pura-tiff 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b00dc30c05d30d3947e757c942c5f9c41d7039e8c5dd627b67b5f9d68fe0872b
-  data.tar.gz: 3e0a469c58f5c8eed893b9d89d30febffe0b46c8e569ee5783d331ba1d442ca9
+  metadata.gz: a5de8bb460d185dadbd4303b95cb83002fabbfeb452b09e76cab6fa2902fc001
+  data.tar.gz: 2132a81943a9ca91aa6f8875f8d6013d603ab862d3ef3c7d96d559b5a37b9c00
 SHA512:
-  metadata.gz: a972f156bb570f8ca7645c1b6fec3905fec8754d7c35d9dfb38cd10c13337c7e97b0f3468bac3e43f4126b5c22604afa9822c10e59a5b42a008302a364bf5961
-  data.tar.gz: 80edb1fdb65459d42ce68fc827266461cdca99f0e679fb67ea5d15529ae5ca8a2b8501471d06d5b1ace29912d0a13b9f814ab5845d41eedd92fe07f80ec5eaea
+  metadata.gz: 2063bd023a49b5af798eb2965b91ee5648bd35207f7ab8351b421dde2258e61690d39695b65c9530a762d42bc21558ad3520f46759dbc67328ec3bd9b0856a6d
+  data.tar.gz: fcc4e7fda37d03106b6ccb43474c39b34bda1f5ac391af13ae5a8365cb194cee6e6dbd24bfcb78314ac611293c036beedc89149b21067fb57c9887bd28d21fe0

data/README.md

@@ -1,6 +1,6 @@
 # pura-tiff
 
-A pure Ruby TIFF decoder/encoder with zero C extension dependencies.
+A pure Ruby TIFF decoder/encoder without additional image-processing libraries.
 
 Part of the **pura-*** series — pure Ruby image codec gems.
 
@@ -8,7 +8,7 @@ Part of the **pura-*** series — pure Ruby image codec gems.
 
 - TIFF decoding and encoding (uncompressed)
 - Image resizing (bilinear / nearest-neighbor / fit / fill)
-- No native extensions, no FFI, no external dependencies
+- No image-specific native extension or FFI dependency
 - CLI tool included
 
 ## Installation
@@ -46,6 +46,8 @@ pura-tiff resize input.tiff --width 200 --height 200 --out thumb.tiff
 
 ## Benchmark
 
+These historical measurements include ffmpeg process startup. They do not compare against an in-process C codec or establish Rails pipeline throughput.
+
 400×400 image, Ruby 4.0.2 + YJIT.
 
 ### Decode
@@ -55,7 +57,6 @@ pura-tiff resize input.tiff --width 200 --height 200 --out thumb.tiff
 | **pura-tiff** | **14 ms** |
 | ffmpeg (C) | 59 ms |
 
-**pura-tiff is 4× faster than ffmpeg** for TIFF decoding. No other pure Ruby TIFF implementation exists.
 
 ### Encode
 
@@ -67,8 +68,6 @@ pura-tiff resize input.tiff --width 200 --height 200 --out thumb.tiff
 ## Why pure Ruby?
 
 - **`gem install` and go** — no `brew install`, no `apt install`, no C compiler needed
-- **4× faster than C** — uncompressed TIFF is pure data copying, and Ruby + YJIT handles it beautifully
-- **Works everywhere Ruby works** — CRuby, ruby.wasm, JRuby, TruffleRuby
 - **Part of pura-\*** — convert between JPEG, PNG, BMP, GIF, TIFF, WebP seamlessly
 
 ## Related gems
@@ -84,6 +83,21 @@ pura-tiff resize input.tiff --width 200 --height 200 --out thumb.tiff
 | [pura-webp](https://github.com/komagata/pura-webp) | WebP | ✅ Available |
 | [pura-image](https://github.com/komagata/pura-image) | All formats | ✅ Available |
 
+## Pixel model and limitations
+
+Images contain 8-bit RGB pixels. Only the first IFD is decoded. Supported input is 8-bit strip data with uncompressed, LZW, or PackBits compression; encoding is uncompressed. Alpha and extra samples are discarded.
+
+`crop(x, y, width, height)` requires integer coordinates, positive dimensions, and a region entirely inside the image; invalid regions raise `ArgumentError`.
+
+## Decode limits
+
+`Pura::Tiff.decode(input, max_input_bytes: 64 * 1024 * 1024,
+max_pixels: 40_000_000, max_decoded_bytes: 256 * 1024 * 1024)` accepts a path or binary data.
+All limits must be positive integers. These defaults bound input, pixel count, and decoded data size; they are not a cap on the Ruby process's total memory or CPU time.
+
+Invalid image data raises `Pura::Tiff::DecodeError`; exceeding a configured limit raises its subclass `Pura::Tiff::LimitExceeded`.
+TIFF decoding validates directory/tag bounds and rejects truncated or oversized strip output.
+
 ## License
 
 MIT

data/lib/pura/tiff/decoder.rb

@@ -3,6 +3,7 @@
 module Pura
   module Tiff
     class DecodeError < StandardError; end
+    class LimitExceeded < DecodeError; end
 
     class Decoder
       # TIFF tag IDs
@@ -48,16 +49,32 @@ module Pura
         TYPE_RATIONAL => 8
       }.freeze
 
-      def self.decode(input)
+      DEFAULT_MAX_INPUT_BYTES = 64 * 1024 * 1024
+      DEFAULT_MAX_PIXELS = 40_000_000
+      DEFAULT_MAX_DECODED_BYTES = 256 * 1024 * 1024
+
+      def self.decode(input, max_input_bytes: DEFAULT_MAX_INPUT_BYTES, **options)
+        unless max_input_bytes.is_a?(Integer) && max_input_bytes.positive?
+          raise ArgumentError, "max_input_bytes must be a positive integer"
+        end
+
         data = if input.is_a?(String) && input.bytesize < 4096 && !input.include?("\0") && File.exist?(input)
-                 File.binread(input)
+                 File.binread(input, max_input_bytes + 1)
                else
                  input.b
                end
-        new(data).decode
+        raise LimitExceeded, "TIFF input limit exceeded" if data.bytesize > max_input_bytes
+
+        new(data, **options).decode
       end
 
-      def initialize(data)
+      def initialize(data, max_pixels: DEFAULT_MAX_PIXELS, max_decoded_bytes: DEFAULT_MAX_DECODED_BYTES)
+        unless [max_pixels, max_decoded_bytes].all? { |value| value.is_a?(Integer) && value.positive? }
+          raise ArgumentError, "decode limits must be positive integers"
+        end
+
+        @max_pixels = max_pixels
+        @max_decoded_bytes = max_decoded_bytes
         @data = data
         @pos = 0
         @little = true
@@ -88,22 +105,36 @@ module Pura
           raise DecodeError, "unsupported compression: #{compression}"
         end
 
-        # Decompress all strips
+        raise DecodeError, "invalid TIFF dimensions" unless width.positive? && height.positive?
+        raise LimitExceeded, "TIFF pixel limit exceeded" if width * height > @max_pixels
+        raise DecodeError, "invalid SamplesPerPixel" unless samples_per_pixel.positive?
+
+        expected = width * height * samples_per_pixel
+        if [expected, width * height * 3].max > @max_decoded_bytes
+          raise LimitExceeded, "TIFF decoded byte limit exceeded"
+        end
+        unless strip_offsets.size == strip_byte_counts.size
+          raise DecodeError, "strip offsets and byte counts must have equal sizes"
+        end
+
+        # Decompress all strips, bounding every append before allocating output.
         raw = String.new(encoding: Encoding::BINARY)
         strip_offsets.each_with_index do |offset, i|
           count = strip_byte_counts[i]
           strip_data = @data.byteslice(offset, count)
           raise DecodeError, "truncated strip data" unless strip_data && strip_data.bytesize == count
 
-          case compression
-          when COMPRESSION_NONE
-            raw << strip_data
-          when COMPRESSION_LZW
-            raw << decompress_lzw(strip_data)
-          when COMPRESSION_PACKBITS
-            raw << decompress_packbits(strip_data)
-          end
+          remaining = expected - raw.bytesize
+          decoded = case compression
+                    when COMPRESSION_NONE then strip_data
+                    when COMPRESSION_LZW then decompress_lzw(strip_data, remaining)
+                    when COMPRESSION_PACKBITS then decompress_packbits(strip_data, remaining)
+                    end
+          raise DecodeError, "excess TIFF strip data size" if decoded.bytesize > remaining
+
+          raw << decoded
         end
+        raise DecodeError, "incorrect TIFF strip data size" unless raw.bytesize == expected
 
         # Convert to RGB
         pixels = convert_to_rgb(raw, width, height, photometric, samples_per_pixel, color_map, extra_samples)
@@ -133,6 +164,7 @@ module Pura
 
       def parse_ifd(offset)
         count = read_u16(offset)
+        check_bounds(offset + 2, (count * 12) + 4)
         tags = {}
 
         count.times do |i|
@@ -151,6 +183,7 @@ module Pura
                           read_u32(value_offset_field)
                         end
 
+          check_bounds(data_offset, total_size)
           tags[tag_id] = { type: type, count: value_count, offset: data_offset }
         end
 
@@ -191,7 +224,14 @@ module Pura
         end
       end
 
+      def check_bounds(offset, size)
+        return if offset >= 0 && size >= 0 && offset + size <= @data.bytesize
+
+        raise DecodeError, "TIFF data out of bounds or truncated"
+      end
+
       def read_u16(offset)
+        check_bounds(offset, 2)
         if @little
           @data.getbyte(offset) | (@data.getbyte(offset + 1) << 8)
         else
@@ -200,6 +240,7 @@ module Pura
       end
 
       def read_u32(offset)
+        check_bounds(offset, 4)
         if @little
           @data.getbyte(offset) |
             (@data.getbyte(offset + 1) << 8) |
@@ -283,7 +324,7 @@ module Pura
         out
       end
 
-      def decompress_lzw(data)
+      def decompress_lzw(data, limit)
         # TIFF LZW uses big-endian bit packing (MSB first)
         out = String.new(encoding: Encoding::BINARY)
         bit_buf = 0
@@ -335,6 +376,8 @@ module Pura
             raise DecodeError, "invalid LZW code: #{code} (next=#{next_code})"
           end
 
+          raise DecodeError, "excess TIFF strip data size" if out.bytesize + current.bytesize > limit
+
           out << current
 
           if prev_string && (next_code < 4096)
@@ -353,7 +396,7 @@ module Pura
         out
       end
 
-      def decompress_packbits(data)
+      def decompress_packbits(data, limit)
         out = String.new(encoding: Encoding::BINARY)
         pos = 0
         size = data.bytesize
@@ -365,11 +408,17 @@ module Pura
           if n < 128
             # Copy next n+1 bytes literally
             count = n + 1
+            raise DecodeError, "truncated PackBits literal" if pos + count > size
+            raise DecodeError, "excess TIFF strip data size" if out.bytesize + count > limit
+
             out << data.byteslice(pos, count)
             pos += count
           elsif n > 128
             # Repeat next byte (257-n) times
             count = 257 - n
+            raise DecodeError, "truncated PackBits repeat" if pos >= size
+            raise DecodeError, "excess TIFF strip data size" if out.bytesize + count > limit
+
             byte = data.byteslice(pos, 1)
             pos += 1
             out << (byte * count)

data/lib/pura/tiff/image.rb

@@ -81,6 +81,11 @@ module Pura
       end
 
       def crop(x, y, w, h)
+        unless [x, y, w, h].all?(Integer) &&
+               x >= 0 && y >= 0 && w.positive? && h.positive? && x + w <= @width && y + h <= @height
+          raise ArgumentError, "crop must be a positive integer region within the image"
+        end
+
         out = String.new(encoding: Encoding::BINARY, capacity: w * h * 3)
         h.times do |row|
           src_offset = (((y + row) * @width) + x) * 3

data/lib/pura/tiff/version.rb

@@ -2,6 +2,6 @@
 
 module Pura
   module Tiff
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
   end
 end

data/lib/pura-tiff.rb

@@ -7,8 +7,8 @@ require_relative "pura/tiff/encoder"
 
 module Pura
   module Tiff
-    def self.decode(input)
-      Decoder.decode(input)
+    def self.decode(input, **options)
+      Decoder.decode(input, **options)
     end
 
     def self.encode(image, output_path)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pura-tiff
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - komagata