style: rustfmt

* fix(clipboard): size-check a Wayland clipboard picture before it is decoded

* address review: refuse a clipboard PNG the renderer cannot decode within its budget

apps/wordcraft/src/clipboard.rs

@@ -108,8 +108,8 @@ pub fn formats() -> Vec<String> {
 
 /// The picture on the clipboard: copied files, else image pixels, else (Wayland) an encoded
 /// picture in a format arboard doesn't decode. A picture that is there but can't be read says
-/// why (#833). The UI checks the sizes before inserting anything; on Windows they are checked
-/// from the header before anything is decoded (#3623).
+/// why (#833). The UI checks the sizes before inserting anything; on Windows and Wayland they are
+/// checked from the header before anything is decoded (#3623).
 pub fn picture() -> Option<ClipboardPicture> {
     let mut clipboard = match arboard::Clipboard::new() {
         Ok(c) => c,
@@ -136,6 +136,10 @@ fn decoded_picture(_: &mut arboard::Clipboard) -> Option<ClipboardPicture> {
 /// The picture arboard decodes from the clipboard, else an encoded one read past it.
 #[cfg(not(target_os = "windows"))]
 fn decoded_picture(clipboard: &mut arboard::Clipboard) -> Option<ClipboardPicture> {
+    #[cfg(all(unix, not(any(target_os = "macos", target_os = "android", target_os = "emscripten"))))]
+    if let Some(picture) = platform::picture() {
+        return Some(picture);
+    }
     match clipboard.get_image() {
         Ok(image) => Some(ClipboardPicture::Pixels { width: image.width, height: image.height, rgba: image.bytes.into_owned() }),
         Err(arboard::Error::ContentNotAvailable) => platform::encoded_picture().map(ClipboardPicture::Encoded),
@@ -160,6 +164,7 @@ mod platform {
     use std::io::Read;
 
     use wl_clipboard_rs::paste::{ClipboardType, MimeType, Seat, get_contents, get_mime_types_ordered};
+    use wordcraft_ui_egui::paste_picture::{self, ClipboardPicture};
 
     fn wayland() -> bool {
         std::env::var_os("WAYLAND_DISPLAY").is_some()
@@ -364,6 +369,22 @@ mod platform {
             assert!(complete(0, 0, 0));
         }
     }
+
+    /// The Wayland clipboard's picture, read encoded under the paste's byte cap and refused from
+    /// its header when a paste can't take its size, before anything decodes it. arboard decodes
+    /// and converts the PNG to RGBA with no size limits. `None` when Wayland offers no picture
+    /// (or isn't reachable): arboard is asked then, which also covers X11.
+    pub fn picture() -> Option<ClipboardPicture> {
+        if !wayland() {
+            return None;
+        }
+        let offered = formats();
+        let mime = super::PICTURE_MIMES.into_iter().find(|m| offered.iter().any(|o| o == m))?;
+        Some(match read(mime, wordcraft_ui_egui::paste_picture::MAX_FILE_BYTES) {
+            Some(bytes) => wordcraft_ui_egui::paste_picture::encoded_picture(bytes),
+            None => ClipboardPicture::Unreadable("the clipboard picture is larger than 200 MB, or couldn't be read".into()),
+        })
+    }
 }
 
 #[cfg(target_os = "windows")]

crates/metafile/src/place.rs

@@ -136,8 +136,14 @@ impl Picture {
             match item {
                 Item::Path { segs, fill, stroke, even_odd } => {
                     let path = tf * bez(segs);
-                    if in_range(path.bounding_box()) {
-                        let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
+                    let bounds = path.bounding_box();
+                    if in_range(bounds) {
+                        // A pen wider than twice the distance across the frame and the path
+                        // already covers the whole frame: wider adds nothing the frame shows, only
+                        // work for the renderer flattening its round caps (the width is file data).
+                        let u = bounds.union(r);
+                        let widest = 2.0 * u.width().hypot(u.height());
+                        let stroke = stroke.map(|(c, w)| (c, (f64::from(w) * k).min(widest)));
                         out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd });
                     }
                 }

crates/metafile/src/tests.rs

@@ -891,6 +891,34 @@ fn place_fits_the_frame_scales_strokes_and_drops_far_paths() {
     assert_eq!(stroke.map(|s| s.1), Some(8.0));
 }
 
+#[test]
+fn a_huge_pen_is_held_to_what_covers_the_frame() {
+    // A pen of 1e30 units on a short path: round caps that wide took the renderer forever to
+    // flatten. Past twice the distance across the frame and the path it covers no more.
+    let path = |w: f32| crate::Picture {
+        width: 100.0,
+        height: 50.0,
+        items: vec![Item::Path {
+            segs: vec![Seg::Move(0.0, 0.0), Seg::Line(10.0, 0.0)],
+            fill: None,
+            stroke: Some(([0, 0, 0, 255], w)),
+            even_odd: true,
+        }],
+    };
+    let width = |w: f32| match pic_place(&path(w)).first() {
+        Some(crate::PlacedItem::Path { stroke, .. }) => stroke.map(|s| s.1),
+        _ => None,
+    };
+    let cap = 2.0 * 200f64.hypot(100.0);
+    assert_eq!(width(1e30), Some(cap));
+    assert_eq!(width(f32::MAX), Some(cap));
+    assert_eq!(width(4.0), Some(8.0), "an ordinary pen is untouched");
+}
+
+fn pic_place(pic: &crate::Picture) -> Vec<crate::PlacedItem> {
+    pic.place(kurbo::Rect::new(0.0, 0.0, 200.0, 100.0), [0.0; 4])
+}
+
 /// #1899: a crop keeps what the file says down to a sliver (a header's bar is 2.7% of a page-sized
 /// metafile), and junk sides give a finite part of the source with some area.
 #[test]

crates/ui-egui/src/paste_picture.rs

@@ -67,11 +67,16 @@ fn too_large_to_paste(width: u32, height: u32) -> ClipboardPicture {
     ClipboardPicture::Unreadable(format!("the clipboard picture is too large to paste ({width} × {height} pixels)"))
 }
 
+/// Whether the renderer can decode `bytes` within its budget (a 16-bit picture takes more than its pixel count says).
+fn probe_fits(bytes: &[u8]) -> bool {
+    wordcraft_geom::picture::probe(bytes).is_ok_and(|p| p.fits(wordcraft_geom::MAX_DECODED_BYTES))
+}
+
 /// An encoded picture the host read from the clipboard (the Windows "PNG" format), refused from
 /// its header when a paste can't take its size, before anything decodes it (#3623).
 pub fn encoded_picture(bytes: Vec<u8>) -> ClipboardPicture {
     match wordcraft_geom::picture::probe(&bytes).map(|p| (p.width, p.height)) {
-        Ok((w, h)) if pastes(w, h) => ClipboardPicture::Encoded(bytes),
+        Ok((w, h)) if pastes(w, h) && probe_fits(&bytes) => ClipboardPicture::Encoded(bytes),
         Ok((w, h)) => too_large_to_paste(w, h),
         Err(e) => ClipboardPicture::Unreadable(e.to_string()),
     }
@@ -258,6 +263,22 @@ mod tests {
         image::GrayImage::new(20_000, 1).write_to(&mut std::io::Cursor::new(&mut wide), image::ImageFormat::Png).unwrap();
         assert!(matches!(encoded_picture(wide), ClipboardPicture::Unreadable(e) if e.contains("too large")));
         assert!(matches!(encoded_picture(b"not a picture".to_vec()), ClipboardPicture::Unreadable(_)));
+        // 8000 × 6000 passes the pixel limits, but 16-bit RGBA needs 12 bytes a pixel to decode.
+        let mut big = Vec::new();
+        image::DynamicImage::ImageRgba16(image::ImageBuffer::new(1, 1))
+            .write_to(&mut std::io::Cursor::new(&mut big), image::ImageFormat::Png)
+            .unwrap();
+        big[16..20].copy_from_slice(&8000u32.to_be_bytes());
+        big[20..24].copy_from_slice(&6000u32.to_be_bytes());
+        let mut crc = 0xFFFF_FFFFu32;
+        for &b in &big[12..29] {
+            crc ^= u32::from(b);
+            for _ in 0..8 {
+                crc = if crc & 1 == 1 { 0xEDB8_8320 ^ (crc >> 1) } else { crc >> 1 };
+            }
+        }
+        big[29..33].copy_from_slice(&(!crc).to_be_bytes());
+        assert!(matches!(encoded_picture(big), ClipboardPicture::Unreadable(e) if e.contains("too large")));
         // BGRA in memory: a half-transparent red pixel and an opaque blue one.
         let ClipboardPicture::Pixels { width, height, rgba } = dib_picture(dib(2, 1, &[[0, 0, 255, 128], [255, 0, 0, 255]])) else {
             panic!("pixels")

packaging/freebsd/package.sh

@@ -55,7 +55,7 @@ esac
 # Only binaries for this machine run here (the --version check at the end); a FreeBSD target built
 # on another OS never does.
 HOST_ARCH="$(release_arch "$(uname -m)" 2>/dev/null)" || HOST_ARCH="$(uname -m)"
-if [ -n "${CARGO_BUILD_TARGET:-}" ] && [ "$(uname -s)" != FreeBSD ]; then
+if [[ -n "${CARGO_BUILD_TARGET:-}" ]] && [[ "$(uname -s)" != FreeBSD ]]; then
   HOST_ARCH="$(uname -s) $HOST_ARCH"
 fi
 BASENAME="wordcraft-$VERSION-freebsd-$ARCH"
@@ -96,12 +96,12 @@ mkdir -p "$DIST"
 tar -C "$WORK" -czf "$DIST/$BASENAME.tar.gz" "$BASENAME"
 echo "wrote $DIST/$BASENAME.tar.gz"
 
-if [ -z "${CARGO_BUILD_TARGET:-}" ] && [ "$ARCH" = "$HOST_ARCH" ]; then
+if [[ -z "${CARGO_BUILD_TARGET:-}" ]] && [[ "$ARCH" = "$HOST_ARCH" ]]; then
   "$STAGE/bin/wordcraft-cli" --version
 else
   # They cannot run here, so check what they are instead: executables, not libraries or objects.
   # An older file(1) calls a PIE a shared object; its interpreter still marks it as a program.
-  want="$ARCH"; [ "$ARCH" != x86_64 ] || want=x86-64
+  want="$ARCH"; [[ "$ARCH" != x86_64 ]] || want=x86-64
   for b in "$STAGE"/bin/*; do
     case "$(file -b "$b")" in
       ELF*" executable, "*"$want"*FreeBSD* | ELF*"$want"*FreeBSD*interpreter*) ;;