imprimatur 0.6.0 → 0.7.0

data/ext/imprimatur_native/core/src/read/pdf/document/labels.rs

@@ -0,0 +1,152 @@
+use std::collections::HashSet;
+
+use super::{Dict, Document, Object, Result};
+
+struct LabelRange {
+    start: u32,
+    style: Option<u8>,
+    prefix: Option<String>,
+    first: i64,
+}
+
+const ROMAN: &[(i64, &str)] = &[
+    (1000, "M"),
+    (900, "CM"),
+    (500, "D"),
+    (400, "CD"),
+    (100, "C"),
+    (90, "XC"),
+    (50, "L"),
+    (40, "XL"),
+    (10, "X"),
+    (9, "IX"),
+    (5, "V"),
+    (4, "IV"),
+    (1, "I"),
+];
+
+impl Document<'_> {
+    pub fn page_labels(&self, count: usize) -> Result<Option<Vec<Option<String>>>> {
+        let Some(ranges) = self.label_ranges()? else { return Ok(None) };
+        Ok(Some(
+            (0..count)
+                .map(|index| label_for(&ranges, u32::try_from(index).unwrap_or(u32::MAX)))
+                .collect(),
+        ))
+    }
+
+    fn label_ranges(&self) -> Result<Option<Vec<LabelRange>>> {
+        let Some(root) = self.trailer().get(b"Root") else { return Ok(None) };
+        let root = self.resolve(root)?;
+        let Some(catalog) = root.as_dict() else { return Ok(None) };
+        let Some(tree) = catalog.get(b"PageLabels") else { return Ok(None) };
+        let mut ranges = Vec::new();
+        self.walk_labels(tree, 0, &mut HashSet::new(), &mut ranges)?;
+        ranges.sort_by_key(|range| range.start);
+        ranges.dedup_by_key(|range| range.start);
+        Ok(Some(ranges))
+    }
+
+    fn walk_labels(
+        &self,
+        node: &Object,
+        depth: usize,
+        visited: &mut HashSet<u32>,
+        out: &mut Vec<LabelRange>,
+    ) -> Result<()> {
+        self.budget.check()?;
+        self.budget.nest(depth)?;
+        if let Some((number, _)) = node.as_reference()
+            && !visited.insert(number)
+        {
+            return Ok(());
+        }
+        let node = self.resolve(node)?;
+        let Some(dict) = node.as_dict() else { return Ok(()) };
+        if let Some(Object::Array(nums)) = self.entry(dict, b"Nums")?.as_deref() {
+            let mut nums = nums.iter();
+            while let (Some(start), Some(value)) = (nums.next(), nums.next()) {
+                let Some(start) =
+                    self.resolve(start)?.as_integer().and_then(|start| u32::try_from(start).ok())
+                else {
+                    continue;
+                };
+                let value = self.resolve(value)?;
+                if let Some(label) = value.as_dict() {
+                    out.push(self.label_range(start, label)?);
+                }
+            }
+        }
+        if let Some(Object::Array(kids)) = self.entry(dict, b"Kids")?.as_deref() {
+            for kid in kids {
+                self.walk_labels(kid, depth + 1, visited, out)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn label_range(&self, start: u32, dict: &Dict) -> Result<LabelRange> {
+        let style = self
+            .entry(dict, b"S")?
+            .as_deref()
+            .and_then(Object::as_name)
+            .and_then(|name| name.first().copied());
+        let prefix = self
+            .entry(dict, b"P")?
+            .as_deref()
+            .and_then(Object::as_bytes)
+            .map(|bytes| String::from_utf8_lossy(bytes).into_owned());
+        let first = self.entry(dict, b"St")?.as_deref().and_then(Object::as_integer).unwrap_or(1);
+        Ok(LabelRange { start, style, prefix, first })
+    }
+}
+
+fn label_for(ranges: &[LabelRange], index: u32) -> Option<String> {
+    let range = ranges.iter().rev().find(|range| range.start <= index)?;
+    let offset = i64::from(index - range.start);
+    let number = range.first.checked_add(offset)?;
+    let mut label = range.prefix.clone().unwrap_or_default();
+    if let Some(style) = range.style {
+        label.push_str(&numeral(style, number));
+    }
+    Some(label)
+}
+
+fn numeral(style: u8, number: i64) -> String {
+    match style {
+        b'R' => roman(number, true),
+        b'r' => roman(number, false),
+        b'A' => alpha(number, true),
+        b'a' => alpha(number, false),
+        _ => number.to_string(),
+    }
+}
+
+fn roman(number: i64, upper: bool) -> String {
+    if number < 1 {
+        return number.to_string();
+    }
+    let mut remaining = number;
+    let mut out = String::new();
+    for &(value, symbol) in ROMAN {
+        while remaining >= value {
+            out.push_str(symbol);
+            remaining -= value;
+        }
+    }
+    if upper { out } else { out.to_ascii_lowercase() }
+}
+
+fn alpha(number: i64, upper: bool) -> String {
+    if number < 1 {
+        return String::new();
+    }
+    let zero_based = number - 1;
+    let letter = u8::try_from(zero_based % 26).unwrap_or(0);
+    let repeat = usize::try_from(zero_based / 26 + 1).unwrap_or(1);
+    let letter = if upper { b'A' + letter } else { b'a' + letter };
+    std::iter::repeat_n(char::from(letter), repeat).collect()
+}
+
+#[cfg(test)]
+mod tests;

data/ext/imprimatur_native/core/src/read/pdf/document.rs

@@ -1,6 +1,7 @@
 //! A PDF file's objects on demand: loaded once and shared, decrypted, and
 //! their streams decoded; then the pages, with what they inherit.
 
+mod labels;
 mod pages;
 
 use std::borrow::Cow;

data/ext/imprimatur_native/core/src/read/pdf/isolation/protocol.rs

@@ -1,105 +1,190 @@
-//! A versioned, bounded reply and numeric-only worker arguments.
+//! Versioned replies and numeric-only arguments for the trusted PDF worker.
 
 use std::ffi::OsString;
 use std::io::Write;
+use std::time::Duration;
 
 use super::ProcessLimits;
 use crate::read::Limits;
-use crate::read::pdf::RenderOptions;
+use crate::read::pdf::{ReadOptions, RenderOptions};
 use crate::{Error, Result};
 
-pub(super) const HEADER: &[u8; 6] = b"IMPR\x01\0";
+pub(super) const HEADER: &[u8; 6] = b"IMPR\x02\0";
 pub(super) const MAX_ERROR_BYTES: usize = 4096;
 
+pub(super) enum Operation {
+    Info,
+    Pages(ReadOptions),
+    Render(u32, RenderOptions),
+}
+
+impl Operation {
+    pub fn maximum(&self) -> Result<usize> {
+        let invalid = || Error::InvalidPdfOption("worker output limit is too large");
+        let maximum = match self {
+            Self::Info => MAX_ERROR_BYTES,
+            // JSON can escape each text byte as six ASCII bytes. Reasons and
+            // record metadata are separately bounded for every selected page.
+            Self::Pages(options) => options
+                .max_output_bytes
+                .checked_mul(6)
+                .and_then(|text| {
+                    options.max_pages.checked_mul(MAX_ERROR_BYTES * 6 + 512)?.checked_add(text)
+                })
+                .and_then(|bytes| bytes.checked_add(MAX_ERROR_BYTES * 6 + 512))
+                .ok_or_else(invalid)?,
+            Self::Render(_, options) => options.max_output_bytes,
+        };
+        maximum.max(MAX_ERROR_BYTES).checked_add(HEADER.len()).ok_or_else(invalid)
+    }
+}
+
 pub(super) struct Request {
-    pub number: u32,
-    pub options: RenderOptions,
+    pub restricted: bool,
+    pub operation: Operation,
     pub limits: Limits,
     pub memory: u64,
     pub cpu_seconds: u64,
 }
 
 impl Request {
-    pub fn new(
-        number: u32,
-        options: &RenderOptions,
-        limits: &Limits,
-        process: &ProcessLimits,
-    ) -> Result<Self> {
-        options
-            .max_output_bytes
-            .checked_add(HEADER.len())
-            .ok_or(Error::InvalidPdfOption("output limit is too large"))?;
+    pub fn new(operation: Operation, limits: &Limits, process: &ProcessLimits) -> Result<Self> {
+        operation.maximum()?;
+        match &operation {
+            Operation::Pages(options) => options.validate()?,
+            Operation::Render(0, _) => {
+                return Err(Error::InvalidPdfOption("page number must be positive"));
+            }
+            _ => {}
+        }
         if process.memory_bytes == 0 || process.memory_bytes >= i64::MAX as u64 {
             return Err(Error::InvalidPdfOption("memory limit must be positive and finite"));
         }
-        let cpu_seconds = process
-            .wall_time
+        let wall = limits.timeout.unwrap_or(process.wall_time).min(process.wall_time);
+        let cpu_seconds = wall
             .as_secs()
-            .checked_add(u64::from(process.wall_time.subsec_nanos() != 0))
+            .checked_add(u64::from(wall.subsec_nanos() != 0))
             .filter(|&seconds| seconds != 0 && seconds < i64::MAX as u64)
             .ok_or(Error::InvalidPdfOption("worker wall time must be positive and finite"))?;
+        u64::try_from(wall.as_nanos())
+            .map_err(|_| Error::InvalidPdfOption("worker wall time is too large"))?;
         Ok(Self {
-            number,
-            options: options.clone(),
-            limits: limits.clone(),
+            restricted: false,
+            operation,
+            limits: limits.clone().timeout(Some(wall)),
             memory: process.memory_bytes,
             cpu_seconds,
         })
     }
 
     pub fn arguments(&self) -> Vec<OsString> {
-        [
-            u64::from(self.number),
-            u64::from(self.options.max_side),
-            self.options.max_pixels,
-            self.options.max_output_bytes as u64,
-            u64::from(self.options.grayscale),
+        let timeout = self.limits.timeout.unwrap_or_default();
+        let mut values = vec![
+            u64::from(self.restricted),
             self.limits.max_input as u64,
             self.limits.max_inflated,
             self.limits.max_depth as u64,
             self.memory,
             self.cpu_seconds,
-        ]
-        .map(|number| OsString::from(number.to_string()))
-        .to_vec()
+            u64::try_from(timeout.as_nanos()).unwrap_or(u64::MAX),
+        ];
+        match &self.operation {
+            Operation::Info => values.push(0),
+            Operation::Pages(options) => values.extend([
+                1,
+                u64::from(options.first_page),
+                u64::from(options.last_page),
+                options.max_pages as u64,
+                options.max_page_bytes as u64,
+                options.max_output_bytes as u64,
+            ]),
+            Operation::Render(number, options) => values.extend([
+                2,
+                u64::from(*number),
+                u64::from(options.max_side),
+                options.max_pixels,
+                options.max_output_bytes as u64,
+                u64::from(options.grayscale),
+            ]),
+        }
+        values.into_iter().map(|number| OsString::from(number.to_string())).collect()
     }
 
     pub fn parse() -> Result<Self> {
-        let invalid = || Error::InvalidPdfOption("invalid render worker arguments");
+        let invalid = || Error::InvalidPdfOption("invalid PDF worker arguments");
         let values: Vec<u64> = std::env::args()
             .skip(1)
             .map(|value| value.parse().map_err(|_| invalid()))
             .collect::<Result<_>>()?;
-        let [number, side, pixels, output, gray, input, inflated, depth, memory, cpu] =
+        let [restricted, input, inflated, depth, memory, cpu, timeout, rest @ ..] =
             values.as_slice()
         else {
             return Err(invalid());
         };
-        if *gray > 1
-            || *memory == 0
-            || *memory >= i64::MAX as u64
-            || *cpu == 0
-            || *cpu >= i64::MAX as u64
-        {
+        if *restricted > 1 {
             return Err(invalid());
         }
-        Ok(Self {
-            number: u32::try_from(*number).map_err(|_| invalid())?,
-            options: RenderOptions {
-                max_side: u16::try_from(*side).map_err(|_| invalid())?,
-                max_pixels: *pixels,
-                max_output_bytes: usize::try_from(*output).map_err(|_| invalid())?,
-                grayscale: *gray == 1,
-            },
-            limits: Limits::default()
-                .max_input(usize::try_from(*input).map_err(|_| invalid())?)
-                .max_inflated(*inflated)
-                .max_depth(usize::try_from(*depth).map_err(|_| invalid())?)
-                .timeout(None),
-            memory: *memory,
-            cpu_seconds: *cpu,
-        })
+        let length = |value| usize::try_from(value).map_err(|_| invalid());
+        let operation = match rest {
+            [0] => Operation::Info,
+            [1, first, last, count, page, output] => Operation::Pages(ReadOptions {
+                first_page: u32::try_from(*first).map_err(|_| invalid())?,
+                last_page: u32::try_from(*last).map_err(|_| invalid())?,
+                max_pages: length(*count)?,
+                max_page_bytes: length(*page)?,
+                max_output_bytes: length(*output)?,
+            }),
+            [2, number, side, pixels, output, gray] if *gray <= 1 => Operation::Render(
+                u32::try_from(*number).map_err(|_| invalid())?,
+                RenderOptions {
+                    max_side: u16::try_from(*side).map_err(|_| invalid())?,
+                    max_pixels: *pixels,
+                    max_output_bytes: length(*output)?,
+                    grayscale: *gray == 1,
+                },
+            ),
+            _ => return Err(invalid()),
+        };
+        let limits = Limits::default()
+            .max_input(length(*input)?)
+            .max_inflated(*inflated)
+            .max_depth(length(*depth)?)
+            .timeout(Some(Duration::from_nanos(*timeout)));
+        let process =
+            ProcessLimits { memory_bytes: *memory, wall_time: Duration::from_nanos(*timeout) };
+        let mut request = Self::new(operation, &limits, &process)?;
+        request.restricted = *restricted == 1;
+        if request.cpu_seconds != *cpu {
+            return Err(invalid());
+        }
+        Ok(request)
+    }
+}
+
+pub(super) fn failure(error: &Error) -> (u8, String) {
+    let kind = match error {
+        Error::PasswordRequired => 1,
+        Error::UnsupportedDocument(_) => 2,
+        Error::LimitExceeded(_) | Error::Cancelled => 3,
+        Error::InvalidPdfOption(_) => 4,
+        _ => 5,
+    };
+    let mut message = error.to_string();
+    let mut end = message.len().min(MAX_ERROR_BYTES);
+    while !message.is_char_boundary(end) {
+        end -= 1;
+    }
+    message.truncate(end);
+    (kind, message)
+}
+
+pub(super) fn error(kind: u8, message: String) -> Error {
+    match kind {
+        1 => Error::PasswordRequired,
+        2 => Error::UnsupportedDocument(message),
+        3 => Error::LimitExceeded("PDF worker limit"),
+        4 => Error::InvalidPdfOption("the PDF worker rejected the options"),
+        _ => Error::malformed("PDF worker", message),
     }
 }
 
@@ -111,20 +196,10 @@ pub(super) fn write_reply(mut out: impl Write, result: Result<Vec<u8>>) -> Resul
             out.write_all(&data)?;
         }
         Err(error) => {
-            header[5] = match &error {
-                Error::PasswordRequired => 1,
-                Error::UnsupportedDocument(_) => 2,
-                Error::LimitExceeded(_) | Error::Cancelled => 3,
-                Error::InvalidPdfOption(_) => 4,
-                _ => 5,
-            };
-            let message = error.to_string();
-            let mut end = message.len().min(MAX_ERROR_BYTES);
-            while !message.is_char_boundary(end) {
-                end -= 1;
-            }
+            let (kind, message) = failure(&error);
+            header[5] = kind;
             out.write_all(&header)?;
-            out.write_all(&message.as_bytes()[..end])?;
+            out.write_all(message.as_bytes())?;
         }
     }
     out.flush()?;
@@ -133,23 +208,17 @@ pub(super) fn write_reply(mut out: impl Write, result: Result<Vec<u8>>) -> Resul
 
 pub(super) fn decode(mut data: Vec<u8>, maximum: usize) -> Result<Vec<u8>> {
     if data.len() < HEADER.len() || data[..5] != HEADER[..5] {
-        return Err(Error::malformed("render worker", "missing or incompatible response"));
+        return Err(Error::malformed("PDF worker", "missing or incompatible response"));
     }
     let status = data[5];
     data.drain(..HEADER.len());
     if status == 0 {
         return if data.len() > maximum {
-            Err(Error::LimitExceeded("rendered bytes"))
+            Err(Error::LimitExceeded("PDF worker output"))
         } else {
             Ok(data)
         };
     }
     let message = String::from_utf8_lossy(&data[..data.len().min(MAX_ERROR_BYTES)]).into_owned();
-    Err(match status {
-        1 => Error::PasswordRequired,
-        2 => Error::UnsupportedDocument(message),
-        3 => Error::LimitExceeded("render worker limit"),
-        4 => Error::InvalidPdfOption("the render worker rejected the rendering options"),
-        _ => Error::malformed("render worker", message),
-    })
+    Err(error(status, message))
 }

data/ext/imprimatur_native/core/src/read/pdf/isolation/stream.rs

@@ -0,0 +1,113 @@
+//! Flushed page records survive a worker timeout or resource termination.
+
+use std::io::Write;
+
+use serde::{Deserialize, Serialize};
+
+use super::{Output, protocol};
+use crate::read::pdf::{Info, PageResult, Pages, ReadOptions, Status, bounded};
+use crate::{Error, Result};
+
+#[derive(Serialize, Deserialize)]
+pub(super) enum Frame {
+    Info(Info),
+    Page(PageResult),
+    End,
+    Error { kind: u8, message: String },
+}
+
+pub(super) fn write(out: &mut impl Write, frame: &Frame) -> Result<()> {
+    serde_json::to_writer(&mut *out, frame)
+        .map_err(|error| Error::malformed("PDF worker", error.to_string()))?;
+    out.write_all(b"\n")?;
+    out.flush()?;
+    Ok(())
+}
+
+pub(super) fn decode(output: Output, options: &ReadOptions) -> Result<Pages> {
+    let mut failure = output.failure;
+    if output.data.len() < protocol::HEADER.len() {
+        return Err(failure.unwrap_or_else(|| malformed("missing response")));
+    }
+    let bytes =
+        protocol::decode(output.data, protocol::Operation::Pages(options.clone()).maximum()?)?;
+    let mut info = None;
+    let mut pages = Vec::new();
+    let mut text_bytes = 0_usize;
+    let mut ended = false;
+    for line in bytes.split_inclusive(|&byte| byte == b'\n') {
+        if ended {
+            return Err(malformed("records after the end of the response"));
+        }
+        if !line.ends_with(b"\n") && failure.is_some() {
+            break; // A killed worker may leave one incomplete final record.
+        }
+        let frame: Frame =
+            serde_json::from_slice(line).map_err(|error| malformed(&error.to_string()))?;
+        match frame {
+            Frame::Info(value) if info.is_none() && pages.is_empty() => info = Some(value),
+            Frame::Page(page) => {
+                let metadata = info.ok_or_else(|| malformed("page before metadata"))?;
+                validate(&page, pages.len(), metadata, options)?;
+                text_bytes = text_bytes
+                    .checked_add(page.text.len())
+                    .filter(|&bytes| bytes <= options.max_output_bytes)
+                    .ok_or_else(|| malformed("text exceeds the requested limit"))?;
+                pages.push(page);
+            }
+            Frame::End => ended = true,
+            Frame::Error { kind, message } => {
+                failure = Some(protocol::error(kind, message));
+                ended = true;
+            }
+            Frame::Info(_) => return Err(malformed("duplicate metadata")),
+        }
+    }
+    let info =
+        info.ok_or_else(|| failure.take().unwrap_or_else(|| malformed("missing metadata")))?;
+    let count = selected(info, options);
+    if pages.len() == count && ended {
+        return Ok(Pages { info, pages });
+    }
+    let error = failure.ok_or_else(|| malformed("incomplete response"))?;
+    let reason = error.to_string();
+    let timed_out = matches!(
+        error,
+        Error::LimitExceeded("time" | "render worker wall time" | "PDF worker limit")
+    );
+    let first_missing = pages.len();
+    for index in first_missing..count {
+        let number =
+            options.first_page + u32::try_from(index).map_err(|_| malformed("page index"))?;
+        let status =
+            if timed_out || index > first_missing { Status::Skipped } else { Status::Failed };
+        pages.push(bounded::unread(number, status, reason.clone()));
+    }
+    Ok(Pages { info, pages })
+}
+
+fn selected(info: Info, options: &ReadOptions) -> usize {
+    let count = options
+        .last_page
+        .min(info.page_count)
+        .checked_sub(options.first_page)
+        .map_or(0, |difference| u64::from(difference) + 1);
+    usize::try_from(count).unwrap_or(usize::MAX).min(options.max_pages)
+}
+
+fn validate(page: &PageResult, index: usize, info: Info, options: &ReadOptions) -> Result<()> {
+    let expected = u64::from(options.first_page) + index as u64;
+    if index >= selected(info, options)
+        || u64::from(page.number) != expected
+        || page.text.len() > options.max_page_bytes
+        || page.reason.as_ref().is_some_and(|reason| reason.len() > protocol::MAX_ERROR_BYTES)
+        || (matches!(page.status, Status::Failed | Status::Skipped) && !page.text.is_empty())
+    {
+        return Err(malformed("invalid page record"));
+    }
+    Ok(())
+}
+
+fn malformed(reason: &str) -> Error {
+    Error::malformed("PDF worker", reason)
+}

data/ext/imprimatur_native/core/src/read/pdf/isolation/system.rs

@@ -28,6 +28,33 @@ pub(super) fn apply_limits(memory: u64, cpu: u64, output: u64) -> Result<()> {
     Ok(())
 }
 
+/// Replace the bootstrap after setting address-space limits, so the loader
+/// and parser cannot reuse memory mapped before the cap was installed.
+#[cfg(any(target_os = "linux", target_os = "freebsd"))]
+pub(super) fn reexec(arguments: &[std::ffi::OsString]) -> Result<()> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+
+    let string = |value: &[u8]| {
+        CString::new(value)
+            .map_err(|error| std::io::Error::new(std::io::ErrorKind::InvalidInput, error))
+    };
+    let executable = string(std::env::current_exe()?.as_os_str().as_bytes())?;
+    let mut args = vec![executable.clone(), string(b"1")?];
+    for argument in arguments.iter().skip(1) {
+        args.push(string(argument.as_os_str().as_bytes())?);
+    }
+    match nix::unistd::execv(&executable, &args) {
+        Ok(never) => match never {},
+        // A tiny address-space cap can prevent exec from allocating its
+        // argument/environment pages and surface as E2BIG rather than ENOMEM.
+        Err(Errno::ENOMEM | Errno::E2BIG) => {
+            Err(Error::LimitExceeded("PDF worker startup resources"))
+        }
+        Err(error) => Err(std::io::Error::from(error).into()),
+    }
+}
+
 fn lower(resource: Resource, value: u64) -> Result<()> {
     let (soft, hard) = getrlimit(resource).map_err(std::io::Error::from)?;
     let value = bounded_limit(value, soft, hard)?;