Merge remote-tracking branch 'origin/main' into HEAD

; Conflicts:
;	ROADMAP.md

ROADMAP.md

@@ -258,6 +258,9 @@ Ranked, to beta (detail and remaining milestones in [docs/roadmap.md](docs/roadm
 - 2026-11-03: Security: LaTeX import parses at most 63 cells of a `tabular` row (what a table row keeps), so a very wide row can no longer widen the multirow tracking that every later row walks. Readiness unchanged.
 - 2026-11-03: Security: XLSX and ODS import (mail merge recipient lists) keep each cell's character count as text is added, instead of counting the whole cell again for every piece of text, so a full cell followed by many small text events no longer costs its length each time. Readiness unchanged.
 - 2026-11-03: Security: exported hyperlinks (ODT, LaTeX, HTML, Markdown, RTF) holding a control character or noncharacter that the writer drops are written as plain text, so `file\u{85}:///…` can't pass the link check and come out as a `file:` link. Readiness unchanged.
+- 2026-11-03: Security: pictures are measured, and checked for transparency for tight text wrapping, from a PNG's chunk headers, instead of through the decoder, whose header read inflates an embedded ICC profile of up to 512 MiB for every picture it only measures. Readiness unchanged.
+- 2026-11-03: Security: saving an embedded object (a native document's kept markup included) collects the relationship ids its markup uses in a set and checks them against the writable ones in one pass, instead of scanning every id collected so far for each attribute. Readiness unchanged.
+- 2026-11-03: Security: the renderer leaves out a drawing path reaching more than a million device pixels (64 times the largest canvas) or of no finite size, which the rasteriser would otherwise flatten into points by the billion before clipping it. Readiness unchanged.
 - 2026-11-03: Language packs: language-packs-2 is published and WordCraft pins its index: 75 languages, adding Danish, German (Germany, Austria, Switzerland), Esperanto, Estonian, Persian, Croatian, Hungarian, Norwegian (Bokmål, Nynorsk), Dutch (#4145, #2505) and Swedish (Sweden, Finland), which need craft-proof's flag-based compounding (storytold/craft-libs#497, pinned). English (Australia) is checked against SCOWL's en-AU list as well as en-GB's (storytold/craft-libs#496). Mongolian and Thai stay hidden. Readiness unchanged.
 - 2026-11-03: Language lists (CP4.3): a language installed from a Language pack (Bulgarian, say) can now be chosen. Set Proofing Language lists every built-in language and every installed or available pack's, each once and sorted by name; Review › Language and the status bar's menu add the installed packs' languages to the short list, with one way of working out the check mark, by tag. A pack's language is stored as a tag that finds the pack again (`sr-Latn-RS` is proofed by the Latin `sr-latn` pack, not the Cyrillic one; Valencian is Word's `ca-ES-valencia`). Every pack in language-packs-2 now has an English name (Belarusian used to show its own name, Беларуская). Readiness unchanged.
 - 2026-11-03: Language packs (CP4.3): on a fresh install (or after an upgrade, with the list cached for an older pin) the missing-pack bar still offers a document language that has no dictionary, "Turkish proofing isn't installed. Install": the person's click turns on downloading, fetches the list and installs the pack if it lists one (if not, the bar goes). With downloading already on, a missing or stale list is fetched once in the background. Choosing a language with only the caret counts before anything is typed, and the spelling context menu's heading (Possible spelling mistake) is in the interface language, not the text's. Closing the bar is remembered per document, per pack and, before the list is known, per language tag. Readiness unchanged.

crates/docx/src/write/embed.rs

@@ -353,11 +353,11 @@ impl super::Writer<'_> {
         };
         self.embeds.markup_bytes = left;
         let mut root = xml::parse(src.xml.as_bytes()).ok()?;
-        let mut used = Vec::new();
+        let mut used = HashSet::new();
         rel_attr_values(&root, &mut used, 0);
         // Every relationship the markup uses must be writable, or the object would be broken.
-        let writable = |id: &String| src.refs.iter().any(|r| r.id == *id && (r.external || self.embeds.available(&r.target)));
-        if !used.iter().all(writable) {
+        let writable: HashSet<&str> = src.refs.iter().filter(|r| r.external || self.embeds.available(&r.target)).map(|r| r.id.as_str()).collect();
+        if !used.iter().all(|id| writable.contains(id.as_str())) {
             log::warn!("docx: an embedded object's parts are missing; it is left out");
             return None;
         }
@@ -638,13 +638,15 @@ fn set_attr(e: &mut El, k: &str, v: &str) {
     }
 }
 
-fn rel_attr_values(e: &El, out: &mut Vec<String>, depth: usize) {
+/// The distinct relationship ids `e` uses: a set, so a large tree (a native document's markup
+/// never went through the reader's id limit) costs no scan per attribute.
+fn rel_attr_values(e: &El, out: &mut HashSet<String>, depth: usize) {
     if depth > MAX_DEPTH {
         return;
     }
     for (k, v) in &e.attrs {
         if xml::is_rel_attr(&e.name, k) && !out.contains(v) {
-            out.push(v.clone());
+            out.insert(v.clone());
         }
     }
     for c in e.els() {
@@ -852,6 +854,24 @@ fn valid_part_name(name: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn relationship_ids_are_collected_once_each() {
+        // A native document's embedded markup skips the reader's id limit: 40,000 distinct ids
+        // (each named twice) were a scan of every id collected so far, per attribute.
+        let mut xml = String::from(
+            r#"<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">"#,
+        );
+        for i in 0..40_000 {
+            xml.push_str(&format!(r#"<w:r r:id="rId{i}"/><w:r r:id="rId{i}"/>"#));
+        }
+        xml.push_str("</w:p>");
+        let root = xml::parse(xml.as_bytes()).unwrap();
+        let mut used = HashSet::new();
+        rel_attr_values(&root, &mut used, 0);
+        assert_eq!(used.len(), 40_000);
+        assert!(used.contains("rId39999"));
+    }
+
     #[test]
     fn charts_cut_to_the_limits_on_save_say_so_once() {
         // A model deserialised as is can hold more than a chart part keeps; the save left the rest

crates/geom/src/picture.rs

@@ -51,6 +51,8 @@ pub struct Probe<'a> {
     pub width: u32,
     pub height: u32,
     peak: u64,
+    /// Whether a PNG has transparency, read from its chunk headers; `None` for other formats.
+    png_alpha: Option<bool>,
 }
 
 /// TIFF compressions decoded within the caller's limits: none, CCITT Group 4, LZW, Deflate (both
@@ -72,9 +74,48 @@ pub fn probe(bytes: &[u8]) -> Result<Probe<'_>, Refusal> {
         }
         _ => return Err(Refusal::NotAPicture),
     };
+    if format == ImageFormat::Png {
+        let (width, height, native, alpha) = png_chunks(bytes).ok_or_else(|| Refusal::Broken("its PNG header can't be read".into()))?;
+        let (width, height, peak) = sized(width, height, native, 0)?;
+        return Ok(Probe { bytes: Cow::Borrowed(bytes), dib: false, format, width, height, peak, png_alpha: Some(alpha) });
+    }
     let decoder = image::ImageReader::with_format(Cursor::new(bytes), format).into_decoder().map_err(broken)?;
     let (width, height, peak) = measure(&decoder, held)?;
-    Ok(Probe { bytes: Cow::Borrowed(bytes), dib: false, format, width, height, peak })
+    Ok(Probe { bytes: Cow::Borrowed(bytes), dib: false, format, width, height, peak, png_alpha: None })
+}
+
+/// A PNG's width, height, the bytes a pixel its decoder gives (samples under 8 bits widened to 8,
+/// a palette to RGB, `tRNS` to an alpha channel) and whether it has transparency, from `IHDR` and
+/// the chunk headers before the image data. The decoder's own header read inflates an ICC profile
+/// (`iCCP`) up to its 512 MiB default limit, for a picture that may only be measured.
+fn png_chunks(bytes: &[u8]) -> Option<(u32, u32, u64, bool)> {
+    let be = |at: usize| bytes.get(at..at.checked_add(4)?).and_then(|b| <[u8; 4]>::try_from(b).ok()).map(u32::from_be_bytes);
+    // The 8-byte signature, then IHDR: length, type, width, height, bit depth, colour type.
+    if bytes.get(12..16) != Some(b"IHDR".as_slice()) {
+        return None;
+    }
+    let (width, height) = (be(16)?, be(20)?);
+    let (depth, color) = (*bytes.get(24)?, *bytes.get(25)?);
+    let mut trns = false;
+    let mut at = 8usize;
+    loop {
+        let len = usize::try_from(be(at)?).ok()?;
+        match bytes.get(at.checked_add(4)?..at.checked_add(8)?)? {
+            b"IDAT" => break,
+            b"IEND" => return None,
+            b"tRNS" => trns = true,
+            _ => {}
+        }
+        at = at.checked_add(12)?.checked_add(len)?;
+    }
+    let (channels, alpha) = match color {
+        0 => (1 + u64::from(trns), trns),
+        2 | 3 => (3 + u64::from(trns), trns),
+        4 => (2, true),
+        6 => (4, true),
+        _ => return None,
+    };
+    Some((width, height, channels * if depth == 16 { 2 } else { 1 }, alpha))
 }
 
 /// Read a DIB's header: a BMP without its 14-byte file header, as the Windows clipboard holds
@@ -86,16 +127,20 @@ pub fn probe_dib(dib: Vec<u8>) -> Result<Probe<'static>, Refusal> {
         let decoder = image::codecs::bmp::BmpDecoder::new_without_file_header(Cursor::new(dib.as_slice())).map_err(broken)?;
         measure(&decoder, 0)?
     };
-    Ok(Probe { bytes: Cow::Owned(dib), dib: true, format: ImageFormat::Bmp, width, height, peak })
+    Ok(Probe { bytes: Cow::Owned(dib), dib: true, format: ImageFormat::Bmp, width, height, peak, png_alpha: None })
 }
 
 /// A decoder's size and the peak bytes of decoding it, `held` bytes kept beside its output.
 fn measure(decoder: &impl ImageDecoder, held: u64) -> Result<(u32, u32, u64), Refusal> {
     let (width, height) = decoder.dimensions();
+    sized(width, height, u64::from(decoder.color_type().bytes_per_pixel()), held)
+}
+
+/// A `width` × `height` picture of `native` bytes a pixel, with its peak (see [`peak_bytes`]).
+fn sized(width: u32, height: u32, native: u64, held: u64) -> Result<(u32, u32, u64), Refusal> {
     if width == 0 || height == 0 {
         return Err(Refusal::Broken("it has no pixels".into()));
     }
-    let native = u64::from(decoder.color_type().bytes_per_pixel());
     let peak = peak_bytes(width, height, native, held).ok_or(Refusal::TooLarge { width, height })?;
     Ok((width, height, peak))
 }
@@ -106,6 +151,18 @@ impl Probe<'_> {
         self.peak
     }
 
+    /// Whether the picture has transparency, from its header: a PNG's from its chunk headers
+    /// (an ICC profile isn't inflated to say), another format's from its decoder.
+    pub fn has_alpha(&self) -> bool {
+        if let Some(alpha) = self.png_alpha {
+            return alpha;
+        }
+        if self.dib {
+            return image::codecs::bmp::BmpDecoder::new_without_file_header(Cursor::new(&*self.bytes)).is_ok_and(|d| d.color_type().has_alpha());
+        }
+        image::ImageReader::with_format(Cursor::new(&*self.bytes), self.format).into_decoder().is_ok_and(|d| d.color_type().has_alpha())
+    }
+
     /// Whether decoding fits `budget` bytes.
     pub fn fits(&self, budget: u64) -> bool {
         self.peak <= budget
@@ -305,6 +362,39 @@ mod tests {
         !c
     }
 
+    /// `png` with a chunk of `kind` holding `data` placed after IHDR.
+    fn with_chunk(png: &[u8], kind: &[u8; 4], data: &[u8]) -> Vec<u8> {
+        let mut chunk = (data.len() as u32).to_be_bytes().to_vec();
+        chunk.extend_from_slice(kind);
+        chunk.extend_from_slice(data);
+        let crc = crc32(&chunk[4..]);
+        chunk.extend_from_slice(&crc.to_be_bytes());
+        let mut out = png.get(..33).unwrap().to_vec();
+        out.extend(chunk);
+        out.extend_from_slice(&png[33..]);
+        out
+    }
+
+    #[test]
+    fn a_png_is_measured_from_its_chunk_headers() {
+        // An ICC profile isn't inflated to measure a picture: one whose deflate stream is junk
+        // (the decoder refused it while reading the header) still measures, and isn't decoded.
+        let rgb = encode(image::RgbImage::new(4, 2), ImageFormat::Png);
+        let icc = with_chunk(&rgb, b"iCCP", b"p\0\0\xFF\xFF\xFF\xFF");
+        let p = probe(&icc).unwrap();
+        assert_eq!((p.width, p.height, p.peak_bytes()), (4, 2, 4 * 2 * 8));
+        assert!(!p.has_alpha());
+        assert_eq!(probe(&rgb).unwrap().peak_bytes(), p.peak_bytes(), "as the decoder measures it");
+        // Transparency: an alpha channel, or tRNS before the image data.
+        assert!(probe(&encode(image::GrayAlphaImage::new(2, 2), ImageFormat::Png)).unwrap().has_alpha());
+        let trns = with_chunk(&rgb, b"tRNS", &[0, 0, 0, 0, 0, 0]);
+        let p = probe(&trns).unwrap();
+        assert!(p.has_alpha());
+        assert_eq!(p.decode(1 << 20).map(|i| i.color().has_alpha()), Ok(true), "the decoder agrees");
+        // No image data: broken.
+        assert!(probe(&rgb[..33]).is_err());
+    }
+
     #[test]
     fn small_pictures_decode_and_peaks_count_every_buffer() {
         let png = encode(image::RgbaImage::from_pixel(16, 8, image::Rgba([1, 2, 3, 4])), ImageFormat::Png);

crates/layout/src/contour.rs

@@ -286,16 +286,13 @@ impl Alphas {
 /// without transparency or that don't decode; [`OverBudget`] for one that would take `decoded`
 /// past [`MAX_DECODED_PIXELS`]. Pictures whose header says they're opaque cost nothing.
 fn decode_alpha(bytes: &[u8], decoded: &mut u64) -> Result<Option<Alpha>, OverBudget> {
-    use image::ImageDecoder;
     let Ok(pic) = wordcraft_geom::picture::probe(bytes) else { return Ok(None) };
     // Formats that can't be transparent aren't decoded.
     if pic.format == image::ImageFormat::Jpeg || pic.width > MAX_PICTURE_SIDE || pic.height > MAX_PICTURE_SIDE {
         return Ok(None);
     }
     // Only the header is read here (a PNG's `tRNS` counts as transparency).
-    let has_alpha =
-        image::ImageReader::with_format(std::io::Cursor::new(bytes), pic.format).into_decoder().ok().is_some_and(|d| d.color_type().has_alpha());
-    if !has_alpha {
+    if !pic.has_alpha() {
         return Ok(None);
     }
     let pixels = u64::from(pic.width) * u64::from(pic.height);

crates/render/src/lib.rs

@@ -842,10 +842,22 @@ fn draw_image(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     }
 }
 
+/// Widest path drawn, in device pixels a side: 64 times the largest canvas. The rasteriser
+/// flattens a curve into as many points as its size asks for, before clipping, so a path with
+/// coordinates of 1e15 (file data in a native document) would take it forever or run out of
+/// memory; one this far past every canvas shows nothing a real drawing would.
+const MAX_PATH_PIXELS: f64 = 1_048_576.0;
+
+/// Whether `path` under `view` is small enough to draw ([`MAX_PATH_PIXELS`]) and finite.
+fn path_extent_ok(view: Affine, path: &kurbo::BezPath) -> bool {
+    let b = view.transform_rect_bbox(path.bounding_box());
+    path.is_finite() && [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() <= MAX_PATH_PIXELS)
+}
+
 fn draw_path(ctx: &mut RenderContext, fr: &Frame, it: &Draw) {
     let Draw::Path { segs, fill, stroke, stroke_width, dash, cap } = it else { return };
     let path = wordcraft_layout::display::seg_path(segs);
-    if path.elements().is_empty() {
+    if path.elements().is_empty() || !path_extent_ok(fr.view, &path) {
         return;
     }
     ctx.set_transform(fr.view);

crates/render/src/tests.rs

@@ -1411,3 +1411,18 @@ fn a_line_runs_from_top_left_to_bottom_right() {
     let p = shape_path(ShapeKind::Line, kurbo::Rect::new(10.0, 20.0, 30.0, 60.0), None);
     assert_eq!(p.elements(), &[kurbo::PathEl::MoveTo((10.0, 20.0).into()), kurbo::PathEl::LineTo((30.0, 60.0).into())]);
 }
+
+#[test]
+fn paths_far_past_every_canvas_are_not_flattened() {
+    let line = |x: f64| {
+        let mut p = kurbo::BezPath::new();
+        p.move_to((0.0, 0.0));
+        p.curve_to((x, 0.0), (x, x), (0.0, x));
+        p
+    };
+    assert!(path_extent_ok(Affine::IDENTITY, &line(500.0)));
+    assert!(path_extent_ok(Affine::scale(4.0), &line(200_000.0)), "a large page at a high zoom");
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(1e15)));
+    assert!(!path_extent_ok(Affine::scale(1e12), &line(10.0)));
+    assert!(!path_extent_ok(Affine::IDENTITY, &line(f64::NAN)));
+}