fix(render): refuse paths with non-finite points too

crates/docx/src/write/math.rs

@@ -179,18 +179,9 @@ fn char_prop(w: &mut W, name: &str, c: Option<char>) {
     val(w, name, &s);
 }
 
-/// Most cells a matrix is padded out to (rows × its widest row). A ragged matrix past it (a
-/// native document's, or one parsed from a few bytes of text) writes each row as it is, rather
-/// than output that grows with the square of its size.
-const MAX_PADDED_CELLS: usize = 1 << 20;
-
 fn write_matrix(w: &mut W, n: &MNode, depth: usize) {
     let MNode::Matrix { rows, col_jc } = n else { return };
     let cols = rows.iter().map(|r| r.len()).max().unwrap_or(0).max(1);
-    let pad = rows.len().saturating_mul(cols) <= MAX_PADDED_CELLS;
-    if !pad {
-        log::warn!("docx: a {} × {cols} matrix is too large to pad; its rows are written as they are", rows.len());
-    }
     w.open("m:m", &[]);
     w.open("m:mPr", &[]);
     w.open("m:mcs", &[]);
@@ -212,7 +203,7 @@ fn write_matrix(w: &mut W, n: &MNode, depth: usize) {
     w.close("m:mPr");
     for row in rows {
         w.open("m:mr", &[]);
-        for c in 0..if pad { cols } else { row.len().max(1) } {
+        for c in 0..cols {
             arg(w, "m:e", row.get(c).map(|v| v.as_slice()).unwrap_or(&[]), depth);
         }
         w.close("m:mr");
@@ -489,24 +480,3 @@ fn run(w: &mut W, r: &MRun) {
     w.leaf("m:t", &[("xml:space", "preserve")], &r.text);
     w.close("m:r");
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn cells(rows: Vec<Vec<Arg>>) -> usize {
-        let mut w = W::new();
-        write_matrix(&mut w, &MNode::Matrix { rows, col_jc: Vec::new() }, 0);
-        w.s.matches("<m:e/>").count() + w.s.matches("<m:e>").count()
-    }
-
-    #[test]
-    fn a_ragged_matrix_is_padded_within_a_cell_budget() {
-        // A small ragged matrix is padded to a rectangle, as before.
-        assert_eq!(cells(vec![vec![Vec::new(); 3], vec![Vec::new()]]), 6);
-        // 2,000 one-cell rows and one 2,000-cell row: 4 million cells padded, past the budget.
-        let mut rows = vec![vec![Vec::new()]; 2000];
-        rows.push(vec![Vec::new(); 2000]);
-        assert_eq!(cells(rows), 4000);
-    }
-}

crates/render/src/lib.rs

@@ -836,10 +836,22 @@ fn draw_image(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     }
 }
 
+/// Widest path drawn, in device pixels a side: 64 times the largest canvas. The rasteriser
+/// flattens a curve into as many points as its size asks for, before clipping, so a path with
+/// coordinates of 1e15 (file data in a native document) would take it forever or run out of
+/// memory; one this far past every canvas shows nothing a real drawing would.
+const MAX_PATH_PIXELS: f64 = 1_048_576.0;
+
+/// Whether `path` under `view` is small enough to draw ([`MAX_PATH_PIXELS`]) and finite.
+fn path_extent_ok(view: Affine, path: &kurbo::BezPath) -> bool {
+    let b = view.transform_rect_bbox(path.bounding_box());
+    path.is_finite() && [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_PATH_PIXELS)
+}
+
 fn draw_path(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     let Draw::Path { segs, fill, stroke, stroke_width, dash, cap } = it else { return };
     let path = wordcraft_layout::display::seg_path(segs);
-    if path.elements().is_empty() {
+    if path.elements().is_empty() || !path_extent_ok(fr.view, &path) {
         return;
     }
     ctx.set_transform(fr.view);

crates/render/src/tests.rs

@@ -1318,3 +1318,18 @@ fn a_line_runs_from_top_left_to_bottom_right() {
     let p = shape_path(ShapeKind::Line, kurbo::Rect::new(10.0, 20.0, 30.0, 60.0), None);
     assert_eq!(p.elements(), &[kurbo::PathEl::MoveTo((10.0, 20.0).into()), kurbo::PathEl::LineTo((30.0, 60.0).into())]);
 }
+
+#[test]
+fn paths_far_past_every_canvas_are_not_flattened() {
+    let line = |x: f64| {
+        let mut p = kurbo::BezPath::new();
+        p.move_to((0.0, 0.0));
+        p.curve_to((x, 0.0), (x, x), (0.0, x));
+        p
+    };
+    assert!(path_extent_ok(Affine::IDENTITY, &line(500.0)));
+    assert!(path_extent_ok(Affine::scale(4.0), &line(200_000.0)), "a large page at a high zoom");
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(1e15)));
+    assert!(!path_extent_ok(Affine::scale(1e12), &line(10.0)));
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(f64::NAN)));
+}