aiongg
0c748e34a8
* fix(render): bound xref streams, JBIG2 referred-to counts, saved graphics states and /W2 runs Input bounds and crash fixes in the vendored hayro crates, ported from the snapshot craft-libs carries (storytold/craft-libs#176, #239, #241): - hayro-syntax: an xref stream subsection must be backed by its decoded data. All-zero /W widths and a count longer than the data are refused before any entry is inserted; a tiny stream with a large /Size or /Index count inserted that many entries. - hayro-syntax: a subsection running past object number u32::MAX is refused; start + i overflowed. - hayro-syntax: the xref stream type field is read big-endian at its full /W[0] width, and /W[0] over 8 bytes is refused like /W[1]. - hayro-jbig2: the long-form referred-to segment count is capped at u16::MAX before its retention bytes are read; the 29-bit count went straight to Vec::with_capacity (about 2 GiB) and aborted the process. - hayro-interpret: at most 4096 saved graphics states holding at most 64 MiB together. A q past either limit is counted but not copied, and its Q still removes the clips added since. - hayro-interpret: a /W2 run whose first CID is past MAX_CID stops there, as /W does; a first CID of 4294967295 discarded the whole /W2 table. Each patch is marked in the source, has a regression test in its crate, and is listed in vendor/README.md. * fix(render): a binary usecmap counts against the CMap nesting limit; /W2 checks the CID first - hayro-cmap: a binary CMap's usecmap passed its own depth to the nested parse, so a self-referencing binary CMap recursed until the stack overflowed. It now counts like a text usecmap (ledger hayro-cmap 2). - hayro-interpret: the /W2 first-CID check runs before the run's metrics are read, so an incomplete run past MAX_CID no longer discards the rest of the table (ledger 52). * fix(render): refuse xref-stream object numbers past i32::MAX ObjectIdentifier stores an i32; a number between i32::MAX and u32::MAX was cast to a negative object number (ledger hayro-syntax 26).
hayro-syntax
A low-level library for reading PDF files.
This crate implements the Syntax chapter of the PDF reference, and therefore
serves as a very good basis for building various abstractions on top of it, without having to reimplement
the PDF parsing logic.
This crate does not provide more high-level functionality, such as parsing fonts or color spaces.
Such functionality is out-of-scope for hayro-syntax, since this crate is supposed to be
as light-weight and application-agnostic as possible.
Functionality-wise, this crate is therefore close to feature-complete. The main missing feature is support for password-protected documents. In addition to that, more low-level APIs might be added in the future.
The crate is no_std compatible but requires an allocator to be available.
Example
This short example shows you how to load a PDF file and iterate over the content streams of all pages.
use hayro_syntax::Pdf;
use std::path::PathBuf;
// First load the data that constitutes the PDF file.
let data = std::fs::read(
PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../hayro-tests/pdfs/custom/text_with_rise.pdf"),
)
.unwrap();
// Then create a new PDF file from it.
//
// Here we are just unwrapping in case reading the file failed, but you
// might instead want to apply proper error handling.
let pdf = Pdf::new(data).unwrap();
// First access all pages, and then iterate over the operators of each page's
// content stream and print them.
let pages = pdf.pages();
for page in pages.iter() {
let mut ops = page.typed_operations();
while let Some(op) = ops.next() {
println!("{op:?}");
}
}
Safety
When the unsafe feature is disabled, there is only use of unsafe in hayro-syntax.
We also unconditionally use the smallvec crate which uses unsafe internally, but that's
it.
For better performance, it is strongly recommended to enable the unsafe feature,
which does result in slightly more unsafe code being, but does give better performance:
- We will use the
flate2crate for decoding flate streams. - SIMD will be enabled to accelerate decoding of images.
memchrwill be used to accelerate some of the fallback parsing code.
Features
The supported features include:
- Parsing xref tables in all its possible formats, including xref streams.
- Best-effort attempt at repairing PDF files with broken xref tables.
- Parsing of all objects types (also in object streams).
- Parsing and decoding PDF streams.
- Iterating over pages as well as their content streams in a typed or untyped fashion.
- The crate is very lightweight, especially in comparison to other PDF crates.
Limitations
- There are still a few features missing, for example, support for password-protected PDFs. In addition to that, many properties (like page annotations) are currently not exposed.
- This crate is for read-only processing, you cannot directly use it to manipulate PDF files. If you need to do that, there are other crates in the Rust ecosystem that are suitable for this.
License
Licensed under either of
- Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.