::{Info, PageResult, Pages, ReadOptions, Status, bounded};
+use crate::{Error, Result};
+
+#[derive(Serialize, Deserialize)]
+pub(super) enum Frame {
+    Info(Info),
+    Page(PageResult),
+    End,
+    Error { kind: u8, message: String },
+}
+
+pub(super) fn write(out: &mut impl Write, frame: &Frame) -> Result<()> {
+    serde_json::to_writer(&mut *out, frame)
+        .map_err(|error| Error::malformed("PDF worker", error.to_string()))?;
+    out.write_all(b"\n")?;
+    out.flush()?;
+    Ok(())
+}
+
+pub(super) fn decode(output: Output, options: &ReadOptions) -> Result<Pages> {
+    let mut failure = output.failure;
+    if output.data.len() < protocol::HEADER.len() {
+        return Err(failure.unwrap_or_else(|| malformed("missing response")));
+    }
+    let bytes =
+        protocol::decode(output.data, protocol::Operation::Pages(options.clone()).maximum()?)?;
+    let mut info = None;
+    let mut pages = Vec::new();
+    let mut text_bytes = 0_usize;
+    let mut ended = false;
+    for line in bytes.split_inclusive(|&byte| byte == b'\n') {
+        if ended {
+            return Err(malformed("records after the end of the response"));
+        }
+        if !line.ends_with(b"\n") && failure.is_some() {
+            break; // A killed worker may leave one incomplete final record.
+        }
+        let frame: Frame =
+            serde_json::from_slice(line).map_err(|error| malformed(&error.to_string()))?;
+        match frame {
+            Frame::Info(value) if info.is_none() && pages.is_empty() => info = Some(value),
+            Frame::Page(page) => {
+                let metadata = info.ok_or_else(|| malformed("page before metadata"))?;
+                validate(&page, pages.len(), metadata, options)?;
+                text_bytes = text_bytes
+                    .checked_add(page.text.len())
+                    .filter(|&bytes| bytes <= options.max_output_bytes)
+                    .ok_or_else(|| malformed("text exceeds the requested limit"))?;
+                pages.push(page);
+            }
+            Frame::End => ended = true,
+            Frame::Error { kind, message } => {
+                failure = Some(protocol::error(kind, message));
+                ended = true;
+            }
+            Frame::Info(_) => return Err(malformed("duplicate metadata")),
+        }
+    }
+    let info =
+        info.ok_or_else(|| failure.take().unwrap_or_else(|| malformed("missing metadata")))?;
+    let count = selected(info, options);
+    if pages.len() == count && ended {
+        return Ok(Pages { info, pages });
+    }
+    let error = failure.ok_or_else(|| malformed("incomplete response"))?;
+    let reason = error.to_string();
+    let timed_out = matches!(
+        error,
+        Error::LimitExceeded("time" | "render worker wall time" | "PDF worker limit")
+    );
+    let first_missing = pages.len();
+    for index in first_missing..count {
+        let number =
+            options.first_page + u32::try_from(index).map_err(|_| malformed("page index"))?;
+        let status =
+            if timed_out || index > first_missing { Status::Skipped } else { Status::Failed };
+        pages.push(bounded::unread(number, status, reason.clone()));
+    }
+    Ok(Pages { info, pages })
+}
+
+fn selected(info: Info, options: &ReadOptions) -> usize {
+    let count = options
+        .last_page
+        .min(info.page_count)
+        .checked_sub(options.first_page)
+        .map_or(0, |difference| u64::from(difference) + 1);
+    usize::try_from(count).unwrap_or(usize::MAX).min(options.max_pages)
+}
+
+fn validate(page: &PageResult, index: usize, info: Info, options: &ReadOptions) -> Result<()> {
+    let expected = u64::from(options.first_page) + index as u64;
+    if index >= selected(info, options)
+        || u64::from(page.number) != expected
+        || page.text.len() > options.max_page_bytes
+        || page.reason.as_ref().is_some_and(|reason| reason.len() > protocol::MAX_ERROR_BYTES)
+        || (matches!(page.status, Status::Failed | Status::Skipped) && !page.text.is_empty())
+    {
+        return Err(malformed("invalid page record"));
+    }
+    Ok(())
+}
+
+fn malformed(reason: &str) -> Error {
+    Error::malformed("PDF worker", reason)
+}