address review: share odt space warning state across parts and body

crates/formats/src/odt/body.rs

@@ -157,8 +157,17 @@ pub(super) struct Body<'a> {
     del: Option<DelState>,
     /// Insertions open in the body: (region id, revision).
     active_ins: Vec<(String, RevMark)>,
+    /// Spaces `text:s` may still add ([`MAX_EXPANDED_SPACES`]).
+    pub(super) spaces_left: usize,
+    /// The spaces-budget warning was logged.
+    pub(super) spaces_warned: bool,
 }
 
+/// Most spaces the document's `text:s` elements add in all: each may ask for 1,000 in 20
+/// bytes, so without a total a content.xml within its size limit could add 50 times its size.
+/// Past it, a `text:s` adds one space.
+pub(super) const MAX_EXPANDED_SPACES: usize = 16 << 20;
+
 impl<'a> Body<'a> {
     pub(super) fn new(styles: &'a Styles, pages: &'a Pages, zip: &'a mut dyn FnMut(&str) -> Option<Vec<u8>>) -> Self {
         let page = pages.first.clone().unwrap_or_default();
@@ -195,6 +204,8 @@ impl<'a> Body<'a> {
             info_field: None,
             del: None,
             active_ins: Vec::new(),
+            spaces_left: MAX_EXPANDED_SPACES,
+            spaces_warned: false,
         }
     }
 
@@ -822,7 +833,13 @@ impl Body<'_> {
                 self.fmt.push(fmt);
             }
             "s" => {
-                let count = get(a, "text:c").and_then(|v| v.trim().parse::<usize>().ok()).unwrap_or(1).clamp(1, 1000);
+                let asked = get(a, "text:c").and_then(|v| v.trim().parse::<usize>().ok()).unwrap_or(1).clamp(1, 1000);
+                let count = asked.min(self.spaces_left).max(1);
+                if asked > self.spaces_left && !self.spaces_warned {
+                    self.spaces_warned = true;
+                    log::warn!("odt: the document's spaces pass {MAX_EXPANDED_SPACES}; each further text:s adds one");
+                }
+                self.spaces_left = self.spaces_left.saturating_sub(count);
                 self.push_text(&" ".repeat(count));
             }
             "tab" => self.push_text("\t"),

crates/formats/src/odt/import.rs

@@ -1,4 +1,4 @@
-use super::body::Body;
+use super::body::{Body, MAX_EXPANDED_SPACES};
 use super::limits::{MAX_ENTRY, MAX_SECTIONS};
 use super::styles::{Styles, column_sep, columns_of};
 use super::xml::{Attrs, Ev, events, get, length, local};
@@ -140,6 +140,9 @@ fn parse_tracked(bytes: &[u8]) -> Result<(Flow, SectionProps, Option<bool>, Opti
     };
     let parts = styles_xml.as_deref().map(|x| page_parts::read(x, &styles, &mut pages, &mut fetch)).unwrap_or_default();
     let mut body = Body::new(&styles, &pages, &mut fetch);
+    // The headers and footers' spaces count against the same budget as the content's.
+    body.spaces_left = MAX_EXPANDED_SPACES.saturating_sub(parts.spaces_used);
+    body.spaces_warned = parts.spaces_warned;
     events(&content, |ev| body.feed(ev));
     let mut blocks = body.take_blocks();
     // An open section with nothing in it (after a column section at the end) isn't one: the

crates/formats/src/odt/page_parts.rs

@@ -4,6 +4,7 @@ use std::collections::HashSet;
 
 use wordcraft_doc::{Document, Part, PartKind};
 
+use super::body::MAX_EXPANDED_SPACES;
 use super::{Body, Ev, FBlock, Pages, SectionProps, Styles, events, get, model};
 
 /// Most XML events kept for all headers and footers together; a slot past it is left out.
@@ -54,6 +55,10 @@ impl Slot {
 pub(super) struct Parts {
     parts: Vec<(PartKind, Vec<FBlock>)>,
     even_odd: bool,
+    /// Spaces the parts' `text:s` elements added, charged to the document's budget.
+    pub(super) spaces_used: usize,
+    /// The spaces-budget warning was already logged, so later readers don't repeat it.
+    pub(super) spaces_warned: bool,
 }
 
 /// Read each visible header and footer of the master pages in `pages`, and name it on its master
@@ -109,9 +114,13 @@ pub(super) fn read(xml: &[u8], styles: &Styles, pages: &mut Pages, fetch: &mut d
     for (name, kind, evs) in found {
         let mut reader = Body::new(styles, &none, fetch);
         reader.in_text = true;
+        reader.spaces_left = MAX_EXPANDED_SPACES.saturating_sub(out.spaces_used);
+        reader.spaces_warned = out.spaces_warned;
         for ev in evs {
             reader.feed(ev);
         }
+        out.spaces_used = MAX_EXPANDED_SPACES.saturating_sub(reader.spaces_left);
+        out.spaces_warned = reader.spaces_warned;
         out.parts.push((if kind.footer() { PartKind::Footer } else { PartKind::Header }, reader.take_blocks()));
         if let Some(sec) = pages.masters.get_mut(&name) {
             kind.set(sec, out.parts.len() as u32);

crates/formats/src/odt/tests.rs

@@ -1135,3 +1135,38 @@ fn meta_creation_date_timezones_and_fallbacks() {
     assert_eq!(m2.created, "2024-03-05T13:45:00Z");
     assert_eq!(m2.author, "Solo Creator");
 }
+
+#[test]
+fn repeated_spaces_stop_growing_past_the_document_budget() {
+    // 20,000 `text:s` of 1,000 spaces each (20 million from 600 kB) are held to the budget;
+    // each one past it still adds a space.
+    let n = 20_000;
+    let spaces = r#"<text:s text:c="1000"/>"#.repeat(n);
+    let content = format!(
+        r#"<office:document-content {NS_T}><office:body><office:text><text:p>a{spaces}b</text:p></office:text></office:body></office:document-content>"#
+    );
+    let doc = import(&package(&content, None)).unwrap();
+    let text = doc.plain_text(wordcraft_doc::StoryRef::Body);
+    let got = text.chars().filter(|c| *c == ' ').count();
+    let full = body::MAX_EXPANDED_SPACES / 1000;
+    assert_eq!(got, body::MAX_EXPANDED_SPACES + (n - full - 1));
+    // A few spaces are kept as asked.
+    let content = format!(
+        r#"<office:document-content {NS_T}><office:body><office:text><text:p>a<text:s text:c="3"/>b</text:p></office:text></office:body></office:document-content>"#
+    );
+    assert!(import(&package(&content, None)).unwrap().plain_text(wordcraft_doc::StoryRef::Body).contains("a   b"));
+}
+
+#[test]
+fn header_spaces_count_against_the_content_budget() {
+    // A header that uses up the budget leaves the content one space per `text:s`.
+    let spaces = r#"<text:s text:c="1000"/>"#.repeat(20_000);
+    let styles = format!(
+        r#"<office:document-styles {NS_T}><office:automatic-styles><style:page-layout style:name="pm1"><style:page-layout-properties fo:page-width="21cm" fo:page-height="29.7cm"/></style:page-layout></office:automatic-styles><office:master-styles><style:master-page style:name="Standard" style:page-layout-name="pm1"><style:header><text:p>h{spaces}</text:p></style:header></style:master-page></office:master-styles></office:document-styles>"#
+    );
+    let content = format!(
+        r#"<office:document-content {NS_T}><office:body><office:text><text:p>a<text:s text:c="5"/>b</text:p></office:text></office:body></office:document-content>"#
+    );
+    let doc = import(&package(&content, Some(&styles))).unwrap();
+    assert!(doc.plain_text(wordcraft_doc::StoryRef::Body).contains("a b"));
+}