- A VectorCraft or PhotoCraft `generator`, and a VectorCraft `preview` or
`pdf`, are read as they are parsed. A value of the wrong shape is
skipped element by element with `IgnoredAny` and none of it is kept;
before, serde's untagged enum buffered the whole value first, with no
limit on that buffer. The preview and PDF still read as `File::read`
reads them, the array form of `Image` included.
- A rendition after the JSON of a gzip file is counted against
`max_total` once, as it is decompressed. A 40 KiB PDF with `max_total`
at 64 KiB now reads compressed as it does uncompressed. A preview and
PDF that name the same bytes are counted as two copies.
- A repeated VectorCraft `version` is malformed, not too new, and
`renditions` refuses a missing or repeated `document`, as `File::read`
does.
- The README says that a VectorCraft file written as a JSON array is not
recognized by `sniff`.
std::path sees no \??\ or \\.\ prefix and no //server/share boundary on Unix,
so the native root check let those document roots through. Resolve the link
against the lossy document path with the Unicode rules, and return the native
join only when it names the same components.
- pcraft_layer_rgba builds a name-to-entry map of the bundle once per
call instead of walking the central directory for every tile.
- A tile that several references name is read, decoded and counted
against max_total once per call. A hash referenced at two pixel sizes
is malformed.
- Surfaces stored as RGB or grayscale are read in documents of every
mode, so bitmap, duotone, indexed and multichannel documents read. A
CMYK or Lab layer or mask gives Unsupported, and an RGB mask gives its
first channel.
- A canvas of zero width or height is malformed.
- The docs name video layers, the masks of layers without pixels, and
tile references counting against max_items.
- doc.yml runs the tests without features again, next to
--all-features.
An <include> naming a folder listed, collected and sorted the folder's
entries before any budget applied, and again for every repetition, so a
configuration repeating one include made a single discovery call walk
the same folder thousands of times. Include folders are now checked
against the depth and file budgets first, listed at most once (by
canonical path), and all listings share a cap on entries.
A relative link next to a document whose path is not Unicode was joined
to the document's folder natively, skipping the parsing that refuses
device and object-manager namespaces. On Windows a document path with an
unpaired surrogate under \\.\, \\?\GLOBALROOT or \??\ therefore let
the link resolve inside that namespace. The native join now refuses those
roots as resolve does for a Unicode path; drives and shares are kept.
Inverting a sampled curve scanned the whole table for its flat start and
end runs whenever the value fell at or beyond an end. A constant table
falls there for every input, so each pixel the exact pipeline evaluated
read the whole curve again. inverse64_many already cached the ends for
output tables; a Pipeline now caches them for every inverse-curve stage,
recomputed on extend and optimize.
The Ghostscript work directory had a predictable name under the shared
temporary directory, and a failed removal of an existing one was ignored.
Another local user could create it first with an in.pdf symlink, and
writing the input would follow it. The directory is now created with
tempfile (random name, owner-only permissions, fails if it exists), and
in.pdf is created with create_new.
A cmap can list 65535 encoding records that all name the same subtable,
and Cmap::ranges expanded that subtable's spans once per record before
merging them. Records naming a subtable already read are now skipped,
and at most 16 distinct Unicode subtables are read from one face.
A manifest file or licence_file that is absolute, climbs out with .., or
resolves through a symlink to a file outside the checkout is now an
Error::OutsideCheckout instead of being embedded with include_bytes! or
copied (and written) outside the directory given to Embed::serve.
An integration test builds the library without cfg(test), so it checks the release configuration: the remote agents refuse plain HTTP (an upper-case scheme too) without connecting, loopback links still work, and with local-mirror the remote agents take plain HTTP.
A refused hop's message names only the host. ureq's message holds the whole link, and a redirect to the file host carries a signed query. host() also drops a query and any user:password@.
pcraft_layer_rgba(bytes, layer, &Limits) decodes one layer of a .pcraft
bundle over the canvas: a raster layer's surface, or the rendered copy
saved with a text, shape or smart object layer, as RGBA at the layer's
8, 16 or 32-bit sample type, with the layer mask as its own plane.
Grayscale repeats the gray value, missing tiles hold the default pixel,
and tiles outside the canvas are not read. Other color modes give
Unsupported; groups, adjustment and fill layers give None.
Tiles are read with craft-pcraft-format's TileRef and tile paths,
decoded with ruzstd and checked against their BLAKE3 hash, as PhotoCraft
reads them. The decoded layer and mask count against max_entry and
max_total before they are allocated; a frame is decoded only up to its
tile's size, and a frame larger than the tile plus an eighth and 4 KiB,
or one that declares a window over 8 MiB, is refused.
The feature adds ruzstd and blake3, both pure Rust. The doc workflow
runs clippy and the tests with --all-features.
Part of #59.
A 4 MiB list holds some 60,000 names, and searching the earlier entries
for each one made parsing quadratic: about 8 s for a full-size list in
a release build. A map from name to position and a set of conflicting
names make it linear again, with the same entries in the same order.
- renditions checks where the last VectorCraft member after the JSON
ends against max_total before it inflates anything past the marker,
and keeps only the members' bytes, not the data before them.
- A ZIP archive whose manifest.json has no format_version gives
Unrecognized instead of Malformed.
- A PhotoCraft manifest that is a JSON array is refused, as
read_manifest refuses it.
- renditions and outline refuse a PhotoCraft manifest nested past
PhotoCraft's limit (manifest_depth(MAX_GROUP_DEPTH), 367 levels).
- The TooNew check reads only the format's own version member, so a
newer file that also has another format's member is TooNew, not
Malformed.
- A generator that is not a string reads as None. A repeated VectorCraft
generator, preview or pdf reads as its last value, as File::read
reads it.
- The VectorCraft marker must follow the JSON's closing }, ] or ",
through craft_vectorcraft_format::marker_at.
- sniff reads the names in a whole archive's central directory, which
info reads too; a head too short to reach it still uses the local
headers.
read_code_num read the leading zeros one read_bit() at a time. It now takes
peek(32) and, when the code has fewer than 16 leading zeros and lies wholly
inside the data, decodes it from that one word. Longer codes, codes cut off
by the end of the data and invalid codes take the previous bit-by-bit loop,
moved to a cold function, so errors and the position after an error are
unchanged.
write_code_num wrote the zero prefix as up to 32 one-bit writes. A code of
up to 32 bits is now one write_bits call; longer codes write the zero prefix
in one call.
Tests compare read_ue, read_se (several codes in a row, every start
position, zero runs of 28 to 40 bits, buffers of 0 to 16 bytes) and write_ue
with verbatim copies of the previous code, plus the 31/32/33-bit code
boundaries and u32::MAX.
Closes#517
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
unescape_rbsp pushed every byte into the output Vec one at a time. It now
scans for 00 00 03 with the usual skip rule (a nonzero byte at i rules out
a match ending at i + 1 or i + 2, so the scan advances by 3) and copies the
bytes between matches with extend_from_slice. No unsafe, no indexing that
can panic.
Output is identical: a removed 03 still restarts the zero count. Tests
compare it with a verbatim copy of the old function over 20000 random
buffers (fixed-seed PRNG) and list the edge cases (empty input, 00 00 03 at
the end, 00 00 03 03, runs of zeros).
Closes#518
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Dylan M. Taylor