mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-25 18:47:22 -06:00
Brandon ThomasandClaude Opus 5.5
1449b71a19
Fuzzed inputs drove one check-one process to 2-6 GB (the 16 GB CI runner running two of them was killed every night). Three causes, each with a test: - lopdf (bootstrap inspector) sized PNG predictor rows from /Columns before reading data: /Columns 4294967295 allocated two 4 GiB rows. Vendored lopdf 0.45.0 refuses rows longer than the data (and uses saturating row widths); its load-time stream decoding also gets a 256 MiB limit (it had none). - hayro sized a tiling pattern's cell pixmap from /XStep x scale, bounded only by u16: a step far beyond /BBox allocated 2 GB. The vendored patch keeps the cell within 3000 px a side, lowering the resolution instead. - cos decoded cross-reference streams up to the general 1 GiB limit; they now stop at what 8,388,607 objects' rows can hold (~200 MB at most), and the section is reconstructed (logged) instead. On the nightly's seed (41) the worst captured input fell from 6.2 GB to 6 MB, and a 300 s fuzz run had no process above 300 MB (before: many at 2-5 GB). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
108 lines
2.7 KiB
TOML
108 lines
2.7 KiB
TOML
[package]
|
|
authors = [
|
|
"Junfeng Liu <china.liujunfeng@gmail.com>",
|
|
"Emulator <emulator@hotmail.it>",
|
|
]
|
|
categories = ["text-processing"]
|
|
description = "A Rust library for PDF document manipulation."
|
|
documentation = "https://docs.rs/crate/lopdf/"
|
|
edition = "2024"
|
|
homepage = "https://github.com/J-F-Liu/lopdf"
|
|
keywords = ["pdf", "editing", "manipulation", "merge"]
|
|
license = "MIT"
|
|
name = "lopdf"
|
|
readme = "README.md"
|
|
repository = "https://github.com/J-F-Liu/lopdf.git"
|
|
version = "0.45.0"
|
|
rust-version = "1.88"
|
|
exclude = ["/benches", "/assets", "/.chglog", "/.vscode", "/.github"]
|
|
|
|
[dependencies]
|
|
aes = "0.9"
|
|
bitflags = "2.13"
|
|
brotli-decompressor = "5.0"
|
|
cbc = "0.2"
|
|
chrono = { version = "0.4", optional = true, default-features = false, features = [
|
|
"std",
|
|
] }
|
|
ecb = "0.2"
|
|
encoding_rs = "0.8"
|
|
flate2 = "1.1"
|
|
image = { version = "0.25", optional = true }
|
|
indexmap = "2.14"
|
|
itoa = "1.0"
|
|
jiff = { version = "0.2", optional = true }
|
|
getrandom = "0.4"
|
|
log = "0.4"
|
|
md-5 = "0.11"
|
|
nom = "8.0"
|
|
rand = { version = "0.10" }
|
|
rangemap = "1.7"
|
|
rayon = { version = "1.12", optional = true }
|
|
serde = { version = "1.0", features = ["derive"], optional = true }
|
|
sha2 = "0.11"
|
|
stringprep = "0.1.5"
|
|
thiserror = "2.0"
|
|
time = { version = "0.3", features = [
|
|
"formatting",
|
|
"parsing",
|
|
], optional = true }
|
|
tokio = { version = "1", features = ["fs", "io-util"], optional = true }
|
|
weezl = "0.2"
|
|
skrifa = { version = "0.45.1", optional = true }
|
|
|
|
[dev-dependencies]
|
|
clap = { version = "4.6", features = ["derive"] }
|
|
env_logger = "0.11"
|
|
flate2 = "1.1"
|
|
serde_json = "1.0"
|
|
shellexpand = "3.1"
|
|
tempfile = "3.27"
|
|
wasm-bindgen-test = "0.3"
|
|
|
|
[target.'cfg(not(target_family="wasm"))'.dev-dependencies]
|
|
criterion = "0.8"
|
|
|
|
[features]
|
|
async = ["tokio/rt-multi-thread", "tokio/macros"]
|
|
# Fixed-offset and UTC conversions, which is all a PDF date can express.
|
|
chrono = ["dep:chrono"]
|
|
# The system-local conversions, and the iana-time-zone subtree they need.
|
|
chrono-clock = ["chrono", "chrono/clock"]
|
|
default = ["chrono-clock", "rayon"]
|
|
embed_image = ["image"]
|
|
font_embedding = ["dep:skrifa"]
|
|
jiff = ["dep:jiff"]
|
|
wasm_js = ["getrandom/wasm_js"]
|
|
serde = ["dep:serde"]
|
|
time = ["dep:time"]
|
|
|
|
[[example]]
|
|
name = "extract_toc"
|
|
required-features = ["serde"]
|
|
|
|
[[example]]
|
|
name = "extract_text"
|
|
required-features = ["serde"]
|
|
|
|
[[example]]
|
|
name = "print_annotations"
|
|
# No `required-features`: the example uses `env_logger` (a dev-dependency,
|
|
# always available to an example) and `Document`/`Object`, none of which is
|
|
# behind a feature. Naming `default` only made it silently unbuildable under
|
|
# `--no-default-features`.
|
|
|
|
[[example]]
|
|
name = "rotate"
|
|
|
|
[[bench]]
|
|
name = "datetime"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "parse"
|
|
harness = false
|
|
|
|
[badges]
|
|
travis-ci = { repository = "J-F-Liu/lopdf" }
|