@reekon-tools/react-native-pdf-canvas 0.1.1 → 0.2.1

package/android/src/main/java/tools/reekon/pdfcanvas/PdfPlatformQuirks.java

@@ -1,277 +0,0 @@
-package tools.reekon.pdfcanvas;
-
-import android.graphics.Bitmap;
-import android.graphics.Color;
-import android.graphics.Matrix;
-import android.graphics.pdf.PdfRenderer;
-import android.os.Build;
-import android.os.ParcelFileDescriptor;
-
-import java.io.File;
-import java.io.FileOutputStream;
-import java.nio.charset.Charset;
-import java.util.concurrent.atomic.AtomicBoolean;
-
-/**
- * Where this backend keeps what it has MEASURED about the platform it is running
- * on, as opposed to what the documentation promises.
- *
- * Two quirks live here, both found on the API 24 floor and both invisible on API
- * 31 and 33. They are kept together because they share a shape: the platform
- * does not report either of them, so the only way to know is to look.
- */
-public final class PdfPlatformQuirks {
-
-  /**
-   * The lowest API level MEASURED to survive a failed {@code PdfRenderer}
-   * construction. 24 does not; 31 and 33 do.
-   *
-   * The bound is deliberately the lowest level measured GOOD rather than one
-   * above the level measured bad: 25 through 30 were never tested (no image
-   * available in this session), and treating untested territory as safe is how a
-   * process-killing bug ships. The cost of being wrong in this direction is that
-   * a device between 25 and 30 refuses further documents after it has already
-   * met a corrupt one; the cost of being wrong in the other direction is a
-   * SIGSEGV.
-   */
-  static final int LOWEST_SDK_MEASURED_SAFE_AFTER_FAILED_OPEN = 31;
-
-  private static final AtomicBoolean pdfiumPoisoned = new AtomicBoolean(false);
-
-  private PdfPlatformQuirks() {}
-
-  /* ================================================================ *
-   * Quirk 1 — a failed PdfRenderer construction poisons PDFium
-   * ================================================================ */
-
-  /**
-   * True when a throwing {@code PdfRenderer} constructor is expected to leave
-   * this process's PDFium unusable.
-   *
-   * See {@link PdfPreflight} for the mechanism and the measurement. Preflight
-   * removes the two common triggers before the platform class ever sees the
-   * file; this latch covers what is left — a file that looks like a PDF and is
-   * structurally broken deeper in.
-   */
-  static boolean failedNativeOpenIsPoisonous() {
-    return Build.VERSION.SDK_INT < LOWEST_SDK_MEASURED_SAFE_AFTER_FAILED_OPEN;
-  }
-
-  static void recordFailedNativeOpen() {
-    if (failedNativeOpenIsPoisonous()) {
-      pdfiumPoisoned.set(true);
-    }
-  }
-
-  static boolean isPdfiumPoisoned() {
-    return pdfiumPoisoned.get();
-  }
-
-  /**
-   * Public form of {@link #isPdfiumPoisoned()}, for the React binding, which
-   * lives in a different package and has no business with the rest of this
-   * class's internals. A host can surface "PDF viewing needs an app restart"
-   * instead of watching every subsequent open fail.
-   */
-  public static boolean isBackendPoisoned() {
-    return pdfiumPoisoned.get();
-  }
-
-  /**
-   * Refuses rather than risking the segfault.
-   *
-   * This is a session-wide capitulation and it is meant to be: once a
-   * construction has thrown on an affected build, the reference count is already
-   * wrong and there is no way to put it back. An error every consumer can show
-   * is strictly better than a crash on whichever document happens to be opened
-   * next, which will not be the one that caused it.
-   */
-  static void requireUsablePdfium() throws PdfRasterException {
-    if (pdfiumPoisoned.get()) {
-      throw new PdfRasterException(
-          PdfErrorCode.BACKEND_FAILURE,
-          "Refusing to open a document: a previous file failed to load and, on API "
-              + Build.VERSION.SDK_INT + ", that leaves the platform's PDFium library "
-              + "reference count corrupted — the next successful load would segfault. "
-              + "Restarting the app clears it.");
-    }
-  }
-
-  /** Test hook. Package-private, and the only way this flag is ever cleared. */
-  static void setPdfiumPoisonedForTesting(boolean poisoned) {
-    pdfiumPoisoned.set(poisoned);
-  }
-
-  /* ================================================================ *
-   * Quirk 2 — /Rotate is not applied when rendering
-   * ================================================================ */
-
-  public enum RotationSupport {
-    /** A page carrying /Rotate renders upright, as the contract requires. */
-    SUPPORTED,
-    /**
-     * {@code getWidth()}/{@code getHeight()} swap for a /Rotate 90 page, but the
-     * CONTENT is drawn unrotated, and the y-flip uses the post-rotation height —
-     * so the page lands shifted and clipped. Measured on API 24:
-     *
-     * <pre>
-     *   rotate=0   geometry=612x792 drawn=[0,0..611,791] red=[0,0..111,99]
-     *   rotate=90  geometry=792x612 drawn=[0,0..611,611] red=ABSENT blue=[0,512..111,611]
-     *   rotate=180 geometry=612x792 drawn=[0,0..611,791] red=[0,0..111,99]
-     *   rotate=270 geometry=792x612 drawn=[0,0..611,611] red=ABSENT blue=[0,512..111,611]
-     * </pre>
-     *
-     * /Rotate 180 producing output identical to /Rotate 0 is the tell: the
-     * rotation is not applied at ANY angle. API 31 and 33 render all four
-     * correctly.
-     */
-    UNSUPPORTED,
-    /** The probe could not run. Treated as unsupported by callers that care. */
-    UNKNOWN
-  }
-
-  private static volatile RotationSupport rotationSupport;
-
-  /**
-   * Renders a tiny purpose-built /Rotate 90 page and looks at where the ink
-   * landed. Computed once per process and cached.
-   *
-   * Probed rather than keyed off {@code Build.VERSION.SDK_INT} for the same
-   * reason the latch above is conservative: 25 to 30 are untested, and a version
-   * check would have to guess about them. A probe answers for the device it is
-   * actually running on. It costs one ~450-byte file and one 200x100 render.
-   *
-   * @param scratchDir somewhere writable; the probe file is deleted afterwards.
-   */
-  public static RotationSupport rotationSupport(File scratchDir) {
-    RotationSupport cached = rotationSupport;
-    if (cached != null) {
-      return cached;
-    }
-    synchronized (PdfPlatformQuirks.class) {
-      if (rotationSupport == null) {
-        rotationSupport = probeRotation(scratchDir);
-      }
-      return rotationSupport;
-    }
-  }
-
-  private static final Charset LATIN1 = Charset.forName("ISO-8859-1");
-
-  /** 100x200pt, /Rotate 90, with a red 50x50 marker at the UNROTATED top-left. */
-  private static byte[] rotationProbeDocument() {
-    // PDF user space is y-up from the bottom-left, so the unrotated top-left
-    // 50x50 of a 100x200 page is the rect (0, 150) to (50, 200).
-    String content = "1 1 1 rg 0 0 100 200 re f\n1 0 0 rg 0 150 50 50 re f\n";
-    StringBuilder body = new StringBuilder();
-    int[] offsets = new int[4];
-    StringBuilder pdf = new StringBuilder("%PDF-1.4\n");
-
-    offsets[0] = pdf.length();
-    pdf.append("1 0 obj\n<< /Length ").append(content.length()).append(" >>\nstream\n")
-        .append(content).append("endstream\nendobj\n");
-    offsets[1] = pdf.length();
-    pdf.append("2 0 obj\n<< /Type /Page /Parent 3 0 R /MediaBox [0 0 100 200] /Rotate 90 "
-        + "/Contents 1 0 R /Resources << >> >>\nendobj\n");
-    offsets[2] = pdf.length();
-    pdf.append("3 0 obj\n<< /Type /Pages /Kids [2 0 R] /Count 1 >>\nendobj\n");
-    offsets[3] = pdf.length();
-    pdf.append("4 0 obj\n<< /Type /Catalog /Pages 3 0 R >>\nendobj\n");
-
-    int xref = pdf.length();
-    pdf.append("xref\n0 5\n0000000000 65535 f \n");
-    for (int offset : offsets) {
-      pdf.append(String.format("%010d 00000 n \n", offset));
-    }
-    pdf.append("trailer\n<< /Size 5 /Root 4 0 R >>\nstartxref\n").append(xref).append("\n%%EOF\n");
-    // Every byte written is ASCII, so String.length() above is the byte length.
-    return pdf.toString().getBytes(LATIN1);
-  }
-
-  private static RotationSupport probeRotation(File scratchDir) {
-    // The probe is a PdfRenderer construction like any other, so it is subject
-    // to quirk 1 in both directions: it must not run on an already-poisoned
-    // process (the constructor would be the segfault), and if it throws it must
-    // arm the latch like every other construction site does. Neither was true
-    // before — this was the one place that built a PdfRenderer inside a bare
-    // `catch (Throwable) { return UNKNOWN; }`, so a throw here was swallowed and
-    // the next open walked into it.
-    if (pdfiumPoisoned.get()) {
-      return RotationSupport.UNKNOWN;
-    }
-    File probe = new File(scratchDir, "pdfcanvas-rotation-probe.pdf");
-    ParcelFileDescriptor pfd = null;
-    PdfRenderer renderer = null;
-    PdfRenderer.Page page = null;
-    Bitmap bitmap = null;
-    try {
-      if (!scratchDir.exists() && !scratchDir.mkdirs()) {
-        return RotationSupport.UNKNOWN;
-      }
-      try (FileOutputStream out = new FileOutputStream(probe)) {
-        out.write(rotationProbeDocument());
-      }
-      pfd = ParcelFileDescriptor.open(probe, ParcelFileDescriptor.MODE_READ_ONLY);
-      try {
-        renderer = new PdfRenderer(pfd);
-      } catch (Throwable t) {
-        // The probe document is authored by this class and is valid, so this
-        // should be unreachable — but "should be" is exactly the assumption that
-        // costs a process. A constructor that threw has already left the
-        // half-built finalizable object behind, so the latch is armed here for
-        // the same reason PdfRendererPool arms it.
-        recordFailedNativeOpen();
-        throw t;
-      }
-      pfd = null; // ownership transferred
-      page = renderer.openPage(0);
-
-      // Past the constructor now. A throw from here on is not a poisoning event
-      // — the document is open and PDFium's reference count is balanced — so
-      // UNKNOWN is the honest answer and the catch below produces it.
-      if (page.getWidth() != 200 || page.getHeight() != 100) {
-        // Dimensions are not even swapped: /Rotate is ignored wholesale.
-        return RotationSupport.UNSUPPORTED;
-      }
-
-      bitmap = Bitmap.createBitmap(200, 100, Bitmap.Config.ARGB_8888);
-      bitmap.eraseColor(Color.WHITE);
-      page.render(bitmap, null, new Matrix(), PdfRenderer.Page.RENDER_MODE_FOR_DISPLAY);
-
-      // A clockwise quarter turn — which is what /Rotate means — puts the
-      // unrotated top-left marker at the displayed top-RIGHT.
-      int sample = bitmap.getPixel(185, 15);
-      boolean red = Color.red(sample) > 200 && Color.green(sample) < 60 && Color.blue(sample) < 60;
-      return red ? RotationSupport.SUPPORTED : RotationSupport.UNSUPPORTED;
-    } catch (Throwable t) {
-      return RotationSupport.UNKNOWN;
-    } finally {
-      if (bitmap != null) {
-        bitmap.recycle();
-      }
-      if (page != null) {
-        page.close();
-      }
-      if (renderer != null) {
-        renderer.close();
-      }
-      if (pfd != null) {
-        try {
-          pfd.close();
-        } catch (Exception ignored) {
-          // Only reachable if the PdfRenderer constructor threw, and the
-          // throwing path already carries the real cause.
-        }
-      }
-      //noinspection ResultOfMethodCallIgnored
-      probe.delete();
-    }
-  }
-
-  /** Test hook: forget the cached verdict so the probe can be re-run. */
-  static void resetRotationSupportForTesting() {
-    synchronized (PdfPlatformQuirks.class) {
-      rotationSupport = null;
-    }
-  }
-}

package/android/src/main/java/tools/reekon/pdfcanvas/PdfPreflight.java

@@ -1,214 +0,0 @@
-package tools.reekon.pdfcanvas;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.RandomAccessFile;
-
-/**
- * Cheap structural checks run BEFORE {@code new PdfRenderer(...)} is allowed
- * anywhere near the file.
- *
- * <h3>Why this exists, measured on device</h3>
- *
- * On API 24, a {@code PdfRenderer} CONSTRUCTOR THAT THROWS permanently poisons
- * PDFium for the whole process. The constructor assigns its
- * {@code ParcelFileDescriptor} field before calling {@code nativeCreate}, so a
- * throw leaves a half-built, unreachable, FINALIZABLE object; when the collector
- * runs it, {@code finalize -> doClose -> nativeClose(0)} decrements PDFium's
- * library reference count with no matching initialise. The count goes below
- * zero, {@code initializeLibraryIfNeeded} then never re-initialises, and the
- * NEXT document load dereferences a null {@code CPDF_ModuleMgr} and takes the
- * process down.
- *
- * Measured, not inferred — one failed construction plus a forced
- * {@code System.gc(); System.runFinalization()} is enough:
- *
- * <pre>
- *   API 24: baseline good = OK(1)
- *           failure #1 -> IOException; collecting
- *           about to open good after 1 collected failures
- *           F libc: Fatal signal 11 (SIGSEGV), fault addr 0x10
- *                   #00 libpdfium.so (CPDF_Document::CPDF_Document(CPDF_Parser*)+96)
- *   API 31: SURVIVED 12
- *   API 33: SURVIVED 12
- * </pre>
- *
- * So on the minSdk floor a single wrong file — a JPEG the user picked by
- * mistake, a password-protected drawing — is not an error, it is a delayed
- * process death. The two overwhelmingly common causes are cheap to detect from
- * the bytes, and detecting them here means the platform class never sees the
- * file at all.
- *
- * <h3>What this is NOT</h3>
- *
- * It is not a PDF validator and must not grow into one. It answers two
- * questions — "does this even claim to be a PDF" and "is it encrypted" — and
- * anything subtler (a broken xref, a truncated object stream) still reaches
- * PdfRenderer and is still caught by {@link PdfPlatformQuirks}'s latch. Being
- * incomplete is fine; being WRONG is not, which is why the encryption test
- * insists on the full indirect-reference shape rather than a bare substring.
- */
-final class PdfPreflight {
-
-  /**
-   * PDFium scans this far for the header rather than insisting on byte 0, and a
-   * good many real-world PDFs have junk in front of {@code %PDF-}. Matching its
-   * tolerance means preflight rejects only files PdfRenderer would also reject.
-   */
-  private static final int HEADER_SEARCH_BYTES = 1024;
-
-  /** Enough to cover a linearised file's first-page xref and trailer. */
-  private static final int HEAD_SCAN_BYTES = 32 * 1024;
-  /** Enough to cover the trailer, the xref, and a few incremental updates. */
-  private static final int TAIL_SCAN_BYTES = 256 * 1024;
-
-  private static final byte[] PDF_HEADER = {'%', 'P', 'D', 'F', '-'};
-  private static final byte[] ENCRYPT = {'/', 'E', 'n', 'c', 'r', 'y', 'p', 't'};
-
-  private PdfPreflight() {}
-
-  static void check(File file) throws PdfRasterException {
-    if (!file.exists()) {
-      throw new PdfRasterException(
-          PdfErrorCode.NOT_FOUND, "No file at " + file.getAbsolutePath() + ".");
-    }
-    if (!file.isFile() || !file.canRead()) {
-      throw new PdfRasterException(
-          PdfErrorCode.NOT_FOUND, "Not a readable file: " + file.getAbsolutePath() + ".");
-    }
-    long length = file.length();
-    if (length == 0L) {
-      // Reported as corrupt rather than not-found: the path resolved, so the
-      // actionable truth is that the download or copy never finished.
-      throw new PdfRasterException(
-          PdfErrorCode.CORRUPT, "File is empty: " + file.getAbsolutePath() + ".");
-    }
-
-    byte[] head;
-    byte[] tail;
-    try (RandomAccessFile raf = new RandomAccessFile(file, "r")) {
-      head = read(raf, 0L, (int) Math.min(length, HEAD_SCAN_BYTES));
-      long tailStart = Math.max(0L, length - TAIL_SCAN_BYTES);
-      // The ONLY case where the tail can be skipped is a file the head already
-      // covers END TO END. Comparing tailStart against head.length instead is
-      // the bug this line used to have: for any length in
-      // (HEAD_SCAN_BYTES, TAIL_SCAN_BYTES] the tail starts at 0, which is less
-      // than head.length, so the tail was dropped while the head reached only
-      // 32 KB — and every byte from there to EOF, TRAILER INCLUDED, went
-      // unread. A 60 KB encrypted drawing is an entirely ordinary document, and
-      // on API 24 it then reached `new PdfRenderer(...)` and poisoned PDFium
-      // for the session: exactly the outcome this class exists to prevent.
-      // preflightFindsTheEncryptTrailerBeyondTheHeadWindow pins it.
-      tail = length <= head.length ? new byte[0] : read(raf, tailStart, TAIL_SCAN_BYTES);
-    } catch (IOException e) {
-      throw new PdfRasterException(
-          PdfErrorCode.CORRUPT, "Could not read " + file.getName() + ".", e);
-    }
-
-    if (indexOf(head, PDF_HEADER, 0, Math.min(head.length, HEADER_SEARCH_BYTES)) < 0) {
-      throw new PdfRasterException(
-          PdfErrorCode.CORRUPT,
-          "Not a PDF: no %PDF- header in the first " + HEADER_SEARCH_BYTES
-              + " bytes of " + file.getName() + ".");
-    }
-
-    if (hasEncryptReference(head) || hasEncryptReference(tail)) {
-      throw new PdfRasterException(
-          PdfErrorCode.PASSWORD_REQUIRED,
-          "The document is encrypted: " + file.getName() + ".");
-    }
-  }
-
-  private static byte[] read(RandomAccessFile raf, long offset, int max) throws IOException {
-    raf.seek(offset);
-    byte[] buffer = new byte[max];
-    int read = 0;
-    while (read < max) {
-      int n = raf.read(buffer, read, max - read);
-      if (n < 0) {
-        break;
-      }
-      read += n;
-    }
-    if (read == max) {
-      return buffer;
-    }
-    byte[] exact = new byte[read];
-    System.arraycopy(buffer, 0, exact, 0, read);
-    return exact;
-  }
-
-  /**
-   * True when the buffer contains {@code /Encrypt <num> <num> R}.
-   *
-   * The full shape is required, not just the name. A bare {@code /Encrypt}
-   * substring can appear inside an uncompressed content stream or a piece of
-   * metadata, and refusing such a document would be a false "this file needs a
-   * password" — the single most confusing thing this class could say. The spec
-   * requires the trailer's /Encrypt value to be an indirect reference, so
-   * demanding the reference costs nothing in recall and removes almost all of
-   * the false-positive surface.
-   */
-  private static boolean hasEncryptReference(byte[] buffer) {
-    int from = 0;
-    while (true) {
-      int at = indexOf(buffer, ENCRYPT, from, buffer.length);
-      if (at < 0) {
-        return false;
-      }
-      if (isIndirectReferenceAt(buffer, at + ENCRYPT.length)) {
-        return true;
-      }
-      from = at + 1;
-    }
-  }
-
-  private static boolean isIndirectReferenceAt(byte[] buffer, int start) {
-    int i = skipWhitespace(buffer, start);
-    int digits = countDigits(buffer, i);
-    if (digits == 0) {
-      return false;
-    }
-    i = skipWhitespace(buffer, i + digits);
-    digits = countDigits(buffer, i);
-    if (digits == 0) {
-      return false;
-    }
-    i = skipWhitespace(buffer, i + digits);
-    return i < buffer.length && buffer[i] == 'R';
-  }
-
-  private static int skipWhitespace(byte[] buffer, int from) {
-    int i = from;
-    while (i < buffer.length) {
-      byte b = buffer[i];
-      if (b != ' ' && b != '\n' && b != '\r' && b != '\t' && b != 0 && b != 0x0c) {
-        break;
-      }
-      i++;
-    }
-    return i;
-  }
-
-  private static int countDigits(byte[] buffer, int from) {
-    int i = from;
-    while (i < buffer.length && buffer[i] >= '0' && buffer[i] <= '9') {
-      i++;
-    }
-    return i - from;
-  }
-
-  private static int indexOf(byte[] haystack, byte[] needle, int from, int limit) {
-    int end = Math.min(limit, haystack.length) - needle.length;
-    outer:
-    for (int i = Math.max(0, from); i <= end; i++) {
-      for (int j = 0; j < needle.length; j++) {
-        if (haystack[i + j] != needle[j]) {
-          continue outer;
-        }
-      }
-      return i;
-    }
-    return -1;
-  }
-}