diff --git a/crates/pdf/src/export/images.rs b/crates/pdf/src/export/images.rs index 8110ce2db5..af686e1857 100644 --- a/crates/pdf/src/export/images.rs +++ b/crates/pdf/src/export/images.rs @@ -138,6 +138,7 @@ impl Exporter<'_> { } let doc = self.doc; let out = self.out.clone(); + let profiles = !out.standard.cmyk_only(); let img = doc.image_blob(im).filter(|_| !self.left_out.contains(key)).and_then(|blob| { let cmyk_image = blob.is_cmyk(); if !cmyk_image && self.convert && doc.color_mode == vectorcraft_doc::ColorMode::Cmyk { @@ -147,12 +148,12 @@ impl Exporter<'_> { let icc = out.cmyk_image_icc(blob); crate::images::recode_cmyk(blob, size, c, interpolate, out.cmyk_pixels(), None, icc.as_deref()) } else { - crate::images::recode(&blob.bytes, size, c, interpolate, out.pixels()) + crate::images::recode(&blob.bytes, size, c, interpolate, out.pixels(), profiles) }; if let Some(w) = r.warning { self.warn(w); } - r.image.or_else(|| embed(blob, interpolate, self.sixteen_bit)) + r.image.or_else(|| embed(blob, interpolate, self.sixteen_bit, profiles)) }); if img.is_none() { self.warn(UNDECODED); @@ -316,9 +317,13 @@ pub(super) fn png_8_bit(bytes: &[u8]) -> Option> { } /// Image `blob` as it is: PNG, JPEG, GIF and WebP through the PDF writer (JPEG data unchanged), -/// other formats decoded. Without `sixteen_bit` (a file before PDF 1.5), a PNG of 16 bits a -/// sample is written at 8 bits ([`png_8_bit`]). -pub(super) fn embed(blob: &vectorcraft_doc::ImageBlob, interpolate: bool, sixteen_bit: bool) -> Option { +/// other formats (a TIFF) decoded with their 16-bit samples and, when `profiles` allows it (not in +/// PDF/X-1a), the ICC profile they carry ([`crate::images::decoded_image`]). Without `profiles`, an +/// image that carries a gray or RGB profile is written without it, and so is one whose gray or RGB +/// profile is malformed ([`crate::images::valid_icc`]): a JPEG with its data unchanged, an image of +/// another format decoded. Without `sixteen_bit` (a file before PDF 1.5), a PNG or another image of +/// 16 bits a sample is written at 8 bits ([`png_8_bit`]). +pub(super) fn embed(blob: &vectorcraft_doc::ImageBlob, interpolate: bool, sixteen_bit: bool, profiles: bool) -> Option { // The header's size first: the writer's decoders allocate what it declares, and the encoded // bytes of an image that is far larger than any the app reads may be a few kilobytes. let size = image::ImageReader::new(std::io::Cursor::new(blob.bytes.as_slice())).with_guessed_format().ok()?.into_dimensions(); @@ -326,7 +331,17 @@ pub(super) fn embed(blob: &vectorcraft_doc::ImageBlob, interpolate: bool, sixtee return None; } let bytes = blob.bytes.as_ref().clone(); + // The PDF writer keeps a gray or RGB image's ICC profile: without `profiles`, or when the + // profile is malformed, such a JPEG is written without its profile, and an image of another + // format is decoded and written without it. The color space is read from the header's bytes + // 16..20 even in a profile cut short, as the PDF writer reads it. + let strip = crate::images::source_icc(&bytes).is_some_and(|icc| match icc.get(16..20) { + Some(space @ (b"GRAY" | b"RGB ")) => !profiles || <[u8; 4]>::try_from(space).is_ok_and(|s| !crate::images::valid_icc(&icc, s)), + _ => false, + }); let direct = match blob.mime.as_str() { + "image/jpeg" | "image/jpg" if strip => Image::from_jpeg_with_icc(bytes.clone().into(), None, interpolate).ok(), + _ if strip => None, "image/png" if !sixteen_bit && png_16_bit(&bytes) => png_8_bit(&bytes).and_then(|png| Image::from_png(png.into(), interpolate).ok()), "image/png" => Image::from_png(bytes.clone().into(), interpolate).ok(), "image/jpeg" | "image/jpg" => Image::from_jpeg(bytes.clone().into(), interpolate).ok(), @@ -334,11 +349,7 @@ pub(super) fn embed(blob: &vectorcraft_doc::ImageBlob, interpolate: bool, sixtee "image/webp" => Image::from_webp(bytes.clone().into(), interpolate).ok(), _ => None, }; - direct.or_else(|| { - let rgba = image::load_from_memory(&bytes).ok()?.to_rgba8(); - let (w, h) = rgba.dimensions(); - Some(Image::from_rgba8(rgba.into_raw(), w, h)) - }) + direct.or_else(|| crate::images::decoded_image(&bytes, interpolate, sixteen_bit, profiles)) } #[cfg(test)] @@ -357,7 +368,7 @@ mod tests { let crc = !png[12..29].iter().fold(!0u32, |c, b| (0..8).fold(c ^ u32::from(*b), |c, _| if c & 1 == 1 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 })); png[29..33].copy_from_slice(&crc.to_be_bytes()); - assert!(super::embed(&ImageBlob::png(png), false, true).is_none()); + assert!(super::embed(&ImageBlob::png(png), false, true, true).is_none()); } #[test] diff --git a/crates/pdf/src/export/text.rs b/crates/pdf/src/export/text.rs index 4b0b3a047a..c9ef8203c7 100644 --- a/crates/pdf/src/export/text.rs +++ b/crates/pdf/src/export/text.rs @@ -325,7 +325,7 @@ impl Exporter<'_> { let img = match self.images.get(&cache) { Some(img) => img.clone(), None => { - let img = embed(&image.blob, self.interpolate, self.sixteen_bit); + let img = embed(&image.blob, self.interpolate, self.sixteen_bit, !self.out.standard.cmyk_only()); self.images.insert(cache, img.clone()); img } diff --git a/crates/pdf/src/images.rs b/crates/pdf/src/images.rs index d8b873364c..5204e4f396 100644 --- a/crates/pdf/src/images.rs +++ b/crates/pdf/src/images.rs @@ -29,8 +29,8 @@ use vectorcraft_doc::resample::{Resample, premultiply, resized, unpremultiply}; use crate::output::{CmykPixels, Pixels}; use crate::{CompressionSettings, Downsample, ImageCodec, JpegQuality, MonoCodec}; -/// Raw 8-bit pixels: colour samples (RGB, grey or CMYK) and an optional alpha channel, with the -/// ICC profile the colour samples are in, if any. +/// Raw pixels: colour samples (RGB, grey or CMYK) and an optional alpha channel, of 8 bits a +/// sample or of 16 (big-endian), with the ICC profile the colour samples are in, if any. #[derive(Clone, Hash)] struct Raw { color: Arc>, @@ -38,6 +38,7 @@ struct Raw { width: u32, height: u32, space: ImageColorspace, + bits: BitsPerComponent, icc: Option>>, } @@ -51,7 +52,7 @@ impl CustomImage for Raw { } fn bits_per_component(&self) -> BitsPerComponent { - BitsPerComponent::Eight + self.bits } fn size(&self) -> (u32, u32) { @@ -67,24 +68,86 @@ impl CustomImage for Raw { } } +/// `icc` when it is a well-formed profile ([`valid_icc`]) of the colour space `space` names: `GRAY` +/// for grey samples, `RGB ` for RGB ones. `None` for other profiles and spaces. +fn icc_for(icc: Option>, space: ImageColorspace) -> Option>> { + let want = match space { + ImageColorspace::Luma => *b"GRAY", + ImageColorspace::Rgb => *b"RGB ", + ImageColorspace::Cmyk | ImageColorspace::DeviceN => return None, + }; + icc.filter(|icc| valid_icc(icc, want)).map(Arc::new) +} + +/// The ICC profile image `bytes` carries: a TIFF's tag 34675 (read by the TIFF decoder itself, +/// which reads tags of any size), another format's as its decoder reads it. `None` without one. +pub(crate) fn source_icc(bytes: &[u8]) -> Option> { + let reader = ImageReader::new(Cursor::new(bytes)).with_guessed_format().ok()?; + if reader.format() == Some(ImageFormat::Tiff) { + return vectorcraft_doc::cmyk::tiff_icc_profile(bytes); + } + let mut decoder = reader.into_decoder().ok()?; + decoder.icc_profile().ok().flatten().filter(|icc| !icc.is_empty()) +} + /// A `width` × `height` image of straight (not premultiplied) RGBA pixels, written as RGB (as /// CMYK when `pixels` converts to CMYK), or as grey when every pixel is grey, with an alpha -/// channel only when some pixel isn't opaque. `interpolate` asks viewers to smooth it when -/// enlarged (PDF/A forbids it). `None` when `rgba` doesn't hold that many pixels. -fn from_rgba(rgba: &[u8], width: u32, height: u32, interpolate: bool, pixels: Option<&Pixels>) -> Option { +/// channel only when some pixel isn't opaque. With an RGB `icc` profile, pixels that `pixels` +/// doesn't convert stay RGB and carry it; a grey one tags grey pixels. `interpolate` asks viewers +/// to smooth it when enlarged (PDF/A forbids it). `None` when `rgba` doesn't hold that many pixels. +fn from_rgba(rgba: &[u8], width: u32, height: u32, interpolate: bool, pixels: Option<&Pixels>, icc: Option>) -> Option { let px = rgba.as_chunks::<4>().0; if px.len() as u64 != width as u64 * height as u64 || px.is_empty() { return None; } - let (color, space) = if neutral(rgba) { + let rgb_icc = pixels.is_none() && icc.as_deref().is_some_and(|icc| valid_icc(icc, *b"RGB ")); + let (color, space) = if neutral(rgba) && !rgb_icc { (px.iter().map(|p| p[0]).collect(), ImageColorspace::Luma) } else if let Some(cmyk) = pixels.and_then(|p| p.cmyk(rgba)) { (cmyk, ImageColorspace::Cmyk) } else { (px.iter().flat_map(|p| [p[0], p[1], p[2]]).collect(), ImageColorspace::Rgb) }; + let icc = icc_for(icc.filter(|_| pixels.is_none()), space); let alpha = px.iter().any(|p| p[3] < 255).then(|| Arc::new(px.iter().map(|p| p[3]).collect())); - Image::from_custom(Raw { color: Arc::new(color), alpha, width, height, space, icc: None }, interpolate).ok() + Image::from_custom(Raw { color: Arc::new(color), alpha, width, height, space, bits: BitsPerComponent::Eight, icc }, interpolate).ok() +} + +/// Decoded image `img` written losslessly as it is: grey or RGB samples (other kinds as RGB), with +/// an alpha channel only when some pixel isn't opaque, at 16 bits a sample when it has more than 8 +/// and `sixteen_bit` allows it (PDF 1.5 and later), else at 8; tagged with ICC profile `icc` when +/// that is a profile of the samples' colour space (`GRAY` or `RGB `). `None` when it has no pixels. +pub(crate) fn from_decoded(img: DynamicImage, icc: Option>, interpolate: bool, sixteen_bit: bool) -> Option { + let (width, height) = (img.width(), img.height()); + if width == 0 || height == 0 { + return None; + } + let kind = img.color(); + let space = if kind.has_color() { ImageColorspace::Rgb } else { ImageColorspace::Luma }; + let n = if kind.has_color() { 3 } else { 1 }; + let deep = sixteen_bit && kind.bits_per_pixel() > 8 * u16::from(kind.channel_count()); + let (color, alpha, bits) = if deep { + let s = if kind.has_color() { img.into_rgba16().into_raw() } else { img.into_luma_alpha16().into_raw() }; + let px = s.chunks_exact(n + 1); + let color = px.clone().flat_map(|p| p[..n].iter().flat_map(|v| v.to_be_bytes())).collect(); + let alpha = (kind.has_alpha() && px.clone().any(|p| p[n] < u16::MAX)).then(|| px.flat_map(|p| p[n].to_be_bytes()).collect()); + (color, alpha, BitsPerComponent::Sixteen) + } else { + let s = if kind.has_color() { img.into_rgba8().into_raw() } else { img.into_luma_alpha8().into_raw() }; + let px = s.chunks_exact(n + 1); + let color = px.clone().flat_map(|p| p[..n].iter().copied()).collect(); + let alpha = (kind.has_alpha() && px.clone().any(|p| p[n] < u8::MAX)).then(|| px.map(|p| p[n]).collect()); + (color, alpha, BitsPerComponent::Eight) + }; + let raw = Raw { color: Arc::new(color), alpha: alpha.map(Arc::new), width, height, space, bits, icc: icc_for(icc, space) }; + Image::from_custom(raw, interpolate).ok() +} + +/// Image `bytes` decoded within [`limits`], with the ICC profile it carries ([`source_icc`]) when +/// `profiles` allows it (not in PDF/X-1a, which allows no ICC-based color spaces), as +/// [`from_decoded`] writes it. `None` when it can't be decoded. +pub(crate) fn decoded_image(bytes: &[u8], interpolate: bool, sixteen_bit: bool, profiles: bool) -> Option { + from_decoded(decoded(bytes)?, profiles.then(|| source_icc(bytes)).flatten(), interpolate, sixteen_bit) } /// Are all of the RGBA pixels `rgba` grey? @@ -104,26 +167,28 @@ fn lossless( icc: Option<&[u8]>, ) -> Option { let icc = icc.map(|icc| Arc::new(icc.to_vec())); - Image::from_custom(Raw { color: Arc::new(samples), alpha: alpha.map(Arc::new), width, height, space, icc }, interpolate).ok() + let raw = Raw { color: Arc::new(samples), alpha: alpha.map(Arc::new), width, height, space, bits: BitsPerComponent::Eight, icc }; + Image::from_custom(raw, interpolate).ok() } /// Most pixels an image may have to be embedded: twice what the app reads (64 million), so every image /// it holds is still written. pub(crate) const MAX_EMBED_PIXELS: u64 = 1 << 27; -/// The most bytes a CMYK profile carried by an image is written with (16 MiB). +/// The most bytes an ICC profile carried by an image is written with (16 MiB). const MAX_ICC: usize = 16 << 20; /// The CMYK ICC profile image `blob` carries ([`ImageBlob::cmyk_icc_profile`]), when it is one a -/// CMYK image can be tagged with: at most [`MAX_ICC`] bytes, the size its header declares, the -/// `acsp` signature, an input, display, output or colour space profile of CMYK colours, and a tag -/// table whose tags lie within it. `None` for other images and other profiles. +/// CMYK image can be tagged with ([`valid_icc`]). `None` for other images and other profiles. pub(crate) fn cmyk_icc(blob: &ImageBlob) -> Option> { - blob.cmyk_icc_profile().filter(|icc| valid_cmyk_icc(icc)) + blob.cmyk_icc_profile().filter(|icc| valid_icc(icc, *b"CMYK")) } -/// Is `icc` a CMYK profile as [`cmyk_icc`] describes? -fn valid_cmyk_icc(icc: &[u8]) -> bool { +/// Is `icc` a profile an image of colour space `space` (`GRAY`, `RGB ` or `CMYK`) can be tagged +/// with: at most [`MAX_ICC`] bytes, the size its header declares, the `acsp` signature, an input, +/// display, output or colour space profile of `space` colours, and a tag table whose tags lie +/// within it? +pub(crate) fn valid_icc(icc: &[u8], space: [u8; 4]) -> bool { let be = |at: usize| icc.get(at..at + 4).and_then(|b| b.try_into().ok()).map(u32::from_be_bytes); let fits = |at: u32, len: u32| u64::from(at) + u64::from(len) <= icc.len() as u64; if icc.len() > MAX_ICC || be(0).and_then(|n| usize::try_from(n).ok()) != Some(icc.len()) { @@ -131,7 +196,7 @@ fn valid_cmyk_icc(icc: &[u8]) -> bool { } let class = icc.get(12..16); if icc.get(36..40) != Some(b"acsp".as_slice()) - || icc.get(16..20) != Some(b"CMYK".as_slice()) + || icc.get(16..20) != Some(space.as_slice()) || ![b"scnr", b"mntr", b"prtr", b"spac"].iter().any(|c| class == Some(c.as_slice())) { return false; @@ -151,7 +216,7 @@ pub(crate) fn from_rgba_in(mut rgba: Vec, width: u32, height: u32, interpola if let Some(p) = pixels { p.rgb_in_place(&mut rgba); } - from_rgba(&rgba, width, height, interpolate, pixels) + from_rgba(&rgba, width, height, interpolate, pixels, None) } /// A `width` × `height` image of CMYK ink amounts `inks` (four bytes a pixel), converted by @@ -306,9 +371,17 @@ fn resample_channels(img: DynamicImage, r: &Rule, (w, h): (u32, u32)) -> Dynamic /// Encoded image `bytes` placed `size` points wide and high, as the Compression settings `c` ask: /// resampled when its resolution is above the threshold, compressed with ZIP or JPEG, its colours -/// converted by `convert` (colour images). `interpolate` lets viewers smooth it. An image that -/// can't be decoded is kept as it is. -pub(crate) fn recode(bytes: &[u8], size: (f64, f64), c: &CompressionSettings, interpolate: bool, convert: Option<&Pixels>) -> Recoded { +/// converted by `convert` (colour images). Pixels that keep their colours keep the ICC profile +/// they carry when `profiles` allows it (not in PDF/X-1a, which allows no ICC-based color spaces). +/// `interpolate` lets viewers smooth it. An image that can't be decoded is kept as it is. +pub(crate) fn recode( + bytes: &[u8], + size: (f64, f64), + c: &CompressionSettings, + interpolate: bool, + convert: Option<&Pixels>, + profiles: bool, +) -> Recoded { let keep = Recoded { image: None, warning: None }; let Ok(reader) = ImageReader::new(Cursor::new(bytes)).with_guessed_format() else { return keep }; let jpeg = reader.format() == Some(ImageFormat::Jpeg); @@ -337,6 +410,11 @@ pub(crate) fn recode(bytes: &[u8], size: (f64, f64), c: &CompressionSettings, in return Recoded { image: None, warning: rule.instead }; } let Some(img) = pixels.or_else(|| decoded(bytes)) else { return keep }; + // Pixels that keep their colours keep the profile they are in; converted ones are in the + // destination's. + let want = if kind == Kind::Color { *b"RGB " } else { *b"GRAY" }; + let icc = (profiles && convert.is_none()).then(|| source_icc(bytes)).flatten().filter(|icc| valid_icc(icc, want)); + let rgb_icc = icc.is_some() && kind == Kind::Color; let mut rgba = resample(img, &rule, sized(&rule, dims, size)).into_rgba8(); if kind == Kind::Mono { // Resampling greys the edges: back to black and white. @@ -351,16 +429,18 @@ pub(crate) fn recode(bytes: &[u8], size: (f64, f64), c: &CompressionSettings, in let (width, height) = rgba.dimensions(); let opaque = rgba.pixels().all(|p| p[3] == 255); let jpeg = jpeg_quality(&rule, jpeg).filter(|_| opaque).and_then(|q| { - // Grey pixels stay grey; colour ones go to CMYK when the output converts to CMYK. - let grey = kind != Kind::Color || neutral(&rgba); + // Grey pixels stay grey, unless they keep an RGB profile; colour ones go to CMYK when the + // output converts to CMYK. + let grey = kind != Kind::Color || (neutral(&rgba) && !rgb_icc); let (samples, space) = match convert.filter(|_| !grey).and_then(|p| p.cmyk(&rgba)) { Some(cmyk) => (cmyk, ImageColorspace::Cmyk), None if grey => (rgba.pixels().map(|p| p[0]).collect(), ImageColorspace::Luma), None => (rgba.pixels().flat_map(|p| [p[0], p[1], p[2]]).collect(), ImageColorspace::Rgb), }; - to_jpeg(&samples, space, width, height, q, interpolate, None) + let icc = icc_for(icc.clone(), space); + to_jpeg(&samples, space, width, height, q, interpolate, icc.as_deref().map(Vec::as_slice)) }); - let image = jpeg.or_else(|| from_rgba(rgba.as_raw(), width, height, interpolate, convert)); + let image = jpeg.or_else(|| from_rgba(rgba.as_raw(), width, height, interpolate, convert, icc)); Recoded { image, warning: rule.instead } } @@ -514,7 +594,11 @@ fn to_jpeg(samples: &[u8], space: ImageColorspace, width: u32, height: u32, qual } ImageColorspace::Rgb | ImageColorspace::Luma => { let t = if space == ImageColorspace::Rgb { ExtendedColorType::Rgb8 } else { ExtendedColorType::L8 }; - image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, quality).encode(samples, width, height, t).ok()?; + let mut encoder = image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, quality); + if let Some(icc) = icc { + image::ImageEncoder::set_icc_profile(&mut encoder, icc.to_vec()).ok()?; + } + encoder.encode(samples, width, height, t).ok()?; } ImageColorspace::DeviceN => return None, } diff --git a/crates/pdf/src/tests/compression.rs b/crates/pdf/src/tests/compression.rs index 076c3c08c9..400bc0b0a8 100644 --- a/crates/pdf/src/tests/compression.rs +++ b/crates/pdf/src/tests/compression.rs @@ -5,7 +5,7 @@ use std::io::Cursor; -use craft_pdf::syntax::object::{Name, Object}; +use craft_pdf::syntax::object::{Array, Name, Object, Stream}; use image::{DynamicImage, ImageFormat}; use serde_json::{Value, json}; use vectorcraft_doc::{Document, ImageBlob, ImageObject, Node, NodeKind}; @@ -266,6 +266,292 @@ fn images_declaring_more_than_the_allowance_are_not_decoded() { assert_eq!(crate::images::mask_alpha(&blob, 60_000, 60_000, false), None); assert_eq!(crate::images::mask_alpha(&blob, 2, 2, false), None, "another size is not decoded at all"); let c: CompressionSettings = serde_json::from_value(json!({"gray": {"downsample": "bicubic", "ppi": 72, "abovePpi": 100}})).unwrap(); - let r = crate::images::recode(&png, (10.0, 10.0), &c, false, None); + let r = crate::images::recode(&png, (10.0, 10.0), &c, false, None, true); assert!(r.image.is_none(), "kept as it is"); } + +/// A version 2.1 display ICC profile for colour space `space` (`RGB ` or `GRAY`), `len` bytes in +/// all, with an empty tag table, every byte after the tag count different from its neighbors. +fn icc_profile(space: &[u8; 4], len: usize) -> Vec { + let mut icc: Vec = (0..len).map(|i| (i % 251) as u8).collect(); + icc[..4].copy_from_slice(&u32::try_from(len).unwrap().to_be_bytes()); + icc[8..12].copy_from_slice(&[2, 0x10, 0, 0]); + icc[12..16].copy_from_slice(b"mntr"); + icc[16..20].copy_from_slice(space); + icc[36..40].copy_from_slice(b"acsp"); + icc[128..132].copy_from_slice(&0u32.to_be_bytes()); + icc +} + +/// `img` encoded as `format` carrying ICC profile `icc`. +fn tagged(img: &DynamicImage, icc: &[u8], format: ImageFormat) -> Vec { + use image::ImageEncoder as _; + let mut out = Vec::new(); + match format { + ImageFormat::Tiff => { + let mut enc = image::codecs::tiff::TiffEncoder::new(Cursor::new(&mut out)); + enc.set_icc_profile(icc.to_vec()).unwrap(); + img.write_with_encoder(enc).unwrap(); + } + ImageFormat::Jpeg => { + let mut enc = image::codecs::jpeg::JpegEncoder::new(&mut out); + enc.set_icc_profile(icc.to_vec()).unwrap(); + img.write_with_encoder(enc).unwrap(); + } + _ => { + let mut enc = image::codecs::png::PngEncoder::new(&mut out); + enc.set_icc_profile(icc.to_vec()).unwrap(); + img.write_with_encoder(enc).unwrap(); + } + } + out +} + +/// An image XObject as it is written. +#[derive(Debug, PartialEq)] +struct Written { + /// Its colour space's name: `ICCBased` for an ICC-based one. + space: String, + /// The profile an ICC-based colour space holds. + icc: Option>, + bits: u8, + filter: String, + smask: bool, +} + +/// Each image XObject of `pdf` other than soft masks. +fn image_spaces(pdf: &[u8]) -> Vec { + let file = craft_pdf::syntax::Pdf::new(std::sync::Arc::new(pdf.to_vec())).unwrap(); + let images: Vec> = file + .objects() + .into_iter() + .filter_map(|o| match o { + Object::Stream(s) if s.dict().get::>(b"Subtype").is_some_and(|n| n.as_ref() == b"Image") => Some(s), + _ => None, + }) + .collect(); + let masks: Vec> = images.iter().filter_map(|s| s.dict().get::>(b"SMask")).map(|m| m.raw_data().to_vec()).collect(); + let mut out = vec![]; + for s in images.iter().filter(|s| !masks.contains(&s.raw_data().to_vec())) { + let d = s.dict(); + let (space, icc) = match (d.get::>(b"ColorSpace"), d.get::>(b"ColorSpace")) { + (Some(n), _) => (n.as_str().to_string(), None), + (_, Some(a)) => { + let mut it = a.flex_iter(); + let name = it.next::>().unwrap().as_str().to_string(); + (name, it.next::>().map(|s| s.decoded().unwrap().into_owned())) + } + _ => (String::new(), None), + }; + let filter = d.get::>(b"Filter").map(|n| n.as_str().to_string()).unwrap_or_default(); + let (bits, smask) = (d.get::(b"BitsPerComponent").unwrap_or(0), d.get::>(b"SMask").is_some()); + out.push(Written { space, icc, bits, filter, smask }); + } + out +} + +/// The decoded samples of each image XObject of `pdf` other than soft masks. +fn image_samples(pdf: &[u8]) -> Vec> { + let file = craft_pdf::syntax::Pdf::new(std::sync::Arc::new(pdf.to_vec())).unwrap(); + let images: Vec> = file + .objects() + .into_iter() + .filter_map(|o| match o { + Object::Stream(s) if s.dict().get::>(b"Subtype").is_some_and(|n| n.as_ref() == b"Image") => Some(s), + _ => None, + }) + .collect(); + let masks: Vec> = images.iter().filter_map(|s| s.dict().get::>(b"SMask")).map(|m| m.raw_data().to_vec()).collect(); + images.iter().filter(|s| !masks.contains(&s.raw_data().to_vec())).map(|s| s.decoded().unwrap().into_owned()).collect() +} + +/// The raw (still encoded) data of each image XObject of `pdf`. +fn image_data(pdf: &[u8]) -> Vec> { + let file = craft_pdf::syntax::Pdf::new(std::sync::Arc::new(pdf.to_vec())).unwrap(); + file.objects() + .into_iter() + .filter_map(|o| match o { + Object::Stream(s) if s.dict().get::>(b"Subtype").is_some_and(|n| n.as_ref() == b"Image") => Some(s.raw_data().to_vec()), + _ => None, + }) + .collect() +} + +/// A PNG or JPEG embedded as it is whose gray or RGB profile is malformed is written without it, +/// the JPEG with its JPEG data unchanged: a profile whose header declares another size, one without +/// the `acsp` signature, one whose tag table runs past its end, and one cut short after 64 bytes. +#[test] +fn a_malformed_profile_is_left_out_of_a_png_or_jpeg_kept_as_it_is() { + for (space, img, device) in [(b"RGB ", colour(), "DeviceRGB"), (b"GRAY", colour().grayscale(), "DeviceGray")] { + let mut malformed = [icc_profile(space, 600), icc_profile(space, 600), icc_profile(space, 600), icc_profile(space, 600)]; + malformed[0][..4].copy_from_slice(&601u32.to_be_bytes()); + malformed[1][36..40].copy_from_slice(b"xxxx"); + malformed[2][128..132].copy_from_slice(&100u32.to_be_bytes()); + malformed[3].truncate(64); + malformed[3][..4].copy_from_slice(&64u32.to_be_bytes()); + for (i, icc) in malformed.iter().enumerate() { + for (format, mime, filter) in [(ImageFormat::Png, "image/png", "FlateDecode"), (ImageFormat::Jpeg, "image/jpeg", "DCTDecode")] { + let what = format!("{device}, {format:?}, malformed profile {i}"); + let bytes = tagged(&img, icc, format); + let mut settings = PdfSettings::default(); + settings.compression.compress_text = false; + let pdf = export_with_report(&doc(bytes.clone(), mime), &PdfOptions { settings, ..Default::default() }).unwrap().bytes; + let spaces = image_spaces(&pdf); + let plain = spaces.len() == 1 && spaces[0].space == device && spaces[0].icc.is_none() && spaces[0].filter == filter; + assert!(plain, "{what}: {spaces:?}"); + if format == ImageFormat::Jpeg { + assert!(image_data(&pdf) == [bytes], "{what}: the JPEG data unchanged"); + } + } + } + } +} + +/// In PDF/X-1a a tagged gray JPEG kept as JPEG is written with its JPEG data, without its profile. +#[test] +fn pdf_x1a_keeps_a_tagged_gray_jpeg_as_jpeg() { + let jpeg = tagged(&colour().grayscale(), &icc_profile(b"GRAY", 300), ImageFormat::Jpeg); + let d = doc(jpeg.clone(), "image/jpeg"); + for compression in [json!({}), json!({"gray": {"compression": "jpeg"}})] { + let mut settings: PdfSettings = + serde_json::from_value(json!({"standard": "pdfX1a", "compatibility": "1.3", "compression": compression.clone()})).unwrap(); + settings.compression.compress_text = false; + let bytes = export_with_report(&d, &PdfOptions { settings, ..Default::default() }).unwrap().bytes; + crate::pdfx::verify(&bytes, Standard::PdfX1a).unwrap_or_else(|e| panic!("{compression}: {e}")); + let spaces = image_spaces(&bytes); + let dct = spaces.len() == 1 && spaces[0].space == "DeviceGray" && spaces[0].icc.is_none() && spaces[0].filter == "DCTDecode"; + assert!(dct, "{compression}: {spaces:?}"); + assert!(image_data(&bytes) == [jpeg.clone()], "{compression}: the JPEG data unchanged"); + } +} + +/// A gray or RGB TIFF that carries an ICC profile of its colour space is written in an ICC-based +/// colour space holding the same profile, at 16 bits a sample from PDF 1.5 on, with its alpha as +/// a soft mask; and so is a tagged TIFF or PNG that is resampled or compressed with JPEG. Pixels +/// the Output settings convert, and a profile of another colour space, are written without it. +#[test] +fn tagged_tiffs_keep_their_icc_profile() { + let (rgb, gray) = (icc_profile(b"RGB ", 600), icc_profile(b"GRAY", 300)); + let mut clear = colour().to_rgba8(); + clear.put_pixel(0, 0, image::Rgba([10, 20, 30, 0])); + let tiff = |img: &DynamicImage, icc: &[u8]| doc(tagged(img, icc, ImageFormat::Tiff), "image/tiff"); + let export = |d: &Document, settings: Value| { + let mut settings: PdfSettings = serde_json::from_value(settings).unwrap(); + settings.compression.compress_text = false; + let r = export_with_report(d, &PdfOptions { settings, ..Default::default() }).unwrap(); + assert!(r.warnings.is_empty(), "{:?}", r.warnings); + image_spaces(&r.bytes) + }; + let icc_based = |icc: &[u8], bits: u8, filter: &str, smask: bool| { + vec![Written { space: "ICCBased".into(), icc: Some(icc.to_vec()), bits, filter: filter.into(), smask }] + }; + let flate = "FlateDecode"; + let cases = [ + ("RGB", tiff(&colour(), &rgb), json!({}), icc_based(&rgb, 8, flate, false)), + ("gray", tiff(&colour().grayscale(), &gray), json!({}), icc_based(&gray, 8, flate, false)), + ( + "RGB, 16 bits", + tiff(&DynamicImage::ImageRgb16(colour().to_rgb16()), &rgb), + json!({"compatibility": "1.7"}), + icc_based(&rgb, 16, flate, false), + ), + ( + "RGB, 16 bits, PDF 1.4", + tiff(&DynamicImage::ImageRgb16(colour().to_rgb16()), &rgb), + json!({"compatibility": "1.4"}), + icc_based(&rgb, 8, flate, false), + ), + ("RGBA", tiff(&clear.clone().into(), &rgb), json!({}), icc_based(&rgb, 8, flate, true)), + ( + "RGB, resampled", + tiff(&colour(), &rgb), + json!({"compression": {"color": {"downsample": "bicubic", "ppi": 150, "abovePpi": 225}}}), + icc_based(&rgb, 8, flate, false), + ), + ( + "gray, resampled", + tiff(&colour().grayscale(), &gray), + json!({"compression": {"gray": {"downsample": "bicubic", "ppi": 150, "abovePpi": 225}}}), + icc_based(&gray, 8, flate, false), + ), + ("RGB, JPEG", tiff(&colour(), &rgb), json!({"compression": {"color": {"compression": "jpeg"}}}), icc_based(&rgb, 8, "DCTDecode", false)), + ( + "gray, JPEG", + tiff(&colour().grayscale(), &gray), + json!({"compression": {"gray": {"compression": "jpeg"}}}), + icc_based(&gray, 8, "DCTDecode", false), + ), + ( + "PNG, resampled", + doc(tagged(&colour(), &rgb, ImageFormat::Png), "image/png"), + json!({"compression": {"color": {"downsample": "bicubic", "ppi": 150, "abovePpi": 225}}}), + icc_based(&rgb, 8, flate, false), + ), + ]; + for (what, d, settings, want) in cases { + assert_eq!(export(&d, settings), want, "{what}"); + } + // 16-bit samples are written big-endian from PDF 1.5 on, and reduced to 8 bits before it. + // Their high and low bytes differ, so a swapped or truncated stream does not match. + let deep = DynamicImage::ImageRgb16(image::ImageBuffer::from_fn(600, 600, |x, y| { + image::Rgb([((x * 109 + y) % 65_521) as u16, ((y * 257 + 3) ^ 0x5a) as u16, ((x * y) % 65_521) as u16]) + })); + let sixteen: Vec = deep.to_rgb16().iter().flat_map(|v| v.to_be_bytes()).collect(); + for (compatibility, want) in [("1.7", sixteen), ("1.4", deep.to_rgb8().into_raw())] { + let mut settings: PdfSettings = serde_json::from_value(json!({ "compatibility": compatibility })).unwrap(); + settings.compression.compress_text = false; + let r = export_with_report(&tiff(&deep, &rgb), &PdfOptions { settings, ..Default::default() }).unwrap(); + assert!(image_samples(&r.bytes) == [want], "16-bit samples, PDF {compatibility}"); + } + // A gray image in an RGB profile stays RGB to keep it, resampled too. + let neutral = tiff(&DynamicImage::ImageRgb8(colour().grayscale().to_rgb8()), &rgb); + for settings in [json!({}), json!({"compression": {"color": {"downsample": "bicubic", "ppi": 150, "abovePpi": 225}}})] { + assert_eq!(export(&neutral, settings.clone()), icc_based(&rgb, 8, flate, false), "neutral RGB, {settings}"); + } + // A profile of another colour space is left out. + let spaces = export(&tiff(&colour(), &gray), json!({})); + assert!(spaces.len() == 1 && spaces[0].space == "DeviceRGB" && spaces[0].icc.is_none(), "RGB in a gray profile: {spaces:?}"); + // A malformed profile is left out, the image kept as it is, resampled or compressed with JPEG: + // one whose header declares another size, one without the `acsp` signature, and one whose tag + // table runs past its end. + let mut malformed = [rgb.clone(), rgb.clone(), rgb.clone()]; + malformed[0][..4].copy_from_slice(&601u32.to_be_bytes()); + malformed[1][36..40].copy_from_slice(b"xxxx"); + malformed[2][128..132].copy_from_slice(&100u32.to_be_bytes()); + let compressions = + [json!({}), json!({"color": {"downsample": "bicubic", "ppi": 150, "abovePpi": 225}}), json!({"color": {"compression": "jpeg"}})]; + for (i, icc) in malformed.iter().enumerate() { + for compression in &compressions { + let spaces = export(&tiff(&colour(), icc), json!({ "compression": compression })); + assert!( + spaces.len() == 1 && spaces[0].space == "DeviceRGB" && spaces[0].icc.is_none(), + "malformed profile {i}, {compression}: {spaces:?}" + ); + } + } + // Converted pixels are in the destination's colours, not the image's profile. + for destination in [vectorcraft_color::cms::DISPLAY_P3, vectorcraft_color::cms::GENERIC_CMYK] { + let spaces = export(&tiff(&colour(), &rgb), json!({"output": {"conversion": "destination", "destination": destination}})); + assert!(spaces.len() == 1 && spaces[0].icc.as_deref() != Some(rgb.as_slice()), "converted to {destination}: {spaces:?}"); + } + // PDF/X-1a allows no ICC-based color spaces: a tagged gray TIFF (8 or 16 bits), PNG or JPEG is + // written in DeviceGray, kept as it is, resampled or compressed with JPEG, and the file passes + // the PDF/X-1a check. + let compressions = [json!({}), json!({"gray": {"downsample": "bicubic", "ppi": 150, "abovePpi": 225}}), json!({"gray": {"compression": "jpeg"}})]; + let tiff16 = tiff(&DynamicImage::ImageLuma16(colour().to_luma16()), &gray); + let png = doc(tagged(&colour().grayscale(), &gray, ImageFormat::Png), "image/png"); + let jpeg = doc(tagged(&colour().grayscale(), &gray, ImageFormat::Jpeg), "image/jpeg"); + for (format, d) in [("TIFF", tiff(&colour().grayscale(), &gray)), ("TIFF, 16 bits", tiff16), ("PNG", png), ("JPEG", jpeg)] { + for compression in &compressions { + let mut settings: PdfSettings = + serde_json::from_value(json!({"standard": "pdfX1a", "compatibility": "1.3", "compression": compression.clone()})).unwrap(); + settings.compression.compress_text = false; + let r = export_with_report(&d, &PdfOptions { settings, ..Default::default() }); + let bytes = r.unwrap_or_else(|e| panic!("PDF/X-1a, {format}, {compression}: {e}")).bytes; + crate::pdfx::verify(&bytes, Standard::PdfX1a).unwrap_or_else(|e| panic!("PDF/X-1a, {format}, {compression}: {e}")); + let spaces = image_spaces(&bytes); + let gray = spaces.len() == 1 && spaces[0].space == "DeviceGray" && spaces[0].icc.is_none(); + assert!(gray, "PDF/X-1a, {format}, {compression}: {spaces:?}"); + } + } +} diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md index bf242a0054..f4b5607d81 100644 --- a/docs/target-app-parity.md +++ b/docs/target-app-parity.md @@ -1846,6 +1846,7 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur - A photo whose EXIF orientation turns or flips it (a camera held upright or upside down) is placed and opened upright, as it was taken; the image is stored as it is seen (#4284). A quarter turn swaps the resolution's axes, so the image keeps its physical size. TIFFs read without the image decoder (grayscale with extra channels, CCITT Group 3, CMYK with one plane per ink) follow their Orientation tag too, and a turned CMYK JPEG or TIFF keeps its inks, at the 8 or 16 bits the file has, as a CMYK TIFF. - PDF export writes a CMYK image that keeps its numbers in an `ICCBased` color space holding, byte for byte, the CMYK profile the image carries (a CMYK TIFF's tag 34675, or a CMYK JPEG's `ICC_PROFILE` APP2 segments) when `output.profiles` is `all` or `taggedSource`, and in PDF/A-2b, PDF/X-3 and PDF/X-4 unless it is `destination` ([the help page](https://helpx.adobe.com/illustrator/desktop/save-and-export/export-files-to-different-formats/pdf-marks-bleeds-and-color-output-options.html)). This covers a CMYK JPEG embedded as it is, one the Compression settings resample or compress again, a TIFF written again, and an image written with its mask as its soft mask. With `none`, and in PDF/X-1a, the image is DeviceCMYK and a JPEG's own profile is left out, so PDF/X-1a export writes a CMYK JPEG that carries a profile. Pixels the Output settings convert are never tagged with the profile of their old numbers. A profile tags an image only when its size, signature, class, CMYK color space and tag table are well formed and it is at most 16 MiB (VectorCraft's own limit). Transparency in a tagged CMYK document blends in the document's CMYK profile; when the file holds no space of that profile it blends in DeviceCMYK, or keeps its RGB space in PDF/A, and never in an image's own profile (`crates/pdf/src/tests/cmykimages.rs`, `export::writer::tests`). - An image that Open and Place store again keeps the ICC profile its file embeds and its 16-bit samples. A turned PNG, JPEG, WebP or TIFF stored as PNG, and a TIFF the image decoder reads, keep their gray or RGB samples at 8 or 16 bits with their gray or RGB profile in the PNG's `iCCP` chunk ([PNG specification, iCCP](https://www.w3.org/TR/png-3/#11iCCP)). A CMYK TIFF stored with one plane per ink and a turned CMYK JPEG or TIFF keep their CMYK profile as TIFF tag 34675, a JPEG's put together from all its APP2 segments ([ICC image-format guide](https://github.com/InternationalColorConsortium/iccDEV/blob/master/iccdev-mcp/docs/icc-format-guide.md)). A profile whose color space differs from the stored samples' is left out. The profile is kept in the stored image; how CMYK inks are drawn and exported to PDF does not change (`crates/engine/src/cmd/fileio/tests.rs`). + - PDF export writes a stored gray or RGB TIFF in an `ICCBased` color space that holds the gray or RGB profile of its tag 34675, at 16 bits a sample from PDF 1.5 on and 8 before, with its alpha as a soft mask only when some pixel is not opaque ([ISO 32000-1, §8.6.5.5](https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/PDF32000_2008.pdf#page=157)). A gray or RGB image, a PNG included, that the Compression settings resample or compress with JPEG keeps its profile too, and gray pixels in an RGB profile stay RGB. Pixels the Output settings convert, a profile whose color space differs from the samples', and a malformed profile, a PNG's or JPEG's kept as it is included, are written without it; such a JPEG keeps its JPEG data. PDF/X-1a allows no ICC-based color spaces, so there a gray image with a gray profile, kept as it is, resampled or compressed with JPEG, is written in DeviceGray without the profile, a JPEG kept as JPEG with its JPEG data unchanged, and RGB images are converted to CMYK as before. CMYK images are unchanged (`crates/pdf/src/tests/compression.rs`). - SVG import shows a raster `` whose EXIF orientation or TIFF Orientation tag turns or flips it upright, linked or as a data URL, and inside an SVG shown as an image: the pixels are stored turned, the width and height swap, and the `` box fits the turned image under `preserveAspectRatio`, as CSS `image-orientation: from-image` describes (). A turned CMYK JPEG or TIFF keeps its inks as a CMYK TIFF, as does a CMYK TIFF that is not turned. TIFF data URLs (`image/tiff`, or untyped TIFF bytes) are read, and TIFFs with an alpha or other extra channel, CCITT Group 3 TIFFs and CMYK TIFFs stored one plane per ink are read as Open and Place read them. The pixels are decoded within the decode allowance, and a TIFF claiming more strips or tiles than the decoder can count is refused before it is decoded (`crates/svg/tests/it/image_orientation.rs`). - An image that SVG import stores again, as PNG or as a CMYK TIFF, keeps the resolution its PNG, JPEG, TIFF, WebP or BMP file declares, as Open and Place keep it: in a PNG `pHYs` chunk () or the TIFF's resolution tags, with the horizontal and vertical values swapped when the image turns a quarter. An image that declares no resolution is stored without one (`a_turned_raster_keeps_its_resolution`, `an_upright_tiff_keeps_its_resolution` and `a_cmyk_tiff_keeps_its_resolution_turned_or_not` in `crates/svg/tests/it/image_orientation.rs`). - SVG import leaves out an SVG shown as an image that it can't read (text that isn't XML, an SVG without a size) and goes on with the images after it, as SVG 2's error processing describes (). Only images that decode count toward the 256 nested SVG images an SVG may show, so an image after many broken ones is imported. Every nested SVG image read, decoded or not, counts toward VectorCraft's own limits of 1,024 reads and 512 MB of text per import; past them, nested SVG images are left out with a warning (`crates/svg/tests/it/import_details.rs`).