b642e327e7
* fix(create): cap decoded size of imported PNGs A PNG's declared dimensions sized an infallible allocation, so a few-byte file claiming huge dimensions aborted the process when the allocation failed. Cap the decoded size at the TIFF ceiling and reserve every input-sized buffer fallibly, returning CreateError::Image instead. (Security audit run-2: v3-024.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(xfa): bound total picture bytes kept during layout Each laid-out picture kept its own copy, so one picture in a repeating subform multiplied without bound and could exhaust memory on open. Add a per-layout aggregate cap (256 MiB) that stops with XfaError::TooLarge. (Security audit run-2: v3-103.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(xfdf): bound XML nesting and protect redaction marks on import Deeply nested XFDF/XML overflowed roxmltree's recursive parser and aborted the process; a non-recursive depth scan now rejects it before parsing. Imported comments could also replace a locked or redaction mark by /NM or add a hidden one; place() no longer replaces locked/Redact annotations and clears the hidden/invisible flags on imported redaction marks. (Security audit run-2: v3-105, v3-111.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(sign): classify post-signing changes by the signed revision's roles A signed object's modification was classified from labels in the attacker-written new version, so relabelling a signed page /Type /Sig (or giving it /ModDate), or relabelling a drawn stream /ObjStm or /XRef, let a forged page validate as Valid even under DocMDP P=1. Decide an object's role (page content, signature, metadata, file plumbing) from what it was in the signed revision, not its new dictionary. (Security audit run-2: v3-082, v3-083.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(redact): remove redacted content from the saved file, fail closed otherwise Apply Redactions and Remove Hidden Information left the originals behind: dropped or cleaned image/form XObjects kept their resource names (so the full rewrite saved the originals), an XFA form kept the redacted value in its datasets packet, and vertical-writing text under a mark was never hit by the horizontal removal geometry yet reported success. Prune replaced XObject names the page no longer draws, drop /XFA and /NeedsRendering when redacting an XFA form, and fail closed (RedactError::VerticalText) rather than silently leave vertical text. (Security audit run-2: v3-064, v3-067, v3-062.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ui-egui): trust the displayed signer, not the document's embedded root The Signatures panel's one-click 'Add to trusted certificates' trusted the top of the chain the document supplied, installing the author's self-signed root as an anchor instead of the signer shown. Trust the displayed signer certificate. (Security audit run-2: v3-098.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Use main's decoded-size ceiling for PNGs too; keep the depth tests on main's checker --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Brandon Thomas <echelon@gmail.com> |
||
|---|---|---|
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
README.md
pdfcraft-create
Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
blank(width, height, pages): an empty document;from_images(&[(name, bytes)]): one page per image, sized from the image's resolution (PNGpHYs, JPEG JFIF density; 72 dpi when absent). JPEG data is embedded as is (/DCTDecode, grey, RGB or Adobe-inverted CMYK); PNG is decoded and stored with Flate, with transparency as a soft mask. An ICC profile in the file (JPEGAPP2 ICC_PROFILE, PNGiCCP) that matches the image's colour space is kept as an/ICCBasedcolour space with the device space as/Alternate; images with the same profile share one profile object. JPEG metadata scanning skips marker fill bytes and reads application segments after the frame header, stopping at the first scan or end marker. Broken or mismatched ICC profiles still fall back to the device colour space;from_images_with_resolution(images, ImageResolution::Dpi(dpi)): override the page resolution (1–1200 dpi), without resampling or recompressing image pixels. Use 72 dpi for one point per pixel, orImageResolution::Embeddedfor the same behavior asfrom_images. The largest page side is still capped at 14,400 points;from_text(text, …): plain text set in Helvetica, wrapped and paginated.
Every function returns a pdfcraft_cos::Document; the caller writes it.