mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-12 08:52:32 +00:00
Dylan M. Taylor
6f05ad84a3
* craft-kra, craft-ora: read and write through craft-zip Both drop their own bounded entry read (and craft-ora its zip writer). New: the declared entry count is checked before the archive is indexed (MAX_ENTRIES, 100,000), and an archive with two entries of one name is refused. craft-ora writes a fixed timestamp. zip_mimetype moves into craft-zip as stored_mimetype; both crates keep their function. * craft-zip: Archive is Clone; compressed_size and read_head For the package crates moving onto it: a clone reads behind &self with its own count, compressed_size gives a format the ratio an entry claims, and read_head reads a signature without inflating the rest. * craft-sketch: read through craft-zip Its own budgets (ratio, per-member, JSON total, image total) stay. New: the declared entry count is checked before the archive is indexed (MAX_ENTRIES, 100,000), also when sniffing, and an archive with two entries of one name is refused. * craft-fig: read and write through craft-zip The image budget (per image, total, charged for failed reads, skipped count) stays this crate's. A failed image read is now charged its declared size, which bounds it because the read stops one byte past it; the separate checksum check at an exact budget goes, as the read now always reaches the end of the entry. New: the declared entry count is checked before the archive is indexed (MAX_ENTRIES, 1,000,000), also when sniffing, and two entries of one name are refused. The writer writes a fixed timestamp. * craft-penpot: read and write through craft-zip The 1 GiB byte budget is now the archive's total in craft-zip, counted from bytes actually read; the JSON value budget and the sticky exhaustion flag stay here. Duplicate names are found by craft-zip (the hand-read end record goes). A read that does not fit what is left is refused before it starts and fails every later check(); one that fails otherwise is charged its declared size. embedded_fonts reads four bytes of each candidate with read_head. New: the entry count is checked before the archive is indexed. * craft-opc: read and write through craft-zip The entry-count guard and its test sample move to craft-zip; check_entry_count and zip64_entry_count_sample stay here as wrappers. Package and LazyPackage keep their own counts and rules and read through craft-zip's bounded read. A part that declares more than is left is now refused before it is inflated, so it no longer spends the inflate budget (the test that pinned the old charge is updated). An exactly repeated entry name is logged, not refused. ZipOut wraps craft-zip's Writer; its output is unchanged in kind (level 6, fixed timestamp). * craft-odf: read and write through craft-zip The entry-count guard moves to craft-zip; zip_guard::check and zip64_entry_count_sample stay public here as wrappers. Package keeps its own count and reads through craft-zip's bounded read: a damaged file is still Ok(None), now charged its declared size. Two files of one name are refused. encrypt read every file whole and decrypt cut a file at the limit without saying so; both now refuse a file declaring more than the per-file limit. * craft-ora: a needless borrow in a test; Cargo.lock for the crates now on craft-zip
craft-kra
Krita documents (.kra, .krz), read. Written from files Krita writes; no Krita code is used.
A Krita document is a ZIP whose first, stored entry is mimetype = application/x-krita. It
holds maindoc.xml (the node tree), one tiled pixel file per paint layer and mask under
<image name>/layers/, the ICC profile in <image name>/annotations/icc, and Krita's rendering
of the whole image in mergedimage.png.
is_kra,zip_mimetype: recognise an archive by its first entry, without unzipping.Archive::open: checks the mimetype and readsmaindoc.xmlinto anImageofNodes. Every node kind is kept with the attributes the file has (nodetype,compositeop,opacity, offsets,colorspacename,filename, masks, ...). No pixel is read.Archive::layer_file,default_pixel,icc_profile,merged_image: the other entries, each with a size limit.tiles::TileFile: a tiled pixel file's header and tile table;decodegives one tile's interleaved pixels.tiles::lzf_decompressis the LZF inside.tiles::Space: the pixel layouts read (RGBA,RGBA16,GRAYA,GRAYAU16, and one-byte masks), withrgbaandsamplesto turn Krita's B, G, R, A little-endian pixels into channel order.
What a node kind, a composite operation or a colour space means to an application is not decided here. There is no writer.
Limits
| Limit | Value |
|---|---|
| Canvas side | 300,000 px (MAX_SIDE); offsets and tile positions up to four times that |
| Canvas area | 1 GiB at 8 bytes per pixel (MAX_PIXEL_BYTES) |
<layer> nodes |
8192 (MAX_NODES) |
maindoc.xml |
32 MiB, 512 levels of nesting, no internal DTD subset |
| A pixel file, inflated | 1 GiB (MAX_LAYER_FILE) |
| ICC profile | 16 MiB |
| Tile | 1024 × 1024 px, 64 bytes per pixel, header lines of 256 bytes |
A pixel file is decoded one tile at a time into a buffer the caller owns, so the memory a document takes is the caller's to budget.
ZIP
The archive is read with the zip crate directly. zip_mimetype (the leading stored mimetype
entry) and the bounded entry read are the same in every mimetype-first ZIP format and belong in a
shared ZIP crate once there is one.