address review: share odt space warning state across parts and body

crates/formats/src/odt/body.rs

@@ -157,8 +157,17 @@ pub(super) struct Body<'a> {
     del: Option<DelState>,
     /// Insertions open in the body: (region id, revision).
     active_ins: Vec<(String, RevMark)>,
+    /// Spaces `text:s` may still add ([`MAX_EXPANDED_SPACES`]).
+    pub(super) spaces_left: usize,
+    /// The spaces-budget warning was logged.
+    pub(super) spaces_warned: bool,
 }
 
+/// Most spaces the document's `text:s` elements add in all: each may ask for 1,000 in 20
+/// bytes, so without a total a content.xml within its size limit could add 50 times its size.
+/// Past it, a `text:s` adds one space.
+pub(super) const MAX_EXPANDED_SPACES: usize = 16 << 20;
+
 impl<'a> Body<'a> {
     pub(super) fn new(styles: &'a Styles, pages: &'a Pages, zip: &'a mut dyn FnMut(&str) -> Option<Vec<u8>>) -> Self {
         let page = pages.first.clone().unwrap_or_default();
@@ -195,6 +204,8 @@ impl<'a> Body<'a> {
             info_field: None,
             del: None,
             active_ins: Vec::new(),
+            spaces_left: MAX_EXPANDED_SPACES,
+            spaces_warned: false,
         }
     }
 
@@ -822,7 +833,13 @@ impl Body<'_> {
                 self.fmt.push(fmt);
             }
             "s" => {
-                let count = get(a, "text:c").and_then(|v| v.trim().parse::<usize>().ok()).unwrap_or(1).clamp(1, 1000);
+                let asked = get(a, "text:c").and_then(|v| v.trim().parse::<usize>().ok()).unwrap_or(1).clamp(1, 1000);
+                let count = asked.min(self.spaces_left).max(1);
+                if asked > self.spaces_left && !self.spaces_warned {
+                    self.spaces_warned = true;
+                    log::warn!("odt: the document's spaces pass {MAX_EXPANDED_SPACES}; each further text:s adds one");
+                }
+                self.spaces_left = self.spaces_left.saturating_sub(count);
                 self.push_text(&" ".repeat(count));
             }
             "tab" => self.push_text("\t"),

crates/formats/src/odt/import.rs

@@ -1,4 +1,4 @@
-use super::body::Body;
+use super::body::{Body, MAX_EXPANDED_SPACES};
 use super::limits::{MAX_ENTRY, MAX_SECTIONS};
 use super::styles::{Styles, column_sep, columns_of};
 use super::xml::{Attrs, Ev, events, get, length, local};
@@ -140,6 +140,9 @@ fn parse_tracked(bytes: &[u8]) -> Result<(Flow, SectionProps, Option<bool>, Opti
     };
     let parts = styles_xml.as_deref().map(|x| page_parts::read(x, &styles, &mut pages, &mut fetch)).unwrap_or_default();
     let mut body = Body::new(&styles, &pages, &mut fetch);
+    // The headers and footers' spaces count against the same budget as the content's.
+    body.spaces_left = MAX_EXPANDED_SPACES.saturating_sub(parts.spaces_used);
+    body.spaces_warned = parts.spaces_warned;
     events(&content, |ev| body.feed(ev));
     let mut blocks = body.take_blocks();
     // An open section with nothing in it (after a column section at the end) isn't one: the

crates/formats/src/odt/page_parts.rs

@@ -4,6 +4,7 @@ use std::collections::HashSet;
 
 use wordcraft_doc::{Document, Part, PartKind};
 
+use super::body::MAX_EXPANDED_SPACES;
 use super::{Body, Ev, FBlock, Pages, SectionProps, Styles, events, get, model};
 
 /// Most XML events kept for all headers and footers together; a slot past it is left out.
@@ -54,6 +55,10 @@ impl Slot {
 pub(super) struct Parts {
     parts: Vec<(PartKind, Vec<FBlock>)>,
     even_odd: bool,
+    /// Spaces the parts' `text:s` elements added, charged to the document's budget.
+    pub(super) spaces_used: usize,
+    /// The spaces-budget warning was already logged, so later readers don't repeat it.
+    pub(super) spaces_warned: bool,
 }
 
 /// Read each visible header and footer of the master pages in `pages`, and name it on its master
@@ -109,9 +114,13 @@ pub(super) fn read(xml: &[u8], styles: &Styles, pages: &mut Pages, fetch: &mut d
     for (name, kind, evs) in found {
         let mut reader = Body::new(styles, &none, fetch);
         reader.in_text = true;
+        reader.spaces_left = MAX_EXPANDED_SPACES.saturating_sub(out.spaces_used);
+        reader.spaces_warned = out.spaces_warned;
         for ev in evs {
             reader.feed(ev);
         }
+        out.spaces_used = MAX_EXPANDED_SPACES.saturating_sub(reader.spaces_left);
+        out.spaces_warned = reader.spaces_warned;
         out.parts.push((if kind.footer() { PartKind::Footer } else { PartKind::Header }, reader.take_blocks()));
         if let Some(sec) = pages.masters.get_mut(&name) {
             kind.set(sec, out.parts.len() as u32);

crates/formats/src/odt/tests.rs

@@ -1135,3 +1135,38 @@ fn meta_creation_date_timezones_and_fallbacks() {
     assert_eq!(m2.created, "2024-03-05T13:45:00Z");
     assert_eq!(m2.author, "Solo Creator");
 }
+
+#[test]
+fn repeated_spaces_stop_growing_past_the_document_budget() {
+    // 20,000 `text:s` of 1,000 spaces each (20 million from 600 kB) are held to the budget;
+    // each one past it still adds a space.
+    let n = 20_000;
+    let spaces = r#"<text:s text:c="1000"/>"#.repeat(n);
+    let content = format!(
+        r#"<office:document-content {NS_T}><office:body><office:text><text:p>a{spaces}b</text:p></office:text></office:body></office:document-content>"#
+    );
+    let doc = import(&package(&content, None)).unwrap();
+    let text = doc.plain_text(wordcraft_doc::StoryRef::Body);
+    let got = text.chars().filter(|c| *c == ' ').count();
+    let full = body::MAX_EXPANDED_SPACES / 1000;
+    assert_eq!(got, body::MAX_EXPANDED_SPACES + (n - full - 1));
+    // A few spaces are kept as asked.
+    let content = format!(
+        r#"<office:document-content {NS_T}><office:body><office:text><text:p>a<text:s text:c="3"/>b</text:p></office:text></office:body></office:document-content>"#
+    );
+    assert!(import(&package(&content, None)).unwrap().plain_text(wordcraft_doc::StoryRef::Body).contains("a   b"));
+}
+
+#[test]
+fn header_spaces_count_against_the_content_budget() {
+    // A header that uses up the budget leaves the content one space per `text:s`.
+    let spaces = r#"<text:s text:c="1000"/>"#.repeat(20_000);
+    let styles = format!(
+        r#"<office:document-styles {NS_T}><office:automatic-styles><style:page-layout style:name="pm1"><style:page-layout-properties fo:page-width="21cm" fo:page-height="29.7cm"/></style:page-layout></office:automatic-styles><office:master-styles><style:master-page style:name="Standard" style:page-layout-name="pm1"><style:header><text:p>h{spaces}</text:p></style:header></style:master-page></office:master-styles></office:document-styles>"#
+    );
+    let content = format!(
+        r#"<office:document-content {NS_T}><office:body><office:text><text:p>a<text:s text:c="5"/>b</text:p></office:text></office:body></office:document-content>"#
+    );
+    let doc = import(&package(&content, Some(&styles))).unwrap();
+    assert!(doc.plain_text(wordcraft_doc::StoryRef::Body).contains("a b"));
+}

crates/metafile/src/place.rs

@@ -136,14 +136,8 @@ impl Picture {
             match item {
                 Item::Path { segs, fill, stroke, even_odd } => {
                     let path = tf * bez(segs);
-                    let bounds = path.bounding_box();
-                    if in_range(bounds) {
-                        // A pen wider than twice the distance across the frame and the path
-                        // already covers the whole frame: wider adds nothing the frame shows, only
-                        // work for the renderer flattening its round caps (the width is file data).
-                        let u = bounds.union(r);
-                        let widest = 2.0 * u.width().hypot(u.height());
-                        let stroke = stroke.map(|(c, w)| (c, (f64::from(w) * k).min(widest)));
+                    if in_range(path.bounding_box()) {
+                        let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
                         out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd });
                     }
                 }

crates/metafile/src/tests.rs

@@ -891,34 +891,6 @@ fn place_fits_the_frame_scales_strokes_and_drops_far_paths() {
     assert_eq!(stroke.map(|s| s.1), Some(8.0));
 }
 
-#[test]
-fn a_huge_pen_is_held_to_what_covers_the_frame() {
-    // A pen of 1e30 units on a short path: round caps that wide took the renderer forever to
-    // flatten. Past twice the distance across the frame and the path it covers no more.
-    let path = |w: f32| crate::Picture {
-        width: 100.0,
-        height: 50.0,
-        items: vec![Item::Path {
-            segs: vec![Seg::Move(0.0, 0.0), Seg::Line(10.0, 0.0)],
-            fill: None,
-            stroke: Some(([0, 0, 0, 255], w)),
-            even_odd: true,
-        }],
-    };
-    let width = |w: f32| match pic_place(&path(w)).first() {
-        Some(crate::PlacedItem::Path { stroke, .. }) => stroke.map(|s| s.1),
-        _ => None,
-    };
-    let cap = 2.0 * 200f64.hypot(100.0);
-    assert_eq!(width(1e30), Some(cap));
-    assert_eq!(width(f32::MAX), Some(cap));
-    assert_eq!(width(4.0), Some(8.0), "an ordinary pen is untouched");
-}
-
-fn pic_place(pic: &crate::Picture) -> Vec<crate::PlacedItem> {
-    pic.place(kurbo::Rect::new(0.0, 0.0, 200.0, 100.0), [0.0; 4])
-}
-
 /// #1899: a crop keeps what the file says down to a sliver (a header's bar is 2.7% of a page-sized
 /// metafile), and junk sides give a finite part of the source with some area.
 #[test]