Review follow-up. A huge glow or shadow could still arrive through what text and shapes inherit:
the deck's default text style, a master's title, body and other styles, a text box's or table
cell's own list style, and the theme's effect styles that shape styles point at. sane_numbers caps
those too; the test plants 10^18 pt glows in each and checks they come back capped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A .pptx or .deckcraft could give a glow, soft edge, shadow or reflection any size. A glow of
~10^16 pt made vello panic while flattening, one of 10^18 pt made rendering ask for 34 GB and abort.
sane_numbers (run by repair on every opened file) now caps them like line widths and font sizes:
glow 150, soft edges 100, shadows 200, reflections 100 pt; shadow scale and skew are kept sane and
non-numbers become 0, on shapes and on text runs, table cells included.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
repair re-id'd repeated slide ids but not shape ids, so such a file opened as a deck that fails
validate, and edits by id found only the first of the shapes sharing one. Repeats on a slide,
layout or master (groups included) now get fresh ids from the deck's counter; the first keeps
its id, and decks without repeats aren't copied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use the pinned shared PDF writer with explicit font embedding errors, preserving app-owned rendering and current main. All seven local gates and fresh Ubuntu/FreeBSD checks passed on the exact integration tree; paired native/WASM PDF bytes, structure, text and pixels match. Original contributor commits are preserved.
Conflicts resolved onto main's newer shape, and the PR's policy applied to
every alloc_id/add_media/new_slide call site main has grown since: commands
answer bad(cmd, NO_ID_SPACE) (slide.reuse, insert.zoom, SmartArt, photo
album, review.accept, handout/notes masters, master placeholders,
background/artistic/compress pictures, transition sound, ink to shape,
paste special, file.new templates); reid/bring_media/renumber/regenerate
and compare::adopt/accept are fallible; outline import keeps what fit.
Tests use expect() on the now-Option results.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fix-up in the merge (review): reading older files that hold null numbers re-parses at most
256 MB in all and slices without indexing, so a hostile file can't hang the open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
serde_json writes NaN and infinity as null, which doesn't read back as a number, so one NaN
anywhere in the model (a rotation, position, crop, stroke width…) made the saved file (and its
AutoRecover copy) fail to open as "damaged".
- Writer: presentation.json goes through finite::Finite, a serializer adapter that writes
non-finite floats as 0.
- Loader: files already written that way open; each null where a number belongs reads as 0
(inside tagged enums, where serde only reports the enclosing object, candidates are tried
nearest first and kept only when the parse gets further). Other damage still fails.
- repair() brings shape geometry into range: positions and sizes finite and within ±1e6 pt,
rotation 0–360, picture crop -10..1, font sizes 1–4000 pt, line widths 0–1584 pt.
Animation timings are u32 and can't carry NaN.
Co-authored-by: Cursor <cursoragent@cursor.com>
repair() brings each slide side into PowerPoint's 72–4032 pt (as Design › Slide Size allows;
it accepted 1–4000 before), and replaces a zero, negative or non-finite size with 16:9; a bad
notes size gets the default. The native reader takes a null, string or missing slide/notes
size as NaN for repair to fix, so such a file opens instead of failing as damaged (NaN and
infinity are saved as null). The canvas fit and slide show fit treat a zero or non-finite side
as 1 pt, so an in-memory bad size can't make layout infinite.
Co-authored-by: Cursor <cursoragent@cursor.com>
Only each member was capped (2 GiB), so a compact archive with many
media items, or one large member listed under many items, could
inflate without limit and exhaust memory while opening.
Loading now caps all embedded media together (4 GiB) and the number
of media items (100,000), refuses a member before inflating it when it
declares more than is left, and keeps one item per media id, so a
repeated id inflates its member once and the deck can still be saved
(a zip can't hold two media/<id> entries).
Co-authored-by: Cursor <cursoragent@cursor.com>
load() ignored every failed media read, so a .deckcraft with a missing,
oversized or bad-CRC media member opened silently with empty pictures,
and the next Save overwrote the original with that loss.
load_checked() now lists each unreadable member (linked media saved
without bytes is not damage). file.open/openBytes return damagedMedia,
show a message, and open the deck as an untitled "(Repaired)" copy so
Save asks for a new name and the original file stays intact.
Co-authored-by: Cursor <cursoragent@cursor.com>
alloc_id bumped next_id with saturating_add: a presentation whose
next_id reached u32::MAX (a hostile file can arrive that way;
fix_next_id imports it) handed out that same id to every new slide,
shape, layout and media - duplicate ids, ambiguous references, silent
corruption on every later insert.
alloc_id now returns Option<u32> via checked_add, and every caller
refuses: the engine's insert/duplicate/media/layout commands answer
with a clear error naming the command, paste and duplicate re-id
helpers propagate it, media addition is fallible, and a fresh slide is
Option. The pptx export's synthesized blank layout is guarded the same
way. Loading keeps such a deck viewable: repair re-ids duplicate
slides while it can, and a duplicate it cannot re-id stays as it is -
growth is refused, and only that duplicate keeps its ambiguous id.
Renumbering the loaded graph was rejected: it needs the
cross-document reference remapping that issue #406 tracks.
Tests: model exhaustion (alloc_id None, fresh media refused, a new
slide refused), engine (slide.new, shape.insert, slide.duplicate and
edit.duplicate all refuse; the document holds no duplicate ids),
format repair (an unre-id-able duplicate stays visible).
File ▸ Open's Outline filter accepts `.md`, but a `.md` was read with the
plain outline format (unindented line = slide, indent = bullet), so a
Markdown outline written the usual way kept `#` in its titles and made
every top-level list item a slide of its own.
`deckcraft_format::markdown_to_slides` reads ATX headings (`#`–`######`,
closing `#`s dropped) as slide titles, list items (`-`, `*`, `+`, `1.`,
`1)`) as bullets nested by their indentation, and other lines under a
heading as body paragraphs. A `.md` without headings is still read as a
plain outline, so existing indented `.md` outlines open as before; `.txt`
is unchanged. Opening a `.md` and dropping one on the window
(`slide.fromOutline {markdown: true}`) use it. Both readers now share the
slide builder.
Tests: the outline from the issue (2 slides, nested bullets), numbered and
`*`/`+` lists with text under a heading, `slide.fromOutline` with
`markdown`, plain `.txt`/`.md` outlines unchanged, and heading / list-item
edge cases (not-a-heading forms, closing hashes, Unicode, long digit runs).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brandon Thomas