TIFF: CCITT Group 3 compressed files open and place

1-bit TIFFs compressed with CCITT Group 3 did not open, place or
relink: the image decoder reads Group 4 only and refuses Compression 2
(modified Huffman) and Compression 3 (ITU-T T.4).

They are now decoded with hayro-ccitt, the CCITT decoder that EPS
import uses. Compression 2 rows start at a byte and have no EOL codes.
Compression 3 rows follow an EOL code and are one-dimensional, or, with
T4Options bit 0, one- or two-dimensional as each row's tag bit says.
Fill bits, FillOrder 2, either PhotometricInterpretation, strips and
tiles are read.

A file whose pixels would take more than the decoding allowance as
RGBA is refused as too large to draw. A strip or tile whose data ends
before its last row is refused as damaged, and so is a tile larger
than the allowance. The strips and tiles together are read from at
most as many bytes as the file holds.

Part of #1466.

Docs: docs/file-format-parity.md, docs/target-app-parity.md.

Cargo.lock

@@ -4617,6 +4617,7 @@ dependencies = [
 name = "vectorcraft-doc"
 version = "0.12.0"
 dependencies = [
+ "hayro-ccitt",
  "image",
  "jpeg-encoder",
  "kurbo 0.13.1",
@@ -4883,6 +4884,7 @@ dependencies = [
 name = "vectorcraft-testkit"
 version = "0.12.0"
 dependencies = [
+ "fax",
  "image",
  "kurbo 0.13.1",
  "proptest",

crates/doc/Cargo.toml

@@ -14,6 +14,8 @@ vectorcraft-color = { workspace = true }
 kurbo = { workspace = true }
 image = { workspace = true }
 tiff = { workspace = true }
+# 1-bit TIFFs compressed with CCITT Group 3 (Compression 2 and 3).
+hayro-ccitt = { workspace = true }
 zune-jpeg = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

crates/doc/src/cmyk.rs

@@ -349,6 +349,162 @@ pub fn extra_samples_tiff_rgba(bytes: &[u8], rgb: impl Fn([f32; 4]) -> [f32; 3])
     image::RgbaImage::from_raw(w, h, out)
 }
 
+/// Why a TIFF compressed with CCITT Group 3 wasn't read ([`group3_tiff_rgba`]).
+#[derive(Clone, Debug, PartialEq, thiserror::Error)]
+pub enum Group3Error {
+    /// Its pixels would take more than [`crate::MAX_RASTER_ALLOC`] as RGBA.
+    #[error("an image of {w} × {h} pixels is too large to draw")]
+    TooLarge { w: u32, h: u32 },
+    /// A strip or tile ends before its last row or can't be decoded (it holds a code the decoder
+    /// doesn't read, such as T.4's uncompressed mode, or a row of the wrong width), or a tile is
+    /// larger than [`crate::MAX_RASTER_ALLOC`] allows as RGBA.
+    #[error("could not decode image: {0}")]
+    Damaged(hayro_ccitt::DecodeError),
+}
+
+/// The pixels of a 1-bit TIFF compressed with CCITT Group 3, which the image decoder doesn't read,
+/// as RGBA. Compression 2 is modified Huffman coding with each row starting at a byte and no EOL
+/// codes. Compression 3 is ITU-T T.4 coding with an EOL code before each row: one-dimensional rows,
+/// or with T4Options bit 0, rows that a tag bit marks as one-dimensional or as coded against the
+/// row above. Fill bits before an EOL are skipped. Rows in T.4's uncompressed mode (T4Options
+/// bit 1) can't be decoded. Each strip or tile is coded on its own. White runs are 0 bits and black
+/// runs are 1 bits, as libtiff writes them, and PhotometricInterpretation 0 shows 0 bits as white
+/// and 1 shows them as black. FillOrder 2 (each byte's lowest bit first) is read too. Together, the
+/// strips and tiles are read from at most as many bytes as the file has. `None` for other images;
+/// an error when the pixels would take more than [`crate::MAX_RASTER_ALLOC`] as RGBA, a tile is
+/// larger than that allowance, or a strip or tile can't be decoded or ends before its last row.
+pub fn group3_tiff_rgba(bytes: &[u8]) -> Option<Result<image::RgbaImage, Group3Error>> {
+    use hayro_ccitt::{DecodeError, DecodeSettings, DecoderContext, EncodingMode};
+    use tiff::tags::Tag;
+    let (kind, mut d) = tiff(bytes)?;
+    let compression = d.find_tag_unsigned::<u16>(Tag::Compression).ok().flatten()?;
+    let (w, h) = d.dimensions().ok()?;
+    if kind != tiff::ColorType::Gray(1) || !matches!(compression, 2 | 3) || w == 0 || h == 0 {
+        return None;
+    }
+    // The level of a 0 bit (a white run): white when white is zero (0), black when black is zero (1).
+    let zero = match d.find_tag_unsigned::<u16>(Tag::PhotometricInterpretation).ok().flatten() {
+        Some(0) => u8::MAX,
+        Some(1) => 0,
+        _ => return None,
+    };
+    if u64::from(w) * u64::from(h) > crate::MAX_RASTER_ALLOC / 4 {
+        return Some(Err(Group3Error::TooLarge { w, h }));
+    }
+    let t4_options = d.find_tag_unsigned::<u32>(Tag::Unknown(292)).ok().flatten().unwrap_or(0);
+    let lsb_first = d.find_tag_unsigned::<u16>(Tag::FillOrder).ok().flatten() == Some(2);
+    let encoding = if compression == 3 && t4_options & 1 != 0 {
+        // Each row's tag bit says how it is coded.
+        EncodingMode::Group3_2D { k: 2 }
+    } else {
+        EncodingMode::Group3_1D
+    };
+    // The width and height of each strip or tile, and the tags of their offsets and byte counts.
+    let tiled = d.get_chunk_type() == tiff::decoder::ChunkType::Tile;
+    let (cw, ch, offsets, counts) = if tiled {
+        let tw = d.find_tag_unsigned::<u32>(Tag::TileWidth).ok().flatten().filter(|&v| v > 0)?;
+        let th = d.find_tag_unsigned::<u32>(Tag::TileLength).ok().flatten().filter(|&v| v > 0)?;
+        (tw, th, Tag::TileOffsets, Tag::TileByteCounts)
+    } else {
+        let rows = d.find_tag_unsigned::<u32>(Tag::RowsPerStrip).ok().flatten().filter(|&v| v > 0).map_or(h, |r| r.min(h));
+        (w, rows, Tag::StripOffsets, Tag::StripByteCounts)
+    };
+    let damaged = |e: DecodeError| Some(Err(Group3Error::Damaged(e)));
+    // A tile is held to the allowance the image is held to; a strip is no larger than the image.
+    if u64::from(cw) * u64::from(ch) > crate::MAX_RASTER_ALLOC / 4 {
+        return damaged(DecodeError::Overflow);
+    }
+    let offsets = d.find_tag_unsigned_vec::<u64>(offsets).ok().flatten().unwrap_or_default();
+    let counts = d.find_tag_unsigned_vec::<u64>(counts).ok().flatten().unwrap_or_default();
+    let across = w.div_ceil(cw);
+    let chunks = u64::from(across) * u64::from(h.div_ceil(ch));
+    if chunks > offsets.len().min(counts.len()) as u64 {
+        return damaged(DecodeError::UnexpectedEof);
+    }
+    let mut gray = vec![zero; usize::try_from(u64::from(w) * u64::from(h)).ok()?];
+    let mut budget = bytes.len();
+    for (i, (&offset, &count)) in (0..chunks).zip(offsets.iter().zip(&counts)) {
+        let (x0, y0) = (u32::try_from(i % u64::from(across)).ok()? * cw, u32::try_from(i / u64::from(across)).ok()? * ch);
+        let Some(start) = usize::try_from(offset).ok().filter(|&s| s <= bytes.len()) else {
+            return damaged(DecodeError::UnexpectedEof);
+        };
+        let len = usize::try_from(count).unwrap_or(usize::MAX).min(bytes.len() - start).min(budget);
+        budget -= len;
+        let data = bytes.get(start..start + len)?;
+        let data: std::borrow::Cow<[u8]> = if lsb_first { data.iter().map(|b| b.reverse_bits()).collect() } else { data.into() };
+        let settings = DecodeSettings {
+            columns: cw,
+            // A tile is coded whole; the last strip only has the image's remaining rows.
+            rows: if tiled { ch } else { ch.min(h - y0) },
+            end_of_block: compression == 3,
+            end_of_line: compression == 3,
+            rows_are_byte_aligned: compression == 2,
+            encoding,
+            invert_black: false,
+        };
+        let mut rows = Rows { out: &mut gray, width: w, height: h, x0, y0, x: 0, y: 0, zero };
+        if let Err(e) = hayro_ccitt::decode(&data, &mut rows, &mut DecoderContext::new(settings)) {
+            return damaged(e);
+        }
+        // The data ended, or six EOL codes came, before the strip's or tile's last row.
+        if rows.y < settings.rows {
+            return damaged(DecodeError::UnexpectedEof);
+        }
+    }
+    let gray = image::GrayImage::from_raw(w, h, gray)?;
+    Some(Ok(image::DynamicImage::ImageLuma8(gray).to_rgba8()))
+}
+
+/// Where a strip or tile of a Group 3 TIFF ([`group3_tiff_rgba`]) puts its decoded pixels: `out`
+/// holds the image's levels row by row, `width` × `height`, and the strip or tile starts at (`x0`,
+/// `y0`). Pixels past the image's right or bottom edge (a tile's padding) are dropped.
+struct Rows<'a> {
+    out: &'a mut [u8],
+    width: u32,
+    height: u32,
+    x0: u32,
+    y0: u32,
+    /// The next pixel in the strip or tile.
+    x: u64,
+    y: u32,
+    /// The level of a white run.
+    zero: u8,
+}
+
+impl Rows<'_> {
+    /// The next `n` pixels of the row, a white run's or a black run's.
+    fn run(&mut self, white: bool, n: u64) {
+        let level = if white { self.zero } else { u8::MAX - self.zero };
+        let row = u64::from(self.y0) + u64::from(self.y);
+        let left = u64::from(self.x0) + self.x;
+        let right = left.saturating_add(n).min(u64::from(self.width));
+        if row < u64::from(self.height) && left < right {
+            let at = row * u64::from(self.width);
+            if let (Ok(a), Ok(b)) = (usize::try_from(at + left), usize::try_from(at + right))
+                && let Some(px) = self.out.get_mut(a..b)
+            {
+                px.fill(level);
+            }
+        }
+        self.x = self.x.saturating_add(n);
+    }
+}
+
+impl hayro_ccitt::Decoder for Rows<'_> {
+    fn push_pixel(&mut self, white: bool) {
+        self.run(white, 1);
+    }
+
+    fn push_pixel_chunk(&mut self, white: bool, chunk_count: u32) {
+        self.run(white, u64::from(chunk_count) * 8);
+    }
+
+    fn next_line(&mut self) {
+        self.y = self.y.saturating_add(1);
+        self.x = 0;
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

crates/engine/src/cmd/fileio/load.rs

@@ -474,6 +474,8 @@ pub(crate) fn too_large_note(bytes: &[u8]) -> Option<String> {
 /// ink are written again with their inks together ([`vectorcraft_doc::cmyk::stored_cmyk_tiff`]);
 /// CMYK TIFFs with an alpha channel, which the decoder can't read, become RGBA in the active color
 /// settings' CMYK, as do CMYK Photoshop documents, whose merged image is read ([`psdread`]).
+/// 1-bit TIFFs compressed with CCITT Group 3, which the decoder can't read either, become RGBA
+/// too ([`vectorcraft_doc::cmyk::group3_tiff_rgba`]).
 /// Grayscale TIFFs with an alpha channel or other extra channels, which the decoder can't read
 /// either, become RGBA too, whether they store their channels together or one plane per channel.
 /// A TIFF with more strips or tiles than the decoder can count
@@ -508,7 +510,10 @@ pub fn raster_image(bytes: &[u8]) -> Result<RasterImage> {
     };
     let img = match (f.id == "tiff").then(extra_samples).flatten() {
         Some(img) => img,
-        None => reader.decode().map_err(err)?.to_rgba8(),
+        None => match (f.id == "tiff").then(|| vectorcraft_doc::cmyk::group3_tiff_rgba(bytes)).flatten() {
+            Some(read) => read.map_err(err)?,
+            None => reader.decode().map_err(err)?.to_rgba8(),
+        },
     };
     as_png(img, ppi)
 }

crates/engine/src/cmd/fileio/tests.rs

@@ -208,6 +208,113 @@ fn planar_cmyk_tiffs_open_and_place_with_their_inks() {
     assert!(image::load_from_memory(&blob.bytes).is_ok(), "the image decoder reads the stored image");
 }
 
+/// A 70 × 7 picture, `true` for black: a white row and a black row (runs past 63 take a make-up
+/// code), then runs of several lengths.
+fn fax_picture() -> Vec<Vec<bool>> {
+    (0..7).map(|y| (0..70).map(|x| if y < 2 { y == 1 } else { (x * (y + 2) / 5 + y) % 3 == 0 }).collect()).collect()
+}
+
+/// The first `rows` rows of [`fax_picture`] as a TIFF compressed with CCITT Group 3 in one strip:
+/// `compression` 2 or 3 with `t4_options`, white is zero, the highest bit of each byte first.
+fn group3_tiff(compression: u16, t4_options: u32, rows: usize) -> Vec<u8> {
+    let rows = &fax_picture()[..rows];
+    let g =
+        vectorcraft_testkit::tiff::Group3 { rows, compression, t4_options, photometric: 0, fill_order: 1, rows_per_strip: 7, tile: None, rtc: false };
+    vectorcraft_testkit::tiff::group3(&g)
+}
+
+/// 1-bit TIFFs compressed with CCITT Group 3 open and place with their pixels (#1466): Compression
+/// 2 (modified Huffman) and Compression 3 (ITU-T T.4) with one-dimensional rows or two-dimensional
+/// ones (T4Options bit 0), with and without fill bits (bit 2) and six EOLs at the end, in one strip,
+/// three strips or three 32 × 16 tiles, each byte's highest or lowest bit first (FillOrder 1 and 2),
+/// white or black as zero.
+#[test]
+fn ccitt_group3_tiffs_open_and_place_with_their_pixels() {
+    let rows = fax_picture();
+    let mut s = Session::new();
+    for (compression, t4_options, rtc) in [(2, 0, false), (3, 0, false), (3, 4, true), (3, 1, false), (3, 5, true)] {
+        for (rows_per_strip, tile) in [(7, None), (3, None), (7, Some((32, 16)))] {
+            for fill_order in [1, 2] {
+                for photometric in [0, 1] {
+                    let what = format!(
+                        "Compression {compression}, T4Options {t4_options}, {rows_per_strip} rows a strip, tiles {tile:?}, FillOrder {fill_order}, photometric {photometric}"
+                    );
+                    let g = vectorcraft_testkit::tiff::Group3 {
+                        rows: &rows,
+                        compression,
+                        t4_options,
+                        photometric,
+                        fill_order,
+                        rows_per_strip,
+                        tile,
+                        rtc,
+                    };
+                    let file = vectorcraft_testkit::tiff::group3(&g);
+                    assert!(image::load_from_memory(&file).is_err(), "{what}: the image decoder reads Group 3 now");
+                    // A black run's pixels are 1 bits, which show as black when white is zero.
+                    let want: Vec<u8> = rows.concat().iter().map(|&black| if black == (photometric == 0) { 0 } else { 255 }).collect();
+                    let pixels = |s: &Session| {
+                        let blob = &s.doc().unwrap().doc.images[&image_of(s).key];
+                        image::load_from_memory(&blob.bytes).unwrap_or_else(|e| panic!("{what}: {e}")).to_luma8().into_raw()
+                    };
+                    open(&mut s, "fax.tif", &file);
+                    assert_eq!(pixels(&s), want, "{what}: Open");
+                    let mut placed = session(100.0, 100.0, 1);
+                    placed.execute("file.place", &json!({"name": "fax.tif", "dataBase64": vectorcraft_format::base64_encode(&file)})).unwrap();
+                    assert_eq!(pixels(&placed), want, "{what}: Place");
+                }
+            }
+        }
+    }
+}
+
+/// A Group 3 TIFF whose pixels would take more than the decoding allowance as RGBA is refused as
+/// too large to draw, without a panic at 2^31 × 2^31 pixels too. One whose data ends inside a row,
+/// or after a whole row before the strip's last, is refused as damaged, and so is one whose tiles
+/// are wider than the allowance.
+#[test]
+fn ccitt_group3_tiffs_too_large_or_cut_short_are_refused() {
+    // ImageWidth (the directory's first entry, its value at offset 18), ImageLength (the second, at
+    // 30) and RowsPerStrip (the eighth, at 102).
+    for (width, height) in [(70u32, 1u32 << 30), (1 << 31, 1 << 31)] {
+        let mut big = group3_tiff(3, 1, 7);
+        big[18..22].copy_from_slice(&width.to_le_bytes());
+        big[30..34].copy_from_slice(&height.to_le_bytes());
+        big[102..106].copy_from_slice(&height.to_le_bytes());
+        let e = raster_image(&big).err().expect("refused");
+        assert!(e.to_string().contains(&format!("an image of {width} × {height} pixels is too large to draw")), "{e}");
+    }
+    let mut short = group3_tiff(3, 0, 7);
+    short.truncate(short.len() - 6);
+    let e = raster_image(&short).err().expect("refused");
+    assert!(e.to_string().contains("could not decode image: unexpected end of input"), "{e}");
+    // Compression 2 rows start at a byte, so the strip of the first six rows is where the strip of
+    // seven starts. StripByteCounts (the ninth entry, its value at offset 114) gives the six rows'.
+    let (mut seven, six) = (group3_tiff(2, 0, 7), group3_tiff(2, 0, 6));
+    seven[114..118].copy_from_slice(&six[114..118]);
+    assert_eq!(seven[30..34], 7u32.to_le_bytes(), "ImageLength");
+    assert_eq!(seven[78..82], six[78..82], "StripOffsets (the sixth entry, at offset 78)");
+    let e = raster_image(&seven).err().expect("refused");
+    assert!(e.to_string().contains("could not decode image: unexpected end of input"), "{e}");
+    // A tile wider than the allowance: TileWidth (the eighth entry, its value at offset 102).
+    let rows = fax_picture();
+    let g = vectorcraft_testkit::tiff::Group3 {
+        rows: &rows,
+        compression: 3,
+        t4_options: 1,
+        photometric: 0,
+        fill_order: 1,
+        rows_per_strip: 7,
+        tile: Some((80, 16)),
+        rtc: false,
+    };
+    let mut wide = vectorcraft_testkit::tiff::group3(&g);
+    assert_eq!(wide[102..106], 80u32.to_le_bytes(), "TileWidth");
+    wide[102..106].copy_from_slice(&u32::MAX.to_le_bytes());
+    let e = raster_image(&wide).err().expect("refused");
+    assert!(e.to_string().contains("could not decode image: arithmetic overflow"), "{e}");
+}
+
 #[test]
 fn content_beats_a_wrong_extension() {
     let png = image_bytes(2, 2, image::ImageFormat::Png);

crates/engine/tests/import_fuzz.rs

@@ -1366,6 +1366,54 @@ proptest! {
     }
 }
 
+/// 1-bit TIFFs compressed with CCITT Group 3: modified Huffman (Compression 2) in three strips, T.4
+/// (Compression 3) with two-dimensional rows, fill bits, six EOLs at the end and each byte's lowest
+/// bit first, and T.4 two-dimensional rows in 16 × 16 tiles.
+fn group3_samples() -> Vec<Vec<u8>> {
+    let rows: Vec<Vec<bool>> = (0..6).map(|y| (0..40).map(|x| (x * (y + 1) / 3 + y) % 4 < 2).collect()).collect();
+    let tiff = |compression, t4_options, fill_order, rows_per_strip, tile| {
+        let rtc = compression == 3;
+        let g = vectorcraft_testkit::tiff::Group3 { rows: &rows, compression, t4_options, photometric: 0, fill_order, rows_per_strip, tile, rtc };
+        vectorcraft_testkit::tiff::group3(&g)
+    };
+    vec![tiff(2, 0, 1, 2, None), tiff(3, 5, 2, 6, None), tiff(3, 1, 1, 6, Some((16, 16)))]
+}
+
+/// [`group3_samples`] place as images.
+#[test]
+fn the_group3_samples_place() {
+    for bytes in group3_samples() {
+        let mut s = vectorcraft_engine::Session::new();
+        s.execute("file.new", &json!({"width": 100, "height": 100})).unwrap();
+        s.execute("file.place", &json!({"name": "fax.tif", "dataBase64": vectorcraft_format::base64_encode(&bytes)})).unwrap();
+    }
+}
+
+proptest! {
+    #![proptest_config(config())]
+
+    /// Mutated Group 3 TIFFs (directory values, strip offsets and counts, the coded rows) never
+    /// crash reading or placing them.
+    #[test]
+    fn mutated_group3_tiffs_place_without_panics(which in 0usize..3, cut in 0usize..400, edits in prop::collection::vec((0usize..400, any::<u8>()), 0..12)) {
+        let mut bytes = group3_samples().swap_remove(which);
+        for (at, b) in edits {
+            if let Some(x) = bytes.get_mut(at) {
+                *x = b;
+            }
+        }
+        bytes.truncate(cut.max(8));
+        let r = catch_quiet(|| {
+            let mut s = vectorcraft_engine::Session::new();
+            s.execute("file.new", &json!({"width": 100, "height": 100})).unwrap();
+            let p = json!({"name": "fax.tif", "dataBase64": vectorcraft_format::base64_encode(&bytes), "thumbnail": 8});
+            let _ = no_panic(s.execute("file.place.info", &p));
+            let _ = no_panic(s.execute("file.place", &p));
+        });
+        prop_assert!(r.is_ok(), "panicked: {:?}", r.err());
+    }
+}
+
 // ---------- SVG saved with hidden layers and editing data ----------
 
 /// The rich document with a hidden layer, saved as SVG with its editing data.

crates/testkit/Cargo.toml

@@ -21,3 +21,5 @@ kurbo = { workspace = true }
 serde_json = { workspace = true }
 proptest = { workspace = true }
 image = { workspace = true }
+# A Group 4 encoder and the T.4 run codes, to write CCITT Group 3 TIFFs (`tiff::group3`).
+fax = "0.2"

crates/testkit/src/lib.rs

@@ -12,7 +12,8 @@
 //! - [`pdf`]: hand-written PDF files (page boxes, colour spaces, encryption) for import tests.
 //! - [`ai`]: hand-written Illustrator editing data, and the EPS and `.ai` files that carry it.
 //! - [`ase`]: hand-written swatch exchange (`.ase`) files for swatch library tests.
-//! - [`tiff`]: hand-written TIFF files, chunky or planar, for image import tests.
+//! - [`tiff`]: hand-written TIFF files, chunky or planar, or compressed with CCITT Group 3, for
+//!   image import tests.
 //! - [`fonts`]: font files made from the bundled fonts (a renamed family) for font tests.
 //!
 //! This crate may only be used as a dev-dependency (enforced by `cargo xtask layers`).

crates/testkit/src/tiff.rs

@@ -1,6 +1,13 @@
 //! Hand-written TIFF files for import tests: little-endian, uncompressed, 8 or 16 bits a sample,
 //! with each pixel's samples stored together (chunky) or one plane per sample (planar,
-//! PlanarConfiguration 2) (TIFF 6.0, sections 2 and 8).
+//! PlanarConfiguration 2) (TIFF 6.0, sections 2 and 8); and 1-bit files compressed with CCITT
+//! Group 3 (ITU-T T.4; Compression 2 and 3, T4Options and FillOrder as libtiff's `tiff.h` defines
+//! them), coded by [`group3`].
+
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use fax::{BitWriter, Bits};
 
 /// One image: its channels in the order the file stores them, color first, extra samples after.
 #[derive(Clone, Debug, Default)]
@@ -32,6 +39,16 @@ fn align(out: &mut Vec<u8>) {
 /// A directory entry: its tag, field type, count and value bytes.
 type Entry = (u16, u16, usize, Vec<u8>);
 
+/// An entry of SHORT values.
+fn shorts(tag: u16, v: &[u16]) -> Entry {
+    (tag, 3, v.len(), v.iter().flat_map(|x| x.to_le_bytes()).collect())
+}
+
+/// An entry of LONG values.
+fn longs(tag: u16, v: &[u32]) -> Entry {
+    (tag, 4, v.len(), v.iter().flat_map(|x| x.to_le_bytes()).collect())
+}
+
 /// The TIFF file of `t`: the header, the directory at offset 8, the values longer than four
 /// bytes, then the image in one strip a plane.
 pub fn tiff(t: &Tiff) -> Vec<u8> {
@@ -50,8 +67,6 @@ pub fn tiff(t: &Tiff) -> Vec<u8> {
     let samples = u16::try_from(t.channels.len()).unwrap();
     let counts: Vec<u32> = strips.iter().map(|s| u32::try_from(s.len()).unwrap()).collect();
     let entries = |offsets: &[u32]| -> Vec<Entry> {
-        let shorts = |tag, v: &[u16]| (tag, 3, v.len(), v.iter().flat_map(|x| x.to_le_bytes()).collect());
-        let longs = |tag, v: &[u32]| (tag, 4, v.len(), v.iter().flat_map(|x| x.to_le_bytes()).collect());
         let rational = |tag, n: u32| (tag, 5, 1, [n.to_le_bytes(), 1u32.to_le_bytes()].concat());
         // In ascending tag order.
         let mut e = vec![
@@ -77,6 +92,12 @@ pub fn tiff(t: &Tiff) -> Vec<u8> {
         }
         e
     };
+    file(entries, strips)
+}
+
+/// The TIFF file of the directory `entries` gives for the strips' offsets, and `strips`: the
+/// header, the directory at offset 8, the values longer than four bytes, then the strips.
+fn file(entries: impl Fn(&[u32]) -> Vec<Entry>, strips: Vec<Vec<u8>>) -> Vec<u8> {
     // The strips' offsets follow from the sizes of the rest, which don't depend on them.
     let padded = |n: usize| n + n % 2;
     let sized = entries(&vec![0; strips.len()]);
@@ -114,3 +135,151 @@ pub fn tiff(t: &Tiff) -> Vec<u8> {
     assert_eq!(out.len(), at, "the strips sit where the directory says");
     out
 }
+
+/// A 1-bit image compressed with CCITT Group 3, in strips of `rows_per_strip` rows or in tiles,
+/// each coded on its own.
+#[derive(Clone, Debug)]
+pub struct Group3<'a> {
+    /// The pixels, row by row, `true` for a black run's.
+    pub rows: &'a [Vec<bool>],
+    /// Compression: 2 (modified Huffman: each row starts at a byte, no EOL codes) or 3 (T.4: an
+    /// EOL code before each row).
+    pub compression: u16,
+    /// T4Options, written with Compression 3: bit 0 codes each row after a strip's first against
+    /// the row above (two-dimensional), after a tag bit; bit 2 adds fill bits so that each EOL
+    /// code ends at a byte.
+    pub t4_options: u32,
+    /// PhotometricInterpretation: 0 white is zero, 1 black is zero.
+    pub photometric: u16,
+    /// FillOrder: 1 (written as no tag) or 2 (each byte's lowest bit first).
+    pub fill_order: u16,
+    pub rows_per_strip: u32,
+    /// Tiles of this width and height instead of strips (TileWidth, TileLength, TileOffsets and
+    /// TileByteCounts), left to right and top to bottom; their pixels past the image are white.
+    pub tile: Option<(u32, u32)>,
+    /// With Compression 3, the last strip or tile ends with six EOL codes (T.4's return to
+    /// control).
+    pub rtc: bool,
+}
+
+/// The bits a fax encoder writes, in order.
+#[derive(Clone, Default)]
+struct Written(Rc<RefCell<Vec<Bits>>>);
+
+impl BitWriter for Written {
+    type Error = std::convert::Infallible;
+
+    fn write(&mut self, bits: Bits) -> Result<(), Self::Error> {
+        self.0.borrow_mut().push(bits);
+        Ok(())
+    }
+}
+
+/// `row` as one-dimensional runs (modified Huffman), white and black in turn from a white one
+/// (ITU-T T.4 §4.1.1); runs of 64 to 1791 pixels take a make-up code.
+fn runs(row: &[bool]) -> Vec<Bits> {
+    let mut out = vec![];
+    let (mut x, mut black) = (0, false);
+    while x < row.len() {
+        let n = row[x..].iter().take_while(|b| **b == black).count();
+        let code = |n: usize| if black { fax::maps::black::encode(n as u16) } else { fax::maps::white::encode(n as u16) }.unwrap();
+        if n >= 64 {
+            out.push(code(n & !63));
+        }
+        out.push(code(n % 64));
+        (x, black) = (x + n, !black);
+    }
+    out
+}
+
+/// The coded data of the strip or tile of `g` that holds `rows`; the `last` one carries the six
+/// EOL codes [`Group3::rtc`] asks for.
+fn group3_strip(g: &Group3, rows: &[Vec<bool>], last: bool) -> Vec<u8> {
+    let two_d = g.compression == 3 && g.t4_options & 1 != 0;
+    let fill = g.compression == 3 && g.t4_options & 4 != 0;
+    let written = Written::default();
+    let mut encoder = fax::encoder::Encoder::new(written.clone());
+    let mut bits: Vec<Bits> = vec![];
+    let used = |bits: &[Bits]| bits.iter().map(|b| usize::from(b.len)).sum::<usize>();
+    let zeros = |n: usize| Bits { data: 0, len: n as u8 };
+    let eol = |bits: &mut Vec<Bits>, tag: Option<bool>| {
+        // Fill bits so that the EOL code (12 bits) ends at a byte.
+        let pad = (8 - (used(bits) + 12) % 8) % 8;
+        if fill && pad > 0 {
+            bits.push(zeros(pad));
+        }
+        bits.push(fax::maps::EOL);
+        if let Some(one_d) = tag {
+            bits.push(Bits { data: u16::from(one_d), len: 1 });
+        }
+    };
+    for (i, row) in rows.iter().enumerate() {
+        // The encoder codes each row against the one above (as T.6 and T.4's two-dimensional rows
+        // are coded), the first against a white row.
+        let at = written.0.borrow().len();
+        encoder.encode_line(row.iter().map(|b| if *b { fax::Color::Black } else { fax::Color::White }), row.len() as u16).unwrap();
+        let coded = written.0.borrow()[at..].to_vec();
+        if g.compression == 2 {
+            let pad = (8 - used(&bits) % 8) % 8;
+            if pad > 0 {
+                bits.push(zeros(pad));
+            }
+        } else {
+            eol(&mut bits, two_d.then_some(i == 0));
+        }
+        bits.extend(if two_d && i > 0 { coded } else { runs(row) });
+    }
+    if g.compression == 3 && g.rtc && last {
+        for _ in 0..6 {
+            eol(&mut bits, two_d.then_some(true));
+        }
+    }
+    let mut w = fax::VecWriter::new();
+    for b in bits {
+        w.write(b).unwrap();
+    }
+    let data = w.finish();
+    if g.fill_order == 2 { data.iter().map(|b| b.reverse_bits()).collect() } else { data }
+}
+
+/// The TIFF file of `g`, its rows coded by [`group3_strip`].
+pub fn group3(g: &Group3) -> Vec<u8> {
+    let height = u32::try_from(g.rows.len()).unwrap();
+    let width = u32::try_from(g.rows[0].len()).unwrap();
+    assert!(g.rows.iter().all(|r| r.len() == g.rows[0].len()), "every row has the same width");
+    assert!(matches!(g.compression, 2 | 3), "Compression 2 or 3");
+    let chunks: Vec<Vec<Vec<bool>>> = match g.tile {
+        Some((tw, th)) => {
+            let (across, down) = (width.div_ceil(tw), height.div_ceil(th));
+            let px = |x: u32, y: u32| g.rows.get(y as usize).and_then(|r| r.get(x as usize)).copied().unwrap_or(false);
+            let tile = |tx: u32, ty: u32| (0..th).map(|r| (0..tw).map(|c| px(tx * tw + c, ty * th + r)).collect()).collect();
+            (0..down).flat_map(|ty| (0..across).map(move |tx| (tx, ty))).map(|(tx, ty)| tile(tx, ty)).collect()
+        }
+        None => g.rows.chunks(usize::try_from(g.rows_per_strip).unwrap()).map(<[Vec<bool>]>::to_vec).collect(),
+    };
+    let strips: Vec<Vec<u8>> = chunks.iter().enumerate().map(|(i, rows)| group3_strip(g, rows, i + 1 == chunks.len())).collect();
+    let counts: Vec<u32> = strips.iter().map(|s| u32::try_from(s.len()).unwrap()).collect();
+    let entries = |offsets: &[u32]| -> Vec<Entry> {
+        // In ascending tag order.
+        let mut e =
+            vec![longs(256, &[width]), longs(257, &[height]), shorts(258, &[1]), shorts(259, &[g.compression]), shorts(262, &[g.photometric])];
+        if g.fill_order != 1 {
+            e.push(shorts(266, &[g.fill_order]));
+        }
+        if g.tile.is_none() {
+            e.push(longs(273, offsets));
+        }
+        e.push(shorts(277, &[1]));
+        if g.tile.is_none() {
+            e.extend([longs(278, &[g.rows_per_strip]), longs(279, &counts)]);
+        }
+        if g.compression == 3 {
+            e.push(longs(292, &[g.t4_options]));
+        }
+        if let Some((tw, th)) = g.tile {
+            e.extend([longs(322, &[tw]), longs(323, &[th]), longs(324, offsets), longs(325, &counts)]);
+        }
+        e
+    };
+    file(entries, strips)
+}

docs/file-format-parity.md

@@ -103,7 +103,7 @@ the app's own editing copy of a file (an EPS after its `%%EOF`, a `.ai`'s `AIPri
 | EMF / WMF | open, export | yes | yes | an oversized embedded PNG or JPEG is refused from its header, before any pixels are decoded (#1776) |
 | PSD | open, place, export | yes (merged image, every mode and depth) | yes (layered, max editability) | placing as layers (Photoshop Import Options) missing; the embedded ICC profile's tags are 4-byte aligned (#1584) |
 | PSB | open | yes (merged image) | no | |
-| PNG / JPEG / GIF / BMP / TIFF / Targa | open, export | yes (Targa: export only) | yes; TIFF is also selectable in Export for Screens and Asset Export with its existing options | Targa import missing; TIFF: grayscale with an alpha channel or other extra channels reads (#1466 in part), and so do files that store each channel as its own plane (PlanarConfiguration 2), CMYK ones with their ink amounts; CCITT Group 3 doesn't; the ICC profiles embedded in JPEG and TIFF have 4-byte aligned tags (#1584); PNG export marks its colours as sRGB (`embedIcc`, an `sRGB` chunk; no ICC profile is embedded, #2221) |
+| PNG / JPEG / GIF / BMP / TIFF / Targa | open, export | yes (Targa: export only) | yes; TIFF is also selectable in Export for Screens and Asset Export with its existing options | Targa import missing; TIFF: grayscale with an alpha channel or other extra channels reads (#1466 in part), and so do files that store each channel as its own plane (PlanarConfiguration 2), CMYK ones with their ink amounts, and 1-bit files compressed with CCITT Group 3 (Compression 2 and 3, one- and two-dimensional rows); the ICC profiles embedded in JPEG and TIFF have 4-byte aligned tags (#1584); PNG export marks its colours as sRGB (`embedIcc`, an `sRGB` chunk; no ICC profile is embedded, #2221) |
 | WebP | export (Export for Screens) | yes | yes (lossless only; lossy written lossless with a warning) | |
 | HEIC / HEIF | open, place | no | no | |
 | JPEG 2000 | open, place | no | no | |

docs/target-app-parity.md

@@ -686,8 +686,9 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
     Placed (linked) files in a `.ai`'s editing data come in as linked images in their place, each showing the low-resolution preview the file keeps of it until its file is found or relinked in the Links panel (a file found next to the document or at its path is read as the document opens). A file with them no longer falls back to its PDF part, so its guides, sublayers and hidden objects open (#1264; `crates/eps/src/import/ai/tests.rs`, `crates/engine/src/tests_links.rs`). In a file opened that way, a gradient with stops in the middle runs its whole ramp across its shape and a gradient object no longer passes its fill to the next path (#1390); text objects with an appearance keep their own text and frame, type of hidden layers stays hidden, and type on later artboards lands on its text objects (#1391); area type whose frame is too short for a line of the fallback font shows its first line, the frame made taller with a warning in the open result (#1392).
   - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export; grayscale TIFFs with an alpha channel or other extra channels place, relink and open, the alpha as the image's transparency (#1466 in part; CCITT Group 3 and planar files with extra channels are not read); PSD and PSB files open and place, linked or embedded, as their merged image in every colour mode and depth (#918). EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). PDF export writes type as real, searchable text in embedded subset fonts by default, as Illustrator's PDF presets do (Convert Text to Outlines is an option; printer's marks stay shapes), so text-heavy PDFs stay small (#733). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
   - The Open and Place dialogs list PostScript `.ps` files and `.epsf` files. A `.ps` file opens and places through the EPS reader (its first page), also when its header is only `%!`, as the `ps` format, which exports don't write (Print to PostScript does); an `.epsf` file opens and places as EPS. Copied in a file manager, these files paste as EPS, and `clipboard.importEps` also reads PostScript whose header is only `%!` (`crates/engine/src/cmd/fileio/tests_epsimport.rs`).
-  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export; grayscale TIFFs with an alpha channel or other extra channels place, relink and open, the alpha as the image's transparency (#1466 in part; CCITT Group 3 files are not read); PSD and PSB files open and place, linked or embedded, as their merged image in every colour mode and depth (#918). EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). PDF export writes type as real, searchable text in embedded subset fonts by default, as Illustrator's PDF presets do (Convert Text to Outlines is an option; printer's marks stay shapes), so text-heavy PDFs stay small (#733). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
+  - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export; grayscale TIFFs with an alpha channel or other extra channels place, relink and open, the alpha as the image's transparency (#1466 in part); PSD and PSB files open and place, linked or embedded, as their merged image in every colour mode and depth (#918). EPS import runs a PostScript Level 3 interpreter written from the PostScript Language Reference: resource categories and `resourceforall`, local and global VM (`currentglobal`/`setglobal`/`gcheck`), `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters and strings, `load` by any key, `//name` immediate names, `token`, `execform`, user paths, `cshow`, `rootfont`, `cachestatus`, colour rendering and halftone queries, file `status` and data read with `flushfile`, and `pdfmark` marks dropped (Discord feedback, #466, #469, #474). Masked images (`ImageType 3` in its three interleavings) and reusable streams are read, and an image's several data sources are read in turn, as the reference defines (procedures that read one file get their own rows: such images came in banded, #498). `restore` puts dictionaries back as they were at the `save`, so programs that count their saves in a dictionary read to their end (part of #505). Tiling patterns come in as pattern swatches, uncoloured ones too; Type 3 fonts' glyphs as their outlines, spaced by `ashow`/`widthshow`/`xshow`/`kshow`; mesh and function-based shadings (types 1, 4–7) as gradient meshes; sampled functions (type 0) and Flate/LZW predictors are read. It is tested with programs written from the specification in the ways common generators use these features; Inkscape/cairo EPS files open as vectors. When a file's PostScript still can't be read, it opens as its TIFF preview, its Windows metafile preview (as vectors) or its EPSI preview, and the warning (in the status bar, `document.open`/`app.open`/MCP `open_file` replies and `vectorcraft-cli info`) names the error, the operator that raised it and the procedures it ran in. Legacy PostScript `.ai` files (Illustrator 3–8, written with the prolog that defines their operators) keep their groups and nested groups (`u` … `U`), between and inside clipping groups; EPS and EMF/WMF import nest clips (and groups) at most 128 deep, so a hostile file can't exhaust the stack. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole). PDF export writes type as real, searchable text in embedded subset fonts by default, as Illustrator's PDF presets do (Convert Text to Outlines is an option; printer's marks stay shapes), so text-heavy PDFs stay small (#733). DXF export writes each fill as its outlines followed by its hatch, so laser and cutter software, which skips hatches, gets filled art and type too (#546).
   - TIFFs that store each channel as its own plane (PlanarConfiguration 2) place, relink and open as the same image stored pixel by pixel does, 8 and 16 bits: grayscale with an alpha channel or other extra channels, and CMYK with or without them. A planar CMYK TIFF keeps its ink amounts and is stored as a CMYK TIFF with each pixel's inks together, at the file's resolution. A TIFF whose header claims more strips or tiles than can be counted is refused as too large to draw (#1466 in part; `crates/engine/src/cmd/fileio/tests.rs`).
+  - 1-bit TIFFs compressed with CCITT Group 3 (ITU-T T.4) place, relink and open: Compression 2 (modified Huffman) and Compression 3 with one-dimensional rows or, with T4Options bit 0, two-dimensional ones, with or without fill bits, in strips or tiles, with either FillOrder and either polarity. Rows in T.4's uncompressed mode are not read. A file whose pixels would take more than the decoding allowance as RGBA is refused as too large to draw (#1466 in part; `crates/engine/src/cmd/fileio/tests.rs`).
   - EPS and PostScript import keeps a CMYK image's ink amounts, as PDF import does: the samples of `image` and `colorimage` in a CMYK color space, and of a CMYK JPEG read through `DCTDecode`, come in as a CMYK TIFF, read through the image's Decode array, and the pixels a `MaskColor` or `ImageType 3` mask hides become a grayscale opacity mask (`crates/eps/src/import/tests_images.rs`). Such images came in as RGB PNGs.
   - EPS and PostScript import reads image data through `CCITTFaxDecode`: Group 4 (ITU-T T.6) and Group 3 one-dimensional and mixed (ITU-T T.4) data, with the filter's `K`, `Columns`, `Rows`, `EndOfBlock`, `EndOfLine`, `EncodedByteAlign` and `BlackIs1` parameters, decodes to 1-bit rows for `image` and `imagemask`. Damaged data keeps the rows decoded before it (damage in the first row is a PostScript `ioerror`), and parameters out of range or past the 256 MiB limit on decoded data are refused (`crates/eps/src/import/tests_images.rs`). Reading such a file stopped at an error naming the filter, and the file opened from a fallback, such as its preview or the art drawn before the image, or did not open.
   - DXF control-point SPLINE import honors its closed flag (#1299 follow-up after #1320 fixed export), including rational curves; open curves whose endpoints meet stay open. Own-fixture regressions cover controls/knots, fit-point fallback and all export versions (`crates/cad/src/import/tests.rs`, `crates/cad/src/tests.rs`); native save/read checked; CIRCLE/ARC fitting, CNC preset and VCarve QA remain pending.