An xref-stream entry can be a single decoded byte, so one xref stream at the
256 MiB decode limit could expand into hundreds of millions of map entries
(several gigabytes) while the document was opened. Every insert into the xref
map now goes through insert_entry, which refuses a new object past 8,388,607
entries (the PDF 32000-1 Annex C limit on indirect objects). This covers
xref tables, xref streams, merges of Prev/XRefStm sections and the repair
scan. Replacing an object already in the map is still allowed.
The JBIG2 filter ignored the limit every other filter gets, so a stream
decoded with decoded_within (an output intent's 16 MiB ICC profile in
craft-prepress) could still build a page up to 2^28 one-byte pixels. The
page header's size is now checked against the limit before any output is
allocated: the returned bytes when the stream has no image dimensions,
the 1-bit packed size for an image of known size.
DebugStruct::finish() writes the closing brace only when a field was
added, so an empty Dict prints as Dict. Qualify the Debug line in
vendor/README.craft-reader.md and the repair entry in SOURCE.json.
Dict's and Array's Debug impls built their output with debug_struct and
debug_list but returned Ok(()) instead of calling finish(), so the
closing brace or bracket was never written: a dictionary printed as
Dict { "B": Boolean(true). Both now end with finish(), as upstream
hayro's do.
The tests from #165 only checked that nothing panics. They now parse a
dictionary with a valid entry on each side of an unreadable value (/#zz,
12-.5, and a dictionary followed by stream with no endstream) and check
that both valid entries come back with their values. The array test
checks that the items before an unreadable item (/#zz, 12-.5) come back
with their values. Both tests also check the Debug output.
Update the local hashes of dict.rs and array.rs and the repair list in
SOURCE.json, and note the change in vendor/README.craft-reader.md.
Dict validates a dictionary by skipping its values, and the skip accepts
some values that the parser cannot read: a name with a broken # escape
(/#zz), a number such as 12-.5, and a dictionary followed by stream with
no endstream. Dict::entries and Dict's Debug output unwrapped the result
of parsing every value, so either one panicked on such a dictionary.
Port LaurenzV/hayro#1501 to the vendored copy: entries skips an entry
whose value does not parse, and Debug prints the entries. ArrayIter::next
already ends the iteration on such an item here. Add LaurenzV/hayro#1501's
two tests, update the local hashes of dict.rs and array.rs and the repair
list in SOURCE.json, and note the change in vendor/README.craft-reader.md.
* security: bound vendored hayro CCITT rows of unknown height and JPEG 2000 codestream size
- CCITT: `/Rows 0` decoded to the end of the data; a bit of 2D code can repeat a whole row,
so a small stream produced gigabytes. Rows are now capped by the output limit (in the
stream's 1-bit rows) and 2^28 pixels.
- JPEG 2000: the decoder allocated its output from the codestream's own dimensions,
infallibly. Over 2^28 pixels or the output limit (at least 64 MiB) is refused before
decoding, and the buffer is reserved fallibly.
- SOURCE.json local hashes updated (ascii_85.rs's had not been after #253).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ccitt): pass the output limit in the columns test
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- Patch-mesh triangles are rebuilt after inflation, so the stored dot products match
the vertices.
- A stencil image restores the fill alpha itself when the saved-state bound skipped
its save.
- A resolved JP2 palette decodes to 8 bits whatever /BitsPerComponent says.
From PdfCraft #3438 with its look-ahead bound (01af6cba3): an inline
image without a filter ends at the byte length its /W, /H, /CS, /BPC
and /IM give when white space and EI follow there, so an EI inside its
samples does not end it. Anything else keeps the EI look-ahead. A
computed end past the content window waits for more data only while it
fits within MAX_DECODED_STREAM.
Tests: PdfCraft's six content::tests unit tests.
A JPX image whose dictionary has no /ColorSpace, or one that does not resolve, takes its colors from the JP2 palette instead of drawing its raw indices as gray. Resolved palette colors are 8-bit samples whatever the index precision. From PdfCraft #3184, with its three jpx unit tests.
A trailer /Prev written as N G R is followed: it is the offset the referenced object holds when the section's own entries place it, and otherwise offset N. Each section's entries are read before its Prev is followed. From PdfCraft #2400, with its two xref unit tests; the local xref-stream bounds are kept.
Conflicts: NOTICE, vendor/README.craft-reader.md and the hayro-interpret and
hayro-syntax SOURCE.json keep the ec0a965 provenance and add hayro-cmap
(a2ec27b) and hayro-postscript (crates.io 0.1.0). type0.rs keeps PdfCraft's
flat sample array with its 64-bit largest sample and main's 32-bit test.
Local sha256 values recomputed for the merged files.
* hayro-syntax: port PdfCraft's syntax fixes (ledger 17, 19, 20, 23, 4-ext, #3565, base_dimensions floor)
From PdfCraft a2ec27b47:
- (17), (19): a CCITT image with /Rows 0, or with fewer /Rows than its
/Height, decodes to the image height instead of zero or /Rows rows.
- (20): spaces or tabs between the stream keyword and its line break are
skipped, so the stream data starts after the line break.
- (4) extension: an inline image's EI followed by a delimiter (EI%, EI[)
ends the image; only a regular character makes it part of a longer token.
- (23): bytes above 0x7F between two EI candidates don't reject the first;
the operator look-ahead decides.
- #3565: a doubled sign (--280, +-280) is read and skipped as one number.
- Page::base_dimensions keeps a one-point floor after /UserUnit instead of
one raw unit.
Also a local bound: a CCITT /Columns past u32::MAX is refused instead of
wrapping to a small width that passed ccitt_size_ok.
Tests: content and number unit tests from PdfCraft, a stream unit test, a
synthetic page test for the floor, a CCITT /Columns unit test, and the two CCITT raster tests in
crates/pdf/tests/upstream_raster.rs.
* hayro-interpret: port PdfCraft's text fixes (ledger 30, 44, P2, P6, P8, 26-ext)
From PdfCraft a2ec27b47:
- (30): WinAnsi 0xA0 and 0xAD and MacRoman 0xCA read as an ordinary space
and hyphen (Annex D.2 gives them those glyph names) unless /Differences
names nbspace or sfthyphen.
- (44): a /ToUnicode /Identity-H or /Identity-V name reads two-byte codes
as their Unicode values; controls and lone surrogates give no text.
- P6: glyph names outside the Adobe Glyph List (f_i, hyphen.case,
uniXXXXXXXX) read by the glyph list specification's full mapping; names
that only number a glyph (C39, c251) give no text.
- P8: a substitute font whose charmap lacks a spacing character (U+2002 and
similar) draws its ordinary space instead of .notdef.
- P2: a Type 3 glyph's /FontBBox is transformed to device space before it
bounds the glyph's clip and shadings, so shaded glyphs draw at every
position.
- (26) extension: comma-below letters (s, t, k, l, n, r, G with comma) in
the standard-font stand-ins are the base letter with the font's comma,
scaled and placed under the baseline.
Tests: crates/pdf/tests/upstream_text.rs for (30), (44) and P6; the Type 3
shading and comma-below raster tests in crates/pdf/tests/upstream_raster.rs.
P8's PdfCraft test needs a Japanese substitute font and is not ported.
* hayro-syntax: refresh SOURCE.json local hashes for Cargo.lock, ascii_85.rs and filter/mod.rs
They changed in #241 and #253 without their local sha256 values.
* pdf: keep a CID font's /W2 table past an out-of-range first CID; vendor hayro-cmap from PdfCraft
- hayro-interpret: a /W2 run whose first CID is past 65535 is skipped, as in
/W. A run starting at 4294967295 overflowed the CID counter and discarded
the whole table. Unit test in font::cid.
- hayro-cmap 0.1.0 is vendored from PdfCraft a2ec27b47 with its malformed-CMap
patch (PdfCraft #3177): bad bfchar/bfrange entries, an unresolvable usecmap
and an unparseable tail are skipped instead of failing the whole CMap. The
crate's tests come with it. Wired up like the other vendored Hayro crates
(workspace exclude, patch entry, SOURCE.json, backend test script); NOTICE,
ATTRIBUTION.md and vendor/README.craft-reader.md record the source.
* hayro-syntax: refuse an xref-stream subsection that runs past object number u32::MAX
The object number was start + i in unchecked u32: a subsection starting near
u32::MAX overflowed (a panic in debug builds, a wrong object number in
release). Covered in xref::tests::xref_stream_entries_need_backing_bytes.
* hayro-cmap: a binary usecmap counts against the nesting limit; /W2 checks the CID first
- hayro-cmap: a binary CMap's usecmap passed its own depth to the nested
parse, so a self-referencing binary CMap recursed until the stack
overflowed. It now counts like a text usecmap. Test:
self_referencing_binary_usecmap_stops_at_the_nesting_limit.
- hayro-interpret: the /W2 first-CID check runs before the run's metrics
are read, so an incomplete run past CID 65535 no longer discards the
rest of the table.
* hayro-syntax: refuse xref-stream object numbers past i32::MAX
ObjectIdentifier stores an i32; a number between i32::MAX and u32::MAX
was cast to a negative object number.
- hayro-syntax ascii_85.rs: main's decode-limit version (same bound as
the pdfcraft ec0a965 copy, plus its test).
- hayro-interpret and krilla SOURCE.json: source fields from pdfcraft
ec0a965 / krilla 0.8.2, sha256 recomputed for merged files.
- krilla PNG decode cap from main recorded as patches/11-png-decode-cap.patch
with its ledger row and README section.
* fix(hayro-syntax): read full /W[0] width for xref stream entry type (follow-up to #239)
* hayro-syntax: loader-path test for oversized /W[0]; document patch; drop committed build output (CodeRabbit)
* security: bound vendored hayro xref, object-stream, JBIG2 and graphics-state work; krilla PNG size
hayro-syntax:
- xref-stream subsections must be backed by decoded bytes: zero /W widths and counts
longer than the data are refused before inserting (CodeRabbit CWE-400, xref.rs:962)
- object-stream offset tables are parsed once per document and cached in Data
(CodeRabbit CWE-407, xref.rs:1079)
- embedded JBIG2 pages over 2^28 pixels are refused before allocating, with checked,
fallible reservation (CodeRabbit CWE-789, filter/jbig2.rs:34)
- a JBIG2Globals stream with an image filter is ignored, so globals cannot recurse
(CodeRabbit CWE-674, filter/jbig2.rs:20)
hayro-interpret:
- at most 4096 saved graphics states / 64 MiB retained; dash arrays over 256 entries stroke
solid (CodeRabbit CWE-400, context.rs:226)
krilla:
- PNGs implying more than 1 GiB of decoded output are refused at Image::from_png and in
the deferred decoder; the buffer is reserved fallibly (CodeRabbit CWE-789,
graphics/image.rs:565)
SOURCE.json local hashes updated; patches recorded in vendor/README.craft-reader.md and
vendor/krilla/README.craft.md.
* vendor: fix SOURCE.json local hashes; reserve krilla's colour/alpha split buffers fallibly
- SOURCE.json: only the local sha256 changes; the source/upstream hashes of the patched
files are restored (CodeRabbit review)
- krilla handle_u8_image/handle_u16_image reserve their split buffers with try_reserve_exact
and return an error, so a valid image under the 1 GiB decode cap cannot abort the process
on the second allocation (CodeRabbit review)
Bring vendor/hayro, hayro-interpret, hayro-syntax and hayro-jbig2 to
storytold/pdfcraft ec0a965074f376a5bf610435948e4e5184bf3299 (main,
2026-10-19), from 7437bde. The local patches (per-document decode
limits, incomplete-content diagnostics, Hayro 0.8 resource scopes,
nesting cap, iterative page tree, TJ fill order, transfer rounding,
safety repairs) are carried by a three-way merge without conflicts.
The re-sync includes transparency group /I and /K reading (pdfcraft
#2027), patches 28, 29 and 31-34, and the reader fixes listed in
vendor/README.craft-reader.md. SOURCE.json manifests, NOTICE and the
craft-pdf README name the new source revision.
Dylan M. Taylor