cargo +1.95 clippy --workspace --all-targets --release -- -D warnings
stopped on seven `if` blocks that clippy wants folded into their match
arm (psd, text, effects x2, pdf x2, render). Each becomes a match guard.
The behaviour is unchanged: when a guard is false the value falls through
to arms that can't match it and then to `_ => {}`. The one exception is
the PDF PostScript calculator, where a `{` past the nesting limit would
fall through to the operator arm; it keeps its own no-op arm, so it is
still skipped rather than pushed as an operator.
A PDF could abort the process through its colour spaces and functions.
An Indexed hival of 10^12 asked an image for a 24 TB palette. A sampled
function's outputs (one per /Range pair) multiplied its table without a
bound, and copies of the table (one per q, one per reference) multiplied
it again. Self-referencing colour spaces and functions overflowed the
stack, a calculator's copy doubled its operand stack, index, idiv and
mod could panic, and f64::clamp panicked on a reversed /Domain or
/Range. Clamp hival to 255, count samples with checked arithmetic (at
most 32 inputs and outputs, 2^24 samples a table), share the samples,
give one function read a budget of nodes and samples, limit nesting to
8 levels and the calculator stack to 100, and clamp with the bounds in
either order.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
decode_stream_within now bounds the output of each stage of a /Filter
chain, not only FlateDecode. RunLength, LZW, ASCIIHex and ASCII85 stop
when their output would pass the limit, a full LZW table takes no more
entries, PNG predictor rows are sized with checked arithmetic and only
allocated when a whole row fits in the data, and CCITT checks
/Rows x row bytes against the limit before allocating.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
inflate used the unbounded miniz_oxide functions, and File::parse decodes
every object stream eagerly. Use the limit variants (1 GiB per stream, 256 MiB
for object streams, a quarter of that on 32-bit targets) and bound the
truncated-stream salvage buffer too.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
In EPS/PostScript, `0#7` asked i64::from_str_radix for radix 0, which panics (found by
fuzzing). Radixes outside 2..=36 are not numbers now.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The s, b and b* operators closed the path even when there was no current point, which kurbo
asserts against (a panic in debug builds; found by fuzzing). Close only when a subpath is open.
CFF charstrings that draw before their first rmoveto now start the subpath at the current
point, as Type 1 charstrings already did. Denies the panic lints in the crate (it had no panic
sites).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Text with embedded TrueType, CFF (Type1C / CIDFontType0C / OpenType), Type 1 and Type 3 fonts,
standard-14 fallback to the bundled OFL fonts; Flate / DCT / inline / stencil images with SMask,
Indexed and ICC alternates; luminosity / alpha soft masks and the 16 blend modes in the SVG
render tree; tiling patterns; calculator functions; file.import page and Footage::page;
Create Shapes from Vector Layer keeps clips (page clips as layer masks, nested clips as Merge
Paths Intersect).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tylerjenningsw
Claude
Ikki Nishihara
Dexter
Brandon Thomas