fix(render): refuse paths with non-finite points too

crates/pdf/src/export.rs

@@ -77,7 +77,6 @@ fn write_attempt(doc: &Document, lay: &DocLayout, opts: &PdfOptions, pages: &[us
         cmaps: HashMap::new(),
         images: HashMap::new(),
         vectors: HashMap::new(),
-        vector_bytes_left: crate::exporter::MAX_CACHED_VECTOR_BYTES,
         tags: Vec::new(),
         tag_index: HashMap::new(),
         links: Vec::new(),

crates/pdf/src/exporter.rs

@@ -15,9 +15,6 @@ mod draw;
 mod nav;
 mod text;
 
-/// Most bytes of parsed metafiles (geometry, text and pixels) one export keeps between pages.
-pub(crate) const MAX_CACHED_VECTOR_BYTES: usize = 256 << 20;
-
 pub(crate) struct Exporter<'a> {
     pub(crate) doc: &'a Document,
     pub(crate) lay: &'a DocLayout,
@@ -33,8 +30,6 @@ pub(crate) struct Exporter<'a> {
     pub(crate) images: HashMap<String, Option<Image>>,
     /// Parsed metafiles by media key (`None`: not readable).
     pub(crate) vectors: HashMap<String, Option<Arc<Vector>>>,
-    /// Bytes of parsed metafiles `vectors` may still keep ([`MAX_CACHED_VECTOR_BYTES`]).
-    pub(crate) vector_bytes_left: usize,
     pub(crate) tags: Vec<TagEntry>,
     pub(crate) tag_index: HashMap<(StoryRef, DocPath), usize>,
     /// Link rectangles on the current page: (x0, y0, x1, y1, target).
@@ -89,7 +84,7 @@ impl Exporter<'_> {
 
     /// The metafile picture for a media key, parsed once. None when the bytes are not a metafile
     /// (the raster path takes them) or do not parse (the raster path then draws the grey box).
-    pub(crate) fn vector(&mut self, key: &str) -> Option<Arc<Vector>> {
+    fn vector(&mut self, key: &str) -> Option<Arc<Vector>> {
         let doc = self.doc;
         let bytes = doc.media.get(key)?;
         if !wordcraft_metafile::is_metafile(bytes) {
@@ -102,16 +97,7 @@ impl Exporter<'_> {
         if v.is_none() {
             log::warn!("PDF: metafile `{key}` could not be read");
         }
-        // Kept for the pages that draw it again while the cache has room; past that it is parsed
-        // again when it is next drawn, rather than every metafile's geometry piling up.
-        let size = v.as_ref().map_or(0, |v| v.heap_bytes());
-        match self.vector_bytes_left.checked_sub(size) {
-            Some(left) => {
-                self.vector_bytes_left = left;
-                self.vectors.insert(key.to_string(), v.clone());
-            }
-            None => log::debug!("PDF: metafile `{key}` ({size} bytes parsed) is not kept between pages"),
-        }
+        self.vectors.insert(key.to_string(), v.clone());
         v
     }
 

crates/pdf/src/picture.rs

@@ -14,23 +14,6 @@ pub(crate) struct Vector {
     images: Vec<Option<Image>>,
 }
 
-impl Vector {
-    /// Bytes the parsed picture holds: its paths' segments, its text and its bitmaps' pixels.
-    pub(crate) fn heap_bytes(&self) -> usize {
-        let item = |it: &wordcraft_metafile::Item| match it {
-            wordcraft_metafile::Item::Path { segs, .. } => segs.len().saturating_mul(std::mem::size_of::<wordcraft_metafile::Seg>()),
-            wordcraft_metafile::Item::Bitmap { width, height, .. } => (*width as usize).saturating_mul(*height as usize).saturating_mul(4),
-            wordcraft_metafile::Item::Text(t) => t.text.len().saturating_add(t.font.len()),
-        };
-        let items = self
-            .pic
-            .items
-            .iter()
-            .fold(self.pic.items.len().saturating_mul(std::mem::size_of::<wordcraft_metafile::Item>()), |n, it| n.saturating_add(item(it)));
-        items.saturating_add(self.images.len().saturating_mul(std::mem::size_of::<Option<Image>>()))
-    }
-}
-
 /// Parses a metafile and embeds its bitmaps. None when the picture has no usable size.
 pub(crate) fn build_vector(bytes: &[u8]) -> Option<Vector> {
     let mut pic = wordcraft_metafile::parse(bytes).ok()?;

crates/pdf/src/tests.rs

@@ -1367,7 +1367,6 @@ fn bookmark_destination_is_the_page_of_its_start() {
         cmaps: HashMap::new(),
         images: HashMap::new(),
         vectors: HashMap::new(),
-        vector_bytes_left: crate::exporter::MAX_CACHED_VECTOR_BYTES,
         tags: Vec::new(),
         tag_index: HashMap::new(),
         links: Vec::new(),
@@ -2489,37 +2488,3 @@ fn baseline_is_the_most_shared_y() {
     assert_eq!(baseline(&[(1, 0.0, 9.0), (2, 3.0, 4.0)]), Some(4.0));
     assert_eq!(baseline(&[(1, 0.0, -0.0), (2, 3.0, 0.0)]), Some(0.0));
 }
-
-#[test]
-fn parsed_metafiles_are_kept_only_within_the_cache_budget() {
-    let mut d = Document::new();
-    let media = d.add_media(red_right_half_emf(), "emf");
-    let lay = layout(&d, &mut LayoutCache::new(), &LayoutOptions::default());
-    let outlined = HashSet::new();
-    let mut ex = Exporter {
-        doc: &d,
-        lay: &lay,
-        opts: &PdfOptions::default(),
-        out_index: HashMap::new(),
-        fonts: HashMap::new(),
-        font_error: None,
-        outlined: &outlined,
-        cmaps: HashMap::new(),
-        images: HashMap::new(),
-        vectors: HashMap::new(),
-        vector_bytes_left: crate::exporter::MAX_CACHED_VECTOR_BYTES,
-        tags: Vec::new(),
-        tag_index: HashMap::new(),
-        links: Vec::new(),
-        bookmarks: std::cell::OnceCell::new(),
-    };
-    let v = ex.vector(&media).expect("parses");
-    assert!(v.heap_bytes() > 0);
-    assert_eq!(ex.vectors.len(), 1, "kept while the budget has room");
-    assert_eq!(ex.vector_bytes_left, crate::exporter::MAX_CACHED_VECTOR_BYTES - v.heap_bytes());
-    // With the budget spent, a metafile is still drawn, just not kept.
-    ex.vectors.clear();
-    ex.vector_bytes_left = 0;
-    assert!(ex.vector(&media).is_some());
-    assert!(ex.vectors.is_empty());
-}

crates/render/src/lib.rs

@@ -836,10 +836,22 @@ fn draw_image(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     }
 }
 
+/// Widest path drawn, in device pixels a side: 64 times the largest canvas. The rasteriser
+/// flattens a curve into as many points as its size asks for, before clipping, so a path with
+/// coordinates of 1e15 (file data in a native document) would take it forever or run out of
+/// memory; one this far past every canvas shows nothing a real drawing would.
+const MAX_PATH_PIXELS: f64 = 1_048_576.0;
+
+/// Whether `path` under `view` is small enough to draw ([`MAX_PATH_PIXELS`]) and finite.
+fn path_extent_ok(view: Affine, path: &kurbo::BezPath) -> bool {
+    let b = view.transform_rect_bbox(path.bounding_box());
+    path.is_finite() && [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_PATH_PIXELS)
+}
+
 fn draw_path(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     let Draw::Path { segs, fill, stroke, stroke_width, dash, cap } = it else { return };
     let path = wordcraft_layout::display::seg_path(segs);
-    if path.elements().is_empty() {
+    if path.elements().is_empty() || !path_extent_ok(fr.view, &path) {
         return;
     }
     ctx.set_transform(fr.view);

crates/render/src/tests.rs

@@ -1318,3 +1318,18 @@ fn a_line_runs_from_top_left_to_bottom_right() {
     let p = shape_path(ShapeKind::Line, kurbo::Rect::new(10.0, 20.0, 30.0, 60.0), None);
     assert_eq!(p.elements(), &[kurbo::PathEl::MoveTo((10.0, 20.0).into()), kurbo::PathEl::LineTo((30.0, 60.0).into())]);
 }
+
+#[test]
+fn paths_far_past_every_canvas_are_not_flattened() {
+    let line = |x: f64| {
+        let mut p = kurbo::BezPath::new();
+        p.move_to((0.0, 0.0));
+        p.curve_to((x, 0.0), (x, x), (0.0, x));
+        p
+    };
+    assert!(path_extent_ok(Affine::IDENTITY, &line(500.0)));
+    assert!(path_extent_ok(Affine::scale(4.0), &line(200_000.0)), "a large page at a high zoom");
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(1e15)));
+    assert!(!path_extent_ok(Affine::scale(1e12), &line(10.0)));
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(f64::NAN)));
+}