diff --git a/Cargo.lock b/Cargo.lock
index 846b85418e..1bf47f30d0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1178,17 +1178,17 @@ dependencies = [
[[package]]
name = "craft-docpath"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
[[package]]
name = "craft-fonts-build"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
[[package]]
name = "craft-i18n"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
dependencies = [
"fixed_decimal",
"icu_decimal",
@@ -1211,7 +1211,7 @@ dependencies = [
[[package]]
name = "craft-keymap"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
dependencies = [
"egui",
"serde",
@@ -1221,7 +1221,7 @@ dependencies = [
[[package]]
name = "craft-menu"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
dependencies = [
"craft-keymap",
"craft-quit",
@@ -1234,7 +1234,7 @@ dependencies = [
[[package]]
name = "craft-print"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
dependencies = [
"craft-winprint-gdi",
"log",
@@ -1248,7 +1248,7 @@ dependencies = [
[[package]]
name = "craft-quit"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
dependencies = [
"dispatch2",
"egui",
@@ -1259,7 +1259,7 @@ dependencies = [
[[package]]
name = "craft-ui"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
dependencies = [
"craft-fonts-build",
"craft-i18n",
@@ -1280,7 +1280,7 @@ dependencies = [
[[package]]
name = "craft-update"
version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=c5a1cbfb5f9049f9270955caffb5bee5997aebf7#c5a1cbfb5f9049f9270955caffb5bee5997aebf7"
+source = "git+https://github.com/storytold/craft-libs?rev=787a7a0f972fd1d7a7618fdbeca3a5267a0407ff#787a7a0f972fd1d7a7618fdbeca3a5267a0407ff"
dependencies = [
"chrono",
"dunce",
@@ -4208,7 +4208,7 @@ dependencies = [
[[package]]
name = "pdfcraft"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"chrono",
"craft-update",
@@ -4232,7 +4232,7 @@ dependencies = [
[[package]]
name = "pdfcraft-a11y"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"pdfcraft-content",
"pdfcraft-cos",
@@ -4244,7 +4244,7 @@ dependencies = [
[[package]]
name = "pdfcraft-annot"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"hayro-syntax",
"pdfcraft-cos",
@@ -4255,7 +4255,7 @@ dependencies = [
[[package]]
name = "pdfcraft-audit"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"pdfcraft-content",
"pdfcraft-cos",
@@ -4266,7 +4266,7 @@ dependencies = [
[[package]]
name = "pdfcraft-automation"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"base64 0.23.1",
"flate2",
@@ -4288,7 +4288,7 @@ dependencies = [
[[package]]
name = "pdfcraft-cli"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"base64 0.23.1",
"pdfcraft-audit",
@@ -4306,11 +4306,11 @@ dependencies = [
[[package]]
name = "pdfcraft-compare"
-version = "0.16.1"
+version = "0.17.0"
[[package]]
name = "pdfcraft-content"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"hayro-syntax",
"pdfcraft-cos",
@@ -4318,7 +4318,7 @@ dependencies = [
[[package]]
name = "pdfcraft-cos"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"chrono",
"hayro-syntax",
@@ -4333,11 +4333,10 @@ dependencies = [
[[package]]
name = "pdfcraft-create"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"encoding_rs",
"hayro-ccitt",
- "hayro-jbig2",
"hayro-syntax",
"image",
"pdfcraft-cos",
@@ -4353,7 +4352,7 @@ dependencies = [
[[package]]
name = "pdfcraft-crypt"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"aes",
"md-5",
@@ -4365,7 +4364,7 @@ dependencies = [
[[package]]
name = "pdfcraft-edit"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"hayro-syntax",
"kurbo 0.13.1",
@@ -4374,6 +4373,8 @@ dependencies = [
"pdfcraft-cos",
"pdfcraft-fonts",
"pdfcraft-model",
+ "pdfcraft-render",
+ "proptest",
"sha2 0.11.1",
"thiserror 2.0.21",
"unicode-bidi",
@@ -4381,7 +4382,7 @@ dependencies = [
[[package]]
name = "pdfcraft-engine"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"chrono",
"craft-docpath",
@@ -4393,10 +4394,12 @@ dependencies = [
"pdfcraft-annot",
"pdfcraft-audit",
"pdfcraft-compare",
+ "pdfcraft-content",
"pdfcraft-cos",
"pdfcraft-create",
"pdfcraft-edit",
"pdfcraft-export",
+ "pdfcraft-filters",
"pdfcraft-fonts",
"pdfcraft-forms",
"pdfcraft-geom",
@@ -4423,14 +4426,14 @@ dependencies = [
[[package]]
name = "pdfcraft-export"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"flate2",
]
[[package]]
name = "pdfcraft-filters"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"fax",
"flate2",
@@ -4443,7 +4446,7 @@ dependencies = [
[[package]]
name = "pdfcraft-fonts"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"harfrust",
"pdfcraft-cos",
@@ -4453,7 +4456,7 @@ dependencies = [
[[package]]
name = "pdfcraft-forms"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"hayro-syntax",
"pdfcraft-content",
@@ -4466,11 +4469,11 @@ dependencies = [
[[package]]
name = "pdfcraft-geom"
-version = "0.16.1"
+version = "0.17.0"
[[package]]
name = "pdfcraft-js"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"boa_engine",
"chrono",
@@ -4478,7 +4481,7 @@ dependencies = [
[[package]]
name = "pdfcraft-measure"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"pdfcraft-annot",
"pdfcraft-content",
@@ -4491,14 +4494,14 @@ dependencies = [
[[package]]
name = "pdfcraft-model"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"pdfcraft-cos",
]
[[package]]
name = "pdfcraft-ocr"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"ocrs",
"pdfcraft-fonts",
@@ -4509,7 +4512,7 @@ dependencies = [
[[package]]
name = "pdfcraft-optimize"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"image",
"pdfcraft-annot",
@@ -4525,11 +4528,11 @@ dependencies = [
[[package]]
name = "pdfcraft-oracle"
-version = "0.16.1"
+version = "0.17.0"
[[package]]
name = "pdfcraft-organize"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"hayro-syntax",
"pdfcraft-content",
@@ -4540,7 +4543,7 @@ dependencies = [
[[package]]
name = "pdfcraft-platform"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"async-channel",
"futures-lite",
@@ -4550,7 +4553,7 @@ dependencies = [
[[package]]
name = "pdfcraft-preflight"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"flate2",
"pdfcraft-content",
@@ -4561,7 +4564,7 @@ dependencies = [
[[package]]
name = "pdfcraft-print"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"craft-print",
"pdfcraft-content",
@@ -4573,7 +4576,7 @@ dependencies = [
[[package]]
name = "pdfcraft-redact"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"pdfcraft-annot",
"pdfcraft-content",
@@ -4592,7 +4595,7 @@ dependencies = [
[[package]]
name = "pdfcraft-render"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"bytemuck",
"flate2",
@@ -4611,7 +4614,7 @@ dependencies = [
[[package]]
name = "pdfcraft-sign"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"aes",
"aws-lc-rs",
@@ -4647,11 +4650,11 @@ dependencies = [
[[package]]
name = "pdfcraft-testkit"
-version = "0.16.1"
+version = "0.17.0"
[[package]]
name = "pdfcraft-ui-egui"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"arboard",
"base64 0.23.1",
@@ -4675,6 +4678,7 @@ dependencies = [
"objc2 0.6.5",
"objc2-app-kit 0.3.2",
"objc2-foundation 0.3.2",
+ "pdfcraft-content",
"pdfcraft-cos",
"pdfcraft-engine",
"pdfcraft-fonts",
@@ -4685,6 +4689,7 @@ dependencies = [
"plist",
"png 0.18.1",
"pollster 1.0.1",
+ "proptest",
"rfd",
"rustix 1.1.5",
"serde",
@@ -4703,7 +4708,7 @@ dependencies = [
[[package]]
name = "pdfcraft-web"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"eframe",
"egui",
@@ -4715,7 +4720,7 @@ dependencies = [
[[package]]
name = "pdfcraft-xfa"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"base64 0.23.1",
"image",
@@ -4729,7 +4734,7 @@ dependencies = [
[[package]]
name = "pdfcraft-xfdf"
-version = "0.16.1"
+version = "0.17.0"
dependencies = [
"pdfcraft-annot",
"pdfcraft-cos",
diff --git a/Cargo.toml b/Cargo.toml
index 85d02570ba..edd9e682b7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
[workspace.package]
-version = "0.16.1"
+version = "0.17.0"
edition = "2024"
license = "MIT OR Apache-2.0"
rust-version = "1.95"
@@ -13,52 +13,52 @@ repository = "https://github.com/storytold/pdfcraft"
[workspace.dependencies]
# Shared frontend components; engines remain independent of egui.
-craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["serde"] }
+craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff", features = ["serde"] }
# Quit the macOS way (#1136): ⌘Q asks about unsaved changes, and closing quits through `terminate:`.
-craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+craft-quit = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
# One menu definition for the native macOS menu bar and the in-window bar elsewhere.
-craft-menu = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
-craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", default-features = false }
+craft-menu = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
+craft-keymap = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff", default-features = false }
# Shared system spooler; document composition remains in pdfcraft-print.
-craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
# Whether a path stored in a document may be opened (GoToR link targets).
-craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff" }
# craft-update: app-specific pretend versions apply to startup and manual checks.
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "787a7a0f972fd1d7a7618fdbeca3a5267a0407ff", features = ["egui"] }
# internal
-pdfcraft-geom = { path = "crates/geom", version = "0.16.1" }
-pdfcraft-filters = { path = "crates/filters", version = "0.16.1" }
-pdfcraft-cos = { path = "crates/cos", version = "0.16.1" }
-pdfcraft-crypt = { path = "crates/crypt", version = "0.16.1" }
-pdfcraft-organize = { path = "crates/organize", version = "0.16.1" }
-pdfcraft-measure = { path = "crates/measure", version = "0.16.1" }
-pdfcraft-annot = { path = "crates/annot", version = "0.16.1" }
-pdfcraft-audit = { path = "crates/audit", version = "0.16.1" }
-pdfcraft-fonts = { path = "crates/fonts", version = "0.16.1" }
-pdfcraft-model = { path = "crates/model", version = "0.16.1" }
-pdfcraft-content = { path = "crates/content", version = "0.16.1" }
-pdfcraft-redact = { path = "crates/redact", version = "0.16.1" }
-pdfcraft-print = { path = "crates/print", version = "0.16.1" }
-pdfcraft-xfdf = { path = "crates/xfdf", version = "0.16.1" }
-pdfcraft-sign = { path = "crates/sign", version = "0.16.1" }
-pdfcraft-optimize = { path = "crates/optimize", version = "0.16.1" }
-pdfcraft-a11y = { path = "crates/a11y", version = "0.16.1" }
-pdfcraft-oracle = { path = "crates/oracle", version = "0.16.1" }
-pdfcraft-testkit = { path = "crates/testkit", version = "0.16.1" }
-pdfcraft-ocr = { path = "crates/ocr", version = "0.16.1" }
-pdfcraft-js = { path = "crates/js", version = "0.16.1" }
-pdfcraft-compare = { path = "crates/compare", version = "0.16.1" }
-pdfcraft-preflight = { path = "crates/preflight", version = "0.16.1" }
-pdfcraft-export = { path = "crates/export", version = "0.16.1" }
-pdfcraft-edit = { path = "crates/edit", version = "0.16.1" }
-pdfcraft-create = { path = "crates/create", version = "0.16.1" }
-pdfcraft-forms = { path = "crates/forms", version = "0.16.1" }
-pdfcraft-xfa = { path = "crates/xfa", version = "0.16.1" }
-pdfcraft-render = { path = "crates/render", version = "0.16.1" }
-pdfcraft-engine = { path = "crates/engine", version = "0.16.1" }
-pdfcraft-platform = { path = "crates/platform", version = "0.16.1" }
-pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.16.1" }
-pdfcraft-automation = { path = "crates/automation", version = "0.16.1", default-features = false }
+pdfcraft-geom = { path = "crates/geom", version = "0.17.0" }
+pdfcraft-filters = { path = "crates/filters", version = "0.17.0" }
+pdfcraft-cos = { path = "crates/cos", version = "0.17.0" }
+pdfcraft-crypt = { path = "crates/crypt", version = "0.17.0" }
+pdfcraft-organize = { path = "crates/organize", version = "0.17.0" }
+pdfcraft-measure = { path = "crates/measure", version = "0.17.0" }
+pdfcraft-annot = { path = "crates/annot", version = "0.17.0" }
+pdfcraft-audit = { path = "crates/audit", version = "0.17.0" }
+pdfcraft-fonts = { path = "crates/fonts", version = "0.17.0" }
+pdfcraft-model = { path = "crates/model", version = "0.17.0" }
+pdfcraft-content = { path = "crates/content", version = "0.17.0" }
+pdfcraft-redact = { path = "crates/redact", version = "0.17.0" }
+pdfcraft-print = { path = "crates/print", version = "0.17.0" }
+pdfcraft-xfdf = { path = "crates/xfdf", version = "0.17.0" }
+pdfcraft-sign = { path = "crates/sign", version = "0.17.0" }
+pdfcraft-optimize = { path = "crates/optimize", version = "0.17.0" }
+pdfcraft-a11y = { path = "crates/a11y", version = "0.17.0" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.17.0" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.17.0" }
+pdfcraft-ocr = { path = "crates/ocr", version = "0.17.0" }
+pdfcraft-js = { path = "crates/js", version = "0.17.0" }
+pdfcraft-compare = { path = "crates/compare", version = "0.17.0" }
+pdfcraft-preflight = { path = "crates/preflight", version = "0.17.0" }
+pdfcraft-export = { path = "crates/export", version = "0.17.0" }
+pdfcraft-edit = { path = "crates/edit", version = "0.17.0" }
+pdfcraft-create = { path = "crates/create", version = "0.17.0" }
+pdfcraft-forms = { path = "crates/forms", version = "0.17.0" }
+pdfcraft-xfa = { path = "crates/xfa", version = "0.17.0" }
+pdfcraft-render = { path = "crates/render", version = "0.17.0" }
+pdfcraft-engine = { path = "crates/engine", version = "0.17.0" }
+pdfcraft-platform = { path = "crates/platform", version = "0.17.0" }
+pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.17.0" }
+pdfcraft-automation = { path = "crates/automation", version = "0.17.0", default-features = false }
# pdf
hayro = "0.7.1"
diff --git a/README.md b/README.md
index ce9e71d4a9..3c1b67936a 100644
--- a/README.md
+++ b/README.md
@@ -547,9 +547,18 @@ stand on its own.
| --mode all|read|edit|convert|sign --tool --left open|closed
//! --organize on --fields on --dialog properties|shortcuts|about --palette --home on
//! --cover on|off --default-layout single|continuous|two-up|two-page --default-continuous on|off --default-zoom fit-width|fit-page| --always-default-view on|off
-//! --page-gaps on|off --default-page-gaps on|off
+//! --page-gaps on|off --default-page-gaps on|off --recent-files 0..50
//! --combine-view grid|list --combine-zoom 60..200`
//!
//! `--new-window` opens a window of its own. Without it, on Windows, a launch that only names files
diff --git a/contributors/people.toml b/contributors/people.toml
index a5a47f5c52..fecfb68c90 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -180,3 +180,6 @@ sync_github_name = true
[people.dylanmtaylor]
sync_github_name = true
+
+[people.Combiler01]
+sync_github_name = true
diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index abc746c0dd..909250ef26 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -392,9 +392,13 @@ struct AppearanceDrawing {
}
impl AppearanceDrawing {
+ /// Initialize an appearance drawing buffer and configure its graphics state for opacity and blend mode.
fn new(context: &AppearanceContext<'_>) -> Self {
let mut drawing = Self::default();
- if let Some(gs) = ext_gstate(context.opacity, context.subtype == b"Highlight") {
+ if let Some(gs) = ext_gstate(
+ context.opacity,
+ context.subtype == b"Highlight" || (context.subtype == b"Ink" && context.dict.name(b"IT") == Some(b"FreehandHighlight")),
+ ) {
drawing.resources.set(b"ExtGState".to_vec(), Object::Dict(gs));
drawing.content.push_str("/GS0 gs\n");
}
diff --git a/crates/annot/src/create.rs b/crates/annot/src/create.rs
index a6db5b940b..1904745e95 100644
--- a/crates/annot/src/create.rs
+++ b/crates/annot/src/create.rs
@@ -33,6 +33,16 @@ pub(crate) fn grow(r: [f64; 4], by: f64) -> [f64; 4] {
[r[0] - by, r[1] - by, r[2] + by, r[3] + by]
}
+/// Tight bounding box of ink strokes, including Bezier control points for strokes with three or
+/// more points (matching [`appearance::smooth_segments`]).
+pub(crate) fn ink_bounds(strokes: &[Vec<[f64; 2]>]) -> Option<[f64; 4]> {
+ let controls = strokes.iter().filter(|s| s.len() > 2).flat_map(|s| {
+ let pts: Vec<(f64, f64)> = s.iter().map(|p| (p[0], p[1])).collect();
+ appearance::smooth_segments(&pts).into_iter().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]])
+ });
+ bounds(strokes.iter().flatten().copied().chain(controls))
+}
+
pub(crate) fn ending_draws(ending: LineEnding) -> bool {
ending != LineEnding::None
}
@@ -87,17 +97,11 @@ pub(crate) fn rect_for(shape: &Shape, style: &Style) -> Result<[f64; 4], AnnotEr
let pad = half + if ending_draws(*start) || ending_draws(*end) { appearance::arrow_size(style.width) } else { 0.0 };
grow(bounds([*from, *to].into_iter()).unwrap_or_default(), pad + 1.0)
}
- Shape::Ink { strokes } | Shape::Signature { strokes } => {
+ Shape::Ink { strokes } | Shape::FreehandHighlight { strokes } | Shape::Signature { strokes } => {
if strokes.iter().all(Vec::is_empty) || !strokes.iter().flatten().all(|p| finite(p)) {
return Err(bad("drawing (no points)"));
}
- // Strokes of three or more points are drawn as curves, which stay within their
- // points and control points.
- let controls = strokes.iter().filter(|s| s.len() > 2).flat_map(|s| {
- let pts: Vec<(f64, f64)> = s.iter().map(|p| (p[0], p[1])).collect();
- appearance::smooth_segments(&pts).into_iter().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]])
- });
- grow(bounds(strokes.iter().flatten().copied().chain(controls)).unwrap_or_default(), half + 1.0)
+ grow(ink_bounds(strokes).unwrap_or_default(), half + 1.0)
}
Shape::Polygon { vertices, cloud } => {
let b = bounds(vertices.iter().copied())
@@ -164,6 +168,7 @@ fn subject(shape: &Shape) -> &'static str {
Shape::Oval { .. } => "Oval",
Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Arrow",
Shape::Line { .. } => "Line",
+ Shape::FreehandHighlight { .. } => "Freehand Highlight",
Shape::Ink { .. } => "Pencil",
Shape::TextBox { .. } => "Text Box",
Shape::Typewriter { .. } => "Typewriter",
@@ -292,10 +297,13 @@ pub fn add_annotation(doc: &mut Document, new: &NewAnnotation, meta: &Meta) -> R
}
}
}
- Shape::Ink { strokes } | Shape::Signature { strokes } => {
+ Shape::Ink { strokes } | Shape::FreehandHighlight { strokes } | Shape::Signature { strokes } => {
d.set(b"C".to_vec(), rgb(style.color));
let list = strokes.iter().filter(|s| !s.is_empty()).map(|s| num_array(&s.concat())).collect();
d.set(b"InkList".to_vec(), Object::Array(list));
+ if matches!(&new.shape, Shape::FreehandHighlight { .. }) {
+ d.set(b"IT".to_vec(), Object::name("FreehandHighlight"));
+ }
border(&mut d);
}
Shape::Polygon { vertices, cloud } => {
diff --git a/crates/annot/src/modify.rs b/crates/annot/src/modify.rs
index 2e3ae0b7d0..a615b8e013 100644
--- a/crates/annot/src/modify.rs
+++ b/crates/annot/src/modify.rs
@@ -1,5 +1,5 @@
use super::create::{
- add_annotation, base_dict, bounds, callout_attach, ending_draws, ending_pair, finite, grow, normalize, num_array, rect_for, rgb,
+ add_annotation, base_dict, bounds, callout_attach, ending_draws, ending_pair, finite, grow, ink_bounds, normalize, num_array, rect_for, rgb,
};
use super::draw::{draw_appearance, redraw_or_restore, set_appearance};
use super::info::{line_endings_of, text_value};
@@ -529,7 +529,33 @@ fn apply_text_box(doc: &mut Document, r: ObjRef, rect: [f64; 4], meta: &Meta, ne
}
fn border_width_of(d: &Dict) -> f64 {
- d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0).max(0.0)
+ appearance::border_width(d)
+}
+
+/// Recompute `/Rect` for an `Ink` annotation when its stroke width changes from `old_w` to `w`.
+/// Preserves any baseline margin beyond `old_w / 2.0` (at least `1.0` pt) without accumulating
+/// padding across repeated width increases and decreases.
+fn ink_rect_for_width(d: &Dict, old_w: f64, w: f64) -> Option<[f64; 4]> {
+ let list = d.get(b"InkList")?.as_array()?;
+ let mut strokes: Vec> = Vec::with_capacity(list.len());
+ for s in list {
+ let pts: Vec = s.as_array()?.iter().map(Object::as_f64).collect::>()?;
+ strokes.push(pts.as_chunks::<2>().0.iter().map(|p| [p[0], p[1]]).collect());
+ }
+ let inner = ink_bounds(&strokes)?;
+ let vals: Vec = d.get(b"Rect").and_then(Object::as_array).map(|a| a.iter().filter_map(Object::as_f64).collect()).unwrap_or_default();
+ let Some(old_rect) = four(&vals).map(normalize) else {
+ return Some(grow(inner, w / 2.0 + 1.0));
+ };
+ let old_half = old_w / 2.0;
+ let new_half = w / 2.0;
+ let base = [
+ (inner[0] - old_rect[0] - old_half).max(1.0),
+ (inner[1] - old_rect[1] - old_half).max(1.0),
+ (old_rect[2] - inner[2] - old_half).max(1.0),
+ (old_rect[3] - inner[3] - old_half).max(1.0),
+ ];
+ Some([inner[0] - base[0] - new_half, inner[1] - base[1] - new_half, inner[2] + base[2] + new_half, inner[3] + base[3] + new_half])
}
/// Change a comment's colour, opacity, line width and/or line endings, and redraw it.
@@ -576,10 +602,17 @@ pub fn set_style(doc: &mut Document, page: usize, index: usize, change: StyleCha
}
}
if let Some(w) = width {
+ let old_w = border_width_of(d);
+ let w = w.max(0.0);
let mut bs = d.get(b"BS").and_then(|b| b.as_dict()).cloned().unwrap_or_default();
- bs.set(b"W".to_vec(), Object::Real(w.max(0.0)));
+ bs.set(b"W".to_vec(), Object::Real(w));
d.set(b"BS".to_vec(), Object::Dict(bs));
d.remove(b"Border");
+ if d.name(b"Subtype") == Some(b"Ink")
+ && let Some(rect) = ink_rect_for_width(d, old_w, w)
+ {
+ d.set(b"Rect".to_vec(), num_array(&rect));
+ }
}
if let Some(ends) = endings {
if ends.len() == 1 {
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index a3dc14e262..cf800fa98a 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -2194,3 +2194,59 @@ fn degenerate_and_absurd_leader_and_caption_values_do_not_panic() {
assert!(long.contains(&format!("({}) Tj", "w".repeat(256))), "cut to 256");
assert!(!long.contains(&"w".repeat(257)));
}
+
+#[test]
+fn freehand_highlight_is_compatible_ink_with_marker_blending() {
+ let shape = Shape::FreehandHighlight { strokes: vec![vec![[20.0, 100.0], [120.0, 100.0]]] };
+ let mut annotation = new(0, shape.clone());
+ annotation.style = Style::default_for(&shape);
+ let mut doc = fixture();
+ let index = add_annotation(&mut doc, &annotation, &meta("marker")).unwrap();
+ let doc = reopen(&doc);
+ let ink = &list(&doc, 0)[index];
+
+ assert_eq!(ink.name(b"Subtype"), Some(&b"Ink"[..]));
+ assert_eq!(ink.name(b"IT"), Some(&b"FreehandHighlight"[..]));
+ assert_eq!(ink.get(b"CA").and_then(Object::as_f64), Some(0.35));
+ let ap = ink.get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+ let resources = doc.get(ap).as_dict().unwrap().get(b"Resources").cloned().unwrap();
+ let blend = resources.as_dict().unwrap().get(b"ExtGState").unwrap().as_dict().unwrap().get(b"GS0").unwrap().as_dict().unwrap();
+ assert_eq!(blend.name(b"BM"), Some(&b"Multiply"[..]));
+
+ let mut doc = doc;
+ let rect_of = |doc: &Document, idx: usize| -> Vec {
+ list(doc, 0)[idx].get(b"Rect").unwrap().as_array().unwrap().iter().filter_map(Object::as_f64).collect()
+ };
+ let rect_before = rect_of(&doc, index);
+ set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(34.0), endings: None }, &meta("wider")).unwrap();
+ let rect_after = rect_of(&doc, index);
+ assert!((rect_after[0] - (rect_before[0] - 10.0)).abs() < 1e-4);
+ assert!((rect_after[2] - (rect_before[2] + 10.0)).abs() < 1e-4);
+
+ // Repeated increase/decrease cycles must keep bounds stable and never accumulate padding.
+ set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(14.0), endings: None }, &meta("narrower")).unwrap();
+ let rect_restored = rect_of(&doc, index);
+ for (a, b) in rect_restored.iter().zip(rect_before.iter()) {
+ assert!((a - b).abs() < 1e-4, "expected {rect_before:?}, got {rect_restored:?}");
+ }
+ set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(34.0), endings: None }, &meta("wider-again")).unwrap();
+ let rect_second_wide = rect_of(&doc, index);
+ for (a, b) in rect_second_wide.iter().zip(rect_after.iter()) {
+ assert!((a - b).abs() < 1e-4, "expected {rect_after:?}, got {rect_second_wide:?}");
+ }
+
+ // Imported ink whose width is specified only by `/Border [0 0 20]` must use 20 pt as its
+ // previous width (shrinking by 5 pt on a decrease to 10 pt rather than expanding as if 1 pt).
+ let (_, r) = lookup::annot_ref(&mut doc, 0, index).unwrap();
+ doc.update_dict(r, |d| {
+ d.remove(b"BS");
+ d.set(b"Border".to_vec(), Object::Array(vec![Object::Real(0.0), Object::Real(0.0), Object::Real(20.0)]));
+ d.set(b"Rect".to_vec(), create::num_array(&[5.0, 85.0, 135.0, 115.0]));
+ })
+ .unwrap();
+ set_style(&mut doc, 0, index, StyleChange { color: None, opacity: None, width: Some(10.0), endings: None }, &meta("border-shrink")).unwrap();
+ let rect_from_border = rect_of(&doc, index);
+ for (a, b) in rect_from_border.iter().zip([10.0, 90.0, 130.0, 110.0]) {
+ assert!((a - b).abs() < 1e-4, "expected [10, 90, 130, 110], got {rect_from_border:?}");
+ }
+}
diff --git a/crates/annot/src/types.rs b/crates/annot/src/types.rs
index bd3409b5ae..522995b9f9 100644
--- a/crates/annot/src/types.rs
+++ b/crates/annot/src/types.rs
@@ -355,6 +355,10 @@ pub enum Shape {
start: LineEnding,
end: LineEnding,
},
+ /// Translucent freehand highlighting, stored as ink with a distinct intent.
+ FreehandHighlight {
+ strokes: Vec>,
+ },
/// Freehand strokes (Draw tool).
Ink {
strokes: Vec>,
@@ -474,6 +478,7 @@ pub fn rect_quad(r: [f64; 4]) -> [f64; 8] {
}
impl Shape {
+ /// Return the PDF `/Subtype` name for this annotation shape.
pub fn subtype(&self) -> &'static str {
match self {
Shape::Note { .. } => "Text",
@@ -481,7 +486,7 @@ impl Shape {
Shape::Rectangle { .. } => "Square",
Shape::Oval { .. } => "Circle",
Shape::Line { .. } => "Line",
- Shape::Ink { .. } | Shape::Signature { .. } => "Ink",
+ Shape::Ink { .. } | Shape::FreehandHighlight { .. } | Shape::Signature { .. } => "Ink",
Shape::TextBox { .. } | Shape::Typewriter { .. } | Shape::Callout { .. } => "FreeText",
Shape::Mark { .. } | Shape::Stamp { .. } | Shape::CustomStamp { .. } | Shape::TypedSignature { .. } => "Stamp",
Shape::Redact { .. } => "Redact",
@@ -610,6 +615,7 @@ impl Style {
}
Shape::Callout { .. } => ([0.0, 0.0, 0.0], 1.0),
Shape::Caret { .. } | Shape::Attachment { .. } => ([0.0, 0.47, 0.84], 1.0),
+ Shape::FreehandHighlight { .. } => return Self { color: [1.0, 0.94, 0.0], opacity: 0.35, width: 14.0, fill: None },
Shape::Ink { .. } => ([0.0, 0.4, 0.87], 2.0),
Shape::TextBox { .. } | Shape::Typewriter { .. } => ([0.0, 0.0, 0.0], 0.0),
Shape::Mark { .. } => ([0.0, 0.0, 0.0], 1.5),
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 176946c175..92fd2775c9 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -21,6 +21,9 @@ them with the image's current orientation. Full turns retain its appearance, rec
and flips. Angles that are not multiples of 90 are refused without changing the document or
its undo/redo history.
+`page_add_text`, `content_update` and `text_edit` take per-line `aligns`. An `"inherit"` entry
+follows the box-level `align`; legacy `null` entries remain accepted with the same meaning.
+
`Content` is `Json(Value)` or `Png { data, width, height }`. Errors are `UnknownTool`, `InvalidArgs` (the call didn't match the schema) or `Failed` (a readable message for the agent).
## Conventions
@@ -199,6 +202,19 @@ undoable and survive saving/reopening. `image_hit` shares the UI's curve and hol
The bounds, limits and font requirements are in [existing-text editing](../../docs/editing-existing-text.md)
and [image editing](../../docs/editing-images.md).
+### Superscript and subscript normalization
+
+`text_script` changes characters to their Unicode superscript or subscript forms; it does not
+change the font size or baseline. For characters that have such forms, uniformly plain text
+toggles to the requested script, and uniformly scripted text toggles back to plain text.
+Characters without a matching form stay unchanged and do not determine the selection's state.
+
+A selection mixing plain and target-script characters normalizes to the requested script.
+For example, subscript changes `H₂2` to `H₂₂`, then to `H22` on the next call; superscript
+changes `Q²2` to `Q²²`, then to `Q22`. A second toggle does not reconstruct the original
+mixture. Each call is one undoable text edit: `edit_undo` restores the exact prior text,
+including its original mixture. Save/reopen preserves the resulting normalized characters.
+
## Opening local GoToR links
`link_open {doc, page, index, password?}` follows a local PDF link using `link_list`
diff --git a/crates/automation/src/a11y/documents.rs b/crates/automation/src/a11y/documents.rs
index e52768d535..295502215a 100644
--- a/crates/automation/src/a11y/documents.rs
+++ b/crates/automation/src/a11y/documents.rs
@@ -15,7 +15,7 @@ impl Automation {
if !export.truncated_pages.is_empty() {
use pdfcraft_engine::compare::{MAX_FORM_DEPTH, MAX_FORM_VISITS};
out["warnings"] = json!([format!(
- "forms nested more than {MAX_FORM_DEPTH} deep, or past the first {MAX_FORM_VISITS} forms of a page (forms the page draws itself count too), were left out on the pages in truncated_pages: their text and images are missing from the export, although the viewer may still show them"
+ "pictures past what one export may hold or decode, or forms nested more than {MAX_FORM_DEPTH} deep, or past the first {MAX_FORM_VISITS} forms of a page (forms the page draws itself count too), were left out on the pages in truncated_pages: their text and images are missing from the export, although the viewer may still show them"
)]);
}
Ok(out)
diff --git a/crates/automation/src/comments.rs b/crates/automation/src/comments.rs
index f87fd0b58e..5dbd5b8542 100644
--- a/crates/automation/src/comments.rs
+++ b/crates/automation/src/comments.rs
@@ -183,6 +183,7 @@ impl Automation {
"page": c.page + 1,
"index": c.index + 1,
"type": c.subtype,
+ "intent": c.intent,
"author": c.author,
"contents": c.contents,
"modified": c.modified,
@@ -328,7 +329,7 @@ impl Automation {
let [start, end] = ending_pair(kind, endings.as_deref())?;
Shape::Line { from: to_user(&info, f[0], f[1]), to: to_user(&info, t[0], t[1]), start, end }
}
- "ink" => {
+ "ink" | "freehand_highlight" => {
let wrong = || ToolError::InvalidArgs("strokes must be an array of arrays of [x, y] points".into());
let strokes = a.get("strokes").ok_or_else(|| ToolError::InvalidArgs("ink needs `strokes`".into()))?;
let strokes = strokes
@@ -346,7 +347,7 @@ impl Automation {
.collect::>>()
})
.collect::>>()?;
- Shape::Ink { strokes }
+ if kind == "freehand_highlight" { Shape::FreehandHighlight { strokes } } else { Shape::Ink { strokes } }
}
"polygon" | "cloud" | "polyline" => {
let wrong = || ToolError::InvalidArgs(format!("{kind} needs `points`: an array of [x, y] points"));
diff --git a/crates/automation/src/content.rs b/crates/automation/src/content.rs
index 7518072d1c..6b25c31f61 100644
--- a/crates/automation/src/content.rs
+++ b/crates/automation/src/content.rs
@@ -83,10 +83,10 @@ pub(crate) fn parse_align(al: &str) -> Result {
/// Most entries `aligns` takes: one per paragraph, and no text has this many.
const MAX_ALIGNS: usize = 4096;
-/// `aligns`: each paragraph's (line's) own alignment, or null where it follows `align`.
+/// `aligns`: each paragraph's (line's) own alignment, or inherit/null where it follows `align`.
pub(crate) fn opt_aligns(a: &Args) -> Result>>> {
let Some(v) = a.get("aligns") else { return Ok(None) };
- let items = v.as_array().ok_or_else(|| bad("aligns must be an array of left, center, right, justify or null"))?;
+ let items = v.as_array().ok_or_else(|| bad("aligns must be an array of left, center, right, justify, inherit or null"))?;
if items.len() > MAX_ALIGNS {
return Err(bad(format!("aligns takes at most {MAX_ALIGNS} entries")));
}
@@ -94,8 +94,9 @@ pub(crate) fn opt_aligns(a: &Args) -> Result>>> {
.iter()
.map(|v| match v {
Value::Null => Ok(None),
+ Value::String(s) if s == "inherit" => Ok(None),
Value::String(s) => parse_align(s).map(Some),
- _ => Err(bad("each entry of aligns is left, center, right, justify or null")),
+ _ => Err(bad("each entry of aligns is left, center, right, justify, inherit or null")),
})
.collect::>>()
.map(Some)
diff --git a/crates/automation/src/dispatch.rs b/crates/automation/src/dispatch.rs
index 36e0d00454..49d4e6fd4d 100644
--- a/crates/automation/src/dispatch.rs
+++ b/crates/automation/src/dispatch.rs
@@ -12,6 +12,35 @@ pub enum Content {
Png { data: Vec, width: u32, height: u32 },
}
+/// `image_edit` `transform`: a matrix `[a b c d e f]` acting on top-left-origin points (a point
+/// moves to `(a·x + c·y + e, b·x + d·y + f)`) → the same motion in PDF user space, which is
+/// what `ImageEdit::Transform` applies after the image's placement. Both spaces are related by
+/// an affine map, so three corners of the crop box pin the result down.
+fn view_transform_to_user(info: &pdfcraft_render::PageInfo, m: [f64; 6]) -> Result<[f64; 6]> {
+ let [a, b, c, d, e, f] = m;
+ let det = a * d - b * c;
+ if !m.iter().all(|v| v.is_finite()) || !det.is_finite() || det.abs() < 1e-9 {
+ return Err(ToolError::InvalidArgs("transform needs a finite matrix that keeps an area (a·d − b·c must not be 0)".into()));
+ }
+ let moved = |x: f32, y: f32| {
+ let [vx, vy] = info.user_to_view(x, y).map(f64::from);
+ info.view_to_user((a * vx + c * vy + e) as f32, (b * vx + d * vy + f) as f32).map(f64::from)
+ };
+ let [x0, y0, x1, y1] = info.crop;
+ let (w, h) = (f64::from(x1 - x0), f64::from(y1 - y0));
+ if w.abs() < 1e-3 || h.abs() < 1e-3 {
+ return Err(ToolError::InvalidArgs("the page has no area to transform in".into()));
+ }
+ let (o, px, py) = (moved(x0, y0), moved(x1, y0), moved(x0, y1));
+ let (ua, ub, uc, ud) = ((px[0] - o[0]) / w, (px[1] - o[1]) / w, (py[0] - o[0]) / h, (py[1] - o[1]) / h);
+ let (x0, y0) = (f64::from(x0), f64::from(y0));
+ let user = [ua, ub, uc, ud, o[0] - ua * x0 - uc * y0, o[1] - ub * x0 - ud * y0];
+ if !user.iter().all(|v| v.is_finite()) {
+ return Err(ToolError::InvalidArgs("the transform moves the image too far".into()));
+ }
+ Ok(user)
+}
+
impl Automation {
/// Run the tool `name` with JSON `args` (an object; `null` means no arguments).
pub fn call(&mut self, name: &str, args: &Value) -> Result> {
@@ -294,13 +323,13 @@ impl Automation {
let id = self.doc(&a)?.id;
let before = self.doc(&a)?.bytes.len();
let path = self.resolve(a.str("path")?, true)?;
- let (bytes, merged) = self.session.reduced_bytes(id).map_err(failed)?;
+ let (bytes, merged, images_refused) = self.session.reduced_bytes(id).map_err(failed)?;
// As in the app, a copy that isn't smaller is not written (#490).
let written = bytes.len() < before;
if written {
write_atomic(&path, &bytes)?;
}
- json!({ "path": path.to_string_lossy(), "written": written, "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged })
+ json!({ "path": path.to_string_lossy(), "written": written, "bytes_before": before, "bytes_after": bytes.len(), "merged_objects": merged, "images_refused": images_refused })
}
"doc_optimize" => self.doc_optimize(&a)?,
"doc_initial_view" => self.doc_initial_view(&a)?,
@@ -357,7 +386,7 @@ impl Automation {
let (u, v) = (info.user_to_view(rect[0] as f32, rect[1] as f32), info.user_to_view(rect[2] as f32, rect[3] as f32));
[r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))]
});
- json!({ "visible_rect": visible, "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
+ json!({ "visible_rect": visible, "has_editor_crop": im.has_editor_crop(), "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
})
.collect();
json!({ "page": page + 1, "count": list.len(), "images": list })
@@ -395,6 +424,16 @@ impl Automation {
let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
ImageEdit::Move([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
}
+ "transform" => {
+ let m: Vec = a
+ .get("matrix")
+ .and_then(Value::as_array)
+ .and_then(|x| x.iter().map(Value::as_f64).collect())
+ .ok_or_else(|| ToolError::InvalidArgs("transform needs matrix: 6 numbers [a, b, c, d, e, f]".into()))?;
+ let m = <[f64; 6]>::try_from(m)
+ .map_err(|_| ToolError::InvalidArgs("transform needs matrix: 6 numbers [a, b, c, d, e, f]".into()))?;
+ ImageEdit::Transform(view_transform_to_user(&self.doc(&a)?.info.pages[page], m)?)
+ }
"rotate_by" => ImageEdit::RotateBy(
a.get("degrees")
.and_then(Value::as_f64)
@@ -410,9 +449,18 @@ impl Automation {
let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
ImageEdit::Crop([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
}
- "flip_horizontal" => ImageEdit::Flip { horizontal: true },
- "flip_vertical" => ImageEdit::Flip { horizontal: false },
+ action @ ("flip_horizontal" | "flip_vertical") => {
+ let horizontal = action == "flip_horizontal";
+ let info = self.doc(&a)?.info.pages.get(page).ok_or_else(|| ToolError::InvalidArgs("the page does not exist".into()))?;
+ // The tool names displayed axes; the engine names PDF user-space axes.
+ ImageEdit::Flip { horizontal: horizontal ^ (info.rotation % 180 == 90) }
+ }
"delete" => ImageEdit::Delete,
+ "bring_to_front" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+ "send_to_back" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendToBack),
+ "bring_forward" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringForward),
+ "send_backward" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendBackward),
+ "remove_crop" => ImageEdit::RemoveCrop,
"replace" => {
let path = self.resolve(a.str("path")?, false)?;
let bytes = read_input(&path)?;
@@ -624,6 +672,7 @@ impl Automation {
}
out
}
+ "text_script" => self.text_script(&a)?,
"doc_audit_space" => {
let rows: Vec = self
.doc(&a)?
@@ -815,4 +864,52 @@ impl Automation {
};
Ok(vec![Content::Json(out)])
}
+
+ /// `text_script`: Format text ▸ Superscript or Subscript on a paragraph, or on a byte range
+ /// of its editor text, written as `text_edit` writes the paragraph.
+ fn text_script(&mut self, a: &Args) -> Result {
+ use pdfcraft_engine::text_script::{Script, toggle};
+ let name = a.str("script")?;
+ let script = match name {
+ "superscript" => Script::Super,
+ "subscript" => Script::Sub,
+ other => return Err(ToolError::InvalidArgs(format!("unknown script {other:?} (superscript, subscript)"))),
+ };
+ let page = self.page(a)?;
+ let k = a.int("paragraph")?;
+ let text = {
+ let doc = self.doc(a)?;
+ let blocks = doc.text_blocks(page);
+ let index = self.paragraph_index(doc.id, page, k, &blocks)?;
+ blocks.get(index).map(|b| b.editor_text.clone()).ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range")))?
+ };
+ let range = match a.opt_ints("range")? {
+ None => None,
+ Some(r) => {
+ let bounds = match r.as_slice() {
+ [start, end] => usize::try_from(*start).ok().zip(usize::try_from(*end).ok()),
+ _ => None,
+ };
+ let range = bounds
+ .map(|(start, end)| start..end)
+ .filter(|r| r.start < r.end && r.end <= text.len() && text.is_char_boundary(r.start) && text.is_char_boundary(r.end));
+ let Some(range) = range else {
+ return Err(ToolError::InvalidArgs(format!(
+ "range must be [start, end]: UTF-8 byte offsets of the paragraph's editor_text (from text_paragraphs) with start < end <= {}, on character boundaries",
+ text.len()
+ )));
+ };
+ Some(range)
+ }
+ };
+ let (toggled, _) = toggle(&text, range.as_ref(), script)
+ .ok_or_else(|| ToolError::InvalidArgs(format!("nothing to change: no character of the text has a {name} form")))?;
+ let args = json!({ "doc": a.get("doc"), "page": a.get("page"), "paragraph": k, "text": toggled });
+ let mut out = match self.call("text_edit", &args)?.into_iter().next() {
+ Some(Content::Json(out)) => out,
+ _ => json!({}),
+ };
+ out["script"] = json!(name);
+ Ok(out)
+ }
}
diff --git a/crates/automation/src/documents.rs b/crates/automation/src/documents.rs
index 859c92da48..979b041a73 100644
--- a/crates/automation/src/documents.rs
+++ b/crates/automation/src/documents.rs
@@ -410,6 +410,7 @@ impl Automation {
"images": o.images,
"images_resampled": o.images_resampled,
"images_recompressed": o.images_recompressed,
+ "images_refused": o.images_refused,
"image_bytes_before": o.image_bytes_before,
"image_bytes_after": o.image_bytes_after,
"thumbnails": o.thumbnails,
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index aa30801bfe..c542de957d 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -175,7 +175,7 @@ pub fn tools() -> Vec {
}), &["doc", "page"])),
t("object_list", "List editable objects", "List existing paragraphs, Image/Form artwork and added content once, with source kind/index references, displayed rectangles and document generation. Indexes change when content changes; use generation in object_move to reject stale references.")
.ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1}}), &["doc","page"])),
- t("object_move", "Move objects together", "Atomically translate 1–1000 mixed references from object_list by [dx, dy] in displayed points (right/down). Preserves glyph codes, fonts, image data and relative spacing; success is one undo step. Clipping and vertical text are refused. A bad/stale reference refuses the entire move.")
+ t("object_move", "Move objects together", "Atomically translate 1–1000 mixed references from object_list by [dx, dy] in displayed points (right/down). Preserves glyph codes, fonts, image data and relative spacing; success is one undo step. Text used as a clipping path and vertical text are refused. A bad/stale reference refuses the entire move.")
.with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},
"objects":{"type":"array","minItems":1,"maxItems":1000,"uniqueItems":true,"items":{
"type":"object","properties":{"kind":{"type":"string","enum":["added","text","image"]},"index":{"type":"integer","minimum":1}},"required":["kind","index"],"additionalProperties":false}},
@@ -637,7 +637,7 @@ pub fn tools() -> Vec {
"font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
"bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
"align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
- "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+ "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
"char_spacing": { "type": "number", "minimum": -500, "maximum": 500, "description": "Points after each character." },
}),
&["doc", "page", "text"],
@@ -660,7 +660,7 @@ pub fn tools() -> Vec {
"font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
"bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
"align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
- "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+ "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
"char_spacing": { "type": "number", "minimum": -500, "maximum": 500, "description": "Points after each character." },
"rotate": { "type": "integer" }, "flip_h": { "type": "boolean" }, "flip_v": { "type": "boolean" },
"crop": { "type": "array", "items": { "type": "number", "minimum": 0, "maximum": 0.95 }, "minItems": 4, "maxItems": 4, "description": "Fractions trimmed: left, bottom, right, top. Left and right together, and bottom and top together, trim at most 0.95." },
@@ -754,7 +754,7 @@ pub fn tools() -> Vec {
json!({
"doc": doc(),
"page": { "type": "integer", "minimum": 1 },
- "type": { "type": "string", "enum": ["note", "highlight", "underline", "strikeout", "squiggly", "replace", "rectangle", "oval", "line", "arrow", "ink", "textbox", "stamp", "polygon", "cloud", "polyline", "callout", "caret", "attachment"] },
+ "type": { "type": "string", "enum": ["note", "highlight", "underline", "strikeout", "squiggly", "replace", "rectangle", "oval", "line", "arrow", "ink", "freehand_highlight", "textbox", "stamp", "polygon", "cloud", "polyline", "callout", "caret", "attachment"] },
"path": { "type": "string", "description": "attachment: the file to attach." },
"points": { "type": "array", "items": point(), "minItems": 2 },
"knee": point(),
@@ -1194,7 +1194,7 @@ pub fn tools() -> Vec {
json!({ "doc": doc(), "field": { "type": "string" }, "event": { "type": "string", "enum": ["keystroke", "format", "validate", "calculate", "mouse_up"] }, "script": { "type": "string" } }),
&["doc", "field", "event"],
)),
- t("doc_export_office", "Export to Word, PowerPoint, HTML, RTF or Markdown", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline), RTF (.rtf) or Markdown (.md or .markdown: pipe tables, images left out), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit are listed in truncated_pages, with a warning; the text and images of the forms left out are missing.")
+ t("doc_export_office", "Export to Word, PowerPoint, HTML, RTF or Markdown", "Export a PDF ▸ Word (.docx), PowerPoint (.pptx, one slide per page), HTML (.html, one file with images inline), RTF (.rtf) or Markdown (.md or .markdown: pipe tables, images left out), chosen by path's extension: text, headings, bold and italic. Word uses borderless inferred tables and positioned editable shapes on pages with artwork, rotated or large text; each source page retains its size. Font matching and vector graphics remain limited. Export reads forms 50 deep and up to 50 000 a page, counting forms the page draws itself. Pages that go past either limit, or that have pictures past what one export may hold or decode, are listed in truncated_pages, with a warning; what was left out is missing.")
.cmd("export.docx")
.with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
t("pdfa_verify", "Verify PDF/A", "Standards ▸ Verify PDF/A compliance: the PDF/A-2b or 3b rules the document breaks (ISO 19005 clause, message, page, whether Save as PDF/A can fix it), plus what it declares.")
@@ -1281,7 +1281,7 @@ pub fn tools() -> Vec {
.ro()
.cmd("ocr.recognize")
.with(schema(json!({}), &[])),
- t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`_Page__Image_.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, JBIG2 inside other filters, separations) are listed under skipped. Includes unsaved edits.")
+ t("doc_export_all_images", "Export all images", "Write the images that pages use into a folder (`_Page__Image_.jpg|png`, n zero-padded to the page count's digits), each once: JPEG images unchanged, others as PNG with their soft mask as alpha. min_size skips images with fewer pixels on their shorter side. Images that can't be decoded yet (JPEG 2000, separations), or past what one export may decode or hold, are listed under skipped, with the reason. Includes unsaved edits.")
.cmd("export.all_images")
.with(schema(
json!({
@@ -1340,7 +1340,7 @@ pub fn tools() -> Vec {
}),
&["from"],
)),
- t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. The open document is unchanged.")
+ t("doc_reduce", "Reduce file size", "Write a smaller copy of the document to `path` with Acrobat's Reduce File Size choices: colour and grey images above 225 ppi downsampled to 150 ppi and JPEG-compressed (medium quality), black-and-white images averaged down to 300 ppi above 450 ppi and each stored as CCITT Group 4 (or 1-bit Flate, once resampled or packed from more bits) whenever that is smaller, thumbnails dropped, identical fonts and images merged, unused objects dropped, compressed object streams. If the copy wouldn't be smaller, nothing is written and `written` is false. Images past what one run may decode stay as they are, counted in images_refused; streams it only stores with Flate past that stay LZW, uncounted. The open document is unchanged.")
.cmd("optimize.reduce")
.with(schema(json!({ "doc": doc(), "path": { "type": "string" } }), &["doc", "path"])),
t("doc_initial_view", "Initial view", "Read or change how the document opens (Document Properties ▸ Initial View) and its reading options: navigation (page, bookmarks, pages, attachments, layers), layout (default, single, continuous, two_up, two_up_continuous, two_up_cover, two_up_continuous_cover), magnification (default, actual, fit_page, fit_width, fit_height, fit_visible, or a percentage), page, window options (fit_window, center_window, full_screen, display_title), interface options (hide_menubar, hide_toolbar, hide_window_ui), language and binding (left, right). Only the given ones change; returns the result. Undoable.").with(schema(
@@ -1378,17 +1378,18 @@ pub fn tools() -> Vec {
.ro()
.cmd("edit.edit_text")
.with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
- t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), crop (rect: the part to keep, top-left-origin points; the pixels stay in place and page_images.visible_rect shows the result; a later move carries the crop along), rotate (quarters clockwise, default 1), rotate_by (degrees: any angle clockwise about the visible centre; the box in page_images then becomes the turned image's bounding box), flip_horizontal, flip_vertical, replace (path: an image file, drawn in the same place) or delete. Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
+ t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), crop (rect: the part to keep, top-left-origin points; the pixels stay in place and page_images.visible_rect shows the result; a later move carries the crop along), remove_crop (remove a crop created by PdfCraft while preserving clipping paths from the original document), rotate (quarters clockwise, default 1), rotate_by (degrees: any angle clockwise about the visible centre; the box in page_images then becomes the turned image's bounding box), transform (matrix: 6 numbers [a, b, c, d, e, f] in top-left-origin points, applied after the current placement so a point (x, y) of the image moves to (a·x + c·y + e, b·x + d·y + f); finite, with a·d − b·c not 0; the box in page_images becomes the transformed image's bounding box), flip_horizontal (reflect left/right on the displayed page), flip_vertical (reflect top/bottom on the displayed page; both flip actions follow the page rotation), replace (path: an image file, drawn in the same place), delete, or arrange: bring_to_front, send_to_back, bring_forward, send_backward (reorder stacking order among content on the page; errors when the image is already at the requested limit; arranging an added image converts it into an ordinary page image). Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
.cmd("edit.edit_text")
.with(schema(
json!({
"doc": doc(),
"page": { "type": "integer", "minimum": 1 },
"image": { "type": "integer", "minimum": 1 },
- "action": { "type": "string", "enum": ["move", "crop", "rotate", "rotate_by", "flip_horizontal", "flip_vertical", "replace", "delete"] },
+ "action": { "type": "string", "enum": ["move", "crop", "rotate", "rotate_by", "transform", "flip_horizontal", "flip_vertical", "replace", "delete", "bring_to_front", "send_to_back", "bring_forward", "send_backward", "remove_crop"] },
"rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4 },
"quarters": { "type": "integer" },
"degrees": { "type": "number" },
+ "matrix": { "type": "array", "items": { "type": "number" }, "minItems": 6, "maxItems": 6 },
"path": { "type": "string" },
}),
&["doc", "page", "image", "action"],
@@ -1428,7 +1429,7 @@ pub fn tools() -> Vec {
"size": { "type": "number", "exclusiveMinimum": 0 },
"color": { "type": "string", "description": "#rrggbb" },
"align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
- "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+ "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
"underline": { "type": "boolean" },
"line_spacing": { "type": "number", "description": "Multiple of the font size (1.2 is ordinary)." },
"dx": { "type": "number", "description": "Paragraph only: move right by this many points (negative: left)." },
@@ -1438,11 +1439,19 @@ pub fn tools() -> Vec {
"scale": { "type": "number", "description": "Horizontal scale in percent." } }),
&["doc", "page"],
)),
+ t("text_script", "Superscript or subscript", "Format text ▸ Superscript or Subscript on one paragraph (paragraph, from text_paragraphs), or on range [start, end): UTF-8 byte offsets of its editor_text. The characters take the Unicode superscript or subscript forms (2 → ², 2 → ₂; the font must have those glyphs, and extracted text contains them); text already in that script goes back to plain characters. Characters Unicode has no such form for (q, a space) stay unchanged and do not determine the selection's script state. Mixed plain and target-script characters normalize to that script, then to plain text on the next call (H₂2 → H₂₂ → H22); a second toggle does not reconstruct the original mixture. Use Undo to restore the exact prior text. The paragraph is then rewritten as text_edit rewrites it, with the same result fields. Refused when no character would change. Undoable. Mathematical minus U+2212 has its own script mapping; ASCII hyphen-minus stays unchanged.")
+ .cmd("edit.edit_text")
+ .with(schema(
+ json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "paragraph": { "type": "integer", "minimum": 1 },
+ "script": { "type": "string", "enum": ["superscript", "subscript"] },
+ "range": { "type": "array", "items": { "type": "integer", "minimum": 0 }, "minItems": 2, "maxItems": 2, "description": "UTF-8 byte offsets [start, end) of the paragraph's editor_text; the whole paragraph when omitted." } }),
+ &["doc", "page", "paragraph", "script"],
+ )),
t("doc_revisions", "List revisions", "List the document's saved revisions (oldest first): each incremental update is one. Returns revision number, where it ends in the file and its size, and which signatures sign exactly that revision.")
.with(schema(json!({ "doc": doc() }), &["doc"])),
t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
.with(schema(json!({ "doc": doc(), "revision": { "type": "integer", "minimum": 1 } }), &["doc", "revision"])),
- t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|jbig2|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 or JBIG2 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, Group 3 fax images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT and any other becoming Flate). Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
+ t("doc_optimize", "Optimize PDF", "Write an optimized copy to `path` (Acrobat's PDF Optimizer). preset: standard (default; Reduce File Size's choices) or mobile (images to 96 ppi above 144, JPEG high quality); the options below change it. compatibility: retain (default; keeps the document's version, or 1.5 when object streams are written), 1.4, 1.5, 1.6, 1.7 or 2.0. merge_fragments (default true) first puts a page picture drawn as many stacked image strips (as some PDF printers write it) back together into one image, so it can be resampled (merged_images, fragments_merged). color / gray: { downsample, ppi, above_ppi, compression: jpeg|zip|retain, quality 1–100 } (defaults: downsample to 150 ppi above 225, JPEG 60). mono: { downsample, ppi, above_ppi, compression: ccitt_g4|jbig2|retain } for black-and-white images and image masks (default: averaged down to 300 ppi above 450 ppi, counted in images_resampled; stored losslessly as CCITT Group 4 or JBIG2 (or 1-bit Flate, once resampled or packed from more bits) when that is smaller, Group 3 fax images, JBIG2 images, black-and-white RGB and indexed images using only palette entries 0 and 1 among them, counted in images_recompressed; retain resamples only, a CCITT image staying CCITT, a JBIG2 image JBIG2 and any other becoming Flate). Images past what one run may decode stay as they are, counted in images_refused; streams it only stores with Flate past that stay LZW, uncounted. Images are measured where pages draw them and replaced only when smaller. discard_*: thumbnails (default true), alternate_images (true), tags, print_settings; flate_unencoded (true); object_streams (default true; always off for 1.4); lzw_to_flate (true) decodes LZW streams and stores them with Flate instead, leaving any it cannot decode unchanged (lzw_streams counts the streams converted); remove_invalid_links and remove_unreferenced_dests (true); images and forms the pages list but never draw are always dropped (unused_xobjects). discard: Remove Hidden Information categories (metadata, attachments, comments, form-fields, hidden-text, hidden-layers, bookmarks, links-actions-scripts, private-data). Signed documents are refused. The open document is unchanged.")
.cmd("optimize.advanced")
.with(schema(
json!({
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index 133e31022b..2f208b04bd 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -664,6 +664,44 @@ fn tool_table_is_well_formed() {
}
}
+fn assert_homogeneous_enums(schema: &Value, path: &str) {
+ fn json_kind(value: &Value) -> &'static str {
+ match value {
+ Value::Null => "null",
+ Value::Bool(_) => "boolean",
+ Value::Number(_) => "number",
+ Value::String(_) => "string",
+ Value::Array(_) => "array",
+ Value::Object(_) => "object",
+ }
+ }
+
+ if let Some(values) = schema.get("enum").and_then(Value::as_array) {
+ let first = values.first().map(json_kind);
+ assert!(values.iter().map(json_kind).all(|kind| Some(kind) == first), "mixed enum types at {path}: {values:?}");
+ }
+ match schema {
+ Value::Object(object) => {
+ for (key, child) in object {
+ assert_homogeneous_enums(child, &format!("{path}.{key}"));
+ }
+ }
+ Value::Array(array) => {
+ for (index, child) in array.iter().enumerate() {
+ assert_homogeneous_enums(child, &format!("{path}[{index}]"));
+ }
+ }
+ _ => {}
+ }
+}
+
+#[test]
+fn tool_schema_enums_have_one_json_type() {
+ for tool in tools() {
+ assert_homogeneous_enums(&tool.input_schema, tool.name);
+ }
+}
+
#[test]
fn explicit_font_and_disjoint_ranges_save_reopen_through_tools() {
let dir = workdir("font-ranges");
@@ -2111,6 +2149,27 @@ fn comments_through_tools() {
save_and_reopen_comments(&dir, &mut a, doc);
}
+#[test]
+fn freehand_highlight_through_tools() {
+ let dir = workdir("freehand-highlight");
+ let mut a = auto(&dir);
+ let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+ ok(
+ &mut a,
+ "comment_add",
+ json!({ "doc": doc, "page": 1, "type": "freehand_highlight", "width": 100,
+ "strokes": [[[20, 100], [120, 100]]] }),
+ );
+ let list = ok(&mut a, "comment_list", json!({ "doc": doc }));
+ assert_eq!(list["count"], 1);
+ assert_eq!(list["comments"][0]["type"], "Ink");
+ assert_eq!(list["comments"][0]["intent"], "FreehandHighlight");
+ assert_eq!(list["comments"][0]["color"], "#FFF000");
+ let undone = ok(&mut a, "edit_undo", json!({ "doc": doc }));
+ assert_eq!(undone["undone"], "Add freehand highlight");
+ assert_eq!(ok(&mut a, "comment_list", json!({ "doc": doc }))["count"], 0);
+}
+
fn add_comment_examples(a: &mut Automation, doc: u64) -> String {
// "Page 2" sits at y = 150 (user space) = 150 from the top of the 300 pt page.
let hl = ok(a, "comment_add", json!({ "doc": doc, "page": 2, "type": "highlight", "find": "page 2", "contents": "check", "author": "Ada" }));
@@ -3286,6 +3345,39 @@ fn editing_existing_text_through_tools() {
assert_eq!(p["lines"].as_array().map(Vec::len), Some(2), "{p}");
}
+/// Format text ▸ Superscript and Subscript without the GUI: a range, then back again over a space
+/// (which has no superscript form), each one undo step; refusals change nothing.
+#[test]
+fn superscript_and_subscript_through_tools() {
+ let dir = workdir("text-script");
+ let mut a = auto(&dir);
+ let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+ let paragraph =
+ |a: &mut Automation| ok(a, "text_paragraphs", json!({ "doc": doc, "page": 2 }))["paragraphs"][0]["text"].as_str().unwrap().to_string();
+ let script = |script: &str, range: Value| json!({ "doc": doc, "page": 2, "paragraph": 1, "script": script, "range": range });
+ // "Page 2": the 2 is byte 5.
+ let r = ok(&mut a, "text_script", script("superscript", json!([5, 6])));
+ assert_eq!((r["script"].as_str(), r["paragraph"]["text"].as_str()), (Some("superscript"), Some("Page ²")), "{r}");
+ assert_eq!(page_text(&mut a, doc)[1], "Page ²");
+ // " ²": the space has no superscript form, and the range still toggles back.
+ ok(&mut a, "text_script", script("superscript", json!([4, 7])));
+ assert_eq!(paragraph(&mut a), "Page 2");
+ assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Edit text");
+ assert_eq!(paragraph(&mut a), "Page ²");
+ // Refused, changing nothing: a range that splits ², one past the end, an empty one, a range
+ // with nothing that has a subscript form, an unknown script.
+ for (name, range) in [
+ ("superscript", json!([5, 6])),
+ ("superscript", json!([0, 99])),
+ ("superscript", json!([3, 3])),
+ ("subscript", json!([4, 5])),
+ ("italic", json!([0, 1])),
+ ] {
+ assert!(matches!(a.call("text_script", &script(name, range.clone())), Err(ToolError::InvalidArgs(_))), "{name} {range}");
+ }
+ assert_eq!(paragraph(&mut a), "Page ²");
+}
+
#[test]
fn styled_cyrillic_fallback_is_batched_through_tools_and_reopen() {
if pdfcraft_fonts::document_japanese_font().is_none() {
@@ -3453,6 +3545,13 @@ fn editing_page_images_through_tools() {
assert_eq!(cropped["visible_rect"], json!([10.0, 10.0, 25.0, 30.0]));
ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "rotate" }));
ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "flip_horizontal" }));
+ // A single image is already in front and at the back; no-op arrange is refused without dirtying undo.
+ assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "bring_to_front" })).is_err());
+ assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "send_to_back" })).is_err());
+ assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "bring_forward" })).is_err());
+ assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "send_backward" })).is_err());
+ let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "remove_crop" }));
+ assert_eq!(r["undo"], "Remove crop");
// Any angle: the box grows to the turned picture's bounds, and it undoes like a quarter turn.
let before = ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0]["rect"].clone();
let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "rotate_by", "degrees": 30.5 }));
@@ -3472,6 +3571,80 @@ fn editing_page_images_through_tools() {
assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "delete" })), Err(ToolError::InvalidArgs(_))));
}
+#[test]
+fn arranging_page_images_through_tools() {
+ let dir = workdir("arrange-page-images");
+ let mut a = auto(&dir);
+ let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+ ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 18, "pages": [1, 2] }));
+ let made = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["src/a_page_1.png"] }))["doc"].as_u64().unwrap();
+ ok(&mut a, "page_add_image", json!({ "doc": made, "page": 1, "path": "src/a_page_2.png", "rect": [50, 50, 100, 100] }));
+ assert_eq!(ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["count"], 2);
+ let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "bring_to_front" }));
+ assert_eq!(r["undo"], "Bring to front");
+ let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 2, "action": "send_to_back" }));
+ assert_eq!(r["undo"], "Send to back");
+ ok(&mut a, "doc_save", json!({ "doc": made, "path": "arranged.pdf" }));
+ let reopened = ok(&mut a, "doc_open", json!({ "path": "arranged.pdf" }))["doc"].as_u64().unwrap();
+ let after_reopen = ok(&mut a, "page_images", json!({ "doc": reopened, "page": 1 }));
+ assert_eq!(after_reopen["count"], 2);
+ assert_eq!(after_reopen["images"][0]["rect"], json!([0.0, 0.0, 50.0, 75.0]));
+ assert_eq!(after_reopen["images"][1]["rect"], json!([50.0, 50.0, 100.0, 100.0]));
+}
+
+/// The transform a rotated-image resize sends (`ImageEdit::Transform`) is reachable headlessly,
+/// in the same top-left-origin points as the other image tools, also on a turned page.
+#[test]
+fn transforming_page_images_through_tools() {
+ let dir = workdir("transform-page-images");
+ let mut a = auto(&dir);
+ let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+ ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 18, "pages": [1] }));
+ let made = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["src/a_page_1.png"] }))["doc"].as_u64().unwrap();
+ let rect = |a: &mut Automation| ok(a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0]["rect"].clone();
+ let transform =
+ |a: &mut Automation, m: Value| ok(a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "transform", "matrix": m }));
+ ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "move", "rect": [5, 5, 25, 35] }));
+
+ // Right 10, down 20.
+ assert_eq!(transform(&mut a, json!([1, 0, 0, 1, 10, 20]))["undo"], "Transform image");
+ assert_eq!(rect(&mut a), json!([15.0, 25.0, 35.0, 55.0]));
+ // Twice the size about the top-left corner of the page.
+ transform(&mut a, json!([2, 0, 0, 2, 0, 0]));
+ assert_eq!(rect(&mut a), json!([30.0, 50.0, 70.0, 110.0]));
+ // A quarter turn, (x, y) → (200 − y, x): the box turns with it, and it undoes in one step.
+ transform(&mut a, json!([0, 1, -1, 0, 200, 0]));
+ assert_eq!(rect(&mut a), json!([90.0, 30.0, 150.0, 70.0]));
+ ok(&mut a, "edit_undo", json!({ "doc": made }));
+ assert_eq!(rect(&mut a), json!([30.0, 50.0, 70.0, 110.0]));
+
+ // On a turned page "right" is still right on screen.
+ ok(&mut a, "page_rotate", json!({ "doc": made, "pages": [1], "degrees": 90 }));
+ let numbers = |v: Value| [0, 1, 2, 3].map(|i| v[i].as_f64().unwrap());
+ let [x0, y0, x1, y1] = numbers(rect(&mut a));
+ transform(&mut a, json!([1, 0, 0, 1, 10, 0]));
+ let after = numbers(rect(&mut a));
+ for (got, want) in after.into_iter().zip([x0 + 10.0, y0, x1 + 10.0, y1]) {
+ assert!((got - want).abs() < 0.015, "{after:?} is not ({x0}, {y0}, {x1}, {y1}) moved right by 10");
+ }
+
+ // Flat, non-finite, short and missing matrices are refused before anything changes.
+ let before = rect(&mut a);
+ for bad in [
+ json!([1, 2, 2, 4, 0, 0]),
+ json!([0, 0, 0, 0, 0, 0]),
+ json!([1e300, 0, 0, 1e300, 0, 0]),
+ json!([1, 0, 0, 1]),
+ json!([1, 0, "invalid", 0, 1, 10, 0]),
+ json!([1, 0, null, 0, 1, 10, 0]),
+ ] {
+ let r = a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "transform", "matrix": bad }));
+ assert!(matches!(r, Err(ToolError::InvalidArgs(_))), "{bad}: {r:?}");
+ }
+ assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "transform" })), Err(ToolError::InvalidArgs(_))));
+ assert_eq!(rect(&mut a), before);
+}
+
#[test]
fn enhance_camera_image_through_tools() {
let dir = workdir("enhance-camera");
@@ -6545,10 +6718,12 @@ fn optimizing_through_tools() {
let reduced = ok(&mut a, "doc_reduce", json!({ "doc": doc, "path": "reduced.pdf" }));
assert!(reduced["bytes_after"].as_u64().unwrap() < reduced["bytes_before"].as_u64().unwrap());
assert_eq!(reduced["written"], true);
+ assert_eq!(reduced["images_refused"], 0);
assert_eq!(std::fs::metadata(dir.join("reduced.pdf")).unwrap().len(), reduced["bytes_after"].as_u64().unwrap());
// Target PDF 1.4 (disables object streams) and PDF 2.0 (with object_streams toggled off).
let v14 = ok(&mut a, "doc_optimize", json!({ "doc": doc, "path": "v14.pdf", "compatibility": "1.4" }));
+ assert_eq!(v14["images_refused"], 0);
assert_eq!((v14["pdf_version"].as_str(), v14["object_streams"].as_bool()), (Some("1.4"), Some(false)), "{v14}");
let v14_bytes = std::fs::read(dir.join("v14.pdf")).unwrap();
assert!(v14_bytes.starts_with(b"%PDF-1.4\n") && !v14_bytes.windows(7).any(|w| w == b"/ObjStm"));
@@ -9831,7 +10006,11 @@ fn added_text_lines_take_their_own_alignments() {
let dir = workdir("paragraph-aligns");
let mut a = auto(&dir);
let id = ok(&mut a, "doc_create", json!({"from":"blank","width":600,"height":400}))["doc"].as_u64().unwrap();
- ok(&mut a, "page_add_text", json!({"doc":id,"page":1,"text":"Left line\nRight line","at":[40,50],"width":500,"size":12,"aligns":[null,"right"]}));
+ ok(
+ &mut a,
+ "page_add_text",
+ json!({"doc":id,"page":1,"text":"Left line\nRight line\nInherited line","at":[40,50],"width":500,"size":12,"aligns":[null,"right","inherit"]}),
+ );
let rect = |a: &mut Automation, text: &str| -> Vec {
let lines = ok(a, "text_lines", json!({"doc":id,"page":1}));
let line = lines["lines"].as_array().unwrap().iter().find(|l| l["text"] == text).cloned().unwrap();
@@ -9839,10 +10018,13 @@ fn added_text_lines_take_their_own_alignments() {
};
assert!((rect(&mut a, "Left line")[0] - 40.0).abs() < 1.0);
assert!((rect(&mut a, "Right line")[2] - 540.0).abs() < 1.0, "{:?}", rect(&mut a, "Right line"));
+ assert!((rect(&mut a, "Inherited line")[0] - 40.0).abs() < 1.0);
// The whole box centred: the right-aligned line goes with it.
ok(&mut a, "content_update", json!({"doc":id,"page":1,"index":1,"align":"center"}));
let right = rect(&mut a, "Right line");
assert!(((right[0] + right[2]) / 2.0 - 290.0).abs() < 1.0, "{right:?}");
+ let inherited = rect(&mut a, "Inherited line");
+ assert!(((inherited[0] + inherited[2]) / 2.0 - 290.0).abs() < 1.0, "{inherited:?}");
assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":["sideways"]})).is_err());
assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":"right"})).is_err());
}
@@ -10257,3 +10439,154 @@ fn simple_rule_scan_drawn(content: &[u8]) -> Vec {
}
write_full(&doc, &SaveOptions::default()).unwrap()
}
+
+#[test]
+fn editor_crop_group_move_and_arrange_survive_added_item_deletion_through_tools() {
+ let dir = workdir("editor-crop-group-arrange");
+ let mut a = auto(&dir);
+ let source = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+ ok(&mut a, "doc_export_images", json!({"doc":source,"folder":"src","dpi":18,"pages":[1]}));
+ let doc = ok(&mut a, "doc_create", json!({"from":"images","paths":["src/a_page_1.png"]}))["doc"].as_u64().unwrap();
+ ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":"move","rect":[5,5,25,35]}));
+ ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":"crop","rect":[10,10,20,30]}));
+ ok(&mut a, "page_add_text", json!({"doc":doc,"page":1,"text":"Movable label","rect":[2,40,45,55],"size":6}));
+ let inventory = ok(&mut a, "object_list", json!({"doc":doc,"page":1}));
+ let objects: Vec<_> = inventory["objects"].as_array().unwrap().iter().map(|o| json!({"kind":o["kind"],"index":o["index"]})).collect();
+ assert_eq!(objects.len(), 2);
+ let moved = ok(&mut a, "object_move", json!({"doc":doc,"page":1,"objects":objects,"offset":[3,4]}));
+ assert_eq!(moved["moved"], 2);
+ let picture = ok(&mut a, "page_images", json!({"doc":doc,"page":1}))["images"][0].clone();
+ assert_eq!(picture["rect"], json!([8.0, 9.0, 28.0, 39.0]));
+ assert_eq!(picture["visible_rect"], json!([13.0, 14.0, 23.0, 34.0]));
+ assert!(page_text(&mut a, doc)[0].contains("Movable label"));
+ ok(&mut a, "edit_undo", json!({"doc":doc}));
+ assert_eq!(ok(&mut a, "page_images", json!({"doc":doc,"page":1}))["images"][0]["visible_rect"], json!([10.0, 10.0, 20.0, 30.0]));
+ ok(&mut a, "edit_redo", json!({"doc":doc}));
+ ok(&mut a, "doc_save", json!({"doc":doc,"path":"grouped.pdf"}));
+ let reopened = ok(&mut a, "doc_open", json!({"path":"grouped.pdf"}))["doc"].as_u64().unwrap();
+ assert_eq!(ok(&mut a, "page_images", json!({"doc":reopened,"page":1}))["images"][0]["visible_rect"], picture["visible_rect"]);
+ ok(&mut a, "image_edit", json!({"doc":reopened,"page":1,"image":1,"action":"bring_to_front"}));
+ assert_eq!(ok(&mut a, "content_list", json!({"doc":reopened}))["count"], 1);
+ ok(&mut a, "content_delete", json!({"doc":reopened,"page":1,"index":1}));
+ ok(&mut a, "doc_save", json!({"doc":reopened,"path":"independent.pdf"}));
+ let saved = ok(&mut a, "doc_open", json!({"path":"independent.pdf"}))["doc"].as_u64().unwrap();
+ let after = ok(&mut a, "page_images", json!({"doc":saved,"page":1}));
+ assert_eq!(after["count"], 1);
+ assert_eq!(after["images"][0]["rect"], picture["rect"]);
+ assert_eq!(after["images"][0]["visible_rect"], picture["visible_rect"]);
+ let rendered = a.call("page_render", &json!({"doc":saved,"page":1,"dpi":72})).unwrap();
+ assert!(rendered.iter().any(|c| matches!(c, Content::Png {data,width,height} if !data.is_empty() && *width > 0 && *height > 0)));
+}
+
+#[test]
+fn image_flip_tools_follow_displayed_axes_on_every_page_rotation() {
+ fn corners(a: &Automation, id: u64) -> [[f64; 2]; 4] {
+ let doc = a.session().get(pdfcraft_engine::DocId(id)).unwrap();
+ let [aa, b, c, d, e, f] = doc.page_images(0)[0].matrix;
+ [(0.0, 0.0), (1.0, 0.0), (0.0, 1.0), (1.0, 1.0)]
+ .map(|(x, y)| doc.info.pages[0].user_to_view((aa * x + c * y + e) as f32, (b * x + d * y + f) as f32).map(f64::from))
+ }
+ fn raster(a: &mut Automation, id: u64) -> (usize, usize, Vec) {
+ let rendered = a.call("page_render", &json!({"doc":id,"page":1,"dpi":72})).unwrap();
+ let Content::Png { data, .. } = &rendered[0] else { panic!("expected PNG") };
+ let mut reader = png::Decoder::new(std::io::Cursor::new(data)).read_info().unwrap();
+ let mut bytes = vec![0; reader.output_buffer_size().unwrap()];
+ let frame = reader.next_frame(&mut bytes).unwrap();
+ bytes.truncate(frame.buffer_size());
+ if frame.color_type == png::ColorType::Rgb {
+ bytes = bytes.as_chunks::<3>().0.iter().flat_map(|&[r, g, b]| [r, g, b, 255]).collect();
+ } else {
+ assert_eq!(frame.color_type, png::ColorType::Rgba);
+ }
+ (frame.width as usize, frame.height as usize, bytes)
+ }
+ let dir = workdir("displayed-image-flip");
+ let mut png_bytes = Vec::new();
+ {
+ let mut encoder = png::Encoder::new(&mut png_bytes, 8, 4);
+ encoder.set_color(png::ColorType::Rgb);
+ let colors = [[240, 20, 30], [20, 230, 40], [30, 40, 220], [220, 210, 20]];
+ let pixels: Vec = (0..4).flat_map(|y| (0..8).flat_map(move |x| colors[usize::from(x >= 4) + 2 * usize::from(y >= 2)])).collect();
+ encoder.write_header().unwrap().write_image_data(&pixels).unwrap();
+ }
+ std::fs::write(dir.join("quadrants.png"), png_bytes).unwrap();
+ let mut a = auto(&dir);
+ let mut failures = Vec::new();
+ for rotation in [0, 90, 180, 270] {
+ let doc = ok(&mut a, "doc_create", json!({"from":"images","paths":["quadrants.png"]}))["doc"].as_u64().unwrap();
+ if rotation != 0 {
+ ok(&mut a, "page_rotate", json!({"doc":doc,"pages":[1],"degrees":rotation}));
+ }
+ let before = corners(&a, doc);
+ let (width, height, pixels) = raster(&mut a, doc);
+ let xmin = before.iter().map(|p| p[0]).fold(f64::INFINITY, f64::min);
+ let xmax = before.iter().map(|p| p[0]).fold(f64::NEG_INFINITY, f64::max);
+ let ymin = before.iter().map(|p| p[1]).fold(f64::INFINITY, f64::min);
+ let ymax = before.iter().map(|p| p[1]).fold(f64::NEG_INFINITY, f64::max);
+ for (action, horizontal) in [("flip_horizontal", true), ("flip_vertical", false)] {
+ ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":action}));
+ let after = corners(&a, doc);
+ for (old, new) in before.into_iter().zip(after) {
+ let expected = if horizontal { [xmin + xmax - old[0], old[1]] } else { [old[0], ymin + ymax - old[1]] };
+ if new.into_iter().zip(expected).any(|(actual, want)| (actual - want).abs() > 0.001) {
+ failures.push(format!("rotation {rotation} {action}: corner {old:?} became {new:?}, expected {expected:?}"));
+ break;
+ }
+ }
+ let (new_width, new_height, actual_pixels) = raster(&mut a, doc);
+ assert_eq!((new_width, new_height), (width, height));
+ let mut expected_pixels = Vec::new();
+ for y in 0..height {
+ for x in 0..width {
+ let source = if horizontal { (y * width + width - 1 - x) * 4 } else { ((height - 1 - y) * width + x) * 4 };
+ expected_pixels.extend_from_slice(&pixels[source..source + 4]);
+ }
+ }
+ if actual_pixels.iter().zip(&expected_pixels).any(|(actual, want)| actual.abs_diff(*want) > 1) {
+ failures.push(format!("rotation {rotation} {action}: raster flipped the wrong displayed axis"));
+ }
+ assert_ne!(actual_pixels, pixels, "the asymmetric image makes both flip axes observable");
+ ok(&mut a, "edit_undo", json!({"doc":doc}));
+ assert_eq!(corners(&a, doc), before, "one undo restores the original placement");
+ }
+ }
+ assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
+
+#[test]
+fn mixed_script_tools_normalize_but_undo_restores_the_exact_mixture() {
+ let dir = workdir("mixed-script-policy");
+ let mut a = auto(&dir);
+ for (script, mixed, uniform, plain) in [("superscript", "Q²2", "Q²²", "Q22"), ("subscript", "H₂2", "H₂₂", "H22")] {
+ let doc = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+ ok(&mut a, "text_edit", json!({"doc":doc,"page":1,"paragraph":1,"text":mixed,"size":14,"width":160}));
+ let paragraph =
+ |a: &mut Automation| ok(a, "text_paragraphs", json!({"doc":doc,"page":1}))["paragraphs"][0]["editor_text"].as_str().unwrap().to_owned();
+ assert_eq!(paragraph(&mut a), mixed);
+ let before = a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes.clone();
+ let args = json!({"doc":doc,"page":1,"paragraph":1,"script":script});
+ let once = ok(&mut a, "text_script", args.clone());
+ assert_eq!(once["paragraph"]["text"], uniform);
+ assert_eq!(paragraph(&mut a), uniform);
+ ok(&mut a, "text_script", args);
+ assert_eq!(paragraph(&mut a), plain);
+ assert_ne!(plain, mixed, "normalization does not promise to recreate the original mixture");
+ ok(&mut a, "edit_undo", json!({"doc":doc}));
+ assert_eq!(paragraph(&mut a), uniform, "one Undo restores the preceding scripted text");
+ ok(&mut a, "edit_undo", json!({"doc":doc}));
+ assert_eq!(paragraph(&mut a), mixed, "Undo restores the exact initial Unicode mixture");
+ assert_eq!(
+ a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes.as_ref(),
+ before.as_ref(),
+ "Undo also restores the exact prior document bytes"
+ );
+ ok(&mut a, "edit_redo", json!({"doc":doc}));
+ assert_eq!(paragraph(&mut a), uniform);
+ ok(&mut a, "edit_redo", json!({"doc":doc}));
+ assert_eq!(paragraph(&mut a), plain);
+ let path = format!("mixed-{script}.pdf");
+ ok(&mut a, "doc_save", json!({"doc":doc,"path":path}));
+ let reopened = ok(&mut a, "doc_open", json!({"path":path}))["doc"].as_u64().unwrap();
+ assert_eq!(page_text(&mut a, reopened)[0], plain);
+ }
+}
diff --git a/crates/content/src/lib.rs b/crates/content/src/lib.rs
index c52916d332..4957f86861 100644
--- a/crates/content/src/lib.rs
+++ b/crates/content/src/lib.rs
@@ -730,11 +730,14 @@ impl Matrix {
pub fn invert(&self) -> Option {
let [a, b, c, d, e, f] = self.0;
let det = a * d - b * c;
- if det.abs() < 1e-12 || !det.is_finite() {
+ if det == 0.0 || !det.is_finite() || det.abs() <= 1e-12 * ((a * d).abs() + (b * c).abs()) {
return None;
}
let (ia, ib, ic, id) = (d / det, -b / det, -c / det, a / det);
- Some(Matrix([ia, ib, ic, id, -(e * ia + f * ic), -(e * ib + f * id)]))
+ let inverse = [ia, ib, ic, id, -(e * ia + f * ic), -(e * ib + f * id)];
+ // A determinant that underflows toward zero can still pass the relative check above,
+ // and dividing by it overflows: such a matrix has no usable inverse.
+ inverse.iter().all(|v| v.is_finite()).then_some(Matrix(inverse))
}
/// The bounding box of a rectangle `[x0 y0 x1 y1]` after this transform.
diff --git a/crates/content/src/tests.rs b/crates/content/src/tests.rs
index c5c7a3aaac..9ac9297cd2 100644
--- a/crates/content/src/tests.rs
+++ b/crates/content/src/tests.rs
@@ -552,3 +552,17 @@ fn inline_images_end_where_the_renderer_ends_them() {
assert_eq!((parsed.skipped, parsed.ambiguous_images), (0, 0), "{}", String::from_utf8_lossy(data));
}
}
+
+#[test]
+fn invert_accepts_small_scale_and_rejects_singular() {
+ let m = Matrix([1e-7, 0., 0., 1e-7, 0., 0.]);
+ let inv = m.invert().expect("a uniform 1e-7 scale is invertible");
+ let id = m.then(&inv).0;
+ for (got, want) in id.iter().zip(Matrix::IDENTITY.0) {
+ assert!((got - want).abs() < 1e-9, "{id:?}");
+ }
+ assert!(Matrix([1., 2., 2., 4., 0., 0.]).invert().is_none());
+ assert!(Matrix([f64::NAN, 0., 0., 1., 0., 0.]).invert().is_none());
+ // A subnormal scale passes the relative check but its inverse overflows (CodeRabbit on #5703).
+ assert!(Matrix([1e-310, 0., 0., 1., 0., 0.]).invert().is_none());
+}
diff --git a/crates/cos/README.md b/crates/cos/README.md
index 2cf3342954..7b576f293f 100644
--- a/crates/cos/README.md
+++ b/crates/cos/README.md
@@ -90,6 +90,11 @@ recognisable in a diff and byte-stable when re-serialized.
- Linearized output, Fast Web View (`core.linearization`, M11).
- Structural validation against the Arlington model (`core.arlington-validation`), which will live
in the reserved `arlington` crate.
-- Image codecs. `pdfcraft-filters` carries the non-image filters and CCITT fax decoding
- (`Document::decoded_image`); DCT, JPX and JBIG2 are still decoded through the bootstrap renderer
- (`core.image-filters`, M2.6).
+- Image codecs. `pdfcraft-filters` carries the non-image filters and CCITT fax and JBIG2 decoding
+ (`Document::decoded_image`, a JBIG2 image's `/JBIG2Globals` within `MAX_JBIG2_GLOBALS`, 32 MiB,
+ their filters undone once a document for the images that share them, up to 64 MiB kept, while
+ their segments are decoded for every image, and `ImageBudget` for an operation over many images,
+ which share one allowance of decoding, filters, decoders and pixels alike, and are refused past
+ it: `IMAGE_WORK`, 2^34 steps, or 2 to 5 minutes of JBIG2 and about 1,000 pages scanned at
+ 300 dpi, plus `IMAGE_WORK_PER_BYTE`, 2^13 steps for each byte of the file);
+ DCT and JPX are still decoded through the bootstrap renderer (`core.image-filters`, M2.6).
diff --git a/crates/cos/src/budget.rs b/crates/cos/src/budget.rs
index 1ddd42eaf5..376b108be3 100644
--- a/crates/cos/src/budget.rs
+++ b/crates/cos/src/budget.rs
@@ -6,16 +6,218 @@ use pdfcraft_filters::FilterError;
use crate::{CosError, Document, ObjRef, Object, Stream};
+/// The steps of decoding an operation over a document's images may take whatever the file's size.
+/// A step of JBIG2 decoding ([`hayro_jbig2::Image::decode_within`]) is about a pixel, and takes 6 to
+/// 16 ns, so this is 2 to 5 minutes, and about as long again for what an operation does with the
+/// pixels. A page scanned at 300 dpi takes about 17 million, 8.4 for its pixels and that again to
+/// decode them, so this alone reads about 1,000 of them. A byte into or out of a filter is a step
+/// too, and takes less: 3 ns at most, or up to 19 ns through a predictor on samples of a bit.
+const IMAGE_WORK: u64 = 1 << 34;
+/// The steps each byte of the file adds to [`IMAGE_WORK`], so that a long scan is read whole: such a
+/// page pays for itself with about 2 KB of the file, about the smallest a page of text is stored
+/// in, and a stream of any filter this reads can be decoded about 8 times at Flate's best, 1,032 to
+/// one. So what a hostile file can ask for grows with its length, by about 14 minutes for 10 MB.
+const IMAGE_WORK_PER_BYTE: u64 = 1 << 13;
+
/// Decoded bytes one page's content walk may produce in all: its `/Contents` streams and every
/// form XObject it enters, each occurrence counted again.
pub const MAX_PAGE_DECODED: usize = 256 << 20;
/// Form XObjects one page's content walk may enter, each entry counted again.
pub const MAX_PAGE_FORMS: usize = 50_000;
+/// The steps a sample of a JPEG costs: a few bytes can hold a page of one grey, and decoding,
+/// resampling and storing it took about 20 to 45 ns a sample.
+const JPEG_WORK: u64 = 2;
+/// The steps a byte of a JPEG costs to read: its tables took 24 ns a byte before a size was known,
+/// and images can share one, so reading it again for each has to count.
+const JPEG_READ_WORK: u64 = 4;
+
/// A stream decode within a byte bound, with the bytes its filter stages decoded: the data or
/// the error, each with that count.
type Decoder = fn(&Stream, usize) -> Result<(Vec, usize), (FilterError, usize)>;
+/// What one operation over a document's images may still spend decoding them: exporting them,
+/// optimizing them, and storing LZW streams with Flate as it does, clearing them for redaction.
+///
+/// An image has its own limit, which doesn't bound a file of thousands of images made to reach it:
+/// a few hundred bytes of JBIG2 can ask for seconds of decoding, 4 KB of Flate inside Flate for a
+/// gigabyte, and an image that shares `/JBIG2Globals` decodes them again. So images share this
+/// allowance, whatever they do with what they decode and whether or not it works, and past it they
+/// aren't decoded. A caller then treats them as it does an image it can't read, and
+/// [`ImageBudget::refused`] says how many there were.
+///
+/// An image also pays for its pixels once decoded, as what reads it goes through them one by one
+/// however few bytes coded them: blank rows of fax or Flate take almost none. It pays for no more
+/// than its data holds, a bit a pixel at least, so an image declaring a size its data doesn't fill
+/// costs what a smaller one would, not the run's allowance. A JPEG pays for its samples when
+/// it is decoded ([`ImageBudget::pay_jpeg`]), and is otherwise not charged, as JPEG 2000 isn't:
+/// their decoders don't run here.
+#[derive(Debug)]
+pub struct ImageBudget {
+ work: u64,
+ refused: usize,
+}
+
+impl ImageBudget {
+ /// The allowance for an operation on `doc`, which a longer file makes larger. The streams made
+ /// or changed since it was opened count as the file's bytes do, so a document built in memory
+ /// (combined, created, or given pages of scans) gets what it would once saved and opened again.
+ pub fn new(doc: &Document) -> Self {
+ let length = |n: usize| u64::try_from(n).unwrap_or(u64::MAX);
+ let edited = doc
+ .scan_objects_subset(doc.modified_objects())
+ .filter_map(|(_, object)| match &*object.ok()? {
+ Object::Stream(s) => Some(length(s.raw.len())),
+ _ => None,
+ })
+ .fold(0u64, u64::saturating_add);
+ let bytes = length(doc.bytes().len()).saturating_add(edited);
+ Self::with_work(IMAGE_WORK.saturating_add(bytes.saturating_mul(IMAGE_WORK_PER_BYTE)))
+ }
+
+ /// An allowance of `work` steps of decoding.
+ pub fn with_work(work: u64) -> Self {
+ Self { work, refused: 0 }
+ }
+
+ /// The samples of image `s`, decoded and charged to the allowance: the one way to decode an
+ /// image outside the renderer, so that an operation over many images can't decode them without
+ /// one.
+ ///
+ /// They go through its filters ([`Stream::decoded`]), or, for a CCITT fax or JBIG2 image (its
+ /// last filter), through the filters before it and then [`pdfcraft_filters::decode_ccitt_within`]
+ /// with its [`Document::fax_params`], or [`pdfcraft_filters::decode_jbig2_within`] with its
+ /// `/JBIG2Globals`, as `CCITTFaxDecode` and `JBIG2Decode` give them (ISO 32000-2 §7.4.6,
+ /// §7.4.7). Parameters given by reference count, for every filter
+ /// ([`Document::with_direct_parms`]). A fax image's `/Columns` has to be its `/Width`, and a
+ /// JBIG2 image's page its `/Width` × `/Height`: PdfCraft's renderer draws the whole page into
+ /// the image. Up to its `/Height` rows are decoded, whatever a fax image's `/Rows` says; damaged
+ /// fax data gives fewer, so a caller checks it has the rows it needs. Damaged JBIG2 data, and
+ /// globals that can't be read (within [`MAX_JBIG2_GLOBALS`](crate::MAX_JBIG2_GLOBALS)), are an
+ /// error.
+ ///
+ /// No stage, the filters before a fax or JBIG2 decoder included, may produce more than `max`
+ /// bytes, nor more than [`MAX_DECODED`](crate::MAX_DECODED). A JBIG2 image's `/JBIG2Globals`
+ /// are another stream, shared between images, and are decoded within `MAX_JBIG2_GLOBALS`
+ /// whatever `max` is. Each filter as it runs, the globals when they have to be read, and the fax
+ /// or JBIG2 decoder spend from the allowance, and the image then pays for its pixels; with
+ /// nothing left an image is refused before anything is read, its globals included.
+ ///
+ /// ```
+ /// # let doc = pdfcraft_cos::Document::new_empty();
+ /// # let s = pdfcraft_cos::Stream::from_raw(pdfcraft_cos::Dict::new(), Vec::new());
+ /// let samples = pdfcraft_cos::ImageBudget::new(&doc).decode(&doc, &s, 1 << 20);
+ /// assert_eq!(samples.unwrap(), b"");
+ /// ```
+ ///
+ /// `Document` has no way of its own to decode an image:
+ ///
+ /// ```compile_fail
+ /// # let doc = pdfcraft_cos::Document::new_empty();
+ /// # let s = pdfcraft_cos::Stream::from_raw(pdfcraft_cos::Dict::new(), Vec::new());
+ /// let _ = doc.decoded_image(&s);
+ /// ```
+ ///
+ /// ```compile_fail
+ /// # let doc = pdfcraft_cos::Document::new_empty();
+ /// # let s = pdfcraft_cos::Stream::from_raw(pdfcraft_cos::Dict::new(), Vec::new());
+ /// let _ = doc.decoded_image_within(&s, 1 << 20);
+ /// ```
+ pub fn decode(&mut self, doc: &Document, s: &Stream, max: usize) -> Result, CosError> {
+ let decoded = doc.decoded_image_spending(s, max, &mut self.work);
+ self.count_refused(s, &decoded);
+ self.pay_size(s, decoded?)
+ }
+
+ /// Image `s` through its filters alone, charged to the allowance: [`Stream::decoded_within`]
+ /// with its `/DecodeParms` given by reference read too ([`Document::with_direct_parms`]), for an
+ /// image that has no fax or JBIG2 decoder to go through.
+ pub fn decode_filters(&mut self, doc: &Document, s: &Stream, max: usize) -> Result, CosError> {
+ let decoded = doc.with_direct_parms(s).decoded_spending(max, &mut self.work);
+ self.count_refused(s, &decoded);
+ let decoded = decoded?;
+ if s.filters().iter().all(|(f, _)| f.is_decodable()) { self.pay_size(s, decoded) } else { Ok(decoded) }
+ }
+
+ /// `data` through `chain`, any corruption being an error ([`pdfcraft_filters::decode_within`]),
+ /// for a stream a run rewrites rather than an image it reads, charged to the allowance.
+ pub fn decode_chain(
+ &mut self,
+ chain: &[(pdfcraft_filters::Filter, pdfcraft_filters::Params)],
+ data: &[u8],
+ max: usize,
+ ) -> Result, FilterError> {
+ pdfcraft_filters::decode_within(chain, data, max, &mut self.work)
+ }
+
+ /// Pays `steps` of other work on decoded data, or spends all there is and says so.
+ pub fn spend(&mut self, steps: u64) -> bool {
+ let left = self.work.checked_sub(steps);
+ self.work = left.unwrap_or(0);
+ left.is_some()
+ }
+
+ /// Pays for `pixels` a decode goes on to work through, or spends all there is, and the image
+ /// is refused.
+ pub fn pay_pixels(&mut self, pixels: u64) -> bool {
+ let paid = self.spend(pixels);
+ self.refused += usize::from(!paid);
+ paid
+ }
+
+ /// Pays for reading JPEG `data` and decoding its `samples`, as [`ImageBudget::pay_pixels`] does.
+ /// A caller pays before its tables are parsed, which can be most of the file.
+ pub fn pay_jpeg(&mut self, samples: u64, data: &[u8]) -> bool {
+ let reading = (data.len() as u64).saturating_mul(JPEG_READ_WORK);
+ self.pay_pixels(samples.saturating_mul(JPEG_WORK).saturating_add(reading))
+ }
+
+ /// Pays for the pixels of image `s` that its `decoded` data holds, those of its `/Width` and
+ /// `/Height` but no more than a bit of the data each, unless it is JBIG2, whose decoder pays for
+ /// its page, or isn't decoded here. What can't be paid for refuses the image.
+ fn pay_size(&mut self, s: &Stream, decoded: Vec) -> Result, CosError> {
+ if !charged(s) || matches!(s.filters().last(), Some((pdfcraft_filters::Filter::Jbig2, _))) {
+ return Ok(decoded);
+ }
+ let side = |key: &[u8]| s.dict.int(key).and_then(|v| u64::try_from(v).ok()).unwrap_or(0);
+ let held = u64::try_from(decoded.len()).unwrap_or(u64::MAX).saturating_mul(8);
+ if self.pay_pixels(side(b"Width").saturating_mul(side(b"Height")).min(held)) {
+ Ok(decoded)
+ } else {
+ Err(CosError::Filter(FilterError::Spent.to_string()))
+ }
+ }
+
+ /// An image that failed with nothing left was refused, unless it has a filter that costs
+ /// nothing here, which fails whatever is left.
+ fn count_refused(&mut self, s: &Stream, decoded: &Result, CosError>) {
+ if decoded.is_err() && self.work == 0 && charged(s) {
+ self.refused += 1;
+ }
+ }
+
+ /// The decodes refused for lack of allowance: an image read twice over is counted twice.
+ pub fn refused(&self) -> usize {
+ self.refused
+ }
+
+ /// The steps of decoding still allowed.
+ pub fn work_left(&self) -> u64 {
+ self.work
+ }
+}
+
+/// Whether `s` can be decoded here and so charged: general filters, a fax or JBIG2 decoder last at
+/// most. Those decoders anywhere else can't run.
+fn charged(s: &Stream) -> bool {
+ use pdfcraft_filters::Filter;
+ s.readable_filters().is_ok_and(|chain| {
+ chain.split_last().is_none_or(|((last, _), before)| {
+ (last.is_decodable() || matches!(last, Filter::Jbig2 | Filter::CcittFax)) && before.iter().all(|(f, _)| f.is_decodable())
+ })
+ })
+}
+
/// What one operation may still decode and enter across all the streams it reads.
///
/// [`MAX_DECODED`](crate::MAX_DECODED) bounds one decode. It does not bound a page whose
@@ -143,6 +345,401 @@ impl DecodeBudget {
}
}
+#[cfg(test)]
+mod image_tests {
+ use super::*;
+ use crate::Dict;
+
+ fn jbig2(parms: Option) -> Stream {
+ let mut dict = Dict::new();
+ dict.set(b"Width".to_vec(), Object::Int(16));
+ dict.set(b"Height".to_vec(), Object::Int(2));
+ dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+ if let Some(parms) = parms {
+ dict.set(b"DecodeParms".to_vec(), parms);
+ }
+ Stream::from_raw(dict, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap())
+ }
+
+ /// Each image spends what it took from one allowance, and those past it are refused and
+ /// counted, whatever their filters. What can't be decoded here costs nothing, and fails
+ /// without being one of these.
+ #[test]
+ fn the_images_of_an_operation_share_its_allowance() {
+ let doc = Document::new_empty();
+ let image = jbig2(None);
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ let samples = budget.decode(&doc, &image, 1 << 20).unwrap();
+ let cost = u64::MAX - budget.work_left();
+ assert!(cost > 0);
+ let mut budget = ImageBudget::with_work(3 * cost);
+ for left in [2, 1, 0] {
+ assert_eq!(budget.decode(&doc, &image, 1 << 20).unwrap(), samples);
+ assert_eq!(budget.work_left(), left * cost);
+ }
+ assert_eq!(budget.refused(), 0, "the allowance held exactly three");
+ for refused in [1, 2] {
+ assert!(budget.decode(&doc, &image, 1 << 20).is_err());
+ assert_eq!(budget.refused(), refused);
+ }
+ assert!(budget.decode(&doc, &Stream::flate(Dict::new(), b"samples"), 1 << 20).is_err());
+ assert!(budget.decode(&doc, &Stream::from_raw(Dict::new(), b"samples".to_vec()), 1 << 20).is_err());
+ assert_eq!(budget.refused(), 4, "other images share it");
+ for name in ["NoSuchFilter", "DCTDecode", "JPXDecode"] {
+ let mut dict = Dict::new();
+ dict.set(b"Filter".to_vec(), Object::name(name));
+ assert!(budget.decode(&doc, &Stream::from_raw(dict, b"data".to_vec()), 1 << 20).is_err());
+ assert_eq!(budget.refused(), 4, "{name} isn't one of these");
+ }
+ let mut dict = Dict::new();
+ dict.set(b"Filter".to_vec(), Object::Int(5));
+ assert!(budget.decode(&doc, &Stream::from_raw(dict, b"data".to_vec()), 1 << 20).is_err());
+ assert_eq!(budget.refused(), 4, "a /Filter that can't be read isn't either");
+ }
+
+ /// What a file of images each inflating a megabyte asks for: 4 KB of Flate inside Flate can ask
+ /// for a gigabyte, and these aren't JBIG2, so without the allowance nothing would stop them.
+ #[test]
+ fn filter_bombs_stop_at_the_allowance() {
+ let doc = Document::new_empty();
+ let samples = vec![0; 1 << 20];
+ let inner = pdfcraft_filters::encode_flate(&samples);
+ let mut dict = Dict::new();
+ dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("FlateDecode")]));
+ let bomb = Stream::from_raw(dict, pdfcraft_filters::encode_flate(&inner));
+ let cost = (bomb.raw.len() + inner.len() + samples.len()) as u64;
+ let mut budget = ImageBudget::with_work(2 * cost + 1);
+ for left in [cost + 1, 1] {
+ assert_eq!(budget.decode(&doc, &bomb, 1 << 20).unwrap(), samples);
+ assert_eq!(budget.work_left(), left);
+ }
+ assert!(budget.decode(&doc, &bomb, 1 << 20).is_err());
+ assert_eq!((budget.work_left(), budget.refused()), (0, 1), "the first it can't pay for ends it");
+ }
+
+ /// Filters in front of a JBIG2 decoder pay as they run, on top of what the decoder takes, and
+ /// one that fails has still paid: nothing about the JBIG2 data is known by then, and each image
+ /// of a file can do this.
+ #[test]
+ fn filters_in_front_of_jbig2_pay_whether_or_not_they_work() {
+ let doc = Document::new_empty();
+ let alone = jbig2(None);
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ let samples = budget.decode(&doc, &alone, 1 << 20).unwrap();
+ let decoding = u64::MAX - budget.work_left();
+ let behind = |raw: Vec| {
+ let mut dict = alone.dict.clone();
+ dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("JBIG2Decode")]));
+ Stream::from_raw(dict, raw)
+ };
+
+ let image = behind(pdfcraft_filters::encode_flate(&alone.raw));
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert_eq!(budget.decode(&doc, &image, 1 << 20).unwrap(), samples);
+ assert_eq!(u64::MAX - budget.work_left(), decoding + (image.raw.len() + alone.raw.len()) as u64);
+
+ // Past this image's limit: an error, with what finding out took paid and the rest left.
+ let bomb = behind(pdfcraft_filters::encode_flate(&vec![0; 1 << 16]));
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(budget.decode(&doc, &bomb, 1000).is_err());
+ assert_eq!(u64::MAX - budget.work_left(), bomb.raw.len() as u64 + 1000);
+ assert_eq!(budget.refused(), 0, "that image's limit isn't the run's");
+
+ // A small allowance is a limit too: it stops there, and the image is refused.
+ let mut budget = ImageBudget::with_work(bomb.raw.len() as u64 + 10);
+ assert!(budget.decode(&doc, &bomb, 1 << 20).is_err());
+ assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+ }
+
+ /// Globals that are read again for every image pay every time, and fail having paid. Kept
+ /// ones have no filters left to undo, so they pay for being read and nothing more.
+ #[test]
+ fn globals_pay_for_their_filters_each_time_they_are_decoded() {
+ let skipped = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+ let raw = pdfcraft_filters::encode_flate(&skipped);
+ let stream = |doc: &Document, r: ObjRef| match &*doc.get(r) {
+ Object::Stream(s) => s.clone(),
+ _ => panic!("not a stream"),
+ };
+ let spent = |doc: &Document, s: &Stream| {
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ budget.decode(doc, s, 1 << 20).unwrap();
+ u64::MAX - budget.work_left()
+ };
+ let mut doc = Document::new_empty();
+ let mut dict = Dict::new();
+ dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ let globals = doc.add(Object::Stream(Stream::from_raw(dict, raw.clone())));
+ let mut parms = Dict::new();
+ parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+ let image = doc.add(Object::Stream(jbig2(Some(Object::Dict(parms)))));
+ let root = doc.root().unwrap();
+ doc.update_dict(root, |c| c.set(b"Image".to_vec(), Object::Ref(image))).unwrap();
+
+ // Added in memory, so not kept: the filters are undone for each read.
+ let s = stream(&doc, image);
+ let first = spent(&doc, &s);
+ assert_eq!(spent(&doc, &s), first, "not kept, so paid for again");
+
+ // Read from a file, so kept: the second read has no filters to undo.
+ let file = crate::write_full(&doc, &crate::SaveOptions::default()).unwrap();
+ let doc = Document::open(std::sync::Arc::new(file)).unwrap();
+ let image = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Image").unwrap();
+ let s = stream(&doc, image);
+ let filters = (raw.len() + skipped.len()) as u64;
+ assert_eq!(spent(&doc, &s), first, "the first read undoes them");
+ assert_eq!(spent(&doc, &s), first - filters, "kept");
+
+ // Globals that fail pay too, with the image not refused: these go past their own limit.
+ let over = pdfcraft_filters::encode_flate(&vec![0; crate::MAX_JBIG2_GLOBALS + 1]);
+ let mut doc = Document::new_empty();
+ let mut dict = Dict::new();
+ dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ let globals = doc.add(Object::Stream(Stream::from_raw(dict, over.clone())));
+ let mut parms = Dict::new();
+ parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+ let image = jbig2(Some(Object::Dict(parms)));
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(budget.decode(&doc, &image, 1 << 20).unwrap_err().to_string().contains("globals"));
+ assert_eq!(u64::MAX - budget.work_left(), (over.len() + crate::MAX_JBIG2_GLOBALS) as u64);
+ assert_eq!(budget.refused(), 0);
+ }
+
+ /// A fax image pays for what comes before its decoder and for the rows it asks for, and past
+ /// the allowance it is refused like any other.
+ #[test]
+ fn fax_images_share_the_allowance() {
+ let doc = Document::new_empty();
+ let (w, h) = (4096u32, 64u32);
+ let coded = pdfcraft_filters::encode_g4(&vec![0xFF; 512 * h as usize], w, h).unwrap();
+ let mut parms = Dict::new();
+ parms.set(b"K".to_vec(), Object::Int(-1));
+ parms.set(b"Columns".to_vec(), Object::Int(i64::from(w)));
+ let mut dict = Dict::new();
+ dict.set(b"Width".to_vec(), Object::Int(i64::from(w)));
+ dict.set(b"Height".to_vec(), Object::Int(i64::from(h)));
+ dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("CCITTFaxDecode")]));
+ dict.set(b"DecodeParms".to_vec(), Object::Array(vec![Object::Null, Object::Dict(parms)]));
+ let image = Stream::from_raw(dict, pdfcraft_filters::encode_flate(&coded));
+ let pixels = u64::from(w) * u64::from(h);
+ let cost = (image.raw.len() + coded.len() + 4 * coded.len() + 512 * h as usize) as u64 + pixels;
+ let mut budget = ImageBudget::with_work(cost);
+ assert_eq!(budget.decode(&doc, &image, 1 << 20).unwrap().len(), 512 * h as usize);
+ assert_eq!(budget.work_left(), 0, "exactly that");
+ assert!(budget.decode(&doc, &image, 1 << 20).is_err());
+ assert_eq!(budget.refused(), 1);
+ }
+
+ /// An image pays for its pixels however few bytes hold them, or a blank page of fax or Flate
+ /// would cost a run a second for a few bytes' worth of allowance; a JBIG2 image doesn't pay
+ /// twice, and one this doesn't decode pays nothing. Past what is left it isn't read.
+ #[test]
+ fn an_image_pays_for_its_pixels() {
+ let doc = Document::new_empty();
+ let blank = |filter: Option<&str>, data: Vec| {
+ let mut dict = Dict::new();
+ dict.set(b"Width".to_vec(), Object::Int(4096));
+ dict.set(b"Height".to_vec(), Object::Int(1024));
+ if let Some(filter) = filter {
+ dict.set(b"Filter".to_vec(), Object::name(filter));
+ }
+ Stream::from_raw(dict, data)
+ };
+ let rows = vec![0xFFu8; 512 * 1024];
+ let flate = blank(Some("FlateDecode"), pdfcraft_filters::encode_flate(&rows));
+ let cost = (flate.raw.len() + rows.len()) as u64 + 4096 * 1024;
+ let mut budget = ImageBudget::with_work(cost);
+ assert_eq!(budget.decode(&doc, &flate, 1 << 24).unwrap(), rows);
+ assert_eq!((budget.work_left(), budget.refused()), (0, 0), "exactly that");
+ // Its filters alone pay the same.
+ let mut budget = ImageBudget::with_work(cost);
+ assert_eq!(budget.decode_filters(&doc, &flate, 1 << 24).unwrap(), rows);
+ assert_eq!(budget.work_left(), 0);
+ // Short of its pixels it is refused, having paid for its filters.
+ let mut budget = ImageBudget::with_work(4096 * 1024 - 1);
+ assert!(budget.decode(&doc, &flate, 1 << 24).unwrap_err().to_string().contains("more image decoding than"));
+ assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+ let mut budget = ImageBudget::with_work(4096 * 1024 - 1);
+ assert!(budget.decode_filters(&doc, &flate, 1 << 24).is_err());
+ assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+ // What isn't decoded here pays for nothing, and fails as it would.
+ let mut budget = ImageBudget::with_work(10);
+ assert!(budget.decode(&doc, &blank(Some("DCTDecode"), b"data".to_vec()), 1 << 24).is_err());
+ assert_eq!((budget.work_left(), budget.refused()), (10, 0));
+ // Unfiltered data pays too, and a size that isn't one is no size.
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ budget.decode(&doc, &blank(None, rows.clone()), 1 << 24).unwrap();
+ assert_eq!(u64::MAX - budget.work_left(), rows.len() as u64 + 4096 * 1024);
+ let mut odd = Dict::new();
+ odd.set(b"Width".to_vec(), Object::Int(-4));
+ odd.set(b"Height".to_vec(), Object::Int(9));
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ budget.decode(&doc, &Stream::from_raw(odd, vec![1, 2]), 1 << 24).unwrap();
+ assert_eq!(u64::MAX - budget.work_left(), 2);
+ // A JPEG pays twice over for each sample, and four times for each byte it is read from.
+ let mut budget = ImageBudget::with_work(30);
+ assert!(budget.pay_jpeg(9, b"ab"));
+ assert_eq!((budget.work_left(), budget.refused()), (4, 0));
+ assert!(!budget.pay_jpeg(0, b"ab"));
+ assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+ }
+
+ /// An image pays for the pixels its data holds, not those its size declares: one claiming
+ /// 131072 by 131072 pixels with a few bytes of Flate costs what those bytes give, and the
+ /// images after it are decoded as they would be without it.
+ #[test]
+ fn an_image_pays_for_no_more_pixels_than_its_data_holds() {
+ let doc = Document::new_empty();
+ let sized = |side: i64, data: &[u8]| {
+ let mut dict = Dict::new();
+ dict.set(b"Width".to_vec(), Object::Int(side));
+ dict.set(b"Height".to_vec(), Object::Int(side));
+ Stream::flate(dict, data)
+ };
+ let claims = sized(131_072, &[0; 16]);
+ let image = sized(64, &[7; 64 * 64]);
+ let cost = |s: &Stream| {
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ budget.decode(&doc, s, 1 << 24).unwrap();
+ u64::MAX - budget.work_left()
+ };
+ assert_eq!(cost(&claims), (claims.raw.len() + 16 + 16 * 8) as u64, "its bytes, and a pixel a bit of them");
+ assert_eq!(cost(&image), (image.raw.len() + 64 * 64) as u64 + 64 * 64, "its bytes, and its pixels");
+ for decode in [ImageBudget::decode, ImageBudget::decode_filters] {
+ let mut budget = ImageBudget::with_work(cost(&claims) + cost(&image));
+ assert_eq!(decode(&mut budget, &doc, &claims, 1 << 24).unwrap(), [0; 16]);
+ assert_eq!(decode(&mut budget, &doc, &image, 1 << 24).unwrap(), [7; 64 * 64], "the image after it is decoded");
+ assert_eq!((budget.work_left(), budget.refused()), (0, 0));
+ }
+ }
+
+ /// A stream a run rewrites is read strictly and charged, and what the caller does with it after
+ /// comes out of the same allowance: what can't be paid for spends all of it.
+ #[test]
+ fn a_rewritten_stream_shares_the_allowance() {
+ use pdfcraft_filters::{Filter, FilterError, Params};
+ let samples = vec![7u8; 1000];
+ let raw = pdfcraft_filters::encode_flate(&samples);
+ let chain = [(Filter::Flate, Params::default())];
+ let cost = (raw.len() + samples.len()) as u64;
+ let mut budget = ImageBudget::with_work(cost + 10);
+ assert_eq!(budget.decode_chain(&chain, &raw, 1 << 20).unwrap(), samples);
+ assert_eq!(budget.work_left(), 10);
+ assert!(budget.spend(4));
+ assert_eq!(budget.work_left(), 6);
+ assert!(budget.spend(6), "exactly what is left");
+ assert_eq!(budget.work_left(), 0);
+ assert!(budget.spend(0));
+ let mut budget = ImageBudget::with_work(5);
+ assert!(!budget.spend(6));
+ assert_eq!(budget.work_left(), 0, "spends all of it");
+ assert!(matches!(budget.decode_chain(&chain, &raw, 1 << 20), Err(FilterError::Spent)));
+ let cut = raw.get(..raw.len() / 2).unwrap();
+ assert!(matches!(ImageBudget::with_work(u64::MAX).decode_chain(&chain, cut, 1 << 20), Err(FilterError::Corrupt { .. })), "strictly");
+ }
+
+ /// An image read through its filters alone reads parameters given by reference, is charged, and
+ /// is refused like the others. It isn't given to a decoder.
+ #[test]
+ fn filters_alone_are_charged_too() {
+ let mut doc = Document::new_empty();
+ let p = pdfcraft_filters::Params { predictor: 12, columns: 4, ..pdfcraft_filters::Params::default() };
+ let rows = vec![7u8; 400];
+ let mut parms = Dict::new();
+ parms.set(b"Predictor".to_vec(), Object::Int(12));
+ parms.set(b"Columns".to_vec(), Object::Int(4));
+ let parms = doc.add(Object::Dict(parms));
+ let mut dict = Dict::new();
+ dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ dict.set(b"DecodeParms".to_vec(), Object::Ref(parms));
+ let raw = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, &p, &rows).unwrap();
+ let image = Stream::from_raw(dict, raw);
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert_eq!(budget.decode_filters(&doc, &image, 1 << 20).unwrap(), rows);
+ let cost = u64::MAX - budget.work_left();
+ // The tag byte of each of its 100 rows counts, which the predictor takes off.
+ assert_eq!(cost, (image.raw.len() + rows.len() + 100) as u64);
+ let mut budget = ImageBudget::with_work(cost - 1);
+ assert!(budget.decode_filters(&doc, &image, 1 << 20).is_err());
+ assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(budget.decode_filters(&doc, &jbig2(None), 1 << 20).is_err());
+ assert_eq!(budget.work_left(), u64::MAX, "no decoder here, so nothing was read");
+ // Nor for a fax image, nor for a decoder that isn't last, however large they say they are.
+ for chain in [vec!["CCITTFaxDecode"], vec!["CCITTFaxDecode", "FlateDecode"], vec!["JBIG2Decode", "FlateDecode"]] {
+ let mut dict = Dict::new();
+ dict.set(b"Width".to_vec(), Object::Int(1000));
+ dict.set(b"Height".to_vec(), Object::Int(1000));
+ dict.set(b"Filter".to_vec(), Object::Array(chain.iter().map(|f| Object::name(f)).collect()));
+ let image = Stream::from_raw(dict, b"data".to_vec());
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(budget.decode_filters(&doc, &image, 1 << 20).is_err());
+ assert_eq!(budget.work_left(), u64::MAX, "{chain:?}");
+ }
+ // Through `decode` a decoder that isn't last pays nothing either; one that is does.
+ let mut dict = Dict::new();
+ dict.set(b"Width".to_vec(), Object::Int(1000));
+ dict.set(b"Height".to_vec(), Object::Int(1000));
+ dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("JBIG2Decode"), Object::name("FlateDecode")]));
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(budget.decode(&doc, &Stream::from_raw(dict, b"data".to_vec()), 1 << 20).is_err());
+ assert_eq!(budget.work_left(), u64::MAX);
+ }
+
+ /// The images of a file share its globals, so an image refused doesn't read them: this one's
+ /// can't be read, which is how to tell.
+ #[test]
+ fn an_image_past_the_allowance_does_not_read_its_globals() {
+ let mut doc = Document::new_empty();
+ let mut unreadable = Dict::new();
+ unreadable.set(b"Filter".to_vec(), Object::name("NoSuchFilter"));
+ let globals = doc.add(Object::Stream(Stream::from_raw(unreadable, b"data".to_vec())));
+ let mut parms = Dict::new();
+ parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+ let image = jbig2(Some(Object::Dict(parms)));
+ let read = ImageBudget::with_work(u64::MAX).decode(&doc, &image, 1 << 20).unwrap_err().to_string();
+ assert!(read.contains("globals"), "{read}");
+ let refused = ImageBudget::with_work(0).decode(&doc, &image, 1 << 20).unwrap_err().to_string();
+ assert!(refused.contains("more image decoding than"), "{refused}");
+ }
+
+ /// A longer file gets more, by its length, and an empty one the fixed part.
+ #[test]
+ fn a_longer_file_allows_more_decoding() {
+ assert_eq!(ImageBudget::new(&Document::new_empty()).work_left(), IMAGE_WORK);
+ let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+ let len = pdf.len() as u64;
+ let doc = Document::open(std::sync::Arc::new(pdf)).unwrap();
+ assert_eq!(ImageBudget::new(&doc).work_left(), IMAGE_WORK + len * IMAGE_WORK_PER_BYTE);
+ }
+
+ /// A document made in memory, as Combine, Create and inserted scans make one, gets for the
+ /// streams it was given what it would get for them once saved: what isn't a stream adds nothing.
+ #[test]
+ fn streams_made_in_memory_allow_more_decoding_too() {
+ let mut doc = Document::new_empty();
+ doc.add(Object::Stream(Stream::from_raw(Dict::new(), vec![0; 3000])));
+ doc.add(Object::Dict(Dict::new()));
+ doc.add(Object::Stream(Stream::flate(Dict::new(), &[1; 100])));
+ let flate = pdfcraft_filters::encode_flate(&[1; 100]).len() as u64;
+ assert_eq!(ImageBudget::new(&doc).work_left(), IMAGE_WORK + (3000 + flate) * IMAGE_WORK_PER_BYTE);
+ // A stream of an opened file changed in memory counts with the file.
+ let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+ let len = pdf.len() as u64;
+ let mut doc = Document::open(std::sync::Arc::new(pdf)).unwrap();
+ doc.add(Object::Stream(Stream::from_raw(Dict::new(), vec![0; 500])));
+ assert_eq!(ImageBudget::new(&doc).work_left(), IMAGE_WORK + (len + 500) * IMAGE_WORK_PER_BYTE);
+ }
+
+ // What the constants' comments promise, for a page scanned at 300 dpi: about 1,000 of them
+ // whatever the file's size, and a page paying for itself with 2 KB of the file.
+ const PAGE: u64 = 17_000_000;
+ const _: () = assert!(IMAGE_WORK >= 1_000 * PAGE);
+ const _: () = assert!(IMAGE_WORK_PER_BYTE * 2_100 >= PAGE);
+ // And that a stream can be decoded about 8 times at Flate's best, 1,032 to one, and the byte in.
+ const _: () = assert!(IMAGE_WORK_PER_BYTE >= 7 * 1_033);
+}
+
#[cfg(test)]
mod tests {
use super::*;
@@ -198,6 +795,21 @@ mod tests {
assert_eq!(budget.remaining(), (10 << 20) - partial);
}
+ /// A stream that fails its reading as zlib, and then as raw deflate after decoding all of it,
+ /// gives nothing back, and each reference still pays for what it decoded.
+ #[test]
+ fn a_decode_that_gives_nothing_back_still_pays() {
+ let mut data = vec![0x78, 0x01, 0x06, 0xFE, 0xF9];
+ data.extend(vec![0u8; 0x0601]);
+ data.push(0x07);
+ let mut dict = Dict::new();
+ dict.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ let stream = Stream::from_raw(dict, data);
+ let mut budget = DecodeBudget::new(10 * 0x0601, 1);
+ assert!(budget.decode(&stream).unwrap().is_empty());
+ assert_eq!(budget.remaining(), 9 * 0x0601);
+ }
+
/// A chain whose later stage shrinks the data pays for every stage's output: a Flate stage
/// that inflates to hex text, which ASCIIHex then halves, charges both.
#[test]
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index 0d9b84b749..082d1910d1 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -10,7 +10,7 @@ use std::collections::{BTreeMap, HashMap, HashSet};
use std::sync::{Arc, Mutex, Weak};
use crate::CosError;
-use crate::object::{Dict, MAX_DECODED, ObjRef, Object, Stream};
+use crate::object::{Dict, MAX_DECODED, MAX_JBIG2_GLOBALS, ObjRef, Object, Stream};
use crate::parser::{EndstreamIndex, Lexer, is_whitespace, parse_indirect, parse_indirect_shared};
mod objects;
@@ -49,6 +49,9 @@ pub struct Document {
repair_log: Arc>,
cache: Arc>>>,
objstms: Arc>>>,
+ /// What `/JBIG2Globals` streams of the file decode to, by object number: the images of a scan
+ /// share them, and each would otherwise decode them again (see `Document::jbig2_globals`).
+ jbig2_globals: Arc>>>>,
stream_limit: usize,
overlay: BTreeMap,
next_num: u32,
diff --git a/crates/cos/src/document/objects.rs b/crates/cos/src/document/objects.rs
index 4f05d03ae0..2ac18cff03 100644
--- a/crates/cos/src/document/objects.rs
+++ b/crates/cos/src/document/objects.rs
@@ -1,7 +1,13 @@
use super::reader::find;
use super::state::{LENGTHS, LoadGuard, ObjStm, ObjectReader, ReadState, Slot, SourceIdentity, objstm_member, owned_bytes};
use super::xref::{Revision, XrefEntry};
-use super::{Arc, CosError, Cow, Dict, Document, Lexer, MAX_DECODED, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared};
+use super::{
+ Arc, CosError, Cow, Dict, Document, Lexer, MAX_DECODED, MAX_JBIG2_GLOBALS, ObjRef, Object, Stream, is_whitespace, parse_indirect_shared,
+};
+
+/// The most decoded `/JBIG2Globals` a document keeps for its images to share (see
+/// `Document::jbig2_globals`): two streams at [`MAX_JBIG2_GLOBALS`].
+const JBIG2_GLOBALS_HELD: usize = 2 * MAX_JBIG2_GLOBALS;
impl Document {
pub fn bytes(&self) -> &Arc> {
@@ -233,18 +239,7 @@ impl Document {
if !matches!(chain.last(), Some((pdfcraft_filters::Filter::CcittFax, _))) {
return None;
}
- // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
- // last filter but a /Crypt, which `filters` leaves out wherever it stands.
- let index = match s.dict.get(b"Filter") {
- Some(Object::Array(a)) => a.iter().rposition(|f| f.as_name() != Some(b"Crypt".as_slice())).unwrap_or(0),
- _ => 0,
- };
- let parms = match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
- Some(Object::Array(a)) => a.get(index).and_then(|p| self.dict(p)),
- Some(p) if index == 0 => p.as_dict().cloned(),
- _ => None,
- }
- .unwrap_or_default();
+ let parms = self.last_filter_parms(s);
let int = |key: &[u8], default: i64| parms.get(key).and_then(|v| self.resolve(v).as_int()).unwrap_or(default);
let flag = |key: &[u8], default: bool| match parms.get(key).map(|v| self.resolve(v)).as_deref() {
Some(Object::Bool(b)) => *b,
@@ -262,42 +257,129 @@ impl Document {
})
}
- /// The samples of image `s`, decoded: through its filters ([`Stream::decoded`]), or, for a
- /// CCITT fax image (its last filter), through the filters before it and then
- /// [`pdfcraft_filters::decode_ccitt`] with its [`Document::fax_params`], as `CCITTFaxDecode`
- /// gives them (ISO 32000-2 §7.4.6). Parameters given by reference count, for every filter
- /// ([`Document::with_direct_parms`]). A fax image's `/Columns` has to be its `/Width`. Up to
- /// its `/Height` rows are decoded, whatever `/Rows` says, within [`MAX_DECODED`] bytes; damaged
- /// data gives fewer, so a caller checks it has the rows it needs.
- pub fn decoded_image(&self, s: &Stream) -> Result, CosError> {
+ /// The `/DecodeParms` dictionary of stream `s`'s last filter, resolved: that of a lone filter,
+ /// or its entry in an array. Empty when there is none.
+ fn last_filter_parms(&self, s: &Stream) -> Dict {
+ // Its place in /Filter, /Crypt included, pairs it with its /DecodeParms entry (§7.4.1): the
+ // last filter but a /Crypt, which `filters` leaves out wherever it stands.
+ let index = match s.dict.get(b"Filter") {
+ Some(Object::Array(a)) => a.iter().rposition(|f| f.as_name() != Some(b"Crypt".as_slice())).unwrap_or(0),
+ _ => 0,
+ };
+ match s.dict.get(b"DecodeParms").map(|p| self.resolve(p)).as_deref() {
+ Some(Object::Array(a)) => a.get(index).and_then(|p| self.dict(p)),
+ Some(p) if index == 0 => p.as_dict().cloned(),
+ _ => None,
+ }
+ .unwrap_or_default()
+ }
+
+ /// [`Document::decoded_image_spending`] with no limit on the work, for tests of what an image
+ /// decodes to: everything else decodes images through an [`ImageBudget`](crate::ImageBudget).
+ #[cfg(test)]
+ pub(crate) fn decoded_image(&self, s: &Stream) -> Result, CosError> {
self.decoded_image_within(s, MAX_DECODED)
}
- /// [`Document::decoded_image`] for an image whose decoding has a tighter bound than
- /// [`MAX_DECODED`]: no stage, the filters before a fax decoder included, may produce more than
- /// `max` bytes.
- pub fn decoded_image_within(&self, s: &Stream, max: usize) -> Result, CosError> {
+ /// [`Document::decoded_image`] within `max` bytes.
+ #[cfg(test)]
+ pub(crate) fn decoded_image_within(&self, s: &Stream, max: usize) -> Result, CosError> {
+ let mut unbounded = u64::MAX;
+ self.decoded_image_spending(s, max, &mut unbounded)
+ }
+
+ /// The samples of image `s`, decoded within `max` bytes ([`MAX_DECODED`] at most), spending from
+ /// `work`: see [`ImageBudget::decode`](crate::ImageBudget::decode), the way in from outside this
+ /// crate, which says what this decodes and how.
+ pub(crate) fn decoded_image_spending(&self, s: &Stream, max: usize, work: &mut u64) -> Result, CosError> {
let max = max.min(MAX_DECODED);
let s = &*self.with_direct_parms(s);
- let Some(p) = self.fax_params(s) else { return s.decoded_within(max) };
+ let filter = |e: pdfcraft_filters::FilterError| CosError::Filter(e.to_string());
+ let chain = s.readable_filters().map_err(filter)?;
+ // The filters before the image codec, such as ASCII85Decode, are undone first.
+ let undo = |before: &[(pdfcraft_filters::Filter, pdfcraft_filters::Params)], work: &mut u64| match before {
+ [] => Ok(Cow::Borrowed(&s.raw[..])),
+ _ => pdfcraft_filters::decode_tolerant_within(before, &s.raw, max, work).map(Cow::Owned).map_err(filter),
+ };
+ // `/Width` and `/Height` are read as given directly, as every caller reads them first: one
+ // given by reference has the image refused there, before it gets here.
+ let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok());
+ if let Some(((pdfcraft_filters::Filter::Jbig2, _), before)) = chain.split_last() {
+ let (Some(columns), Some(height)) = (s.dict.int(b"Width").and_then(|w| u32::try_from(w).ok()), height) else {
+ return Err(CosError::Filter("a JBIG2 image's /Width or /Height isn't a size".into()));
+ };
+ // Nothing to read for what can't be decoded: the images of a file share its globals.
+ let globals = if *work == 0 { None } else { self.jbig2_globals(s, work)? };
+ let data = if *work == 0 { Cow::Borrowed(&[][..]) } else { undo(before, work)? };
+ return pdfcraft_filters::decode_jbig2_within(&data, globals.as_deref().map(Vec::as_slice), columns, height, max, work).map_err(filter);
+ }
+ let Some(p) = self.fax_params(s) else { return s.decoded_spending(max, work) };
// As many rows as the image has: a /Rows below /Height would cut the picture short, and
// rows past /Height aren't drawn.
let p = pdfcraft_filters::CcittParams { rows: 0, ..p };
if s.dict.int(b"Width") != Some(p.columns) {
return Err(CosError::Filter("a fax image's /Columns aren't its /Width".into()));
}
- let height = s.dict.int(b"Height").and_then(|h| u32::try_from(h).ok()).unwrap_or(0);
let stride = usize::try_from(p.columns).unwrap_or(usize::MAX).div_ceil(8).max(1);
- let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height);
- // The filters before it, such as ASCII85Decode, are undone first.
- let chain = s.readable_filters().map_err(|e| CosError::Filter(e.to_string()))?;
- let data = match chain.split_last() {
- Some((_, before)) if !before.is_empty() => {
- Cow::Owned(pdfcraft_filters::decode_tolerant(before, &s.raw, max).map_err(|e| CosError::Filter(e.to_string()))?.0)
- }
- _ => Cow::Borrowed(&s.raw[..]),
+ let rows = u32::try_from(max / stride).unwrap_or(u32::MAX).min(height.unwrap_or(0));
+ let data = undo(chain.split_last().map_or(&[][..], |(_, before)| before), work)?;
+ pdfcraft_filters::decode_ccitt_within(&data, &p, rows, work).map_err(filter)
+ }
+
+ /// The `/JBIG2Globals` stream a JBIG2 image `s` names by reference in its last filter's
+ /// `/DecodeParms`: `None` for a stream whose last filter isn't `JBIG2Decode`, or one without
+ /// globals. Redaction finds with it the other images that share a redacted image's globals.
+ pub fn jbig2_globals_ref(&self, s: &Stream) -> Option {
+ let chain = s.readable_filters().ok()?;
+ if !matches!(chain.last(), Some((pdfcraft_filters::Filter::Jbig2, _))) {
+ return None;
+ }
+ self.last_filter_parms(s).get(b"JBIG2Globals").and_then(Object::as_ref)
+ }
+
+ /// What the `/JBIG2Globals` stream of JBIG2 image `s` (in its last filter's `/DecodeParms`)
+ /// decodes to, within [`MAX_JBIG2_GLOBALS`]; `None` without one (a reference to no object is
+ /// one to null, ISO 32000-2 §7.3.10, which is an absent entry, §7.3.7). The image is then read
+ /// without them, as the renderer draws it, so an image that needed them mostly fails to decode
+ /// and can decode to other pixels. A stream that is there and can't be read is an error, rather
+ /// than the image decoded without it.
+ ///
+ /// The images of a scan share one globals stream, so a stream of the file, not edited since
+ /// it was read (the same in every clone) and with its `/DecodeParms` direct (by reference they
+ /// are another object, which can change while this one doesn't), has its filters undone once a
+ /// document and is kept, up to [`JBIG2_GLOBALS_HELD`] in all; others are read each time. That
+ /// saves the filters only: the segments it holds are decoded again for every image. Undoing
+ /// the filters spends from `work`, so globals read for every image pay every time.
+ fn jbig2_globals(&self, s: &Stream, work: &mut u64) -> Result>>, CosError> {
+ let Some(entry) = self.last_filter_parms(s).get(b"JBIG2Globals").cloned() else { return Ok(None) };
+ let held = match entry {
+ Object::Ref(r) if !self.overlay.contains_key(&r.num) => Some(r.num),
+ _ => None,
};
- pdfcraft_filters::decode_ccitt(&data, &p, rows).map_err(|e| CosError::Filter(e.to_string()))
+ if let Some(hit) = held.and_then(|num| self.jbig2_globals.lock().ok()?.get(&num).cloned()) {
+ return Ok(Some(hit));
+ }
+ let Object::Stream(g) = &*self.resolve(&entry) else { return Ok(None) };
+ let readable = self.with_direct_parms(g);
+ let held = held.filter(|_| matches!(readable, Cow::Borrowed(_)));
+ let mut data = readable.decoded_spending(MAX_JBIG2_GLOBALS, work).map_err(|e| {
+ let detail = match e {
+ CosError::Filter(detail) => detail,
+ e => e.to_string(),
+ };
+ CosError::Filter(format!("the JBIG2 globals can't be read: {detail}"))
+ })?;
+ // What is kept counts by its length, so that's all it may hold on to.
+ data.shrink_to_fit();
+ let data = Arc::new(data);
+ // A poisoned lock only means nothing is kept.
+ if let (Some(num), Ok(mut kept)) = (held, self.jbig2_globals.lock()) {
+ let total = kept.values().map(|g| g.len()).fold(data.len(), usize::saturating_add);
+ if total <= JBIG2_GLOBALS_HELD {
+ kept.insert(num, data.clone());
+ }
+ }
+ Ok(Some(data))
}
pub fn try_get(&self, num: u32) -> Result, CosError> {
diff --git a/crates/cos/src/document/open.rs b/crates/cos/src/document/open.rs
index 57d697ed66..395424b771 100644
--- a/crates/cos/src/document/open.rs
+++ b/crates/cos/src/document/open.rs
@@ -19,6 +19,7 @@ impl Document {
repair_log: Arc::new(Vec::new()),
cache: Arc::default(),
objstms: Arc::default(),
+ jbig2_globals: Arc::default(),
stream_limit: crate::object::MAX_DECODED,
overlay: BTreeMap::new(),
next_num: 1,
@@ -102,6 +103,7 @@ impl Document {
repair_log: Arc::new(Vec::new()),
cache: Arc::default(),
objstms: Arc::default(),
+ jbig2_globals: Arc::default(),
stream_limit: stream_limit.min(crate::object::MAX_DECODED),
overlay: BTreeMap::new(),
next_num: 1,
diff --git a/crates/cos/src/document/tests.rs b/crates/cos/src/document/tests.rs
index f5e36f9c83..cca4b87326 100644
--- a/crates/cos/src/document/tests.rs
+++ b/crates/cos/src/document/tests.rs
@@ -173,6 +173,217 @@ fn fax_images_decode_with_their_parameters() {
assert!(behind(&[Object::Int(5), fax], &[null, own], coded.clone()).is_err(), "a /Filter entry that isn't a name");
}
+/// Images that share a `/JBIG2Globals` stream of the file decode it once a document: it is kept
+/// for the next, in every clone. A globals stream edited since is read afresh (the kept one is the
+/// file's), and objects added in memory aren't kept.
+#[test]
+fn shared_jbig2_globals_are_read_once() {
+ let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+ let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+ let mut doc = Document::new_empty();
+ let mut d = Dict::new();
+ d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ let skipped = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+ let globals = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(&skipped))));
+ let image = |doc: &mut Document| {
+ let mut d = Dict::new();
+ d.set(b"Width".to_vec(), Object::Int(10));
+ d.set(b"Height".to_vec(), Object::Int(3));
+ d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+ let mut parms = Dict::new();
+ parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+ d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+ doc.add(Object::Stream(Stream::from_raw(d, coded.clone())))
+ };
+ let (a, b) = (image(&mut doc), image(&mut doc));
+ let stream = |doc: &Document, r: ObjRef| match &*doc.get(r) {
+ Object::Stream(s) => s.clone(),
+ _ => panic!("not a stream"),
+ };
+ assert_eq!(doc.decoded_image(&stream(&doc, a)).unwrap(), bits);
+ assert!(doc.jbig2_globals.lock().unwrap().is_empty(), "an object added in memory isn't kept");
+
+ // The same objects read from a file, the catalog holding on to the images (a full save may
+ // number them anew).
+ let root = doc.root().unwrap();
+ doc.update_dict(root, |c| c.set(b"Images".to_vec(), Object::Array(vec![Object::Ref(a), Object::Ref(b)]))).unwrap();
+ let file = crate::write_full(&doc, &crate::SaveOptions::default()).unwrap();
+ let mut doc = Document::open(Arc::new(file)).unwrap();
+ let images = doc.get(doc.root().unwrap()).as_dict().unwrap().get(b"Images").unwrap().as_array().unwrap().clone();
+ let (a, b) = (images[0].as_ref().unwrap(), images[1].as_ref().unwrap());
+ let parms = stream(&doc, a).dict.get(b"DecodeParms").unwrap().as_dict().unwrap().clone();
+ let globals = parms.reference(b"JBIG2Globals").unwrap();
+ let clone = doc.clone();
+ assert_eq!(doc.decoded_image(&stream(&doc, a)).unwrap(), bits);
+ assert_eq!(doc.jbig2_globals.lock().unwrap().len(), 1, "kept");
+ let kept = doc.jbig2_globals.lock().unwrap()[&globals.num].clone();
+ assert_eq!(clone.decoded_image(&stream(&clone, b)).unwrap(), bits, "the clone's other image");
+ let shared = clone.jbig2_globals.lock().unwrap()[&globals.num].clone();
+ assert!(Arc::ptr_eq(&kept, &shared), "the clone uses the one kept, not a second decode");
+ doc.set(globals, Object::Stream(Stream::from_raw(Dict::new(), b"not JBIG2".to_vec())));
+ assert!(doc.decoded_image(&stream(&doc, b)).is_err(), "the edited globals are read afresh");
+ assert_eq!(clone.decoded_image(&stream(&clone, b)).unwrap(), bits, "the clone keeps the file's");
+}
+
+/// A JBIG2 image's size is read as given directly, as every caller reads it first, and an image
+/// with neither is an error, not an image of no rows.
+#[test]
+fn a_jbig2_image_needs_its_size_given_directly() {
+ let coded = pdfcraft_filters::encode_jbig2_generic(&[0xFF, 0xFF], 8, 2).unwrap();
+ let mut doc = Document::new_empty();
+ let size = doc.add(Object::Int(2));
+ let image = |width: Object, height: Object| {
+ let mut d = Dict::new();
+ d.set(b"Width".to_vec(), width);
+ d.set(b"Height".to_vec(), height);
+ d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+ doc.decoded_image(&Stream::from_raw(d, coded.clone()))
+ };
+ assert!(image(Object::Int(8), Object::Int(2)).is_ok());
+ assert!(image(Object::Ref(size), Object::Int(2)).is_err(), "/Width by reference");
+ assert!(image(Object::Int(8), Object::Ref(size)).is_err(), "/Height by reference");
+}
+
+/// A document that kept globals of 64 MiB keeps no more, and the images past that still read:
+/// three streams of 22 MiB, shared by three images, are two kept and one decoded each time.
+#[test]
+fn kept_jbig2_globals_are_bounded_in_total() {
+ let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+ let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+ let length = 22 * 1024 * 1024;
+ let mut skipped = vec![0, 0, 0, 0, 0x3E, 0, 0];
+ skipped.extend_from_slice(&u32::try_from(4 + length).unwrap().to_be_bytes());
+ skipped.extend_from_slice(&[0, 0, 0, 1]);
+ skipped.resize(skipped.len() + length, 0);
+ let mut doc = Document::new_empty();
+ let mut images = Vec::new();
+ for _ in 0..3 {
+ let mut d = Dict::new();
+ d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ let globals = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(&skipped))));
+ let mut d = Dict::new();
+ d.set(b"Width".to_vec(), Object::Int(10));
+ d.set(b"Height".to_vec(), Object::Int(3));
+ d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+ let mut parms = Dict::new();
+ parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+ d.set(b"DecodeParms".to_vec(), Object::Dict(parms));
+ images.push(Object::Ref(doc.add(Object::Stream(Stream::from_raw(d, coded.clone())))));
+ }
+ let root = doc.root().unwrap();
+ doc.update_dict(root, |c| c.set(b"Images".to_vec(), Object::Array(images))).unwrap();
+ let doc = Document::open(Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap())).unwrap();
+ let images = doc.get(doc.root().unwrap()).as_dict().unwrap().get(b"Images").unwrap().as_array().unwrap().clone();
+ for image in &images {
+ let Object::Stream(s) = &*doc.get(image.as_ref().unwrap()) else { panic!("not a stream") };
+ assert_eq!(doc.decoded_image(s).unwrap(), bits, "every image reads");
+ }
+ let kept = doc.jbig2_globals.lock().unwrap();
+ assert_eq!(kept.len(), 2, "two fit in 64 MiB, a third doesn't");
+ assert!(kept.values().all(|g| g.capacity() == g.len()), "what is kept holds no more than it counts");
+}
+
+/// Globals whose `/DecodeParms` are given by reference aren't kept: that's another object, so
+/// editing it changes what they decode to while the stream itself, the key kept by, stays the same.
+#[test]
+fn jbig2_globals_with_parameters_by_reference_are_read_afresh() {
+ let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+ let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+ let skipped = [0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1];
+ let params = pdfcraft_filters::Params { predictor: 12, colors: 1, bits_per_component: 8, columns: 15, early_change: 1 };
+ let mut doc = Document::new_empty();
+ let mut parms = Dict::new();
+ parms.set(b"Predictor".to_vec(), Object::Int(12));
+ parms.set(b"Columns".to_vec(), Object::Int(15));
+ let parms = doc.add(Object::Dict(parms));
+ let mut d = Dict::new();
+ d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ d.set(b"DecodeParms".to_vec(), Object::Ref(parms));
+ let predicted = pdfcraft_filters::encode(&pdfcraft_filters::Filter::Flate, ¶ms, &skipped).unwrap();
+ let globals = doc.add(Object::Stream(Stream::from_raw(d, predicted)));
+ let mut d = Dict::new();
+ d.set(b"Width".to_vec(), Object::Int(10));
+ d.set(b"Height".to_vec(), Object::Int(3));
+ d.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+ let mut image_parms = Dict::new();
+ image_parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+ d.set(b"DecodeParms".to_vec(), Object::Dict(image_parms));
+ let image = doc.add(Object::Stream(Stream::from_raw(d, coded)));
+ let root = doc.root().unwrap();
+ doc.update_dict(root, |c| c.set(b"Image".to_vec(), Object::Ref(image))).unwrap();
+ let mut doc = Document::open(Arc::new(crate::write_full(&doc, &crate::SaveOptions::default()).unwrap())).unwrap();
+ let image = doc.get(doc.root().unwrap()).as_dict().unwrap().reference(b"Image").unwrap();
+ let stream = |doc: &Document| match &*doc.get(image) {
+ Object::Stream(s) => s.clone(),
+ _ => panic!("not a stream"),
+ };
+ assert_eq!(doc.decoded_image(&stream(&doc)).unwrap(), bits);
+ assert!(doc.jbig2_globals.lock().unwrap().is_empty(), "not kept");
+ let globals = stream(&doc).dict.get(b"DecodeParms").unwrap().as_dict().unwrap().reference(b"JBIG2Globals").unwrap();
+ let Object::Stream(g) = &*doc.get(globals) else { panic!("not a stream") };
+ let parms = g.dict.reference(b"DecodeParms").unwrap();
+ doc.set(parms, Object::Dict(Dict::new()));
+ assert!(doc.decoded_image(&stream(&doc)).is_err(), "without the predictor they read otherwise");
+}
+
+/// A JBIG2 image reads through its decoder, behind other filters too, with the `/JBIG2Globals` of
+/// its own `/DecodeParms` (a dictionary or its place in an array, /Crypt counting, by reference
+/// too): globals that can't be read are an error, and ones at another filter's place aren't its
+/// own, nor are those of a lone dictionary when other filters come first. Its page has to be its
+/// /Width × /Height, and fit the bound.
+#[test]
+fn jbig2_images_decode_with_their_globals() {
+ // 10 × 3: the first five samples of each row white, the rest black.
+ let bits = [0b1111_1000, 0, 0b1111_1000, 0, 0b1111_1000, 0];
+ let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 10, 3).unwrap();
+ let hex = coded.iter().map(|b| format!("{b:02x}")).chain([">".to_string()]).collect::().into_bytes();
+ let mut doc = Document::new_empty();
+ // An extension segment (ISO/IEC 14492 7.4.14), which a decoder skips, Flate-encoded; and data
+ // that isn't JBIG2.
+ let globals = |doc: &mut Document, data: &[u8]| {
+ let mut d = Dict::new();
+ d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ let globals = doc.add(Object::Stream(Stream::from_raw(d, pdfcraft_filters::encode_flate(data))));
+ let mut parms = Dict::new();
+ parms.set(b"JBIG2Globals".to_vec(), Object::Ref(globals));
+ Object::Dict(parms)
+ };
+ let (good, bad) = (globals(&mut doc, &[0, 0, 0, 0, 0x3E, 0, 0, 0, 0, 0, 4, 0, 0, 0, 1]), globals(&mut doc, b"not JBIG2"));
+ let indirect = Object::Ref(doc.add(bad.clone()));
+ let image = |filters: &[&str], parms: Option, data: &[u8], (width, height): (i64, i64), max: usize| {
+ let mut d = Dict::new();
+ d.set(b"Width".to_vec(), Object::Int(width));
+ d.set(b"Height".to_vec(), Object::Int(height));
+ d.set(b"Filter".to_vec(), Object::Array(filters.iter().map(|f| Object::name(f)).collect()));
+ if let Some(p) = parms {
+ d.set(b"DecodeParms".to_vec(), p);
+ }
+ doc.decoded_image_within(&Stream::from_raw(d, data.to_vec()), max)
+ };
+ let jbig2 = ["JBIG2Decode"];
+ let full = (10, 3);
+ assert_eq!(image(&jbig2, None, &coded, full, MAX_DECODED).unwrap(), bits);
+ assert_eq!(image(&jbig2, Some(good.clone()), &coded, full, MAX_DECODED).unwrap(), bits, "globals it skips");
+ for parms in [bad.clone(), Object::Array(vec![bad.clone()]), indirect.clone(), Object::Array(vec![indirect])] {
+ let e = image(&jbig2, Some(parms.clone()), &coded, full, MAX_DECODED).unwrap_err();
+ assert!(e.to_string().contains("JBIG2"), "{parms:?}: {e}");
+ }
+ let behind = ["ASCIIHexDecode", "JBIG2Decode"];
+ assert_eq!(image(&behind, None, &hex, full, MAX_DECODED).unwrap(), bits, "behind ASCIIHexDecode");
+ assert!(image(&behind, Some(Object::Array(vec![Object::Null, bad.clone()])), &hex, full, MAX_DECODED).is_err(), "its own globals");
+ assert_eq!(image(&behind, Some(Object::Array(vec![bad.clone(), Object::Null])), &hex, full, MAX_DECODED).unwrap(), bits, "another's");
+ assert_eq!(image(&behind, Some(bad.clone()), &hex, full, MAX_DECODED).unwrap(), bits, "a lone dictionary, the first filter's");
+ let after_crypt = ["Crypt", "JBIG2Decode"];
+ assert!(image(&after_crypt, Some(Object::Array(vec![Object::Null, bad.clone()])), &coded, full, MAX_DECODED).is_err(), "after /Crypt");
+ assert_eq!(image(&after_crypt, Some(Object::Array(vec![bad, Object::Null])), &coded, full, MAX_DECODED).unwrap(), bits, "/Crypt's");
+
+ for size in [(11, 3), (9, 3), (10, 2), (10, 4)] {
+ assert!(image(&jbig2, None, &coded, size, MAX_DECODED).is_err(), "a page other than {size:?}");
+ }
+ assert_eq!(image(&jbig2, None, &coded, full, 6).unwrap(), bits, "the page within the bound");
+ assert!(image(&jbig2, None, &coded, full, 5).is_err(), "the page past the bound");
+}
+
#[test]
fn a_missing_file_id_is_derived_from_the_encryption_seed() {
let mut doc = Document::new_empty();
diff --git a/crates/cos/src/lib.rs b/crates/cos/src/lib.rs
index f3be66b9a1..6187acb846 100644
--- a/crates/cos/src/lib.rs
+++ b/crates/cos/src/lib.rs
@@ -22,10 +22,10 @@ mod parser;
mod security;
mod writer;
-pub use budget::{DecodeBudget, MAX_PAGE_DECODED, MAX_PAGE_FORMS};
+pub use budget::{DecodeBudget, ImageBudget, MAX_PAGE_DECODED, MAX_PAGE_FORMS};
pub use bytes::Bytes;
pub use document::{Document, ReadState, Revision, SourceIdentity, XrefEntry};
-pub use object::{Dict, MAX_DECODED, Name, ObjRef, Object, PdfString, Stream};
+pub use object::{Dict, MAX_DECODED, MAX_JBIG2_GLOBALS, Name, ObjRef, Object, PdfString, Stream};
pub use parser::{Lexer, is_whitespace, parse_indirect};
pub use pdfcraft_crypt::{
Algorithm, Auth, Method as CryptMethod, NewEncryption, Permissions, SecurityHandler, effective_password, pdfdoc_byte, pdfdoc_char,
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index 17ee7844cf..5d437faa82 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -213,6 +213,12 @@ pub struct Stream {
/// Upper bound for a single decoded stream (decompression-bomb defence).
pub const MAX_DECODED: usize = 1 << 30;
+/// The most an image's `/JBIG2Globals` stream may decode to: the symbol and pattern dictionaries an
+/// encoder shares between pages, themselves coded, so far less than any stream may decode to
+/// ([`MAX_DECODED`]). They are decoded before the image's JBIG2 page is read, so the page's size
+/// can't bound them: they have a limit of their own.
+pub const MAX_JBIG2_GLOBALS: usize = 32 << 20;
+
impl Stream {
/// A new stream from already-encoded bytes (`/Length` is set at write time).
pub fn from_raw(dict: Dict, raw: Vec) -> Self {
@@ -300,6 +306,14 @@ impl Stream {
self.decode_chain(max, decode)
}
+ /// [`Stream::decoded_within`] spending from `work`, what an operation may still do across a
+ /// document's images ([`pdfcraft_filters::decode_tolerant_within`]).
+ pub(crate) fn decoded_spending(&self, max: usize, work: &mut u64) -> Result, CosError> {
+ let filter = |e: pdfcraft_filters::FilterError| CosError::Filter(e.to_string());
+ let chain = self.readable_filters().map_err(filter)?;
+ pdfcraft_filters::decode_tolerant_within(&chain, &self.raw, max.min(MAX_DECODED), work).map_err(filter)
+ }
+
/// The stream decoded through its filters by `decode`, or copied when it has none, within
/// `max` and [`MAX_DECODED`].
fn decode_chain(
diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index 627f716495..cd0137f452 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -245,7 +245,7 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result,
if let Some(p) = prev {
trailer.set(b"Prev".to_vec(), Object::Int(p as i64));
}
- let size = doc.next_num().max(trailer.int(b"Size").unwrap_or(0) as u32);
+ let size = doc.next_num().max(trailer.int(b"Size").map_or(0, |n| n.clamp(0, i64::from(u32::MAX)) as u32));
if as_stream {
let rows = offsets.iter().map(|(n, (o, g, used))| (*n, if *used { Row::InFile(*o, *g) } else { Row::Free(*g) })).collect();
write_xref_stream(&mut out, base, &mut trailer, rows, size);
diff --git a/crates/cos/tests/it/writer.rs b/crates/cos/tests/it/writer.rs
index 1b98664255..eb03523189 100644
--- a/crates/cos/tests/it/writer.rs
+++ b/crates/cos/tests/it/writer.rs
@@ -228,6 +228,16 @@ fn incremental_save_keeps_a_trailer_only_edit() {
assert_qpdf_clean(&saved);
}
+#[test]
+fn incremental_save_ignores_a_negative_trailer_size() {
+ let mut doc = Document::open(Arc::new(classic_table())).unwrap();
+ doc.trailer_mut().set(b"Size".to_vec(), Object::Int(-1));
+ let next = doc.add(Object::Int(5)).num + 1;
+ let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let back = Document::open(Arc::new(saved)).unwrap();
+ assert_eq!(back.trailer().int(b"Size"), Some(i64::from(next)));
+}
+
/// What one edit added and a later one unlinked (a deleted comment, a cleared redaction mark) is
/// not written: the file never held it, and writing it would keep what was removed. Additions the
/// update still refers to, from the trailer or a changed object and through other additions, are.
diff --git a/crates/create/Cargo.toml b/crates/create/Cargo.toml
index b41caa2b88..51eca668d0 100644
--- a/crates/create/Cargo.toml
+++ b/crates/create/Cargo.toml
@@ -15,8 +15,6 @@ pdfcraft-model = { workspace = true }
pdfcraft-fonts = { workspace = true }
# For `image::bmp_with_pixel_offset`, shared with XFA pictures.
pdfcraft-xfa = { workspace = true }
-# Already in the graph through hayro: decodes JBIG2 images for Export ▸ Images.
-hayro-jbig2.workspace = true
png = "0.18"
tiff = "0.11"
image = { version = "0.25", default-features = false, features = ["bmp", "gif", "jpeg"] }
diff --git a/crates/create/README.md b/crates/create/README.md
index d359eed9ae..f72f70aa26 100644
--- a/crates/create/README.md
+++ b/crates/create/README.md
@@ -27,11 +27,14 @@ Layer L4. Create a PDF (Acrobat's Create a PDF tool), execution plan M10.2:
Every function returns a `pdfcraft_cos::Document`; the caller writes it.
Image export and Save Image As apply each lossless image's Decode pair before converting its color components.
-JBIG2 images and masks (JBIG2 as their only filter) are decoded with `hayro-jbig2`, their `/JBIG2Globals` included,
-as `JBIG2Decode` gives them: black as 0. An image whose JBIG2 page has another width than the image, or more
-pixels than an exported image may have, or whose globals decode to more than 32 MiB (they are decoded before the
-page's size is known, so they have a limit of their own), is skipped; such a mask is left out and the image
-exported opaque, as JPX and CCITT masks are.
+JBIG2 images and masks are decoded through `pdfcraft_cos::ImageBudget` (`pdfcraft_filters::decode_jbig2_within`), behind
+other filters too, with the `/JBIG2Globals` of their own `/DecodeParms` entry, as `JBIG2Decode` gives them: black as 0. An image
+whose JBIG2 page isn't its size (PdfCraft's renderer draws the whole page into the image; the page is refused before it is decoded),
+or whose globals can't be read or decode to more than 32 MiB (they are decoded before the page's size is known, so they have a
+limit of their own), is skipped, and such a mask is left out and the image exported opaque, as JPX and CCITT masks are.
+Past what one export may decode, which its images share, filters, decoders and pixels alike (`ImageBudget`; a JPEG when it has to be
+decoded, as a mask, to apply one, or to undo a CMYK file's inversion, and not when it is written as it is), an image is skipped, and so is one whose mask is past it, which would otherwise come out showing what the mask hides. An export also stops at 2 GiB of files held, or twice the document if that
+is more, since they stay in memory until it ends.
Indexed Decode values select palette entries after rounding and clipping. Color-key masks compare the original samples.
Missing, null or malformed Decode arrays keep the default mapping.
Soft-mask Decode intervals map samples to opacity before the mask is resized, including reversed ranges and indirect entries.
@@ -43,4 +46,4 @@ CCITT fax images (Group 3 and 4) are decoded for export through `pdfcraft_cos::D
`ASCII85Decode` too. Byte-aligned Group 3 rows are read by their end-of-line codes, whether the fill starts each code on a byte or
ends it on one, when the data starts with one (T.4 sends one before the first row), and on bytes otherwise, whatever `/EndOfLine`
says; data that comes up short is reported. Data with codes but none before the first row is read on bytes, and is reported or,
-at `/K 0`, may come out wrong. JPEG 2000 and JBIG2 images are still reported, not exported.
+at `/K 0`, may come out wrong. JPEG 2000 images are still reported, not exported.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index b12bd50ec2..d5103071e6 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -6,7 +6,8 @@
use std::collections::HashSet;
-use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+use pdfcraft_cos::{Dict, Document, ImageBudget, MAX_DECODED, ObjRef, Object, Stream};
+use pdfcraft_filters::FilterError;
/// One image, ready to write.
#[derive(Clone, Debug, PartialEq)]
@@ -31,12 +32,29 @@ pub struct ImageExport {
/// Images larger than this many pixels are skipped (memory).
const MAX_PIXELS: u64 = 100_000_000;
+/// What one export may hold of the files it makes: they are all in memory until it ends, and a file
+/// of a few KB can make gigabytes of PNG. Images past it are left out, with the reason.
+const MAX_EXPORT_BYTES: usize = 2 << 30;
+
+/// What an export of a file of `file_bytes` may hold: twice the file if that is more than
+/// [`MAX_EXPORT_BYTES`], so that a file of large images is exported whole.
+pub(crate) fn export_bytes(file_bytes: usize) -> usize {
+ MAX_EXPORT_BYTES.max(file_bytes.saturating_mul(2))
+}
+
/// The images of `pages` (0-based; each image once, on the first page using it), skipping
/// those with fewer than `min_side` pixels on their shorter side.
pub fn extract_images(doc: &Document, pages: &[usize], min_side: u32) -> ImageExport {
+ extract_images_within(doc, pages, min_side, &mut ImageBudget::new(doc), export_bytes(doc.bytes().len()))
+}
+
+/// [`extract_images`] within `budget`, and holding `max_bytes` of files. An image past either is
+/// left out, with the reason.
+pub(crate) fn extract_images_within(doc: &Document, pages: &[usize], min_side: u32, budget: &mut ImageBudget, max_bytes: usize) -> ImageExport {
let all = pdfcraft_model::pages(doc);
let mut out = ImageExport::default();
let mut seen = HashSet::new();
+ let mut held = 0usize;
for &p in pages {
let Some(page) = all.get(p) else { continue };
let mut refs = Vec::new();
@@ -53,8 +71,15 @@ pub fn extract_images(doc: &Document, pages: &[usize], min_side: u32) -> ImageEx
if w <= 0 || h <= 0 || (w.min(h) as u64) < min_side as u64 {
continue;
}
- match image(doc, s) {
- Ok((extension, data)) => out.images.push(ExtractedImage { page: p, object: r, width: w as u32, height: h as u32, extension, data }),
+ if held >= max_bytes {
+ out.skipped.push((p, r, "more images than one export can hold".into()));
+ continue;
+ }
+ match image(doc, s, budget) {
+ Ok((extension, data)) => {
+ held = held.saturating_add(data.len());
+ out.images.push(ExtractedImage { page: p, object: r, width: w as u32, height: h as u32, extension, data });
+ }
Err(why) => out.skipped.push((p, r, why)),
}
}
@@ -64,8 +89,13 @@ pub fn extract_images(doc: &Document, pages: &[usize], min_side: u32) -> ImageEx
/// One image XObject as a file: JPEG as is, else PNG ("Save image as").
pub fn image_file(doc: &Document, image: ObjRef) -> Result<(&'static str, Vec), String> {
+ image_file_within(doc, image, &mut ImageBudget::new(doc))
+}
+
+/// [`image_file`] within `budget`, for a caller making a file of many images.
+pub fn image_file_within(doc: &Document, image: ObjRef, budget: &mut ImageBudget) -> Result<(&'static str, Vec), String> {
match &*doc.get(image) {
- Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => self::image(doc, s),
+ Object::Stream(s) if s.dict.name(b"Subtype") == Some(b"Image") => self::image(doc, s, budget),
_ => Err("not an image".into()),
}
}
@@ -100,125 +130,24 @@ fn filters(s: &Stream) -> Vec> {
}
}
-/// The samples of image `s`, decoded: through its filters, with a `/DecodeParms` dictionary given
-/// by reference, or as an array's entry, or with numbers inside by reference, read too (a predictor
-/// given so would otherwise be lost), or, for a JBIG2 image
-/// (its only filter), through a JBIG2 decoder with its `/JBIG2Globals`, as rows of one-bit samples
-/// each starting on a byte, with black as 0, as `JBIG2Decode` gives them (ISO 32000-2 §7.4.7).
-fn decoded(doc: &Document, s: &Stream) -> Result, String> {
- match filters(s).as_slice() {
- [f] if f == b"JBIG2Decode" => jbig2(doc, s),
- _ => doc.decoded_image(s).map_err(|e| e.to_string()),
- }
-}
-
-/// The `/DecodeParms` of a stream with one filter: a dictionary, or the one in an array (7.4.2).
-fn decode_parms(doc: &Document, s: &Stream) -> Dict {
- let Some(p) = s.dict.get(b"DecodeParms").map(|p| doc.resolve(p)) else { return Dict::default() };
- let p = match &*p {
- Object::Array(a) => match a.first() {
- Some(first) => doc.resolve(first),
- None => return Dict::default(),
- },
- _ => p,
- };
- p.as_dict().cloned().unwrap_or_default()
-}
-
-/// The most an image's `/JBIG2Globals` decode to: the symbol and pattern dictionaries an encoder
-/// shares between pages, themselves coded, so far less than any stream may decode to
-/// ([`pdfcraft_cos::MAX_DECODED`], 1 GiB). Globals past it refuse the image.
-const MAX_GLOBALS: usize = 32 << 20;
-
-/// [`decoded`] for a JBIG2 image. Its JBIG2 page has to be the image's width, which the caller
-/// checked against the export's size limit, and within that limit itself: the decoder decodes the
-/// whole page, rows past the image's height too, so a small `/Height` over a far taller page
-/// would cost more than the limit allows. Rows past the image's height are dropped, and too few
-/// rows are refused by the caller. Globals that can't be read refuse the image, rather than
-/// decoding it without them. They are decoded before the page's size is known, so the page's
-/// limit can't bound them; they have [`MAX_GLOBALS`] of their own.
-fn jbig2(doc: &Document, s: &Stream) -> Result, String> {
- let globals = match decode_parms(doc, s).get(b"JBIG2Globals").map(|g| doc.resolve(g)).as_deref() {
- Some(Object::Stream(g)) => {
- Some(doc.with_direct_parms(g).decoded_within(MAX_GLOBALS).map_err(|e| format!("the JBIG2 globals can't be read: {e}"))?)
- }
- _ => None,
- };
- let image = hayro_jbig2::Image::new_embedded(&s.raw, globals.as_deref()).map_err(|e| format!("the JBIG2 image can't be read: {e}"))?;
- if s.dict.int(b"Width") != Some(i64::from(image.width())) {
- return Err("the JBIG2 image's width isn't the image's width".into());
- }
- if u64::from(image.width()).saturating_mul(u64::from(image.height())) > MAX_PIXELS {
- return Err(format!("the JBIG2 page, {} × {}, is too large to export", image.width(), image.height()));
- }
- let height = s.dict.int(b"Height").and_then(|h| usize::try_from(h).ok()).unwrap_or(0);
- let mut rows = Rows::new(image.width() as usize, height);
- image.decode(&mut rows).map_err(|e| format!("the JBIG2 image can't be decoded: {e}"))?;
- Ok(rows.out)
-}
-
-/// Rows of one-bit samples, each starting on a byte, filled from a decoder's pixels: `columns`
-/// a row and at most `rows` rows. Pixels past a row's end and rows past the last are dropped, so
-/// the output is bounded by the size the caller gave.
-struct Rows {
- out: Vec,
- row: Vec,
- x: usize,
- columns: usize,
- rows: usize,
- done: usize,
-}
-
-impl Rows {
- fn new(columns: usize, rows: usize) -> Self {
- Rows { out: Vec::new(), row: vec![0; columns.div_ceil(8)], x: 0, columns, rows, done: 0 }
- }
-
- /// `count` pixels, as 1 samples when `one`.
- fn push(&mut self, one: bool, count: usize) {
- let end = self.x.saturating_add(count);
- if one {
- for x in self.x..end.min(self.columns) {
- if let Some(b) = self.row.get_mut(x / 8) {
- *b |= 0x80 >> (x % 8);
- }
- }
- }
- self.x = end;
- }
-
- fn end_row(&mut self) {
- if self.done < self.rows {
- self.out.extend_from_slice(&self.row);
- self.done += 1;
- }
- self.row.fill(0);
- self.x = 0;
- }
-}
-
-/// JBIG2 codes black as 1, which `JBIG2Decode` gives as 0.
-impl hayro_jbig2::Decoder for Rows {
- fn push_pixel(&mut self, black: bool) {
- self.push(!black, 1);
- }
- fn push_pixel_chunk(&mut self, black: bool, chunks: u32) {
- self.push(!black, (chunks as usize).saturating_mul(8));
- }
- fn next_line(&mut self) {
- self.end_row();
- }
+/// The samples of image `s`, decoded ([`ImageBudget::decode`]): through its filters, with a
+/// `/DecodeParms` dictionary given by reference, or as an array's entry, or with numbers inside by
+/// reference, read too (a predictor given so would otherwise be lost); a CCITT fax or JBIG2 image
+/// through its decoder too, behind other filters as well, a JBIG2 image with its `/JBIG2Globals`.
+/// A JBIG2 page has to be the image's size, which the caller checked against the export's limit,
+/// before the page is decoded.
+fn decoded(doc: &Document, s: &Stream, budget: &mut ImageBudget) -> Result, String> {
+ budget.decode(doc, s, MAX_DECODED).map_err(|e| e.to_string())
}
/// The file for one image: its JPEG data as is, or a PNG. An image with transparency (a soft
/// mask, a stencil `/Mask` or a colour-key `/Mask`) is always a PNG with that transparency as
/// alpha, JPEG images included, so cut-out images keep their transparent background.
-fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec), String> {
+fn image(doc: &Document, s: &Stream, budget: &mut ImageBudget) -> Result<(&'static str, Vec), String> {
let f = filters(s);
let jpeg = matches!(f.last().map(Vec::as_slice), Some(b"DCTDecode" | b"DCT")) && f.len() == 1;
match f.last().map(Vec::as_slice) {
Some(b"JPXDecode") => return Err("JPEG 2000 images can't be exported yet".into()),
- Some(b"JBIG2Decode") if f.len() > 1 => return Err("JBIG2 images inside other filters can't be exported yet".into()),
Some(b"DCTDecode" | b"DCT") if !jpeg => return Err("JPEG images inside other filters can't be exported yet".into()),
_ => {}
}
@@ -233,14 +162,24 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec), String>
};
let mask = s.dict.get(b"ImageMask").is_some_and(|m| matches!(&*doc.resolve(m), Object::Bool(true)));
// A stencil mask (`ImageMask true`) has no /SMask or /Mask of its own (8.9.6.2).
- let mut alpha = if mask { None } else { soft_mask(doc, s, w, h).or_else(|| stencil_mask(doc, s, w, h)) };
+ let refused = budget.refused();
+ let mut alpha = if mask { None } else { soft_mask(doc, s, w, h, budget).or_else(|| stencil_mask(doc, s, w, h, budget)) };
+ // Without its mask the image would come out opaque, showing what the mask hides.
+ if budget.refused() > refused {
+ return Err(FilterError::Spent.to_string());
+ }
let key = if mask { None } else { colour_key(doc, s) };
// Keep the existing JPEG and stencil-mask Decode handling separate from lossless colour images.
+ let endpoint = |value: Option<&Object>| value.map(|v| doc.resolve(v)).and_then(|v| v.as_f64()).filter(|v| v.is_finite());
let inverted = (jpeg || mask)
&& s.dict
.get(b"Decode")
.map(|d| doc.resolve(d))
- .and_then(|d| d.as_array().map(|a| a.first().and_then(Object::as_f64) > a.get(1).and_then(Object::as_f64)))
+ // Both ends have to be finite numbers, as for lossless images, or the default mapping stands.
+ .and_then(|d| {
+ let a = d.as_array()?;
+ Some(endpoint(a.first())? > endpoint(a.get(1))?)
+ })
.unwrap_or(false);
// In a PDF a CMYK JPEG's samples are ink amounts unless /Decode inverts them, while image
// viewers read a CMYK JPEG file as inverted (Adobe's convention): as is, it would show as
@@ -251,13 +190,16 @@ fn image(doc: &Document, s: &Stream) -> Result<(&'static str, Vec), String>
}
let mut space = if mask { Space::Gray } else { space(doc, s.dict.get(b"ColorSpace"))? };
let (samples, bpc) = if jpeg {
+ if !budget.pay_jpeg((w as u64).saturating_mul(h as u64).saturating_mul(space.components() as u64), &s.raw) {
+ return Err(FilterError::Spent.to_string());
+ }
// Grey, RGB or CMYK samples (YCCK is converted); a JPEG that doesn't decode, or an
// indexed one (not valid), is written as is, without its transparency.
let Some((samples, decoded)) = jpeg_samples(&s.raw, &space, w, h) else { return as_is() };
space = decoded;
(samples, 8)
} else {
- let data = decoded(doc, s)?;
+ let data = decoded(doc, s, budget)?;
let bpc = if mask { 1 } else { s.dict.int(b"BitsPerComponent").unwrap_or(8) };
let bpc = match bpc {
1 => 1,
@@ -348,6 +290,32 @@ fn size(w: i64, h: i64) -> Option<(usize, usize)> {
(w > 0 && h > 0 && pixels <= MAX_PIXELS).then_some((w, h))
}
+#[cfg(test)]
+thread_local! {
+ /// JPEGs decoded whole, for the tests that keep one from being decoded for nothing.
+ pub(crate) static JPEGS_DECODED: std::cell::Cell = const { std::cell::Cell::new(0) };
+}
+
+/// The size a JPEG's header gives, which is what decoding it goes by, whatever its dictionary
+/// says: an image of one pixel can hold a header of 500 megapixels.
+fn jpeg_size(data: &[u8]) -> Option<(usize, usize)> {
+ use zune_jpeg::zune_core::{bytestream::ZCursor, options::DecoderOptions};
+ let options = DecoderOptions::default().set_strict_mode(false).set_max_width(usize::from(u16::MAX)).set_max_height(usize::from(u16::MAX));
+ let mut dec = zune_jpeg::JpegDecoder::new_with_options(ZCursor::new(data), options);
+ dec.decode_headers().ok()?;
+ dec.dimensions()
+}
+
+/// JPEG `data`, decoded, if its header says it is `w` × `h`.
+fn jpeg_of_size(data: &[u8], w: usize, h: usize) -> Option {
+ if jpeg_size(data)? != (w, h) {
+ return None;
+ }
+ #[cfg(test)]
+ JPEGS_DECODED.with(|n| n.set(n.get() + 1));
+ image::load_from_memory_with_format(data, image::ImageFormat::Jpeg).ok()
+}
+
/// A JPEG's samples (8 bits): grey for a grey image, CMYK as stored for a CMYK one, else RGB,
/// with the space they are in.
fn jpeg_samples(data: &[u8], space: &Space, w: usize, h: usize) -> Option<(Vec, Space)> {
@@ -356,10 +324,7 @@ fn jpeg_samples(data: &[u8], space: &Space, w: usize, h: usize) -> Option<(Vec return cmyk_jpeg_samples(data, w, h).map(|px| (px, Space::Cmyk)),
_ => {}
}
- let img = image::load_from_memory_with_format(data, image::ImageFormat::Jpeg).ok()?;
- if img.width() as usize != w || img.height() as usize != h {
- return None;
- }
+ let img = jpeg_of_size(data, w, h)?;
Some(match space {
Space::Gray => (img.into_luma8().into_raw(), Space::Gray),
_ => (img.into_rgb8().into_raw(), Space::Rgb),
@@ -560,32 +525,35 @@ fn cmyk(c: u8, m: u8, y: u8, k: u8) -> [u8; 3] {
}
/// The soft mask (`/SMask`) as 8-bit alpha, scaled to the image's size when it has another.
-fn soft_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option> {
+fn soft_mask(doc: &Document, s: &Stream, w: usize, h: usize, budget: &mut ImageBudget) -> Option> {
let r = s.dict.get(b"SMask")?.as_ref()?;
let obj = doc.get(r);
let Object::Stream(m) = &*obj else { return None };
- gray_plane(doc, m, w, h)
+ gray_plane(doc, m, w, h, budget)
}
/// A stencil `/Mask` (an image mask stream, 8.9.6.3) as 8-bit alpha: its 1 samples (0 with
/// `/Decode [1 0]`) hide the image.
-fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize) -> Option> {
+fn stencil_mask(doc: &Document, s: &Stream, w: usize, h: usize, budget: &mut ImageBudget) -> Option> {
let r = s.dict.get(b"Mask")?.as_ref()?;
let obj = doc.get(r);
let Object::Stream(m) = &*obj else { return None };
- Some(gray_plane(doc, m, w, h)?.into_iter().map(|v| 255 - v).collect())
+ Some(gray_plane(doc, m, w, h, budget)?.into_iter().map(|v| 255 - v).collect())
}
/// A one-component mask image as 8-bit values (its `/Decode` interval applied), scaled to
/// `w` × `h`. `None` when it can't be decoded (JPEG 2000 masks).
-fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option> {
+fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize, budget: &mut ImageBudget) -> Option> {
let (mw, mh) = size(m.dict.int(b"Width")?, m.dict.int(b"Height")?)?;
let stencil = m.dict.get(b"ImageMask").is_some_and(|v| matches!(&*doc.resolve(v), Object::Bool(true)));
let f = filters(m);
let mut px = match f.last().map(Vec::as_slice) {
Some(b"DCTDecode" | b"DCT") if f.len() == 1 => {
- let img = image::load_from_memory_with_format(&m.raw, image::ImageFormat::Jpeg).ok()?.into_luma8();
- (img.width() as usize == mw && img.height() as usize == mh).then(|| img.into_raw())?
+ // Past the allowance the image goes too: `image` sees this one refused.
+ if !budget.pay_jpeg((mw as u64).saturating_mul(mh as u64), &m.raw) {
+ return None;
+ }
+ jpeg_of_size(&m.raw, mw, mh)?.into_luma8().into_raw()
}
Some(b"DCTDecode" | b"DCT" | b"JPXDecode") => return None,
_ => {
@@ -599,7 +567,7 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option>
_ => return None,
};
let max = (1u32 << bpc.min(8)) - 1;
- unpack(&decoded(doc, m).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
+ unpack(&decoded(doc, m, budget).ok()?, mw, mh, 1, bpc)?.into_iter().map(|v| (v as u32 * 255 / max) as u8).collect()
}
};
if let Some([lo, hi]) = decode(doc, m, 1).and_then(|pairs| pairs.first().copied()) {
@@ -612,7 +580,23 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize) -> Option>
return Some(px);
}
let img = image::GrayImage::from_raw(mw as u32, mh as u32, px)?;
- Some(image::imageops::resize(&img, w as u32, h as u32, image::imageops::FilterType::Triangle).into_raw())
+ Some(scaled(&img, w as u32, h as u32).into_raw())
+}
+
+/// `img` scaled to `w` × `h`. Scaling goes down first, through a buffer of `img`'s width by `h` at
+/// 16 bytes a pixel, which a mask of other proportions than its image can make larger than any
+/// machine: 100,000 × 1 on an image of 1 × 100,000 asks for 160 GB, and that aborts the process.
+/// Such a mask is scaled across first, which holds no more pixels than one of the two has. Past a
+/// quarter over the larger of them, so that rounding leaves a mask of its image's shape as it was.
+pub(crate) fn scaled(img: &image::GrayImage, w: u32, h: u32) -> image::GrayImage {
+ use image::imageops::{FilterType, resize};
+ let (mw, mh) = (u64::from(img.width()), u64::from(img.height()));
+ let largest = (mw * mh).max(u64::from(w) * u64::from(h));
+ if (mw * u64::from(h)).saturating_mul(4) > largest.saturating_mul(5) {
+ resize(&resize(img, w, img.height(), FilterType::Triangle), w, h, FilterType::Triangle)
+ } else {
+ resize(img, w, h, FilterType::Triangle)
+ }
}
fn png(w: u32, h: u32, rgb: &[u8], alpha: Option<&[u8]>) -> Result, String> {
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index 36b52d4211..4c117019d7 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -6,7 +6,7 @@ use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream, serialize}
mod extract;
mod upright_image;
-pub use extract::{ExtractedImage, ImageExport, extract_images, image_file};
+pub use extract::{ExtractedImage, ImageExport, extract_images, image_file, image_file_within};
use pdfcraft_fonts::{literal, win_ansi, wrap};
#[derive(Debug, thiserror::Error, PartialEq)]
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 03c93d4a51..a7a5611ffc 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -2054,10 +2054,10 @@ fn symbol_coded_jbig2_images_export_as_their_picture() {
/// Export ▸ Images reads JBIG2 images (ISO 32000-2 §7.4.7), JBIG2 black as 0: as the image, and as
/// a stencil `/Mask` of another. Their `/JBIG2Globals` are read, from a dictionary or the one in
-/// an array, so globals that can't be read skip the image rather than being ignored. Rows past the
-/// image's height are left out; a JBIG2 page of another width, or with fewer rows than the image,
-/// or larger than an exported image may be (however small the image's `/Height`), or data that
-/// isn't JBIG2, skips the image.
+/// an array, so globals that can't be read skip the image rather than being ignored. A JBIG2 page
+/// of another size than the image (a taller one too: PdfCraft's renderer draws the whole page into
+/// the image), refused before it is decoded however large, or data that isn't JBIG2, skips the
+/// image.
#[test]
fn jbig2_images_export_as_their_picture() {
let (w, h) = (203i64, 41i64);
@@ -2118,33 +2118,24 @@ fn jbig2_images_export_as_their_picture() {
for in_array in [false, true] {
assert!(skipped(&page(w, h, &jbig2, Some((&b"not JBIG2"[..], in_array)), false)), "unreadable globals, in an array: {in_array}");
}
- assert_eq!(exported_rgba(&page(w, h - 5, &jbig2, None, false)).1, picture(h - 5), "rows past the height");
- for (width, height, data) in [(w + 8, h, &jbig2[..]), (w - 1, h, &jbig2[..]), (w, h + 1, &jbig2[..]), (w, h, &b"not JBIG2"[..])] {
+ for (width, height, data) in
+ [(w + 8, h, &jbig2[..]), (w - 1, h, &jbig2[..]), (w, h + 1, &jbig2[..]), (w, h - 5, &jbig2[..]), (w, h, &b"not JBIG2"[..])]
+ {
assert!(skipped(&page(width, height, data, None, false)), "{width} × {height}, {} bytes", data.len());
}
// The same stream with its page information (the first segment's data, after its 11-byte
- // header: width, then height) claiming a 20,000 × 10,000 page: 200 million pixels, over the
- // export's 100 million, behind an image of 20,000 × 4. The decoder would decode the whole page
- // (it takes pages of up to about 2^28 pixels), so it is refused first.
+ // header: width, then height) claiming a 20,000 × 10,000 page, behind an image of 20,000 × 4:
+ // the decoder would decode the whole page, so it is refused first.
let mut large = jbig2.clone();
large[11..15].copy_from_slice(&20_000u32.to_be_bytes());
large[15..19].copy_from_slice(&10_000u32.to_be_bytes());
- assert!(skipped(&page(20_000, 4, &large, None, false)), "a page over the export's size");
+ assert!(skipped(&page(20_000, 4, &large, None, false)), "a page far taller than the image");
// Refused the same ways as a stencil /Mask, it is left out: the image exports opaque.
for (width, height, mask) in [(w + 8, h, &jbig2), (20_000, 4, &large)] {
let rgba = exported_rgba(&page(width, height, mask, None, true)).1;
assert_eq!(rgba.len() as i64, width * height * 4, "a {width}-wide mask");
assert!(alphas(&rgba).iter().all(|a| *a == 255), "a refused {width}-wide mask is left out");
}
- // A page of exactly the budget, 20,000 × 5,000, is decoded; one row more is refused.
- for (rows, refused) in [(5_000u32, false), (5_001, true)] {
- large[15..19].copy_from_slice(&rows.to_be_bytes());
- let doc = page(20_000, 4, &large, None, false);
- assert_eq!(skipped(&doc), refused, "a page of 20,000 × {rows}");
- if !refused {
- assert_eq!(exported_rgba(&doc).1.len(), 20_000 * 4 * 4);
- }
- }
// Damaged data never panics.
for end in [0, 1, 10, 20, 30, jbig2.len() / 2] {
let _ = extract_images(&page(w, h, &jbig2[..end], None, false), &[0], 0);
@@ -2155,6 +2146,38 @@ fn jbig2_images_export_as_their_picture() {
assert_eq!(alphas(&exported_rgba(&page(w, h, &jbig2, None, true)).1), alpha);
}
+/// A JBIG2 image behind another filter (ASCIIHexDecode) exports as its picture, as a fax image does,
+/// with the `/JBIG2Globals` at its own place in a `/DecodeParms` array: globals that can't be read
+/// there skip the image, and ones at the other filter's place aren't the image's.
+#[test]
+fn jbig2_images_behind_another_filter_export_as_their_picture() {
+ let bits = [0xF0u8, 0x0F, 0xAA, 0x55];
+ let jbig2 = pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap();
+ let hex: Vec = jbig2.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect();
+ let picture: Vec = (0..32).flat_map(|i| if bits[i / 8] & (0x80 >> (i % 8)) != 0 { [255; 4] } else { [0, 0, 0, 255] }).collect();
+ // With unreadable globals at place `at` of its /DecodeParms.
+ let page = |at: Option| {
+ let mut doc = from_images(&[("flat.png".into(), png_bytes(false))]).unwrap();
+ with_image(&mut doc, |doc| {
+ let mut d = image_dict(16, 2, "DeviceGray", 1);
+ d.set(b"Filter".to_vec(), Object::Array(vec![Object::name("ASCIIHexDecode"), Object::name("JBIG2Decode")]));
+ if let Some(at) = at {
+ let mut parms = Dict::new();
+ parms.set(b"JBIG2Globals".to_vec(), Object::Ref(doc.add(Object::Stream(Stream::from_raw(Dict::new(), b"not JBIG2".to_vec())))));
+ let mut entries = vec![Object::Null, Object::Null];
+ entries[at] = Object::Dict(parms);
+ d.set(b"DecodeParms".to_vec(), Object::Array(entries));
+ }
+ Stream::from_raw(d, hex.clone())
+ });
+ doc
+ };
+ assert_eq!(exported_rgba(&page(None)), ("png", picture.clone()));
+ assert_eq!(exported_rgba(&page(Some(0))).1, picture, "globals at ASCIIHexDecode's place");
+ let out = extract_images(&page(Some(1)), &[0], 0);
+ assert!(out.images.is_empty() && out.skipped.len() == 1, "unreadable globals at its own place");
+}
+
/// A JBIG2 image's `/JBIG2Globals` are decoded before its JBIG2 page's size is known, so they have
/// a limit of their own, 32 MiB, far below the 1 GiB of any stream: globals that Flate-decode to
/// one byte more skip the image, with the limit in the reason, though they take a few kilobytes
@@ -2162,7 +2185,8 @@ fn jbig2_images_export_as_their_picture() {
/// indirect `/DecodeParms`, in an array or not.
#[test]
fn jbig2_globals_are_decoded_within_a_limit_of_their_own() {
- const LIMIT: usize = 32 << 20;
+ const LIMIT: usize = pdfcraft_cos::MAX_JBIG2_GLOBALS;
+ assert_eq!(LIMIT, 32 << 20);
let bits = [0xF0u8, 0x0F, 0xAA, 0x55];
let jbig2 = pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap();
let picture: Vec = (0..32).flat_map(|i| if bits[i / 8] & (0x80 >> (i % 8)) != 0 { [255; 4] } else { [0, 0, 0, 255] }).collect();
@@ -2206,6 +2230,372 @@ fn jbig2_globals_are_decoded_within_a_limit_of_their_own() {
let out = extract_images(&page(&over, form), &[0], 0);
assert!(out.images.is_empty(), "globals over the limit, form {form}");
let why = &out.skipped.first().expect("the image is skipped").2;
- assert!(why.starts_with("the JBIG2 globals can't be read") && why.contains(&format!("limit of {LIMIT} bytes")), "{why}");
+ assert!(why.contains("the JBIG2 globals can't be read") && why.contains(&format!("limit of {LIMIT} bytes")), "{why}");
}
}
+
+/// One allowance for all the images of an export: an image past it is left out, saying so.
+#[test]
+fn jbig2_images_past_the_exports_allowance_are_left_out_with_the_reason() {
+ use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+ let mut dict = Dict::new();
+ dict.set(b"Subtype".to_vec(), Object::name("Image"));
+ dict.set(b"Width".to_vec(), Object::Int(16));
+ dict.set(b"Height".to_vec(), Object::Int(2));
+ dict.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+ dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ dict.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+ let image = Stream::from_raw(dict, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap());
+ let mut cost = ImageBudget::with_work(u64::MAX);
+ cost.decode(&Document::new_empty(), &image, 1 << 20).unwrap();
+ let cost = u64::MAX - cost.work_left();
+
+ let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] >> endobj\ntrailer << /Root 1 0 R >>\n%%EOF".to_vec();
+ let mut doc = Document::open(std::sync::Arc::new(pdf)).unwrap();
+ let (a, b) = (doc.add(Object::Stream(image.clone())), doc.add(Object::Stream(image)));
+ let mut xobjects = Dict::new();
+ xobjects.set(b"A".to_vec(), Object::Ref(a));
+ xobjects.set(b"B".to_vec(), Object::Ref(b));
+ let mut resources = Dict::new();
+ resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+ let page = pdfcraft_model::pages(&doc).swap_remove(0).obj;
+ doc.update_dict(page, |p| p.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+
+ let export = crate::extract::extract_images_within(&doc, &[0], 1, &mut ImageBudget::with_work(cost), usize::MAX);
+ assert_eq!(export.images.len(), 1);
+ assert_eq!(export.skipped.len(), 1);
+ assert!(export.skipped[0].2.contains("more image decoding than"), "{:?}", export.skipped);
+ // What an export holds is bounded too: the files are all in memory until it ends.
+ let export = crate::extract::extract_images_within(&doc, &[0], 1, &mut ImageBudget::with_work(u64::MAX), 1);
+ assert_eq!(export.images.len(), 1, "the first goes past it");
+ assert_eq!(export.skipped.len(), 1);
+ assert!(export.skipped[0].2.contains("than one export can hold"), "{:?}", export.skipped);
+ // A file of many images shares one allowance too, image by image.
+ let mut budget = ImageBudget::with_work(cost);
+ assert!(crate::extract::image_file_within(&doc, a, &mut budget).is_ok());
+ assert!(crate::extract::image_file_within(&doc, b, &mut budget).is_err());
+}
+
+/// An image that isn't JBIG2 shares the allowance too: a file of filter bombs would hold an export
+/// as long as one of JBIG2. What isn't decoded here, a JPEG, is still exported.
+#[test]
+fn flate_images_past_the_exports_allowance_are_left_out_with_the_reason() {
+ use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+ let image = |filter: &str, raw: Vec| {
+ let mut dict = Dict::new();
+ dict.set(b"Subtype".to_vec(), Object::name("Image"));
+ dict.set(b"Width".to_vec(), Object::Int(2));
+ dict.set(b"Height".to_vec(), Object::Int(2));
+ dict.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ dict.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ dict.set(b"Filter".to_vec(), Object::name(filter));
+ Stream::from_raw(dict, raw)
+ };
+ let flate = image("FlateDecode", pdfcraft_filters::encode_flate(&[0x80; 4]));
+ let mut cost = ImageBudget::with_work(u64::MAX);
+ cost.decode(&Document::new_empty(), &flate, 1 << 20).unwrap();
+ let cost = u64::MAX - cost.work_left();
+
+ let mut doc = Document::new_empty();
+ let (a, b) = (doc.add(Object::Stream(flate.clone())), doc.add(Object::Stream(flate)));
+ let mut budget = ImageBudget::with_work(cost);
+ assert!(crate::extract::image_file_within(&doc, a, &mut budget).is_ok());
+ let refused = crate::extract::image_file_within(&doc, b, &mut budget).unwrap_err();
+ assert!(refused.contains("more image decoding than"), "{refused}");
+ assert_eq!(budget.refused(), 1);
+
+ let jpeg = image::RgbImage::from_pixel(2, 2, image::Rgb([9, 9, 9]));
+ let mut bytes = Vec::new();
+ jpeg.write_to(&mut std::io::Cursor::new(&mut bytes), image::ImageFormat::Jpeg).unwrap();
+ let jpeg = doc.add(Object::Stream(image("DCTDecode", bytes)));
+ assert!(crate::extract::image_file_within(&doc, jpeg, &mut budget).is_ok(), "nothing charged");
+ assert_eq!(budget.refused(), 1);
+}
+
+/// A JPEG is written as it is, at no cost, unless something means decoding it, here a mask: that
+/// pays for its samples, and past the allowance the image goes, with the reason, as it would come out without
+/// its transparency otherwise.
+#[test]
+fn a_jpeg_that_has_to_be_decoded_shares_the_allowance() {
+ use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+ let mut jpeg = Vec::new();
+ image::RgbImage::from_pixel(4, 4, image::Rgb([9, 9, 9])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+ let image_dict = |extra: Option<(&[u8], Object)>| {
+ let mut d = Dict::new();
+ d.set(b"Subtype".to_vec(), Object::name("Image"));
+ d.set(b"Width".to_vec(), Object::Int(4));
+ d.set(b"Height".to_vec(), Object::Int(4));
+ d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+ d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+ if let Some((key, value)) = extra {
+ d.set(key.to_vec(), value);
+ }
+ d
+ };
+ let mut doc = Document::new_empty();
+ let mut mask = Dict::new();
+ mask.set(b"Subtype".to_vec(), Object::name("Image"));
+ mask.set(b"Width".to_vec(), Object::Int(4));
+ mask.set(b"Height".to_vec(), Object::Int(4));
+ mask.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ mask.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ let mask = doc.add(Object::Stream(Stream::from_raw(mask, vec![0x80; 16])));
+ let doc_jpeg_len = jpeg.len();
+ let masked = doc.add(Object::Stream(Stream::from_raw(image_dict(Some((b"SMask", Object::Ref(mask)))), jpeg.clone())));
+ let plain = doc.add(Object::Stream(Stream::from_raw(image_dict(None), jpeg)));
+
+ let mut budget = ImageBudget::with_work(0);
+ assert!(crate::extract::image_file_within(&doc, plain, &mut budget).is_ok(), "written as it is");
+ assert_eq!(budget.refused(), 0);
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(crate::extract::image_file_within(&doc, masked, &mut budget).is_ok());
+ let cost = u64::MAX - budget.work_left();
+ let read = 4 * doc_jpeg_len as u64;
+ assert_eq!(cost, 16 + 16 + 2 * 4 * 4 * 3 + read, "the mask's bytes and pixels, the JPEG's samples twice and its reading");
+ let mut budget = ImageBudget::with_work(cost - 1);
+ let refused = crate::extract::image_file_within(&doc, masked, &mut budget).unwrap_err();
+ assert!(refused.contains("more image decoding than"), "{refused}");
+ assert_eq!(budget.refused(), 1);
+}
+
+/// A JPEG that is itself a mask pays for its samples, each time an image reads it: images can
+/// share one, and only the images are ever seen once.
+#[test]
+fn a_jpeg_mask_pays_for_its_samples() {
+ use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+ let mut jpeg = Vec::new();
+ image::GrayImage::from_pixel(4, 4, image::Luma([90])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+ let mut mask = Dict::new();
+ mask.set(b"Subtype".to_vec(), Object::name("Image"));
+ mask.set(b"Width".to_vec(), Object::Int(4));
+ mask.set(b"Height".to_vec(), Object::Int(4));
+ mask.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ mask.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ mask.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+ let mut doc = Document::new_empty();
+ let read = 4 * jpeg.len() as u64;
+ let mask = doc.add(Object::Stream(Stream::from_raw(mask, jpeg)));
+ let mut image = Dict::new();
+ image.set(b"Subtype".to_vec(), Object::name("Image"));
+ image.set(b"Width".to_vec(), Object::Int(1));
+ image.set(b"Height".to_vec(), Object::Int(1));
+ image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ image.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ image.set(b"SMask".to_vec(), Object::Ref(mask));
+ let image = doc.add(Object::Stream(Stream::from_raw(image, vec![0x80])));
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(crate::extract::image_file_within(&doc, image, &mut budget).is_ok());
+ assert_eq!(u64::MAX - budget.work_left(), 2 * 4 * 4 + read + 2, "its samples twice, its reading, and the image's byte and pixel");
+ // Just short of what the mask costs: it isn't decoded, and takes the image with it.
+ let mut budget = ImageBudget::with_work(2 * 4 * 4 + read - 1);
+ let refused = crate::extract::image_file_within(&doc, image, &mut budget).unwrap_err();
+ assert!(refused.contains("more image decoding than"), "{refused}");
+ assert_eq!((budget.work_left(), budget.refused()), (0, 1));
+}
+
+/// What decoding a JPEG takes goes by its header, so that is what has to agree with the
+/// dictionary before it is decoded: one image of a pixel can hold a page of 500 megapixels. The
+/// file comes out as it is either way, so what shows is whether it was decoded.
+#[test]
+fn a_jpeg_larger_than_its_dictionary_says_isnt_decoded() {
+ use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+ let mut jpeg = Vec::new();
+ image::RgbImage::from_pixel(4, 4, image::Rgb([9, 9, 9])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+ // A colour key means decoding it, to find the pixels it hides.
+ let keyed = |side: i64| {
+ let mut d = Dict::new();
+ d.set(b"Subtype".to_vec(), Object::name("Image"));
+ d.set(b"Width".to_vec(), Object::Int(side));
+ d.set(b"Height".to_vec(), Object::Int(side));
+ d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ d.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+ d.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+ d.set(b"Mask".to_vec(), Object::Array(vec![Object::Int(0); 6]));
+ Stream::from_raw(d, jpeg.clone())
+ };
+ let decodes = |doc: &Document, image: pdfcraft_cos::ObjRef| {
+ crate::extract::JPEGS_DECODED.with(|n| n.set(0));
+ assert!(crate::extract::image_file_within(doc, image, &mut ImageBudget::with_work(u64::MAX)).is_ok());
+ crate::extract::JPEGS_DECODED.with(std::cell::Cell::get)
+ };
+ let mut doc = Document::new_empty();
+ let (honest, lying) = (doc.add(Object::Stream(keyed(4))), doc.add(Object::Stream(keyed(1))));
+ assert_eq!(decodes(&doc, honest), 1);
+ assert_eq!(decodes(&doc, lying), 0);
+ // The same as a mask: read as none, without being decoded.
+ let mut mask = keyed(1);
+ mask.dict.remove(b"Mask");
+ let mask = doc.add(Object::Stream(mask));
+ let mut image = Dict::new();
+ image.set(b"Subtype".to_vec(), Object::name("Image"));
+ image.set(b"Width".to_vec(), Object::Int(1));
+ image.set(b"Height".to_vec(), Object::Int(1));
+ image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ image.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ image.set(b"SMask".to_vec(), Object::Ref(mask));
+ let image = doc.add(Object::Stream(Stream::from_raw(image, vec![0x80])));
+ assert_eq!(decodes(&doc, image), 0);
+ // Reading the header to find that out is paid for: a mask can be mostly tables, shared by
+ // every image of a file, and with nothing left it isn't read.
+ let mut budget = ImageBudget::with_work(u64::MAX);
+ assert!(crate::extract::image_file_within(&doc, image, &mut budget).is_ok());
+ assert_eq!(u64::MAX - budget.work_left(), 2 + 4 * jpeg.len() as u64 + 2, "its one declared sample twice, its bytes, the image's byte and pixel");
+ let mut budget = ImageBudget::with_work(0);
+ assert!(crate::extract::image_file_within(&doc, image, &mut budget).is_err());
+ assert_eq!(budget.refused(), 1, "the image goes, with its mask unread");
+}
+
+/// A mask past the allowance can't be left out as an unreadable one is, or the image comes out
+/// opaque, showing what the mask hides: the image goes, with the reason.
+#[test]
+fn an_image_whose_jbig2_mask_is_past_the_allowance_is_left_out() {
+ use pdfcraft_cos::{Dict, Document, ImageBudget, Object, Stream};
+ let mut mask = Dict::new();
+ mask.set(b"Subtype".to_vec(), Object::name("Image"));
+ mask.set(b"Width".to_vec(), Object::Int(16));
+ mask.set(b"Height".to_vec(), Object::Int(2));
+ mask.set(b"BitsPerComponent".to_vec(), Object::Int(1));
+ mask.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ mask.set(b"Filter".to_vec(), Object::name("JBIG2Decode"));
+ let mut doc = Document::new_empty();
+ let mask = doc.add(Object::Stream(Stream::from_raw(mask, pdfcraft_filters::encode_jbig2_generic(&[0xFF; 4], 16, 2).unwrap())));
+ // A JPEG, read for nothing until its mask is, so only the mask can be what stops it.
+ let mut jpeg = Vec::new();
+ image::RgbImage::from_pixel(1, 1, image::Rgb([9, 9, 9])).write_to(&mut std::io::Cursor::new(&mut jpeg), image::ImageFormat::Jpeg).unwrap();
+ let mut image = Dict::new();
+ image.set(b"Subtype".to_vec(), Object::name("Image"));
+ image.set(b"Width".to_vec(), Object::Int(1));
+ image.set(b"Height".to_vec(), Object::Int(1));
+ image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ image.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+ image.set(b"Filter".to_vec(), Object::name("DCTDecode"));
+ image.set(b"SMask".to_vec(), Object::Ref(mask));
+ let image = doc.add(Object::Stream(Stream::from_raw(image, jpeg)));
+ assert!(crate::extract::image_file_within(&doc, image, &mut ImageBudget::with_work(u64::MAX)).is_ok());
+ let refused = crate::extract::image_file_within(&doc, image, &mut ImageBudget::with_work(0)).unwrap_err();
+ assert!(refused.contains("more image decoding than"), "{refused}");
+}
+
+/// A large honest file keeps its images: what an export may hold grows with the file past the fixed
+/// part, and a file too long to double doesn't wrap round to nothing.
+#[test]
+fn an_export_may_hold_twice_a_large_file() {
+ let fixed = crate::extract::export_bytes(0);
+ assert_eq!(fixed, 2 << 30);
+ assert_eq!(crate::extract::export_bytes(fixed / 2), fixed);
+ assert_eq!(crate::extract::export_bytes(fixed / 2 + 1), fixed + 2);
+ assert_eq!(crate::extract::export_bytes(usize::MAX), usize::MAX);
+}
+
+/// `/Decode` says which way round a stencil mask is, and its numbers can be given by reference. Read
+/// as absent, they gave the wrong answer, so the file came out a negative of what the page draws.
+#[test]
+fn a_stencil_masks_decode_array_can_hold_references() {
+ use pdfcraft_cos::Document;
+ let export = |decode: &str| {
+ let pdf = format!(
+ "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+ 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+ 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Resources << /XObject << /Im 4 0 R >> >> >> endobj\n\
+ 4 0 obj << /Subtype /Image /ImageMask true /Width 8 /Height 1 /BitsPerComponent 1 /Decode {decode} /Filter /ASCIIHexDecode /Length 3 >> stream\nF0>\nendstream endobj\n\
+ 5 0 obj 1 endobj\n6 0 obj 0 endobj\n7 0 obj 7 0 R endobj\n8 0 obj 9 0 R endobj\n9 0 obj 8 0 R endobj\n\
+ trailer << /Root 1 0 R >>\n%%EOF"
+ );
+ let doc = Document::open(std::sync::Arc::new(pdf.into_bytes())).unwrap();
+ let mut export = crate::extract::extract_images(&doc, &[0], 1);
+ assert_eq!(export.images.len(), 1, "{decode}: {:?}", export.skipped);
+ export.images.remove(0).data
+ };
+ let (inverted, identity) = (export("[1 0]"), export("[0 1]"));
+ assert_ne!(inverted, identity, "the two ways round differ");
+ for decode in ["[5 0 R 0]", "[1 6 0 R]", "[5 0 R 6 0 R]"] {
+ assert_eq!(export(decode), inverted, "{decode}");
+ }
+ for decode in ["[0 5 0 R]", "[6 0 R 1]", "[6 0 R 5 0 R]"] {
+ assert_eq!(export(decode), identity, "{decode}");
+ }
+ // A reference that only leads back to itself holds no number, and an end that is missing or isn't
+ // a number leaves the default mapping, whichever end it is.
+ for decode in ["[7 0 R 0]", "[1 7 0 R]", "[8 0 R 0]", "[1 8 0 R]", "[7 0 R 8 0 R]", "[1]", "[1 /Name]", "[/Name 0]"] {
+ assert_eq!(export(decode), identity, "{decode}");
+ }
+ // Equal ends aren't the two ways round either, and a number too long to hold reads as infinite.
+ assert_eq!(export("[1 1]"), identity);
+ assert_eq!(export(&format!("[{} 0]", "9".repeat(400))), identity);
+}
+
+/// A mask of other proportions than its image is scaled to it, however far apart they are: the
+/// first two shapes asked for 160 GB on the way, in a file of a kilobyte, and that aborted the
+/// process. The third would ask for 10 GB if it went across first, which is why the way round
+/// depends on the shapes. The value comes through, and masks of ordinary proportions, of the
+/// image's size and larger than it, are scaled as they always were.
+#[test]
+fn a_mask_of_other_proportions_than_its_image_is_scaled_without_the_memory_of_both() {
+ use pdfcraft_cos::{Dict, Document, Object, Stream};
+ let gray = |w: i64, h: i64, data: &[u8]| {
+ let mut d = Dict::new();
+ d.set(b"Subtype".to_vec(), Object::name("Image"));
+ d.set(b"Width".to_vec(), Object::Int(w));
+ d.set(b"Height".to_vec(), Object::Int(h));
+ d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+ d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+ d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+ Stream::from_raw(d, pdfcraft_filters::encode_flate(data))
+ };
+ let shapes = [
+ (100_000usize, 1usize, 1usize, 100_000usize),
+ (100_000, 64, 64, 100_000),
+ (1, 100_000, 100_000, 1),
+ (64, 1, 1, 64),
+ (3, 2, 6, 4),
+ (3, 2, 3, 2),
+ (6, 4, 3, 2),
+ ];
+ for (mask_w, mask_h, w, h) in shapes {
+ let mut doc = Document::new_empty();
+ let mask = doc.add(Object::Stream(gray(mask_w as i64, mask_h as i64, &vec![0x80; mask_w * mask_h])));
+ let mut image = gray(w as i64, h as i64, &vec![0x40; w * h]);
+ image.dict.set(b"SMask".to_vec(), Object::Ref(mask));
+ let image = doc.add(Object::Stream(image));
+ let (name, png) = crate::image_file(&doc, image).unwrap_or_else(|e| panic!("{mask_w} × {mask_h} on {w} × {h}: {e}"));
+ assert_eq!(name, "png");
+ let mut reader = ::png::Decoder::new(std::io::Cursor::new(&png)).read_info().unwrap();
+ let mut rgba = vec![0; reader.output_buffer_size().unwrap()];
+ let info = reader.next_frame(&mut rgba).unwrap();
+ assert_eq!((info.width as usize, info.height as usize, info.color_type), (w, h, ::png::ColorType::Rgba));
+ assert!(rgba.as_chunks::<4>().0.iter().all(|p| p[3].abs_diff(0x80) <= 1), "{mask_w} × {mask_h} on {w} × {h}");
+ }
+}
+
+/// The long way round is for proportions far apart: up to a quarter over the larger image the
+/// buffer is no danger, and such a mask scales as it always did, to the byte. Noise, as a flat mask comes
+/// out the same either way.
+#[test]
+fn proportions_up_to_the_limit_scale_as_they_did() {
+ let noise = |w: u32, h: u32| {
+ let mut seed = 0x2545_F491_4F6C_DD1Du64;
+ let px = (0..w * h)
+ .map(|_| {
+ seed ^= seed << 13;
+ seed ^= seed >> 7;
+ seed ^= seed << 17;
+ seed as u8
+ })
+ .collect();
+ image::GrayImage::from_raw(w, h, px).unwrap()
+ };
+ // Each exactly a quarter over the larger: the source's size, then the target's.
+ for (mw, mh, w, h) in [(25, 16, 10, 20), (20, 5, 16, 25)] {
+ let mask = noise(mw, mh);
+ let direct = image::imageops::resize(&mask, w, h, image::imageops::FilterType::Triangle);
+ assert_eq!(crate::extract::scaled(&mask, w, h), direct, "{mw} × {mh} to {w} × {h}");
+ }
+ // A step past it goes the long way, which is how to tell.
+ let mask = noise(25, 15);
+ let direct = image::imageops::resize(&mask, 10, 20, image::imageops::FilterType::Triangle);
+ assert_ne!(crate::extract::scaled(&mask, 10, 20), direct);
+ // A mask of its image's size comes through as it is.
+ let mask = noise(20, 10);
+ assert_eq!(crate::extract::scaled(&mask, 20, 10), mask);
+}
diff --git a/crates/edit/Cargo.toml b/crates/edit/Cargo.toml
index 89d9387989..2cd33a275d 100644
--- a/crates/edit/Cargo.toml
+++ b/crates/edit/Cargo.toml
@@ -24,3 +24,5 @@ unicode-bidi = "0.3"
[dev-dependencies]
hayro-syntax = { workspace = true }
+pdfcraft-render = { workspace = true }
+proptest = { workspace = true }
diff --git a/crates/edit/src/apply.rs b/crates/edit/src/apply.rs
index ff570d5483..0d0213904b 100644
--- a/crates/edit/src/apply.rs
+++ b/crates/edit/src/apply.rs
@@ -7,9 +7,25 @@ use super::place::{
};
use super::{Document, EditError, Object, added, backdrop, helvetica_width};
+/// Commit one complete mark operation only after every selected page succeeds. The snapshot
+/// shares original bytes, cross-references, caches and unchanged objects; only the overlay table
+/// and document metadata are copied. Dropping a failed stage also drops removed marks, changed
+/// page/resources/backdrop dictionaries and new objects, including the allocation cursor.
+fn apply_mark_transaction(doc: &mut Document, apply: impl FnOnce(&mut Document) -> Result<(), EditError>) -> Result<(), EditError> {
+ let mut staged = doc.clone();
+ apply(&mut staged)?;
+ *doc = staged;
+ Ok(())
+}
+
/// Add a header and footer to `pages` (0-based). With `replace`, existing headers and footers on
-/// those pages are removed first (Acrobat's Replace Existing).
+/// those pages are removed first (Acrobat's Replace Existing). The whole call is atomic:
+/// on error, the document (including earlier selected pages) is unchanged.
pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter, replace: bool, cx: &Context) -> Result<(), EditError> {
+ apply_mark_transaction(doc, |staged| add_header_footer_in_place(staged, pages, hf, replace, cx))
+}
+
+fn add_header_footer_in_place(doc: &mut Document, pages: &[usize], hf: &HeaderFooter, replace: bool, cx: &Context) -> Result<(), EditError> {
let all = page_list(doc);
check(pages, all.len())?;
if hf.text.iter().all(|t| t.trim().is_empty()) {
@@ -121,8 +137,13 @@ pub fn add_header_footer(doc: &mut Document, pages: &[usize], hf: &HeaderFooter,
Ok(())
}
-/// Add a text watermark to `pages`.
+/// Add a text or picture watermark to `pages`. All selected pages, including mark replacement,
+/// form one transaction; on error, the document is unchanged.
pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replace: bool) -> Result<(), EditError> {
+ apply_mark_transaction(doc, |staged| add_watermark_in_place(staged, pages, wm, replace))
+}
+
+fn add_watermark_in_place(doc: &mut Document, pages: &[usize], wm: &Watermark, replace: bool) -> Result<(), EditError> {
let all = page_list(doc);
check(pages, all.len())?;
let text = wm.text.trim();
@@ -201,8 +222,13 @@ pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replac
/// Add a solid-colour background behind the content of `pages`. With `bg.replace_backdrop`, a
/// white backdrop a page paints itself is replaced first, so the background shows (see
-/// [`backdrop`]); a picture backdrop (a scan) still hides it.
+/// [`backdrop`]); a picture backdrop (a scan) still hides it. All selected pages, including
+/// replacement and backdrop edits, form one transaction; on error, the document is unchanged.
pub fn add_background(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
+ apply_mark_transaction(doc, |staged| add_background_in_place(staged, pages, bg, replace))
+}
+
+fn add_background_in_place(doc: &mut Document, pages: &[usize], bg: &Background, replace: bool) -> Result<(), EditError> {
let all = page_list(doc);
check(pages, all.len())?;
if replace {
diff --git a/crates/edit/src/background.rs b/crates/edit/src/background.rs
index 7d745c0c10..376cb5a165 100644
--- a/crates/edit/src/background.rs
+++ b/crates/edit/src/background.rs
@@ -98,8 +98,13 @@ pub fn page_background(doc: &Document, page: usize) -> Result, EditE
}
b"sc" | b"scn" => st.fill = colour(st.space, op),
b"gs" => {
- if let Some(g) = op.name(0).and_then(|n| gstates.get(n)).map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()) {
- apply_gstate(doc, &g, &mut st);
+ let mut held = None;
+ let gstate = match op.name(0).and_then(|n| gstates.get(n)) {
+ Some(g) => crate::text::dict_in_place(doc, g, &mut held),
+ None => None,
+ };
+ if let Some(g) = gstate {
+ apply_gstate(doc, g, &mut st);
}
}
b"re" => match op.nums::<4>() {
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index f66e7f24ee..73aa116ff3 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -4,13 +4,28 @@
//! or delete. Only the stream that draws it is rewritten, as a new object.
use kurbo::{BezPath, Point, Shape};
-use pdfcraft_content::{Matrix, Op, Pieces, parse};
+use pdfcraft_content::{Matrix, Op, Pieces, parse, serialize_ops};
use pdfcraft_cos::{Dict, Document, ObjRef, Object};
use std::sync::Arc;
use crate::EditError;
use crate::text::content_streams;
+/// The identity of a soft mask (`/SMask`) in the PDF graphics state.
+#[derive(Clone, Debug)]
+pub(crate) struct MaskIdentity {
+ // Share the owning ExtGState instead of copying an arbitrarily large inline mask on q/Q.
+ // Its complete SMask value retains S, TR, BC and every other mask parameter, not just G.
+ definition: Arc,
+ ctm: Matrix,
+}
+
+impl PartialEq for MaskIdentity {
+ fn eq(&self, other: &Self) -> bool {
+ self.ctm == other.ctm && self.definition.as_dict().and_then(|d| d.get(b"SMask")) == other.definition.as_dict().and_then(|d| d.get(b"SMask"))
+ }
+}
+
/// An image drawn on a page.
#[derive(Clone, Debug, PartialEq)]
pub struct PageImage {
@@ -33,7 +48,7 @@ pub struct PageImage {
pub height: u32,
/// The content stream its `Do` (its first token) is in, and the `Do`'s index among the
/// operators of the page's streams joined ([`Pieces`]).
- stream: usize,
+ pub stream: usize,
op: usize,
/// CTM before `Do`, excluding a Form's own Matrix.
draw_matrix: [f64; 6],
@@ -41,6 +56,11 @@ pub struct PageImage {
}
impl PageImage {
+ /// Whether an active clip was written by PdfCraft's image crop tool.
+ pub fn has_editor_crop(&self) -> bool {
+ self.clips.iter().any(|clip| clip.app_crop)
+ }
+
/// Whether a user-space point belongs to the placed artwork and every active clip.
pub fn contains(&self, point: [f64; 2]) -> bool {
if !point.iter().all(|v| v.is_finite()) {
@@ -72,6 +92,7 @@ impl PageImage {
struct ClipPath {
path: Arc,
even_odd: bool,
+ app_crop: bool,
}
/// Image draws one page's inventory lists at most: a form drawn many times from other forms
@@ -115,17 +136,39 @@ struct ImageState {
placement: Placement,
stack: Vec,
path: BezPath,
+ subpath_start: Option,
pending_clip: Option,
+ app_crop: bool,
}
impl ImageState {
fn new(matrix: Matrix, clip: [f64; 4], clips: Vec) -> Self {
- Self { placement: Placement { matrix, clip, clips }, stack: Vec::new(), path: BezPath::new(), pending_clip: None }
+ Self {
+ placement: Placement { matrix, clip, clips },
+ stack: Vec::new(),
+ path: BezPath::new(),
+ subpath_start: None,
+ pending_clip: None,
+ app_crop: false,
+ }
}
- fn point(&self, x: f64, y: f64) -> Point {
+ fn current_point(&self) -> Option {
+ match self.path.elements().last() {
+ Some(kurbo::PathEl::MoveTo(p) | kurbo::PathEl::LineTo(p)) => Some(*p),
+ Some(kurbo::PathEl::QuadTo(_, p2) | kurbo::PathEl::CurveTo(_, _, p2)) => Some(*p2),
+ Some(kurbo::PathEl::ClosePath) => self.subpath_start,
+ None => None,
+ }
+ }
+
+ fn has_current_point(&self) -> bool {
+ self.current_point().is_some()
+ }
+
+ fn point(&self, x: f64, y: f64) -> Option {
let (x, y) = self.placement.matrix.apply(x, y);
- Point::new(x, y)
+ if x.is_finite() && y.is_finite() { Some(Point::new(x, y)) } else { None }
}
fn apply(&mut self, op: &Op) -> Result<(), EditError> {
@@ -146,12 +189,18 @@ impl ImageState {
}
b"cm" => {
if let Some(m) = op.nums::<6>() {
- self.placement.matrix = Matrix(m).then(&self.placement.matrix);
+ let next_mat = Matrix(m).then(&self.placement.matrix);
+ if next_mat.0.iter().all(|v| v.is_finite()) {
+ self.placement.matrix = next_mat;
+ }
}
}
b"m" => {
- if let Some([x, y]) = op.nums::<2>() {
- self.path.move_to(self.point(x, y));
+ if let Some([x, y]) = op.nums::<2>()
+ && let Some(p) = self.point(x, y)
+ {
+ self.subpath_start = Some(p);
+ self.path.move_to(p);
}
}
b"l" => {
@@ -159,46 +208,57 @@ impl ImageState {
// friends panic on an empty path by contract, so the segment is skipped, as the
// renderer, MuPDF and pdftotext do (#3581).
if let Some([x, y]) = op.nums::<2>()
- && self.path.elements().last().is_some()
+ && self.has_current_point()
+ && let Some(p) = self.point(x, y)
{
- self.path.line_to(self.point(x, y));
+ self.path.line_to(p);
}
}
b"c" => {
if let Some([x1, y1, x2, y2, x3, y3]) = op.nums::<6>()
- && self.path.elements().last().is_some()
+ && self.has_current_point()
+ && let (Some(p1), Some(p2), Some(p3)) = (self.point(x1, y1), self.point(x2, y2), self.point(x3, y3))
{
- self.path.curve_to(self.point(x1, y1), self.point(x2, y2), self.point(x3, y3));
+ self.path.curve_to(p1, p2, p3);
}
}
b"v" => {
if let Some([x1, y1, x2, y2]) = op.nums::<4>()
- && let Some(current) = self.path.elements().last().and_then(|e| e.end_point())
+ && self.has_current_point()
+ && let (Some(p1), Some(p2)) = (self.point(x1, y1), self.point(x2, y2))
+ && let Some(current) = self.current_point()
{
- self.path.curve_to(current, self.point(x1, y1), self.point(x2, y2));
+ self.path.curve_to(current, p1, p2);
}
}
b"y" => {
if let Some([x1, y1, x2, y2]) = op.nums::<4>()
- && self.path.elements().last().is_some()
+ && self.has_current_point()
+ && let (Some(p1), Some(end)) = (self.point(x1, y1), self.point(x2, y2))
{
- let end = self.point(x2, y2);
- self.path.curve_to(self.point(x1, y1), end, end);
+ self.path.curve_to(p1, end, end);
}
}
- // ClosePath with no subpath panics by the same contract (#3581).
- b"h" if self.path.elements().last().is_some() => {
- self.path.close_path();
- }
- b"re" => {
- if let Some([x, y, w, h]) = op.nums::<4>() {
- self.path.move_to(self.point(x, y));
- self.path.line_to(self.point(x + w, y));
- self.path.line_to(self.point(x + w, y + h));
- self.path.line_to(self.point(x, y + h));
+ b"h" => {
+ // ClosePath with no subpath panics by the same contract (#3581).
+ if self.has_current_point() {
self.path.close_path();
}
}
+ b"re" => {
+ if let Some([x, y, w, h]) = op.nums::<4>()
+ && let (Some(p0), Some(p1), Some(p2), Some(p3)) =
+ (self.point(x, y), self.point(x + w, y), self.point(x + w, y + h), self.point(x, y + h))
+ {
+ self.subpath_start = Some(p0);
+ self.path.move_to(p0);
+ self.path.line_to(p1);
+ self.path.line_to(p2);
+ self.path.line_to(p3);
+ self.path.close_path();
+ }
+ }
+ b"MP" if op.name(0) == Some(b"PdfCraftImageCrop") => self.app_crop = true,
b"W" => self.pending_clip = Some(false),
b"W*" => self.pending_clip = Some(true),
b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => {
@@ -207,9 +267,11 @@ impl ImageState {
// follows the same rule, and its bounds use cubic extrema, not controls.
let bounds = self.path.bounding_box();
self.placement.clip = intersection(self.placement.clip, [bounds.x0, bounds.y0, bounds.x1, bounds.y1]).unwrap_or([0.0; 4]);
- self.placement.clips.push(ClipPath { path: Arc::new(std::mem::take(&mut self.path)), even_odd });
+ self.placement.clips.push(ClipPath { path: Arc::new(std::mem::take(&mut self.path)), even_odd, app_crop: self.app_crop });
}
self.path = BezPath::new();
+ self.subpath_start = None;
+ self.app_crop = false;
}
_ => {}
}
@@ -264,6 +326,7 @@ pub fn page_images(doc: &Document, page: usize) -> Result, EditEr
} else {
continue;
};
+
let rect = matrix.bbox(bounds);
if !bounds.iter().chain(matrix.0.iter()).chain(rect.iter()).all(|v| v.is_finite())
|| bounds[2] <= bounds[0]
@@ -316,34 +379,34 @@ pub fn reading_images(doc: &Document, page: usize) -> Result, Edi
forms: &mut Forms,
out: &mut Vec,
) -> Result<(), EditError> {
- let xo = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned()).unwrap_or_default();
+ let mut held = None;
+ let xo = crate::text::resource_dict(doc, resources, b"XObject", &mut held);
for (i, op) in ops.iter().enumerate() {
st.apply(op)?;
let ctm = st.placement.matrix;
if op.is("Do") {
let Some(name) = op.name(0) else { continue };
+ let drawn = xo.and_then(|xo| xo.get(name));
if let Some(form) = crate::text::form_call(doc, resources, name, ctm, &forms.path, &mut forms.budget) {
if let Some(r) = form.obj {
forms.path.push(r);
}
let bounds =
- xo.get(name).map(|o| doc.resolve(o)).and_then(|o| o.as_dict().and_then(|d| d.get(b"BBox")).map(|b| doc.resolve(b))).and_then(
- |b| {
- let a = b.as_array()?;
- let [x0, y0, x1, y1] = a.as_slice() else { return None };
- Some(form.ctm.bbox([x0.as_f64()?, y0.as_f64()?, x1.as_f64()?, y1.as_f64()?]))
- },
- );
+ drawn.map(|o| doc.resolve(o)).and_then(|o| o.as_dict().and_then(|d| d.get(b"BBox")).map(|b| doc.resolve(b))).and_then(|b| {
+ let a = b.as_array()?;
+ let [x0, y0, x1, y1] = a.as_slice() else { return None };
+ Some(form.ctm.bbox([x0.as_f64()?, y0.as_f64()?, x1.as_f64()?, y1.as_f64()?]))
+ });
let clip = bounds.map_or(st.placement.clip, |b| intersection(st.placement.clip, b).unwrap_or([0.0; 4]));
let mut inner = ImageState::new(form.ctm, clip, st.placement.clips.clone());
let piece = stream(op);
- walk(doc, &parse(&form.data).ops, &form.resources, &mut inner, &|_| piece, forms, out)?;
+ walk(doc, &parse(&form.data).ops, form.resources(resources), &mut inner, &|_| piece, forms, out)?;
if form.obj.is_some() {
forms.path.pop();
}
continue;
}
- let Some(r) = xo.get(name).and_then(Object::as_ref) else { continue };
+ let Some(r) = drawn.and_then(Object::as_ref) else { continue };
let obj = doc.get(r);
let Object::Stream(s) = &*obj else { continue };
if s.dict.name(b"Subtype") != Some(b"Image") {
@@ -382,6 +445,15 @@ pub fn reading_images(doc: &Document, page: usize) -> Result, Edi
Ok(out)
}
+/// The four stacking order arrangements.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ArrangeOrder {
+ BringToFront,
+ SendToBack,
+ BringForward,
+ SendBackward,
+}
+
/// What to do with an image.
#[derive(Clone, Debug, PartialEq)]
pub enum ImageChange {
@@ -394,6 +466,10 @@ pub enum ImageChange {
/// Draw this image XObject instead, in the same place.
Replace(ObjRef),
Delete,
+ /// Change the stacking order.
+ Arrange(ArrangeOrder),
+ /// Remove any private crop on the image.
+ RemoveCrop,
}
/// The user-space transform that maps box `from` onto box `to` (move and resize).
@@ -473,6 +549,1077 @@ fn clip_matrix(draw: Matrix, cm: Matrix, t: Matrix) -> Option {
Some(outer.then(&t).then(&outer.invert()?))
}
+pub(crate) fn is_entire_page_wrapped(ops: &[Op]) -> bool {
+ if ops.len() < 2 || !ops.first().is_some_and(|o| o.is("q")) || !ops.last().is_some_and(|o| o.is("Q")) {
+ return false;
+ }
+ let mut depth: usize = 0;
+ for (i, op) in ops.iter().enumerate() {
+ if op.is("q") {
+ depth = depth.saturating_add(1);
+ } else if op.is("Q") {
+ if depth == 1 && i < ops.len().saturating_sub(1) {
+ return false;
+ }
+ depth = depth.saturating_sub(1);
+ }
+ }
+ depth == 0
+}
+
+/// The end (exclusive) of the sequence opened at `i`: just past the `close` that matches it,
+/// counting the nested `opens`, or `end` when it never closes.
+fn sequence_end(ops: &[Op], i: usize, end: usize, opens: &[&str], close: &str) -> usize {
+ let mut depth: usize = 1;
+ for (j, op) in ops.iter().enumerate().take(end).skip(i.saturating_add(1)) {
+ if opens.iter().any(|o| op.is(o)) {
+ depth = depth.saturating_add(1);
+ } else if op.is(close) {
+ depth = depth.saturating_sub(1);
+ if depth == 0 {
+ return j.saturating_add(1);
+ }
+ }
+ }
+ end
+}
+
+pub(crate) fn content_units(ops: &[Op], scan_start: usize, scan_end: usize) -> Vec> {
+ let mut units = Vec::new();
+ let mut i = scan_start;
+ while i < scan_end {
+ let Some(op) = ops.get(i) else { break };
+ let j = if op.is("BDC") || op.is("BMC") {
+ // A marked-content sequence is one unit up to its matching EMC (#3145), so Arrange moves
+ // it whole and never inserts into another one: its content belongs to its tag (ISO 32000-2
+ // § 14.6). An unbalanced sequence runs to the end of the scan.
+ sequence_end(ops, i, scan_end, &["BDC", "BMC"], "EMC")
+ } else if op.is("q") {
+ sequence_end(ops, i, scan_end, &["q"], "Q")
+ } else if op.is("BT") {
+ sequence_end(ops, i, scan_end, &[], "ET")
+ } else if op.is("BI") {
+ sequence_end(ops, i, scan_end, &[], "EI")
+ } else if op.is("Do") || op.is("sh") {
+ i.saturating_add(1)
+ } else {
+ let mut j = i;
+ let mut found_end = false;
+ while j < scan_end {
+ let Some(next) = ops.get(j) else { break };
+ if matches!(next.op.as_slice(), b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" | b"n") {
+ j = j.saturating_add(1);
+ found_end = true;
+ break;
+ } else if j > i
+ && matches!(
+ next.op.as_slice(),
+ b"q" | b"Q" | b"BT" | b"BI" | b"Do" | b"sh" | b"BDC" | b"BMC" | b"EMC" | b"Tj" | b"TJ" | b"'" | b"\""
+ )
+ {
+ found_end = true;
+ break;
+ }
+ j = j.saturating_add(1);
+ }
+ if found_end { j } else { scan_end.max(i.saturating_add(1)) }
+ };
+ units.push(i..j);
+ i = j;
+ }
+ units.retain(|u| {
+ ops.get(u.clone()).is_some_and(|slice| {
+ slice.iter().any(|op| {
+ matches!(
+ op.op.as_slice(),
+ b"Do" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" | b"Tj" | b"TJ" | b"'" | b"\""
+ )
+ })
+ })
+ });
+ units
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ExtractedScopeState {
+ pub clip_ops: Vec,
+ pub state_ops: Vec,
+ pub do_op: Op,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct EffectiveGState {
+ pub(crate) ca: Option,
+ pub(crate) ca_stroke: Option,
+ pub(crate) bm: Option>,
+ pub(crate) smask: Option,
+ // Printing parameters cannot generally be reset by a content-stream operator. Retain their
+ // exact values so Arrange refuses a destination whose state it cannot reconstruct.
+ print_params: std::collections::BTreeMap, std::rc::Rc>,
+ rendering_intent: Option>,
+}
+
+impl EffectiveGState {
+ pub(crate) fn visually_differs(&self, other: &EffectiveGState) -> bool {
+ (self.ca.unwrap_or(1.0) - other.ca.unwrap_or(1.0)).abs() > 1e-4
+ || (self.ca_stroke.unwrap_or(1.0) - other.ca_stroke.unwrap_or(1.0)).abs() > 1e-4
+ || self.bm.as_deref().unwrap_or(b"Normal") != other.bm.as_deref().unwrap_or(b"Normal")
+ || self.smask != other.smask
+ || self.print_params != other.print_params
+ }
+
+ #[cfg(test)]
+ pub(crate) fn merge_dict(&mut self, dict: &Dict, doc: &Document, ctm: Matrix) {
+ self.merge_shared(&Arc::new(Object::Dict(dict.clone())), doc, ctm);
+ }
+
+ fn merge_shared(&mut self, definition: &Arc, doc: &Document, ctm: Matrix) {
+ let Some(dict) = definition.as_dict() else { return };
+ for key in [b"TR".as_slice(), b"TR2", b"OP", b"op", b"OPM", b"BG", b"BG2", b"UCR", b"UCR2", b"HT"] {
+ if let Some(value) = dict.get(key) {
+ self.print_params.insert(key.to_vec(), std::rc::Rc::new(value.clone()));
+ }
+ }
+ if let Some(intent) = dict.get(b"RI").map(|v| doc.resolve(v)).and_then(|v| v.as_name().map(<[u8]>::to_vec)) {
+ self.rendering_intent = Some(intent);
+ }
+ if let Some(val) = dict.get(b"ca").map(|v| doc.resolve(v)).and_then(|v| v.as_f64()) {
+ self.ca = Some(val);
+ }
+ if let Some(val) = dict.get(b"CA").map(|v| doc.resolve(v)).and_then(|v| v.as_f64()) {
+ self.ca_stroke = Some(val);
+ }
+ if let Some(bm_obj) = dict.get(b"BM").map(|v| doc.resolve(v)) {
+ if let Some(name) = bm_obj.as_name() {
+ self.bm = Some(name.to_vec());
+ } else if let Some(arr) = bm_obj.as_array()
+ && let Some(first_name) = arr.first().map(|v| doc.resolve(v)).and_then(|v| v.as_name().map(|n| n.to_vec()))
+ {
+ self.bm = Some(first_name);
+ }
+ }
+ if let Some(raw_smask) = dict.get(b"SMask") {
+ let disabled = raw_smask.as_name() == Some(b"None") || raw_smask.as_ref().is_some_and(|r| doc.get(r).as_name() == Some(b"None"));
+ self.smask = (!disabled).then(|| MaskIdentity { definition: Arc::clone(definition), ctm });
+ }
+ }
+}
+
+const MAX_ACTIVE_GS_OPS: usize = 128;
+
+type ActiveGsOp = (Vec, Op, Matrix);
+type ActiveGsOps = std::rc::Rc>;
+
+#[derive(Clone, Default)]
+struct ExtendedGStateTracker {
+ stack: Vec<(EffectiveGState, ActiveGsOps)>,
+ current_state: EffectiveGState,
+ active_gs_ops: ActiveGsOps,
+ definitions: std::collections::HashMap, Arc>,
+}
+
+impl ExtendedGStateTracker {
+ fn step(&mut self, op: &Op, ext_gstates: &Dict, doc: &Document, ctm: Matrix) -> Result<(), EditError> {
+ match op.op.as_slice() {
+ b"ri" => self.current_state.rendering_intent = op.name(0).map(<[u8]>::to_vec),
+ b"q" => {
+ if self.stack.len() >= 4096 {
+ return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+ }
+ self.stack.push((self.current_state.clone(), std::rc::Rc::clone(&self.active_gs_ops)));
+ }
+ b"Q" => {
+ if let Some((prev_state, prev_ops)) = self.stack.pop() {
+ self.current_state = prev_state;
+ self.active_gs_ops = prev_ops;
+ }
+ }
+ b"gs" => {
+ let valid_gs = op.name(0).and_then(|name| {
+ let definition = self.definitions.get(name).cloned().or_else(|| {
+ let definition = doc.resolve(ext_gstates.get(name)?);
+ definition.as_dict()?;
+ self.definitions.insert(name.to_vec(), Arc::clone(&definition));
+ Some(definition)
+ })?;
+ Some((name, definition))
+ });
+ if let Some((name, definition)) = valid_gs {
+ self.current_state.merge_shared(&definition, doc, ctm);
+ let mut next = (*self.active_gs_ops).clone();
+ if let Some(pos) = next.iter().position(|(k, _, _)| k.as_slice() == name) {
+ next.remove(pos);
+ }
+ if next.len() < MAX_ACTIVE_GS_OPS {
+ next.push((name.to_vec(), op.clone(), ctm));
+ }
+ self.active_gs_ops = std::rc::Rc::new(next);
+ }
+ }
+ _ => {}
+ }
+ Ok(())
+ }
+}
+
+/// The drawing-state operators besides colour that a moved unit restores, in the order it writes them.
+const DRAWING_PARAMS: [&str; 14] = ["w", "J", "j", "M", "d", "ri", "i", "Tc", "Tw", "Tz", "TL", "Tr", "Ts", "Tf"];
+
+#[derive(Clone, Default, Debug, PartialEq)]
+struct DrawingState {
+ non_stroking_color: Option,
+ stroking_color: Option,
+ /// The last operator of each of [`DRAWING_PARAMS`].
+ params: [Option>; DRAWING_PARAMS.len()],
+}
+
+// Save/restore shares operand storage, including when only the current colour changes under q.
+type SharedColorOps = std::rc::Rc>>;
+
+/// Keep the explicit or implicit colour-space selector before `sc`/`scn` (or `SC`/`SCN`).
+fn set_color(slot: &mut Option, op: &Op, space: &str) {
+ match slot {
+ Some(ops) if ops.first().is_some_and(|o| o.is(space) || matches!(o.op.as_slice(), b"g" | b"rg" | b"k" | b"G" | b"RG" | b"K")) => {
+ let ops = std::rc::Rc::make_mut(ops);
+ ops.truncate(1);
+ ops.push(std::rc::Rc::new(op.clone()));
+ }
+ _ => *slot = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+ }
+}
+
+#[derive(Clone, Default, Debug)]
+struct DrawingStateTracker {
+ stack: Vec,
+ current: DrawingState,
+}
+
+impl DrawingStateTracker {
+ fn step(&mut self, op: &Op) -> Result<(), EditError> {
+ match op.op.as_slice() {
+ b"q" => {
+ if self.stack.len() >= 4096 {
+ return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+ }
+ self.stack.push(self.current.clone());
+ }
+ b"Q" => {
+ if let Some(prev) = self.stack.pop() {
+ self.current = prev;
+ }
+ }
+ b"g" | b"rg" | b"k" | b"cs" => self.current.non_stroking_color = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+ b"sc" | b"scn" => set_color(&mut self.current.non_stroking_color, op, "cs"),
+ b"G" | b"RG" | b"K" | b"CS" => self.current.stroking_color = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+ b"SC" | b"SCN" => set_color(&mut self.current.stroking_color, op, "CS"),
+ _ => {
+ if let Some(slot) = DRAWING_PARAMS.iter().position(|p| op.is(p)).and_then(|k| self.current.params.get_mut(k)) {
+ *slot = Some(std::rc::Rc::new(op.clone()));
+ }
+ }
+ }
+ Ok(())
+ }
+}
+
+/// Initial line style, rendering intent and text-state parameters.
+fn initial_param(name: &str) -> Option {
+ use pdfcraft_content::num;
+ let operands = match name {
+ "w" => vec![num(1.0)],
+ "J" | "j" => vec![num(0.0)],
+ "M" => vec![num(10.0)],
+ "d" => vec![Object::Array(vec![]), num(0.0)],
+ "ri" => vec![Object::name("RelativeColorimetric")],
+ "Tc" | "Tw" | "TL" | "Tr" | "Ts" => vec![num(0.0)],
+ "Tz" => vec![num(100.0)],
+ _ => return None,
+ };
+ Some(Op::new(name, operands))
+}
+
+/// The drawing state the image had at `source` that differs at `dest`, unless the moved unit's own
+/// state operators (`extracted_state_ops`) set it.
+fn compute_inherited_drawing_ops(source: &DrawingState, dest: &DrawingState, extracted_state_ops: &[Op]) -> Vec {
+ let sets = |names: &[&str]| extracted_state_ops.iter().any(|o| names.iter().any(|n| o.is(n)));
+ let mut ops = Vec::new();
+ for (own, source, dest, black) in [
+ (sets(&["g", "rg", "k", "cs"]), &source.non_stroking_color, &dest.non_stroking_color, "g"),
+ (sets(&["G", "RG", "K", "CS"]), &source.stroking_color, &dest.stroking_color, "G"),
+ ] {
+ match (own, source, dest) {
+ (true, _, _) | (false, None, None) => {}
+ (false, Some(color), _) => ops.extend(color.iter().map(|op| (**op).clone())),
+ (false, None, Some(_)) => ops.push(Op::new(black, vec![pdfcraft_content::num(0.0)])),
+ }
+ }
+ let mut text_ops = Vec::new();
+ for ((name, source), dest) in DRAWING_PARAMS.iter().zip(&source.params).zip(&dest.params) {
+ let output = if matches!(*name, "Tc" | "Tw" | "Tz" | "TL" | "Tr" | "Ts" | "Tf") { &mut text_ops } else { &mut ops };
+ match (sets(&[name]), source, dest) {
+ (true, _, _) | (false, None, None) => {}
+ (false, Some(op), _) => output.push((**op).clone()),
+ (false, None, Some(_)) => output.extend(initial_param(name)),
+ }
+ }
+ if !text_ops.is_empty() {
+ // Forms inherit text state, even though each BT resets its text matrices.
+ ops.push(Op::new("BT", vec![]));
+ ops.extend(text_ops);
+ ops.push(Op::new("ET", vec![]));
+ }
+ ops
+}
+
+/// The operators that set `clip` again, in user space. [`ImageState`] builds clips only from
+/// finite points with `m`, `l`, `c` and `h`, so `None` (a quadratic segment) does not happen.
+fn clip_path_to_ops(clip: &ClipPath) -> Option> {
+ let mut ops = Vec::new();
+ if clip.app_crop {
+ ops.push(crop_marker());
+ }
+ for el in clip.path.elements() {
+ let (name, points) = match el {
+ kurbo::PathEl::MoveTo(p) => ("m", vec![*p]),
+ kurbo::PathEl::LineTo(p) => ("l", vec![*p]),
+ kurbo::PathEl::CurveTo(p1, p2, p3) => ("c", vec![*p1, *p2, *p3]),
+ kurbo::PathEl::ClosePath => ("h", Vec::new()),
+ kurbo::PathEl::QuadTo(..) => return None,
+ };
+ ops.push(Op::new(name, points.iter().flat_map(|p| [pdfcraft_content::num(p.x), pdfcraft_content::num(p.y)]).collect()));
+ }
+ if !ops.is_empty() {
+ ops.push(Op::new(if clip.even_odd { "W*" } else { "W" }, vec![]));
+ ops.push(Op::new("n", vec![]));
+ }
+ Some(ops)
+}
+
+pub(crate) fn extract_scope_state(ops: &[Op], start: usize, target: usize, initial_ctm: Matrix) -> Result, EditError> {
+ if target >= ops.len() || start > target {
+ return Ok(None);
+ }
+ let target_op = ops.get(target).cloned().ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
+ if start == target {
+ return Ok(Some(ExtractedScopeState { clip_ops: Vec::new(), state_ops: Vec::new(), do_op: target_op }));
+ }
+ let mut clip_ops = Vec::new();
+ let mut state_ops = Vec::new();
+ let mut pending_path: Vec = Vec::new();
+ let mut pending_clip = false;
+ let mut active_path = false;
+ let mut depth: usize = 0;
+ let mut matrix = initial_ctm;
+ let mut matrix_at_clip = None;
+
+ let scan_start = if ops.get(start).is_some_and(|o| o.is("q")) { start.saturating_add(1) } else { start };
+
+ for i in scan_start..target {
+ let Some(op) = ops.get(i) else {
+ return Ok(None);
+ };
+ match op.op.as_slice() {
+ b"q" => {
+ if depth >= 4096 {
+ return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+ }
+ depth = depth.saturating_add(1);
+ }
+ b"Q" => {
+ if depth == 0 {
+ return Ok(None);
+ }
+ depth = depth.saturating_sub(1);
+ }
+ _ if depth > 0 => {}
+ b"cm" => {
+ if active_path {
+ return Ok(None);
+ }
+ if let Some(m) = op.nums::<6>() {
+ matrix = Matrix(m).then(&matrix);
+ }
+ }
+ b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" => {
+ active_path = true;
+ pending_path.push(op.clone());
+ }
+ b"W" | b"W*" => {
+ if !active_path {
+ return Ok(None);
+ }
+ pending_clip = true;
+ pending_path.push(op.clone());
+ }
+ b"n" => {
+ if pending_clip {
+ if matrix_at_clip.is_none() {
+ matrix_at_clip = Some(matrix);
+ } else if matrix_at_clip != Some(matrix) {
+ return Ok(None);
+ }
+ clip_ops.extend(std::mem::take(&mut pending_path));
+ clip_ops.push(op.clone());
+ pending_clip = false;
+ active_path = false;
+ } else {
+ pending_path.clear();
+ active_path = false;
+ }
+ }
+ b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => {
+ if pending_clip {
+ return Ok(None);
+ }
+ pending_path.clear();
+ active_path = false;
+ }
+ b"gs" | b"CS" | b"cs" | b"SC" | b"sc" | b"SCN" | b"scn" | b"G" | b"g" | b"RG" | b"rg" | b"K" | b"k" | b"ri" | b"i" => {
+ state_ops.push(op.clone());
+ }
+ b"BT" => {
+ return Ok(None);
+ }
+ _ => {}
+ }
+ }
+
+ if depth != 0 || active_path || pending_clip {
+ return Ok(None);
+ }
+
+ if !clip_ops.is_empty() && matrix_at_clip != Some(Matrix::IDENTITY) {
+ return Ok(None);
+ }
+
+ Ok(Some(ExtractedScopeState { clip_ops, state_ops, do_op: target_op }))
+}
+
+/// The unit `order` puts the image's unit `target_idx` next to, and whether after it. An image that
+/// shares its unit with other paint at the limit moves within that unit, past or behind the paint.
+fn target_destination_unit<'a>(
+ units: &'a [std::ops::Range],
+ target_idx: usize,
+ target_unit: &'a std::ops::Range,
+ order: ArrangeOrder,
+ has_other_paint: bool,
+) -> Result<(&'a std::ops::Range, bool), EditError> {
+ let forward = matches!(order, ArrangeOrder::BringToFront | ArrangeOrder::BringForward);
+ let refused = || EditError::Invalid(if forward { "the image is already in front" } else { "the image is already at the back" }.into());
+ let at_limit = if forward { target_idx.saturating_add(1) >= units.len() } else { target_idx == 0 };
+ if at_limit {
+ return if has_other_paint { Ok((target_unit, forward)) } else { Err(refused()) };
+ }
+ let dest = match order {
+ ArrangeOrder::BringToFront => units.last(),
+ ArrangeOrder::SendToBack => units.first(),
+ ArrangeOrder::BringForward => units.get(target_idx.saturating_add(1)),
+ ArrangeOrder::SendBackward => target_idx.checked_sub(1).and_then(|i| units.get(i)),
+ };
+ dest.map(|u| (u, forward)).ok_or_else(refused)
+}
+
+/// A moved unit must not borrow a graphics or marked-content boundary from its neighbours.
+fn balanced_arrange_span(ops: &[Op], range: std::ops::Range) -> bool {
+ let Some(slice) = ops.get(range) else { return false };
+ let (mut graphics, mut marked) = (0usize, 0usize);
+ for op in slice {
+ let depth = match op.op.as_slice() {
+ b"q" => {
+ graphics = graphics.saturating_add(1);
+ continue;
+ }
+ b"BDC" | b"BMC" => {
+ marked = marked.saturating_add(1);
+ continue;
+ }
+ b"Q" => &mut graphics,
+ b"EMC" => &mut marked,
+ _ => continue,
+ };
+ let Some(next) = depth.checked_sub(1) else { return false };
+ *depth = next;
+ }
+ graphics == 0 && marked == 0
+}
+
+/// What Arrange takes out: the byte span, the op where the image's own scope state starts, and the
+/// ops `start..end` removed. That is the image's own `q … Q` scope inside its unit, else the `Do`
+/// alone when the unit paints something else too, else the whole unit.
+fn determine_arrange_spans(
+ ops: &[Op],
+ target: usize,
+ target_unit: &std::ops::Range,
+ has_other_paint: bool,
+ marked_unit: bool,
+) -> Result<(std::ops::Range, usize, usize, usize), EditError> {
+ let scope = image_scopes(ops, target, "arranged")
+ .ok()
+ .and_then(|s| s.isolated)
+ .filter(|&(start, end, _)| start >= target_unit.start && end < target_unit.end);
+ let unit_last = target_unit.end.saturating_sub(1);
+ let (first, scope_start, last) = match scope {
+ Some((start, end, _)) if has_other_paint || !marked_unit => (start, start, end),
+ _ if has_other_paint => (target, target, target),
+ // A marked-content unit holding only this image moves whole, with its BDC…EMC.
+ // The whole sequence is removed; the image's state is rebuilt from the ops inside it.
+ _ if marked_unit => (target_unit.start, target_unit.start.saturating_add(1).min(target), unit_last),
+ _ => (target_unit.start, target_unit.start, unit_last),
+ };
+ if !balanced_arrange_span(ops, first..last.saturating_add(1)) {
+ return Err(EditError::Invalid("cannot arrange an image across graphics or marked-content boundaries".into()));
+ }
+ let missing = || EditError::Invalid("the image content unit could not be located".into());
+ let start = ops.get(first).ok_or_else(missing)?.span.start;
+ let end = ops.get(last).ok_or_else(missing)?.span.end;
+ Ok((start..end, scope_start, first, last.saturating_add(1)))
+}
+
+fn scan_leaking_ops(ops: &[Op], rem_start: usize, rem_end: usize) -> (Vec, bool) {
+ let mut q_depth = 0usize;
+ let mut leaking_ops = Vec::new();
+ let mut pending_clip_path: Vec = Vec::new();
+ let mut pending_clip = false;
+ let mut has_leaking_clip = false;
+ for op in ops.get(rem_start..rem_end).unwrap_or_default() {
+ match op.op.as_slice() {
+ b"q" => q_depth = q_depth.saturating_add(1),
+ b"Q" => q_depth = q_depth.saturating_sub(1),
+ b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" if q_depth == 0 => {
+ pending_clip_path.push(op.clone());
+ }
+ b"W" | b"W*" if q_depth == 0 => {
+ if !pending_clip_path.is_empty() {
+ pending_clip = true;
+ pending_clip_path.push(op.clone());
+ }
+ }
+ b"n" if q_depth == 0 => {
+ if pending_clip {
+ pending_clip_path.push(op.clone());
+ leaking_ops.extend(std::mem::take(&mut pending_clip_path));
+ has_leaking_clip = true;
+ pending_clip = false;
+ } else {
+ pending_clip_path.clear();
+ }
+ }
+ b"rg" | b"RG" | b"g" | b"G" | b"k" | b"K" | b"cs" | b"CS" | b"sc" | b"scn" | b"SC" | b"SCN" | b"w" | b"J" | b"j" | b"M" | b"d"
+ | b"ri" | b"i" | b"gs" | b"Tf" | b"Tc" | b"Tw" | b"Tz" | b"TL" | b"Tr" | b"Ts"
+ if q_depth == 0 =>
+ {
+ leaking_ops.push(op.clone());
+ }
+ b"cm" if q_depth == 0 => {
+ leaking_ops.push(op.clone());
+ }
+ _ => {
+ if q_depth == 0 && !op.is("BDC") && !op.is("BMC") && !op.is("EMC") && !pending_clip {
+ pending_clip_path.clear();
+ }
+ }
+ }
+ }
+ (leaking_ops, has_leaking_clip)
+}
+
+fn build_relocated_unit_ops(
+ marked_open: Option<&Op>,
+ source_gs_ops: &[(Op, Matrix)],
+ inherited_drawing_ops: &[Op],
+ extracted: ExtractedScopeState,
+ dest_ctm: Matrix,
+ draw_matrix: [f64; 6],
+ has_closing_emc: bool,
+) -> Result, EditError> {
+ let mut unit_ops = Vec::new();
+ if let Some(open) = marked_open {
+ unit_ops.push(open.clone());
+ }
+ unit_ops.push(Op::new("q", vec![]));
+ let mut current_ctm = dest_ctm;
+
+ for (gs_op, target_ctm) in source_gs_ops {
+ if *target_ctm != current_ctm {
+ let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+ let delta = target_ctm.then(¤t_inv);
+ if !delta.0.iter().all(|v| v.is_finite()) {
+ return Err(EditError::Invalid("unsupported graphics state: invalid transform coordinates".into()));
+ }
+ if delta != Matrix::IDENTITY {
+ unit_ops.push(Op::new("cm", delta.0.map(pdfcraft_content::num).to_vec()));
+ current_ctm = *target_ctm;
+ }
+ }
+ unit_ops.push(gs_op.clone());
+ }
+
+ unit_ops.extend(inherited_drawing_ops.iter().cloned());
+
+ let non_gs_ops = extracted.state_ops.into_iter().filter(|o| !o.is("gs"));
+ unit_ops.extend(non_gs_ops);
+
+ if !extracted.clip_ops.is_empty() {
+ if current_ctm != Matrix::IDENTITY {
+ let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+ unit_ops.push(Op::new("cm", current_inv.0.map(pdfcraft_content::num).to_vec()));
+ }
+ unit_ops.extend(extracted.clip_ops);
+ if Matrix(draw_matrix) != Matrix::IDENTITY {
+ unit_ops.push(Op::new("cm", draw_matrix.map(pdfcraft_content::num).to_vec()));
+ }
+ } else if Matrix(draw_matrix) != current_ctm {
+ let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+ let delta = Matrix(draw_matrix).then(¤t_inv);
+ if !delta.0.iter().all(|v| v.is_finite()) {
+ return Err(EditError::Invalid("unsupported graphics state: invalid transform coordinates".into()));
+ }
+ if delta != Matrix::IDENTITY {
+ unit_ops.push(Op::new("cm", delta.0.map(pdfcraft_content::num).to_vec()));
+ }
+ }
+ unit_ops.push(extracted.do_op);
+ unit_ops.push(Op::new("Q", vec![]));
+ if has_closing_emc {
+ unit_ops.push(Op::new("EMC", vec![]));
+ }
+ Ok(unit_ops)
+}
+
+/// Change the stacking order of `img`, drawn on page `p` by its content streams `all`.
+fn arrange_image(
+ doc: &mut Document,
+ p: &pdfcraft_model::Page,
+ all: &[(Object, Vec)],
+ img: &PageImage,
+ order: ArrangeOrder,
+) -> Result<(), EditError> {
+ let pieces = joined(all);
+ let ops = pieces.parse().ops;
+ let target = img.op;
+ let target_op = ops.get(target).filter(|op| op.is("Do")).ok_or_else(|| EditError::Invalid("the image operation could not be located".into()))?;
+
+ let is_wrapped = is_entire_page_wrapped(&ops);
+ let (scan_start, scan_end) = if is_wrapped { (1, ops.len().saturating_sub(1)) } else { (0, ops.len()) };
+ let units = content_units(&ops, scan_start, scan_end);
+ let Some((target_idx, target_unit)) = units.iter().enumerate().find(|(_, u)| u.contains(&target)) else {
+ return Err(EditError::Invalid("the image content unit could not be located".into()));
+ };
+ let has_other_paint = ops.iter().enumerate().any(|(i, op)| {
+ i >= target_unit.start
+ && i < target_unit.end
+ && i != target
+ && matches!(
+ op.op.as_slice(),
+ b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
+ )
+ });
+ if units.len() <= 1 && !has_other_paint {
+ return Err(EditError::Invalid("the page has only one content unit to arrange".into()));
+ }
+
+ let (dest_unit, insert_after) = target_destination_unit(&units, target_idx, target_unit, order, has_other_paint)?;
+ if !balanced_arrange_span(&ops, target_unit.clone()) || !balanced_arrange_span(&ops, dest_unit.clone()) {
+ return Err(EditError::Invalid("cannot arrange an image across graphics or marked-content boundaries".into()));
+ }
+
+ // A marked-content sequence that holds other content cannot be split without generating
+ // a new structure element and MCID, so we refuse to rearrange it to avoid leaving the image untagged.
+ // If the sequence holds only this image, the whole marked unit is moved intact.
+ let marked_unit = ops.get(target_unit.start).is_some_and(|o| o.is("BDC") || o.is("BMC"));
+ let marked_depth = ops.iter().take(target).fold(0usize, |depth, op| {
+ if op.is("BDC") || op.is("BMC") {
+ depth.saturating_add(1)
+ } else if op.is("EMC") {
+ depth.saturating_sub(1)
+ } else {
+ depth
+ }
+ });
+ if marked_depth > usize::from(marked_unit) {
+ return Err(EditError::Invalid("cannot rearrange an image out of a nested marked-content sequence".into()));
+ }
+ if marked_unit && has_other_paint {
+ return Err(EditError::Invalid("cannot rearrange an image that shares a marked-content sequence with other content".into()));
+ }
+
+ let (mut target_span, scope_start, rem_start, rem_end) = determine_arrange_spans(&ops, target, target_unit, has_other_paint, marked_unit)?;
+
+ let missing = || EditError::Invalid("the destination content unit could not be located".into());
+ let (dest_pos, scan_target) = if insert_after {
+ (dest_unit.end.checked_sub(1).and_then(|i| ops.get(i)).ok_or_else(missing)?.span.end, dest_unit.end)
+ } else {
+ (ops.get(dest_unit.start).ok_or_else(missing)?.span.start, dest_unit.start)
+ };
+
+ // An added item owns its entire stream: editing or deleting it replaces that stream.
+ // Insert ordinary artwork next to the complete owned unit in a separate stream instead.
+ let destination_piece = if insert_after {
+ dest_unit.end.checked_sub(1).and_then(|i| ops.get(i)).map(|op| pieces.piece_of(op.span.end.saturating_sub(1)))
+ } else {
+ ops.get(dest_unit.start).map(|op| pieces.piece_of(op.span.start))
+ };
+ let owned_destination = destination_piece
+ .filter(|piece| all.get(*piece).is_some_and(|(obj, _)| doc.resolve(obj).as_dict().is_some_and(|d| d.get(b"PCAdded").is_some())));
+ if let Some(piece) = owned_destination {
+ let whole_unit = ops.iter().enumerate().all(|(index, op)| {
+ let (first, last) = pieces.pieces_of(op);
+ if dest_unit.contains(&index) { first == piece && last == piece } else { piece < first || piece > last }
+ });
+ if !whole_unit || img.stream == piece {
+ return Err(EditError::Invalid("cannot arrange an image inside an added item's content stream".into()));
+ }
+ }
+
+ let (leaking_ops, has_leaking_clip) = scan_leaking_ops(&ops, rem_start, rem_end);
+
+ let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+ let ext_gstates = res.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
+
+ let mut state = ImageState::new(Matrix::IDENTITY, p.crop(doc), Vec::new());
+ let mut tracker = ExtendedGStateTracker::default();
+ let mut drawing_tracker = DrawingStateTracker::default();
+ let mut source_effective_state = EffectiveGState::default();
+ let mut source_gs_ops = Vec::new();
+ let mut source_drawing_state = DrawingState::default();
+ let mut dest_effective_state = EffectiveGState::default();
+ let mut dest_drawing_state = DrawingState::default();
+ let mut dest_ctm = Matrix::IDENTITY;
+ let mut scope_start_ctm = Matrix::IDENTITY;
+ let mut outer_clips = Vec::new();
+ let mut dest_clips = Vec::new();
+ let mut ctm_before_removal = Matrix::IDENTITY;
+ let mut ctm_after_removal = Matrix::IDENTITY;
+
+ let max_scan = scan_target.max(target.saturating_add(1)).max(scope_start.saturating_add(1)).max(rem_end);
+ for (i, op) in ops.iter().enumerate() {
+ if i == rem_start {
+ ctm_before_removal = state.placement.matrix;
+ }
+ if i == scope_start {
+ scope_start_ctm = state.placement.matrix;
+ outer_clips = state.placement.clips.clone();
+ }
+ if i == target {
+ source_effective_state = tracker.current_state.clone();
+ source_gs_ops = tracker.active_gs_ops.iter().map(|(_, op, ctm)| (op.clone(), *ctm)).collect();
+ source_drawing_state = drawing_tracker.current.clone();
+ }
+ if i == scan_target {
+ dest_effective_state = tracker.current_state.clone();
+ dest_drawing_state = drawing_tracker.current.clone();
+ dest_ctm = state.placement.matrix;
+ dest_clips = state.placement.clips.clone();
+ }
+ if i >= max_scan {
+ break;
+ }
+ state.apply(op)?;
+ tracker.step(op, &ext_gstates, doc, state.placement.matrix)?;
+ drawing_tracker.step(op)?;
+ if op.is("gs")
+ && op.name(0).and_then(|name| tracker.definitions.get(name)).and_then(|gs| gs.as_dict()).is_some_and(|gs| gs.get(b"Font").is_some())
+ && let Some(font) = DRAWING_PARAMS.iter().position(|name| *name == "Tf").and_then(|index| drawing_tracker.current.params.get_mut(index))
+ {
+ // The replayed gs selects its font; do not overwrite it with an older direct Tf.
+ *font = None;
+ }
+ if op.is("gs")
+ && let Some(intent) = &tracker.current_state.rendering_intent
+ {
+ drawing_tracker.step(&Op::new("ri", vec![Object::Name(intent.clone())]))?;
+ }
+ if i == rem_end.saturating_sub(1) {
+ ctm_after_removal = state.placement.matrix;
+ }
+ }
+ if scan_target >= ops.len() {
+ dest_effective_state = tracker.current_state.clone();
+ dest_drawing_state = drawing_tracker.current.clone();
+ dest_ctm = state.placement.matrix;
+ dest_clips = state.placement.clips.clone();
+ }
+ if dest_ctm.invert().is_none() {
+ return Err(EditError::Invalid("unsupported graphics state: non-invertible CTM".into()));
+ }
+
+ let owned_crop = ops.get(scope_start..target).unwrap_or_default().iter().any(|op| op.is("MP") && op.name(0) == Some(b"PdfCraftImageCrop"));
+ let extracted_scope = if owned_crop { None } else { extract_scope_state(&ops, scope_start, target, scope_start_ctm)? };
+ let mut extracted = match extracted_scope {
+ Some(ext) => ext,
+ None if scope_start != target => {
+ if !marked_unit || has_other_paint {
+ target_span = target_op.span.clone();
+ }
+ extract_scope_state(&ops, target, target, Matrix(img.draw_matrix))?
+ .ok_or_else(|| EditError::Invalid("unsupported graphics state: unable to cleanly extract image scope state".into()))?
+ }
+ None => {
+ return Err(EditError::Invalid("unsupported graphics state: unable to cleanly extract image scope state".into()));
+ }
+ };
+
+ // The clips the moved unit draws itself: all of the image's when they are rebuilt from
+ // `img.clips`, else those its own scope set after the clips around it.
+ let all_clips = extracted.clip_ops.is_empty();
+ let reemitted = if all_clips {
+ img.clips.as_slice()
+ } else if img.clips.starts_with(&outer_clips) {
+ img.clips.get(outer_clips.len()..).unwrap_or_default()
+ } else {
+ return Err(EditError::Invalid("unsupported graphics state: the image clipping path cannot be cleanly preserved".into()));
+ };
+ // At the destination it is clipped by the clips there and the ones it draws. Moving past a
+ // clip the image isn't under (or out from under one it is) would change what part shows.
+ if !dest_clips.iter().all(|c| img.clips.contains(c)) || !img.clips.iter().all(|c| dest_clips.contains(c) || reemitted.contains(c)) {
+ return Err(EditError::Invalid(
+ "unsupported graphics state: moving the image past a clipping path would change what part of it shows".into(),
+ ));
+ }
+
+ if all_clips {
+ for clip in &img.clips {
+ let ops = clip_path_to_ops(clip)
+ .ok_or_else(|| EditError::Invalid("unsupported graphics state: the image clipping path cannot be cleanly preserved".into()))?;
+ extracted.clip_ops.extend(ops);
+ }
+ }
+
+ let has_inherited_clip = !img.clips.is_empty() && extracted.clip_ops.is_empty();
+ if has_inherited_clip {
+ return Err(EditError::Invalid("unsupported graphics state: inherited clipping path cannot be cleanly preserved".into()));
+ }
+
+ let mut reconstructed_state = dest_effective_state.clone();
+ for (op, ctm) in &source_gs_ops {
+ if let Some(name) = op.name(0)
+ && let Some(definition) = tracker.definitions.get(name)
+ {
+ reconstructed_state.merge_shared(definition, doc, *ctm);
+ }
+ }
+
+ if reconstructed_state.visually_differs(&source_effective_state) {
+ return Err(EditError::Invalid(
+ "unsupported graphics state: moving the image would alter opacity, blend mode, soft mask, or printing parameters".into(),
+ ));
+ }
+
+ let marked_open = if marked_unit && !has_other_paint { ops.get(target_unit.start) } else { None };
+ let has_closing_emc = marked_open.is_some() && target_unit.end.checked_sub(1).and_then(|i| ops.get(i)).is_some_and(|o| o.is("EMC"));
+ let inherited_drawing_ops = compute_inherited_drawing_ops(&source_drawing_state, &dest_drawing_state, &extracted.state_ops);
+ let unit_ops =
+ build_relocated_unit_ops(marked_open, &source_gs_ops, &inherited_drawing_ops, extracted, dest_ctm, img.draw_matrix, has_closing_emc)?;
+
+ let mut serialized = Vec::new();
+ serialized.push(b'\n');
+ serialized.extend_from_slice(&serialize_ops(&unit_ops));
+ serialized.push(b'\n');
+
+ let leaking = if let Some(inv) = ctm_before_removal.invert() { ctm_after_removal.then(&inv) } else { Matrix::IDENTITY };
+ if leaking != Matrix::IDENTITY && has_leaking_clip {
+ return Err(EditError::Invalid("unsupported graphics state: moving the image would alter clipping path transform".into()));
+ }
+ let mut leak_ops = leaking_ops;
+ if leaking != Matrix::IDENTITY && leak_ops.iter().all(|o| !o.is("cm")) {
+ leak_ops.insert(0, Op::new("cm", leaking.0.map(pdfcraft_content::num).to_vec()));
+ }
+ let removal_replacement = if !leak_ops.is_empty() {
+ let mut s = Vec::new();
+ s.push(b'\n');
+ s.extend_from_slice(&serialize_ops(&leak_ops));
+ s.push(b'\n');
+ s
+ } else {
+ Vec::new()
+ };
+
+ if let Some(piece) = owned_destination {
+ let changed = pieces.splice([(target_span, removal_replacement)]);
+ let contents = crate::text::rewritten_contents(doc, all, changed);
+ let mut list = match contents {
+ Object::Array(list) => list,
+ one => vec![one],
+ };
+ let insertion = piece.saturating_add(usize::from(insert_after));
+ if insertion > list.len() {
+ return Err(EditError::Invalid("the destination content stream is missing".into()));
+ }
+ let relocated = doc.add(Object::Stream(pdfcraft_cos::Stream::flate(Dict::new(), &serialized)));
+ list.insert(insertion, Object::Ref(relocated));
+ doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+ return Ok(());
+ }
+
+ let mut edits = Vec::new();
+ if dest_pos >= target_span.end {
+ edits.push((target_span, removal_replacement));
+ edits.push((dest_pos..dest_pos, serialized));
+ } else if dest_pos <= target_span.start {
+ edits.push((dest_pos..dest_pos, serialized));
+ edits.push((target_span, removal_replacement));
+ } else {
+ return Err(EditError::Invalid("cannot arrange image into overlapping content range".into()));
+ }
+
+ let changed = pieces.splice(edits);
+ let contents = crate::text::rewritten_contents(doc, all, changed);
+ doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+ Ok(())
+}
+
+/// The saved graphics-state scopes (`q … Q`) around the `Do` at `target` that paint nothing else,
+/// each as `(q, Q, CTM before the q)`.
+struct ImageScopes {
+ /// The innermost one inside which every clip on the image is set.
+ isolated: Option<(usize, usize, Matrix)>,
+ /// The outermost one. It holds all of the image's private clips, but not a clip set outside it.
+ outermost: Option<(usize, usize, Matrix)>,
+ /// The CTM at the `Do`, and whether a clip applies there.
+ placement: Matrix,
+ clipped: bool,
+}
+
+impl ImageScopes {
+ /// The saved graphics-state scope containing just this image and its crop, or the `Do` alone
+ /// when nothing clips it. Applying a transform before that scope moves the actual clipping path
+ /// as well as the pixels. A shared clip must never be moved along with unrelated artwork or text.
+ ///
+ /// Under a clip set outside every scope that holds only this image (a report or table drawing
+ /// each picture as `q re W n cm Do Q` inside a section's clip), no scope contains every active
+ /// clip. The outermost scope holding only the image is used then: it contains all of the
+ /// image's private clips, which move with it, while the outer clip is shared and stays.
+ fn transform_scope(&self, target: usize) -> Option<(usize, usize, Matrix)> {
+ if !self.clipped {
+ return Some((target, target, self.placement));
+ }
+ self.isolated.or(self.outermost)
+ }
+}
+
+/// [`ImageScopes`] of the `Do` at `target`. An image inside a text object cannot be `done`.
+fn image_scopes(ops: &[Op], target: usize, done: &str) -> Result {
+ struct Scope {
+ start: usize,
+ matrix: Matrix,
+ inherited_clip: bool,
+ inherited_path: bool,
+ selected: bool,
+ other_paint: bool,
+ }
+ let mut stack: Vec = Vec::new();
+ let mut matrix = Matrix::IDENTITY;
+ let mut clipped = false;
+ let mut path = false;
+ let mut pending_clip = false;
+ let mut text = false;
+ let mut at_image = None;
+ let mut isolated = None;
+ let mut outermost = None;
+ for (index, op) in ops.iter().enumerate() {
+ match op.op.as_slice() {
+ b"q" => {
+ if stack.len() >= 256 {
+ return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+ }
+ stack.push(Scope { start: index, matrix, inherited_clip: clipped, inherited_path: path, selected: false, other_paint: false });
+ }
+ b"Q" => {
+ if let Some(scope) = stack.pop() {
+ if scope.selected && !scope.other_paint && !scope.inherited_path {
+ let found = (scope.start, index, scope.matrix);
+ if !scope.inherited_clip {
+ isolated.get_or_insert(found);
+ }
+ // Scopes close inner first, so the last one recorded is the outermost.
+ outermost = Some(found);
+ }
+ matrix = scope.matrix;
+ clipped = scope.inherited_clip;
+ path = scope.inherited_path;
+ pending_clip = false;
+ }
+ }
+ b"cm" => {
+ if let Some(m) = op.nums::<6>() {
+ matrix = Matrix(m).then(&matrix);
+ }
+ }
+ b"BT" => text = true,
+ b"ET" => text = false,
+ b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" => path = true,
+ b"W" | b"W*" => pending_clip = true,
+ _ => {}
+ }
+ if index == target {
+ if text {
+ return Err(EditError::Invalid(format!("an image inside a text object cannot be {done}")));
+ }
+ at_image = Some((matrix, clipped));
+ for scope in &mut stack {
+ scope.selected = true;
+ }
+ } else if matches!(
+ op.op.as_slice(),
+ b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
+ ) {
+ for scope in &mut stack {
+ scope.other_paint = true;
+ }
+ }
+ if matches!(op.op.as_slice(), b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*") {
+ clipped |= pending_clip;
+ pending_clip = false;
+ path = false;
+ }
+ }
+ let (placement, clipped) = at_image.ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
+ Ok(ImageScopes { isolated, outermost, placement, clipped })
+}
+
+/// A marked-content point identifies only the clipping path written by this editor.
+/// It does not open a marked-content sequence or change the document's structure tags.
+fn crop_marker() -> Op {
+ Op::new("MP", vec![Object::Name(b"PdfCraftImageCrop".to_vec())])
+}
+
+fn app_crop_ranges(ops: &[Op], start: usize, target: usize) -> Vec> {
+ let mut ranges = Vec::new();
+ for (index, op) in ops.iter().enumerate().take(target).skip(start) {
+ if !op.is("MP") || op.name(0) != Some(b"PdfCraftImageCrop") {
+ continue;
+ }
+ let path_start = index.saturating_add(1);
+ let mut end = path_start;
+ while end < target && ops.get(end).is_some_and(|o| matches!(o.op.as_slice(), b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re")) {
+ end = end.saturating_add(1);
+ }
+ if end > path_start && ops.get(end).is_some_and(|o| o.is("W") || o.is("W*")) && ops.get(end.saturating_add(1)).is_some_and(|o| o.is("n")) {
+ ranges.push(index..end.saturating_add(2));
+ }
+ }
+ ranges
+}
+
+/// Remove only crops written by PdfCraft, preserving the document author's clipping paths.
+fn remove_image_crop(doc: &mut Document, p: &pdfcraft_model::Page, all: &[(Object, Vec)], img: &PageImage) -> Result<(), EditError> {
+ let pieces = joined(all);
+ let ops = pieces.parse().ops;
+ let target = img.op;
+ let scope = image_scopes(&ops, target, "cropped")?;
+ let Some((start, _, _)) = scope.transform_scope(target) else {
+ return Err(EditError::Invalid("the image has no PdfCraft crop to remove".into()));
+ };
+ let crops = app_crop_ranges(&ops, start, target);
+ if crops.is_empty() {
+ return Err(EditError::Invalid("the image has no PdfCraft crop to remove".into()));
+ }
+ let changed = crate::text::splice(&pieces, &ops, |index| (Vec::new(), !crops.iter().any(|r| r.contains(&index))));
+ let contents = crate::text::rewritten_contents(doc, all, changed);
+ doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+ Ok(())
+}
+
/// Change image `index` (from [`page_images`]) on `page`.
pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &ImageChange) -> Result<(), EditError> {
let images = page_images(doc, page)?;
@@ -490,8 +1637,14 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
ImageChange::Transform(t) => {
return transform_image(doc, &p, &all, &img, *t);
}
+ ImageChange::Arrange(order) => {
+ return arrange_image(doc, &p, &all, &img, *order);
+ }
+ ImageChange::RemoveCrop => {
+ return remove_image_crop(doc, &p, &all, &img);
+ }
ImageChange::Crop(keep) => {
- return crop_image(doc, &p, &all, &img, *keep);
+ return crop_image_impl(doc, &p, &all, &img, *keep);
}
ImageChange::Replace(r) => {
if img.is_form {
@@ -534,94 +1687,6 @@ pub(crate) fn selectable_images(
.collect())
}
-/// Find the saved graphics-state scope containing just this image and its crop. Applying
-/// the transform before that scope moves the actual clipping path as well as the pixels.
-/// A shared clip must never be moved along with unrelated artwork or text.
-///
-/// Under a clip set outside every scope that holds only this image (a report or table drawing
-/// each picture as `q re W n cm Do Q` inside a section's clip), no scope contains every active
-/// clip. The outermost scope holding only the image is used then: it contains all of the
-/// image's private clips, which move with it, while the outer clip is shared and stays.
-fn image_transform_scope(ops: &[Op], target: usize) -> Result, EditError> {
- struct Scope {
- start: usize,
- matrix: Matrix,
- inherited_clip: bool,
- inherited_path: bool,
- selected: bool,
- other_paint: bool,
- }
- let mut stack: Vec = Vec::new();
- let mut matrix = Matrix::IDENTITY;
- let mut clipped = false;
- let mut path = false;
- let mut pending_clip = false;
- let mut text = false;
- let mut at_image = None;
- let mut isolated = None;
- let mut outermost = None;
- for (index, op) in ops.iter().enumerate() {
- match op.op.as_slice() {
- b"q" => {
- if stack.len() >= 256 {
- return Err(EditError::Invalid("the image graphics state is too deeply nested to transform".into()));
- }
- stack.push(Scope { start: index, matrix, inherited_clip: clipped, inherited_path: path, selected: false, other_paint: false });
- }
- b"Q" => {
- if let Some(scope) = stack.pop() {
- if scope.selected && !scope.other_paint && !scope.inherited_path {
- if !scope.inherited_clip {
- // Prefer the innermost scope that contains every active clipping path.
- isolated.get_or_insert((scope.start, index, scope.matrix));
- }
- // Scopes close inner first, so the last one recorded is the outermost.
- outermost = Some((scope.start, index, scope.matrix));
- }
- matrix = scope.matrix;
- clipped = scope.inherited_clip;
- }
- }
- b"cm" => {
- if let Some(m) = op.nums::<6>() {
- matrix = Matrix(m).then(&matrix);
- }
- }
- b"BT" => text = true,
- b"ET" => text = false,
- b"m" | b"l" | b"c" | b"v" | b"y" | b"re" => path = true,
- b"W" | b"W*" => pending_clip = true,
- _ => {}
- }
- if index == target {
- if text {
- return Err(EditError::Invalid("an image inside a text object cannot be transformed".into()));
- }
- at_image = Some((matrix, clipped));
- for scope in &mut stack {
- scope.selected = true;
- }
- } else if matches!(
- op.op.as_slice(),
- b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
- ) {
- for scope in &mut stack {
- scope.other_paint = true;
- }
- }
- if matches!(op.op.as_slice(), b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*") {
- clipped |= pending_clip;
- pending_clip = false;
- path = false;
- }
- }
- let (placement, clipped) = at_image.ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
- if !clipped {
- return Ok(Some((target, target, placement)));
- }
- Ok(isolated.or(outermost))
-}
-
fn transform_image(
doc: &mut Document,
page: &pdfcraft_model::Page,
@@ -640,12 +1705,14 @@ fn transform_image(
}
// A private path crop moves with its image regardless of intervening state operators.
// Shared crops retain the existing fixed-clip behavior, preserving neighbouring paint.
- let (start, end, placement) = image_transform_scope(&ops, target)?.unwrap_or((target, target, Matrix(image.draw_matrix)));
+ let (start, end, placement) =
+ image_scopes(&ops, target, "transformed")?.transform_scope(target).unwrap_or((target, target, Matrix(image.draw_matrix)));
let inverse = placement.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
let local = placement.then(&Matrix(transform)).then(&inverse);
if !local.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
return Err(EditError::Invalid("the image transform is too large".into()));
}
+
// Already alone in a `q cm … Q` (its own placement, or the wrapper an earlier edit added):
// change that `cm` in place. The CTM inside is `local · cm · outer` either way.
if let Some((at, cm)) = enclosing_transform(&ops, start, end) {
@@ -686,13 +1753,16 @@ fn transform_image(
/// that holds the image and its private crop (or a new `q … Q` around the `Do`), written in
/// that scope's coordinates as the box's four corners, so a turned image crops to an upright
/// box too and a later transform of the scope moves the crop with the pixels.
-fn crop_image(
+fn crop_image_impl(
doc: &mut Document,
page: &pdfcraft_model::Page,
streams: &[(Object, Vec)],
image: &PageImage,
keep: [f64; 4],
) -> Result<(), EditError> {
+ if image.is_form {
+ return Err(EditError::Invalid("cropping grouped Form artwork is not supported".into()));
+ }
if !keep.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
return Err(EditError::Invalid("the crop box must be finite and no larger than 1e12".into()));
}
@@ -700,36 +1770,53 @@ fn crop_image(
if x1 - x0 < 1e-6 || y1 - y0 < 1e-6 {
return Err(EditError::Invalid("the crop box has no area".into()));
}
+ if intersection(image.rect, [x0, y0, x1, y1]).is_none() {
+ return Err(EditError::Invalid("the crop box does not intersect the image".into()));
+ }
+
let pieces = joined(streams);
let ops = pieces.parse().ops;
let target = image.op;
if !ops.get(target).is_some_and(|op| op.is("Do")) {
return Err(EditError::Invalid("the image operation could not be located".into()));
}
- let (start, end, placement) = image_transform_scope(&ops, target)?.unwrap_or((target, target, Matrix(image.draw_matrix)));
+ let (start, end, placement) =
+ image_scopes(&ops, target, "cropped")?.transform_scope(target).unwrap_or((target, target, Matrix(image.draw_matrix)));
let inverse = placement.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
let corners = [(x0, y0), (x1, y0), (x1, y1), (x0, y1)].map(|(x, y)| inverse.apply(x, y));
if !corners.iter().all(|(x, y)| x.is_finite() && y.is_finite() && x.abs() <= 1e12 && y.abs() <= 1e12) {
return Err(EditError::Invalid("the crop box is too large for the image's placement".into()));
}
- let clip: Vec = corners
- .iter()
- .enumerate()
- .map(|(i, (x, y))| Op::new(if i == 0 { "m" } else { "l" }, vec![Object::Real(*x), Object::Real(*y)]))
- .chain([Op::new("h", vec![]), Op::new("W", vec![]), Op::new("n", vec![])])
- .collect();
- // The image's own earlier crop (a clipping path right after the scope's `q`) gives way to
- // the new one, so a crop can grow again as well as shrink.
- let old_clip: Option> = (start != end)
- .then(|| {
- let mut k = start + 1;
- while ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re")) {
- k += 1;
- }
- (k > start + 1 && ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"W" | b"W*")) && ops.get(k + 1).is_some_and(|o| o.is("n")))
- .then_some(start + 1..k + 2)
- })
- .flatten();
+ let is_axis_aligned = ((corners[0].1 - corners[1].1).abs() < 1e-4
+ && (corners[1].0 - corners[2].0).abs() < 1e-4
+ && (corners[2].1 - corners[3].1).abs() < 1e-4
+ && (corners[3].0 - corners[0].0).abs() < 1e-4)
+ || ((corners[0].0 - corners[1].0).abs() < 1e-4
+ && (corners[1].1 - corners[2].1).abs() < 1e-4
+ && (corners[2].0 - corners[3].0).abs() < 1e-4
+ && (corners[3].1 - corners[0].1).abs() < 1e-4);
+ let mut clip: Vec = if is_axis_aligned {
+ let min_x = corners.iter().map(|(x, _)| *x).fold(f64::INFINITY, f64::min);
+ let max_x = corners.iter().map(|(x, _)| *x).fold(f64::NEG_INFINITY, f64::max);
+ let min_y = corners.iter().map(|(_, y)| *y).fold(f64::INFINITY, f64::min);
+ let max_y = corners.iter().map(|(_, y)| *y).fold(f64::NEG_INFINITY, f64::max);
+ vec![
+ Op::new("re", vec![Object::Real(min_x), Object::Real(min_y), Object::Real(max_x - min_x), Object::Real(max_y - min_y)]),
+ Op::new("W", vec![]),
+ Op::new("n", vec![]),
+ ]
+ } else {
+ corners
+ .iter()
+ .enumerate()
+ .map(|(i, (x, y))| Op::new(if i == 0 { "m" } else { "l" }, vec![Object::Real(*x), Object::Real(*y)]))
+ .chain([Op::new("h", vec![]), Op::new("W", vec![]), Op::new("n", vec![])])
+ .collect()
+ };
+ clip.insert(0, crop_marker());
+ // Replace only our identified crop; an author's path must remain intact.
+ let old_crops = app_crop_ranges(&ops, start, target);
+ let insert_at = start.saturating_add(1);
let changed = crate::text::splice(&pieces, &ops, |index| {
if start == end && index == target {
// No scope of its own yet: one around the drawing, with the crop inside.
@@ -738,10 +1825,10 @@ fn crop_image(
out.extend(ops.get(index).cloned());
out.push(Op::new("Q", vec![]));
(out, false)
- } else if start != end && index == start + 1 {
+ } else if start != end && index == insert_at {
// Inside the scope's `q`, before whatever it draws (in place of its old crop).
- (clip.clone(), old_clip.is_none())
- } else if old_clip.as_ref().is_some_and(|r| r.contains(&index)) {
+ (clip.clone(), !old_crops.iter().any(|r| r.contains(&index)))
+ } else if old_crops.iter().any(|r| r.contains(&index)) {
(Vec::new(), false)
} else {
(Vec::new(), true)
@@ -787,6 +1874,42 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
}
// Images alone in their own `q re W n cm Do Q` take the clip with them.
let mut clips = std::collections::BTreeMap::new();
+ let mut crop_starts = std::collections::BTreeMap::new();
+ let mut crop_ends = std::collections::BTreeSet::new();
+ let mut folds = std::collections::BTreeMap::new();
+ for image in images.iter().filter(|image| image.has_editor_crop()) {
+ let Some(&(_, _, offset)) = plans.get(&image.op) else { continue };
+ let Some((start, end, placement)) = image_scopes(&ops, image.op, "moved")?.transform_scope(image.op) else {
+ return Err(EditError::Invalid("the image crop cannot be moved independently".into()));
+ };
+ let inverse = placement.invert().ok_or_else(|| EditError::Invalid("a selected image has no area".into()))?;
+ let local = placement.then(&Matrix::translate(offset[0], offset[1])).then(&inverse);
+ if !local.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+ return Err(EditError::Invalid("the image move is too large".into()));
+ }
+ let leading_transform = || {
+ let at = start.checked_add(1)?;
+ if start >= end || !ops.get(start)?.is("q") || !ops.get(at)?.is("cm") {
+ return None;
+ }
+ ops.get(at)?.nums::<6>().map(|m| (at, Matrix(m)))
+ };
+ // An enclosing cm is before the captured placement; an inside-scope cm is after it.
+ // Their multiplication orders differ when that cm scales or shears a translation.
+ let folded = enclosing_transform(&ops, start, end)
+ .map(|(at, cm)| (at, local.then(&cm)))
+ .or_else(|| leading_transform().map(|(at, cm)| (at, cm.then(&local))));
+ if let Some((at, folded)) = folded {
+ if !folded.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+ return Err(EditError::Invalid("the image move is too large".into()));
+ }
+ folds.insert(at, folded);
+ } else {
+ crop_starts.insert(start, local);
+ crop_ends.insert(end);
+ }
+ plans.remove(&image.op);
+ }
for index in 0..ops.len() {
let Some(&(_, placement, offset)) = plans.get(&index) else { continue };
let Some((at, cm)) = exclusive_clip(&ops, index) else { continue };
@@ -807,7 +1930,6 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
};
}
// An image already alone in `q cm Do Q` moves by changing that `cm`, not by nesting another.
- let mut folds = std::collections::BTreeMap::new();
for index in 0..ops.len() {
let Some(&(movement, _, _)) = plans.get(&index) else { continue };
let Some((at, cm)) = enclosing_transform(&ops, index, index) else { continue };
@@ -822,6 +1944,14 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
return Err(EditError::Invalid("a selected image operation is missing".into()));
}
let data = crate::text::splice(&pieces, &ops, |index| {
+ if let Some(matrix) = crop_starts.remove(&index) {
+ return (vec![Op::new("q", vec![]), Op::new("cm", matrix.0.map(Object::Real).to_vec())], true);
+ }
+ if crop_ends.remove(&index) {
+ let mut out: Vec<_> = ops.get(index).cloned().into_iter().collect();
+ out.push(Op::new("Q", vec![]));
+ return (out, false);
+ }
if let Some((c, keep)) = clips.remove(&index) {
return (vec![Op::new("cm", c.0.map(Object::Real).to_vec())], keep);
}
@@ -841,3 +1971,44 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
Ok(())
}
+
+#[cfg(test)]
+mod allocation_tests {
+ use super::*;
+
+ #[test]
+ fn saved_drawing_states_share_large_operand_storage() {
+ let mut tracker = DrawingStateTracker::default();
+ let parsed = parse(b"[1 2 3 4 5 6 7 8] 0 d /Pattern cs 1 2 3 4 5 6 /P scn q q q");
+ for op in &parsed.ops {
+ tracker.step(op).unwrap();
+ }
+ for state in &tracker.stack {
+ let dash = state.params[4].as_ref().unwrap();
+ let current_dash = tracker.current.params[4].as_ref().unwrap();
+ assert!(std::ptr::eq(dash.operands.as_ptr(), current_dash.operands.as_ptr()), "q must share the dash operands instead of cloning them");
+ let color = state.non_stroking_color.as_ref().unwrap().last().unwrap();
+ let current_color = tracker.current.non_stroking_color.as_ref().unwrap().last().unwrap();
+ assert!(std::ptr::eq(color.operands.as_ptr(), current_color.operands.as_ptr()), "q must share scn operands instead of cloning them");
+ }
+ let saved = tracker.current.clone();
+ for op in &parse(b"[9 10] 0 d 4 5 6 /Other scn Q").ops {
+ tracker.step(op).unwrap();
+ }
+ assert_eq!(tracker.current, saved, "changing shared operands must preserve the saved state");
+ }
+
+ #[test]
+ fn review_soft_mask_identity_includes_establishment_matrix() {
+ let doc = Document::new_empty();
+ let mask = Dict::from_iter([(b"S".to_vec(), Object::name("Alpha")), (b"G".to_vec(), Object::Ref(ObjRef::new(8, 0)))]);
+ let definition = Dict::from_iter([(b"SMask".to_vec(), Object::Dict(mask))]);
+ let states = Dict::from_iter([(b"A".to_vec(), Object::Dict(definition))]);
+ let mut tracker = ExtendedGStateTracker::default();
+ let op = Op::new("gs", vec![Object::name("A")]);
+ tracker.step(&op, &states, &doc, Matrix::IDENTITY).unwrap();
+ let before = tracker.current_state.clone();
+ tracker.step(&op, &states, &doc, Matrix::translate(50.0, 0.0)).unwrap();
+ assert!(before.visually_differs(&tracker.current_state), "the same mask established under a different CTM is a different effective mask");
+ }
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 193f7d8424..44a6730acc 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -1,6 +1,11 @@
//! pdfcraft-edit — page content editing (L4). Today: page marks, Acrobat's Header & footer,
//! Watermark, Background and Bates numbering (execution plan M7.6).
//!
+//! **Atomic page-mark operations.** Adding or replacing headers/footers, watermarks and backgrounds
+//! stages the whole call on a document snapshot and commits only after every selected page succeeds.
+//! An error preserves existing marks, content, resources, pending edits and allocated objects. The
+//! snapshot shares original PDF bytes and unchanged objects; it copies the overlay table and metadata.
+//!
//! **How marks are stored.** Each mark is one content stream appended to (or, for content behind
//! the page, inserted after the backgrounds at the start of) the page's `/Contents`, drawn in
//! display space (after `/Rotate`) and wrapped in a marked-content artifact (§14.8.2.2) so
@@ -35,6 +40,7 @@ pub type Rgb = [f64; 3];
pub mod backdrop;
pub use backdrop::{Backdrop, backdrops_left_off, page_backdrop, page_backdrops};
+pub use text::strip_subset_tag;
mod background;
pub use background::page_background;
pub mod objects;
@@ -43,7 +49,7 @@ pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, ed
mod flatten;
pub use flatten::{flatten, flatten_fill_sign};
pub mod images;
-pub use images::{ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre, turn_by_degrees};
+pub use images::{ArrangeOrder, ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre, turn_by_degrees};
pub mod bidi;
pub mod indic;
mod linebreak;
diff --git a/crates/edit/src/mark_transaction_tests.rs b/crates/edit/src/mark_transaction_tests.rs
new file mode 100644
index 0000000000..2623da88ba
--- /dev/null
+++ b/crates/edit/src/mark_transaction_tests.rs
@@ -0,0 +1,211 @@
+//! The public mark APIs either commit the complete operation or leave the document untouched.
+use super::{cx, fixture, reopen, streams};
+use crate::place::MARK_PLACEMENT_FAILURE;
+use crate::*;
+use pdfcraft_cos::{ObjRef, SaveOptions, write_incremental};
+
+const SELECTED: &[usize] = &[0, 1, 2];
+
+struct PlacementFailure;
+
+impl PlacementFailure {
+ fn after_two_pages(kind: MarkKind) -> Self {
+ MARK_PLACEMENT_FAILURE.with(|failure| {
+ assert!(failure.get().is_none());
+ failure.set(Some((kind, 2, 0)));
+ });
+ Self
+ }
+
+ fn completed(&self) -> usize {
+ MARK_PLACEMENT_FAILURE.with(|failure| failure.get().unwrap().2)
+ }
+}
+
+impl Drop for PlacementFailure {
+ fn drop(&mut self) {
+ MARK_PLACEMENT_FAILURE.with(|failure| failure.set(None));
+ }
+}
+
+/// Four pages share an original stream and resources, both inherited and directly referenced.
+/// All have all three existing marks, including a picture background with a replaced white fill.
+fn marked_document() -> (Document, MarkSource) {
+ let mut doc = fixture();
+ let parent = ObjRef::new(2, 0);
+ let extra = doc.add(Object::Dict(Dict::from_iter([
+ (b"Type".to_vec(), Object::name("Page")),
+ (b"Parent".to_vec(), Object::Ref(parent)),
+ (b"Contents".to_vec(), Object::Ref(ObjRef::new(7, 0))),
+ ])));
+ doc.update_dict(parent, |d| {
+ d.set(b"Kids".to_vec(), Object::Array([3, 4, 5].map(|n| Object::Ref(ObjRef::new(n, 0))).into_iter().chain([Object::Ref(extra)]).collect()));
+ d.set(b"Count".to_vec(), Object::Int(4));
+ })
+ .unwrap();
+ doc.set(ObjRef::new(7, 0), Object::Stream(Stream::from_raw(Dict::new(), b"1 g 0 0 600 800 re f 0 g BT /F1 9 Tf (Original page) Tj ET".to_vec())));
+ let picture = |doc: &mut Document, gray| {
+ let image = doc.add(Object::Stream(Stream::from_raw(
+ Dict::from_iter([
+ (b"Type".to_vec(), Object::name("XObject")),
+ (b"Subtype".to_vec(), Object::name("Image")),
+ (b"Width".to_vec(), Object::Int(1)),
+ (b"Height".to_vec(), Object::Int(1)),
+ (b"ColorSpace".to_vec(), Object::name("DeviceGray")),
+ (b"BitsPerComponent".to_vec(), Object::Int(8)),
+ ]),
+ vec![gray],
+ )));
+ MarkSource { xobject: image, size: (1.0, 1.0), image: true }
+ };
+ let old_picture = picture(&mut doc, 170);
+ let replacement_picture = picture(&mut doc, 80);
+ let all = [0, 1, 2, 3];
+ let hf = HeaderFooter {
+ text: ["Old header".into(), String::new(), String::new(), String::new(), String::new(), String::new()],
+ font: added::Family::Times,
+ ..Default::default()
+ };
+ add_header_footer(&mut doc, &all, &hf, false, &cx()).unwrap();
+ add_watermark(&mut doc, &all, &Watermark { text: "Old watermark".into(), opacity: 0.45, ..Default::default() }, false).unwrap();
+ add_background(&mut doc, &all, &Background { source: Some(old_picture), opacity: 0.6, replace_backdrop: true, ..Default::default() }, false)
+ .unwrap();
+ let pages = page_list(&doc);
+ let shared = ObjRef::new(6, 0);
+ let resources = (*doc.resolve(pages[0].dict.get(b"Resources").unwrap())).clone();
+ doc.set(shared, resources);
+ for (i, page) in pages.iter().enumerate() {
+ doc.update_dict(page.obj, |d| {
+ if i % 2 == 0 {
+ d.set(b"Resources".to_vec(), Object::Ref(shared));
+ } else {
+ d.remove(b"Resources");
+ }
+ })
+ .unwrap();
+ }
+ let doc = reopen(&doc);
+ assert!(!doc.is_modified());
+ let pages = page_list(&doc);
+ assert_eq!(pages.len(), 4);
+ assert!(doc.get(pages[1].obj).as_dict().unwrap().get(b"Resources").is_none(), "a selected page inherits its resources");
+ assert_eq!(pages[0].dict.get(b"Resources").and_then(Object::as_ref), Some(shared));
+ assert_eq!(pages[2].dict.get(b"Resources").and_then(Object::as_ref), Some(shared));
+ for i in 0..4 {
+ for kind in [MarkKind::HeaderFooter, MarkKind::Watermark, MarkKind::Background] {
+ assert_eq!(mark_streams(&doc, i, kind).len(), 1, "page {i} has existing {kind:?}");
+ }
+ }
+ (doc, replacement_picture)
+}
+
+fn mark_streams(doc: &Document, page: usize, kind: MarkKind) -> Vec {
+ streams(doc, page).into_iter().filter(|s| s.contains(&format!("/PCMark /{}", kind.tag()))).collect()
+}
+
+fn apply_replacement(doc: &mut Document, kind: MarkKind, source: MarkSource, replace: bool) -> Result<(), EditError> {
+ match kind {
+ MarkKind::HeaderFooter => add_header_footer(
+ doc,
+ SELECTED,
+ &HeaderFooter {
+ text: ["New header".into(), String::new(), String::new(), String::new(), String::new(), String::new()],
+ font: added::Family::Courier,
+ shrink: true,
+ ..Default::default()
+ },
+ replace,
+ &cx(),
+ ),
+ MarkKind::Watermark => add_watermark(doc, SELECTED, &Watermark { source: Some(source), opacity: 0.25, ..Default::default() }, replace),
+ MarkKind::Background => {
+ add_background(doc, SELECTED, &Background { color: [0.1, 0.3, 0.7], replace_backdrop: true, ..Default::default() }, replace)
+ }
+ }
+}
+
+fn unchanged_after_later_page_failure(kind: MarkKind) {
+ // Replacement and addition share the same operation boundary; exercise replacement first.
+ for (replace, pending_edit) in [(true, false), (true, true), (false, false), (false, true)] {
+ let (mut doc, source) = marked_document();
+ if pending_edit {
+ let pending = doc.add(Object::String(pdfcraft_cos::PdfString::literal(b"unsaved caller edit".to_vec())));
+ doc.update_dict(page_list(&doc)[0].obj, |d| d.set(b"CallerEdit".to_vec(), Object::Ref(pending))).unwrap();
+ }
+ let modified = doc.is_modified();
+ let before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let objects = doc.object_numbers().len();
+ let mut allocation_probe = doc.clone();
+ let next_object = allocation_probe.add(Object::Null);
+ let failure = PlacementFailure::after_two_pages(kind);
+ let result = apply_replacement(&mut doc, kind, source, replace);
+ assert_eq!(result, Err(EditError::Invalid("injected mark placement failure".into())));
+ assert_eq!(failure.completed(), 2, "the error followed two real page placements");
+ assert_eq!(doc.object_numbers().len(), objects, "{kind:?}, replace={replace}: no allocated objects remain");
+ assert_eq!(doc.is_modified(), modified, "{kind:?}, replace={replace}: the dirty state is preserved");
+ assert!(write_incremental(&doc, &SaveOptions::default()).unwrap() == before, "{kind:?}, replace={replace}: every byte stays unchanged");
+ assert_eq!(doc.add(Object::Null), next_object, "the allocation cursor is unchanged too");
+ }
+}
+
+#[test]
+fn header_footer_changes_are_atomic_after_a_later_page_failure() {
+ unchanged_after_later_page_failure(MarkKind::HeaderFooter);
+}
+
+#[test]
+fn watermark_changes_are_atomic_after_a_later_page_failure() {
+ unchanged_after_later_page_failure(MarkKind::Watermark);
+}
+
+#[test]
+fn background_changes_are_atomic_after_a_later_page_failure() {
+ unchanged_after_later_page_failure(MarkKind::Background);
+}
+
+#[test]
+fn replacements_commit_all_selected_pages_and_preserve_other_marks_and_shared_resources() {
+ for kind in [MarkKind::HeaderFooter, MarkKind::Watermark, MarkKind::Background] {
+ let (mut doc, source) = marked_document();
+ let before = doc.clone();
+ let expected = match kind {
+ MarkKind::HeaderFooter => "(New header)".to_string(),
+ MarkKind::Watermark => format!("/PCPic{} Do", source.xobject.num),
+ MarkKind::Background => "0.1 0.3 0.7 rg".to_string(),
+ };
+ apply_replacement(&mut doc, kind, source, true).unwrap();
+ let doc = reopen(&doc);
+ assert_eq!(streams(&doc, 3), streams(&before, 3), "the unselected page keeps its content");
+ let unselected = page_list(&before)[3].obj;
+ assert_eq!(doc.get(unselected), before.get(unselected), "the unselected page keeps its resources and entries");
+ for reference in [ObjRef::new(6, 0), ObjRef::new(7, 0)] {
+ assert_eq!(
+ format!("{:?}", doc.get(reference)),
+ format!("{:?}", before.get(reference)),
+ "shared resources and original content stay unchanged"
+ );
+ }
+ for page in SELECTED {
+ let marks = mark_streams(&doc, *page, kind);
+ assert_eq!(marks.len(), 1, "one replacement on selected page {page}");
+ assert!(marks[0].contains(&expected), "the new mark is present: {}", marks[0]);
+ let old_page = &page_list(&before)[*page];
+ let new_page = &page_list(&doc)[*page];
+ let old_resources = before.resolve(old_page.dict.get(b"Resources").unwrap());
+ let new_resources = doc.resolve(new_page.dict.get(b"Resources").unwrap());
+ for category in [&b"Font"[..], &b"ExtGState"[..], &b"XObject"[..]] {
+ let old = before.resolve(old_resources.as_dict().unwrap().get(category).unwrap());
+ let new = doc.resolve(new_resources.as_dict().unwrap().get(category).unwrap());
+ for (name, value) in old.as_dict().unwrap().iter() {
+ assert_eq!(new.as_dict().unwrap().get(name), Some(value), "old resources remain usable on page {page}");
+ assert_eq!(doc.resolve(value), before.resolve(value), "referenced resource contents are unchanged on page {page}");
+ }
+ }
+ for other in [MarkKind::HeaderFooter, MarkKind::Watermark, MarkKind::Background] {
+ if other != kind {
+ assert_eq!(mark_streams(&doc, *page, other), mark_streams(&before, *page, other), "unrelated {other:?} on page {page}");
+ }
+ }
+ }
+ }
+}
diff --git a/crates/edit/src/place.rs b/crates/edit/src/place.rs
index 2f2c24c862..b535d60563 100644
--- a/crates/edit/src/place.rs
+++ b/crates/edit/src/place.rs
@@ -294,7 +294,32 @@ pub(crate) fn isolation(doc: &Document, list: &[Object]) -> Isolation {
/// Put a mark's content on a page: behind (with the behind-marks at the start) or on top
/// (appended, after wrapping the original content in q/Q).
pub(crate) fn place(doc: &mut Document, page: &pdfcraft_model::Page, kind: MarkKind, content: Vec, behind: bool) -> Result<(), EditError> {
- place_tagged(doc, page, kind.tag(), content, behind).map(drop)
+ place_tagged(doc, page, kind.tag(), content, behind)?;
+ #[cfg(test)]
+ fail_after_mark_placement(kind)?;
+ Ok(())
+}
+
+#[cfg(test)]
+thread_local! {
+ /// Force an error after N completed placements of one kind, on this test thread only.
+ pub(crate) static MARK_PLACEMENT_FAILURE: std::cell::Cell> = const { std::cell::Cell::new(None) };
+}
+
+#[cfg(test)]
+fn fail_after_mark_placement(kind: MarkKind) -> Result<(), EditError> {
+ MARK_PLACEMENT_FAILURE.with(|failure| {
+ if let Some((target, after, completed)) = failure.get()
+ && target == kind
+ {
+ let completed = completed.saturating_add(1);
+ failure.set(Some((target, after, completed)));
+ if completed == after {
+ return Err(EditError::Invalid("injected mark placement failure".into()));
+ }
+ }
+ Ok(())
+ })
}
/// Put content on a page, tagged `tag` (see [`place`]). On top, whatever graphics state the
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index d45e983a2e..a6eb76b62b 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -4,6 +4,9 @@ use pdfcraft_cos::{Document, SaveOptions, write_full, write_incremental};
use super::*;
+#[path = "mark_transaction_tests.rs"]
+mod mark_transactions;
+
/// Three pages: an upright page with content that leaves the graphics state changed (an
/// unbalanced `cm`), a page rotated 90° and one with inherited, shared resources.
fn fixture() -> Document {
@@ -3516,11 +3519,24 @@ fn image_page() -> Document {
image_page_with("q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET")
}
+/// Arrange, Crop and Remove crop as the engine asks for them, through [`images::change_image`].
+fn arrange(doc: &mut Document, page: usize, index: usize, order: images::ArrangeOrder) -> Result<(), EditError> {
+ images::change_image(doc, page, index, &images::ImageChange::Arrange(order))
+}
+
+fn crop(doc: &mut Document, page: usize, index: usize, keep: [f64; 4]) -> Result<(), EditError> {
+ images::change_image(doc, page, index, &images::ImageChange::Crop(keep))
+}
+
+fn remove_crop(doc: &mut Document, page: usize, index: usize) -> Result<(), EditError> {
+ images::change_image(doc, page, index, &images::ImageChange::RemoveCrop)
+}
+
fn image_page_with(content: &str) -> Document {
let objs: Vec = vec![
"<< /Type /Catalog /Pages 2 0 R >>".into(),
"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
- "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >>".into(),
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> /ExtGState << /GS0 << /Type /ExtGState /ca 0.5 /CA 0.5 >> /GSalpha << /Type /ExtGState /ca 0.6 >> /GSblend << /Type /ExtGState /BM /Multiply >> /GS_translucent << /Type /ExtGState /ca 0.5 >> >> >> >>".into(),
format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
"<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
@@ -3540,6 +3556,57 @@ fn image_page_with(content: &str) -> Document {
Document::open(Arc::new(out)).unwrap()
}
+fn stencil_page_with(content: &str) -> Document {
+ let objs: Vec = vec![
+ "<< /Type /Catalog /Pages 2 0 R >>".into(),
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >>"
+ .into(),
+ format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+ "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+ "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Filter /ASCIIHexDecode /Length 5 >>\nstream\n0000>\nendstream".into(),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offs = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offs.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+ }
+ let x = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offs {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+ Document::open(Arc::new(out)).unwrap()
+}
+
+fn form_page_with(content: &str) -> Document {
+ let form_content = "0 0 100 100 re f";
+ let objs: Vec = vec![
+ "<< /Type /Catalog /Pages 2 0 R >>".into(),
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Fm0 6 0 R >> >> >>"
+ .into(),
+ format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+ "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+ format!("<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >>\nstream\n{form_content}\nendstream", form_content.len()),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offs = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offs.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+ }
+ let x = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offs {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+ Document::open(Arc::new(out)).unwrap()
+}
+
/// A path segment operator before any `m` (or `re`) has no subpath to extend: the image scan used
/// to call `BezPath`'s `line_to`/`curve_to`/`close_path` on an empty path, which panics by contract,
/// taking `object_list`, `page_images` and the Office export's image walk down with it (#3581).
@@ -3728,6 +3795,880 @@ fn page_images_move_turn_replace_and_delete() {
assert!(images::change_image(&mut doc, 0, 0, &images::ImageChange::Delete).is_err());
}
+#[test]
+fn image_arrange_stacking_order_and_remove_crop() {
+ let content = "q 100 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET q 150 0 0 150 200 200 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ let initial_images = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial_images.len(), 2);
+ assert!(close(initial_images[0].rect, [100.0, 100.0, 200.0, 200.0]));
+ assert!(close(initial_images[1].rect, [200.0, 200.0, 350.0, 350.0]));
+
+ // Boundary case: image 0 is already at the back; SendToBack and SendBackward report an error.
+ assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).is_err());
+ assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendBackward).is_err());
+ let imgs = images::page_images(&doc, 0).unwrap();
+ assert_eq!(imgs.len(), 2);
+ assert!(close(imgs[0].rect, initial_images[0].rect));
+
+ // Bring forward image 0: moves it past the middle text, but it is still behind image 1.
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringForward).unwrap();
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ // Middle text should now precede image 0's Do in the content stream!
+ let text_pos = str_content.find("Middle Text").unwrap();
+ let first_do = str_content.find("/Im0 Do").unwrap();
+ assert!(text_pos < first_do, "text should now precede image 0");
+
+ // Bring to front on image 0: moves it past image 1 to the front!
+ let mut doc = doc;
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let imgs_after_front = images::page_images(&doc, 0).unwrap();
+ assert_eq!(imgs_after_front.len(), 2);
+ // In drawing order, the image that was at [100, 100, 200, 200] is now drawn LAST (index 1)!
+ assert!(close(imgs_after_front[0].rect, [200.0, 200.0, 350.0, 350.0]));
+ assert!(close(imgs_after_front[1].rect, [100.0, 100.0, 200.0, 200.0]));
+
+ // Send to back on the front image (index 1) restores it to the back.
+ let mut doc = doc;
+ arrange(&mut doc, 0, 1, images::ArrangeOrder::SendToBack).unwrap();
+ let imgs_after_back = images::page_images(&doc, 0).unwrap();
+ assert!(close(imgs_after_back[0].rect, [100.0, 100.0, 200.0, 200.0]));
+ assert!(close(imgs_after_back[1].rect, [200.0, 200.0, 350.0, 350.0]));
+
+ // Test remove crop
+ let cropped_content = "q 200 0 0 100 100 100 cm /Im0 Do Q";
+ let mut doc = image_page_with(cropped_content);
+ crop(&mut doc, 0, 0, [100.0, 100.0, 150.0, 150.0]).unwrap();
+ let img_before = &images::page_images(&doc, 0).unwrap()[0];
+ assert_ne!(img_before.visible_rect, Some(img_before.rect));
+ remove_crop(&mut doc, 0, 0).unwrap();
+ let doc = reopen(&doc);
+ let img_after = &images::page_images(&doc, 0).unwrap()[0];
+ assert_eq!(img_after.visible_rect, Some(img_after.rect));
+ // Removing crop again when there is no crop is refused.
+ let mut doc = doc;
+ assert!(remove_crop(&mut doc, 0, 0).is_err());
+
+ // Test crop
+ let uncropped_content = "q 200 0 0 100 100 100 cm /Im0 Do Q";
+ let mut doc = image_page_with(uncropped_content);
+ let img_before = &images::page_images(&doc, 0).unwrap()[0];
+ assert_eq!(img_before.visible_rect, Some(img_before.rect));
+ crop(&mut doc, 0, 0, [120.0, 110.0, 250.0, 180.0]).unwrap();
+ let doc = reopen(&doc);
+ let img_cropped = &images::page_images(&doc, 0).unwrap()[0];
+ assert!(close(img_cropped.visible_rect.unwrap(), [120.0, 110.0, 250.0, 180.0]));
+ // And remove_crop works on it:
+ let mut doc = doc;
+ remove_crop(&mut doc, 0, 0).unwrap();
+ let doc = reopen(&doc);
+ let img_restored = &images::page_images(&doc, 0).unwrap()[0];
+ assert_eq!(img_restored.visible_rect, Some(img_restored.rect));
+
+ // Test cropping an image that was moved (has an outer transform)
+ let mut doc = image_page_with("q 200 0 0 100 100 100 cm /Im0 Do Q");
+ let move_transform = [1.0, 0.0, 0.0, 1.0, 50.0, 40.0];
+ images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(move_transform)).unwrap();
+ let doc = reopen(&doc);
+ let img_moved = &images::page_images(&doc, 0).unwrap()[0];
+ assert_eq!(img_moved.rect, [150.0, 140.0, 350.0, 240.0]);
+ let mut doc = doc;
+ crop(&mut doc, 0, 0, [170.0, 150.0, 300.0, 220.0]).unwrap();
+ let doc = reopen(&doc);
+ let img_crop_moved = &images::page_images(&doc, 0).unwrap()[0];
+ assert!(img_crop_moved.visible_rect.is_some(), "cropped image must not be deleted");
+ assert!(close(img_crop_moved.visible_rect.unwrap(), [170.0, 150.0, 300.0, 220.0]));
+ // Adjust crop (re-crop)
+ let mut doc = doc;
+ crop(&mut doc, 0, 0, [180.0, 160.0, 280.0, 210.0]).unwrap();
+ let doc = reopen(&doc);
+ let img_recropped = &images::page_images(&doc, 0).unwrap()[0];
+ assert!(close(img_recropped.visible_rect.unwrap(), [180.0, 160.0, 280.0, 210.0]));
+ // Remove crop from moved image
+ let mut doc = doc;
+ remove_crop(&mut doc, 0, 0).unwrap();
+ let doc = reopen(&doc);
+ let img_restored_moved = &images::page_images(&doc, 0).unwrap()[0];
+ assert_eq!(img_restored_moved.visible_rect, Some(img_restored_moved.rect));
+}
+
+#[test]
+fn crop_rotated_image_preserves_angle_and_in_place_geometry() {
+ let content = "q 173.20508 100 -50 86.60254 100 100 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ let img_before = &images::page_images(&doc, 0).unwrap()[0];
+ let m_before = img_before.matrix;
+ assert!((m_before[1] - 100.0).abs() < 1e-3);
+ assert!((m_before[2] - (-50.0)).abs() < 1e-3);
+
+ crop(&mut doc, 0, 0, [140.0, 170.0, 180.0, 210.0]).unwrap();
+ let doc = reopen(&doc);
+ let img_cropped = &images::page_images(&doc, 0).unwrap()[0];
+
+ let m_after = img_cropped.matrix;
+ assert!((m_after[0] - m_before[0]).abs() < 1e-3);
+ assert!((m_after[1] - m_before[1]).abs() < 1e-3);
+ assert!((m_after[2] - m_before[2]).abs() < 1e-3);
+ assert!((m_after[3] - m_before[3]).abs() < 1e-3);
+ assert!((m_after[4] - m_before[4]).abs() < 1e-3);
+ assert!((m_after[5] - m_before[5]).abs() < 1e-3);
+
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ assert!(
+ (str_content.contains("re") || (str_content.contains("m\n") && str_content.contains("l\n"))) && str_content.contains("W\nn"),
+ "{str_content}"
+ );
+ assert!(str_content.contains("/Im0 Do"), "{str_content}");
+
+ let mut doc = doc;
+ remove_crop(&mut doc, 0, 0).unwrap();
+ let doc = reopen(&doc);
+ let img_restored = &images::page_images(&doc, 0).unwrap()[0];
+ assert_eq!(img_restored.matrix, m_before);
+}
+
+#[test]
+fn image_arrange_preserves_shared_group_drawings() {
+ let content = "q 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (End Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 2, "both images initially present in shared group");
+
+ // Bring image 0 to front: it must not delete image 1 that shares the same q...Q group!
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 2, "both images must be preserved after BringToFront");
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ assert!(str_content.contains("End Text"), "text in page must be preserved");
+}
+
+/// The marked-content sequence that `mcid` opens (`/MCID n >> BDC` … its `EMC`), as content text.
+fn marked_sequence(content: &str, mcid: u32) -> &str {
+ let tag = format!("/MCID {mcid}");
+ let start = content.find(&tag).unwrap_or_else(|| panic!("no {tag} in {content}"));
+ let end = content[start..].find("EMC").map(|e| start + e).unwrap_or_else(|| panic!("{tag} has no EMC in {content}"));
+ &content[start..end]
+}
+
+/// #3145: Arrange treated marked-content boundaries as if they weren't there, so Bring to Front put
+/// the image inside the text's `BDC`…`EMC` (tagged as the text) and left its own sequence empty.
+#[test]
+fn image_arrange_keeps_marked_content_sequences_whole() {
+ let content = "/P <> BDC q 100 0 0 100 50 50 cm /Im0 Do Q EMC /P <> BDC BT /F1 12 Tf 72 700 Td (Text) Tj ET EMC";
+ let mut doc = image_page_with(content);
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ let s = String::from_utf8_lossy(&bytes);
+ assert!(marked_sequence(&s, 0).contains("/Im0 Do"), "the image stays in its own sequence: {s}");
+ assert!(!marked_sequence(&s, 1).contains("/Im0 Do"), "the text's sequence holds no image: {s}");
+ assert!(marked_sequence(&s, 1).contains("(Text)"), "{s}");
+ assert!(s.find("/MCID 1").unwrap() < s.find("/MCID 0").unwrap(), "the image's sequence now comes after the text's: {s}");
+ assert_eq!(images::page_images(&doc, 0).unwrap().len(), 1);
+}
+
+/// A `BMC` sequence (here an artifact) moves as a whole too.
+#[test]
+fn image_arrange_moves_a_bmc_sequence_as_a_whole() {
+ let content = "/Artifact BMC q 100 0 0 100 50 50 cm /Im0 Do Q EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+ let mut doc = image_page_with(content);
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let s = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+ let (art, emc, body, img) = (s.find("/Artifact BMC").unwrap(), s.rfind("EMC").unwrap(), s.find("(Body)").unwrap(), s.find("/Im0 Do").unwrap());
+ assert!(body < art && art < img && img < emc, "text first, then the whole artifact sequence: {s}");
+}
+
+/// An image sharing a marked-content sequence with other content must not end up untagged.
+/// Either the arrange call is refused with Err, or every image paint remains inside a marked-content sequence.
+#[test]
+fn arrange_image_in_shared_tagged_block_refuses_or_keeps_tagged() {
+ let content =
+ "/Figure <> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Caption) Tj ET EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+ let mut doc = image_page_with(content);
+ let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+ match res {
+ Err(_) => {
+ // Refusing is the expected safe behavior when moving out of a shared tagged unit.
+ }
+ Ok(()) => {
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ let ops = pdfcraft_content::parse(&bytes).ops;
+ let mut mc_depth = 0usize;
+ for op in ops {
+ if op.is("BDC") || op.is("BMC") {
+ mc_depth += 1;
+ } else if op.is("EMC") {
+ mc_depth = mc_depth.saturating_sub(1);
+ } else if op.is("Do") {
+ assert!(mc_depth > 0, "every image paint must be inside a marked-content sequence: {}", String::from_utf8_lossy(&bytes));
+ }
+ }
+ }
+ }
+}
+
+/// An image that shares its marked-content sequence with other content cannot be rearranged
+/// without leaving the image untagged or duplicating MCIDs, so it is refused.
+#[test]
+fn image_arrange_splits_a_shared_marked_sequence_into_own_tag() {
+ let content =
+ "/Figure <> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Caption) Tj ET EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+ let mut doc = image_page_with(content);
+ assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).is_err());
+}
+
+/// Send backward also refuses to rearrange an image when it shares its sequence with other content.
+#[test]
+fn image_arrange_send_backward_splits_shared_marked_sequence() {
+ let content =
+ "BT /F1 12 Tf 72 700 Td (Header) Tj ET /Table <> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Cell) Tj ET EMC";
+ let mut doc = image_page_with(content);
+ assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendBackward).is_err());
+}
+
+#[test]
+fn arrange_preserves_color_leaking_out_of_marked_content() {
+ let content = "/Figure <> BDC 1 0 0 rg q 100 0 0 100 0 0 cm /Im0 Do Q EMC BT /F1 12 Tf 72 700 Td (Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+ if res.is_ok() {
+ let bytes = page_content_bytes(&doc, 0);
+ let s = String::from_utf8_lossy(&bytes);
+ let text_pos = s.find("(Text) Tj").unwrap();
+ assert!(s[..text_pos].contains("1 0 0 rg") || s[..text_pos].contains("1 0 0 RG"));
+ }
+}
+
+#[test]
+fn arrange_shared_tagged_does_not_duplicate_mcid() {
+ let content = "/Figure <> BDC q 100 0 0 100 0 0 cm /Im0 Do Q 0 0 m 10 10 l S EMC";
+ let mut doc = image_page_with(content);
+ assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).is_err());
+}
+
+#[test]
+fn image_crop_preserves_outer_cm_for_subsequent_drawings() {
+ let content = "100 0 0 100 50 50 cm /Im0 Do /Im0 Do";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 2);
+ assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+ assert_eq!(initial[1].rect, [50.0, 50.0, 150.0, 150.0]);
+
+ // Crop image 0
+ crop(&mut doc, 0, 0, [60.0, 60.0, 120.0, 120.0]).unwrap();
+ let doc = reopen(&doc);
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 2, "both images must remain");
+ // Image 0 is cropped:
+ assert!(close(after[0].visible_rect.unwrap(), [60.0, 60.0, 120.0, 120.0]));
+ // Crucial: Image 1 must still have its rect at [50, 50, 150, 150], proving outer cm was not destroyed!
+ assert_eq!(after[1].rect, [50.0, 50.0, 150.0, 150.0], "subsequent image must retain global cm");
+}
+
+#[test]
+fn image_arrange_preserves_position_under_active_ctm() {
+ let content = "100 0 0 100 50 50 cm /Im0 Do /Im0 Do";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 2);
+ assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+ assert_eq!(initial[1].rect, [50.0, 50.0, 150.0, 150.0]);
+
+ // Move first image to front: must not apply destination CTM twice!
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ // 1. Position: check order of operators in the content stream
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let first_do = str_content.find("/Im0 Do").unwrap();
+ let last_do = str_content.rfind("/Im0 Do").unwrap();
+ assert!(first_do < last_do, "Position: multiple image Do calls exist and order was updated");
+
+ // 2. Appearance: both images' positions and sizes are preserved
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 2);
+ assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: first image position preserved");
+ assert_eq!(after[1].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: second image position preserved");
+
+ // 3. Preservation: outer CTM is preserved
+ assert!(str_content.contains("100 0 0 100 50 50 cm"), "Preservation: initial CTM preserved");
+}
+
+#[test]
+fn image_arrange_preserves_shared_group_clipping_bounds() {
+ let content = "q 120 120 40 40 re W n 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 2);
+ assert_eq!(initial[0].rect, [100.0, 100.0, 200.0, 200.0]);
+ assert_eq!(initial[0].visible_rect, Some([120.0, 120.0, 160.0, 160.0]));
+ assert_eq!(initial[1].rect, [100.0, 100.0, 200.0, 200.0]);
+ assert_eq!(initial[1].visible_rect, Some([120.0, 120.0, 160.0, 160.0]));
+
+ // Bring image 0 to front: moves it past the external text while preserving clipping bounds
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ // 1. Position: moved image Do now follows External Text in AST
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let text_pos = str_content.find("External Text").unwrap();
+ let moved_do_pos = str_content.rfind("/Im0 Do").unwrap();
+ assert!(text_pos < moved_do_pos, "Position: moved image Do follows External Text");
+
+ // 2. Appearance: both images retain exact clipping bounds and geometry
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 2, "both images preserved");
+ assert_eq!(after[0].visible_rect, Some([120.0, 120.0, 160.0, 160.0]), "Appearance: image 0 retains clip");
+ assert_eq!(after[1].visible_rect, Some([120.0, 120.0, 160.0, 160.0]), "Appearance: image 1 retains clip");
+
+ // 3. Preservation: External Text and original group drawing preserved
+ assert!(str_content.contains("External Text"), "Preservation: external text preserved");
+ assert!(str_content.contains("120 120 40 40 re W n"), "Preservation: clipping path operators preserved");
+}
+
+#[test]
+fn image_arrange_preserves_extended_graphics_state_opacity() {
+ let content = "q /GS0 gs 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 1);
+ assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ // 1. Position: /Im0 Do moved past External Text
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let text_pos = str_content.find("External Text").unwrap();
+ let do_pos = str_content.rfind("/Im0 Do").unwrap();
+ assert!(text_pos < do_pos, "Position: /Im0 Do moved past External Text");
+
+ // 2. Appearance: /GS0 gs is retained and directly precedes /Im0 Do
+ let gs_pos = str_content.rfind("/GS0 gs").unwrap();
+ assert!(text_pos < gs_pos, "Appearance: /GS0 gs is in the new moved unit");
+ assert!(gs_pos < do_pos, "Appearance: /GS0 gs directly precedes /Im0 Do");
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1, "image preserved");
+ assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+ // 3. Preservation: External Text is preserved
+ assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: text preserved");
+}
+
+#[test]
+fn image_arrange_preserves_exact_non_rectangular_clipping_path() {
+ let content = "q 120 120 m 160 120 l 140 160 l h W* n 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 2);
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ // 1. Position: moved image follows External Text in AST
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let text_pos = str_content.find("External Text").unwrap();
+ let last_do = str_content.rfind("/Im0 Do").unwrap();
+ assert!(text_pos < last_do, "Position: moved image follows External Text");
+
+ // 2. Appearance: polygon geometry and even-odd rule are preserved
+ assert!(str_content.contains("W*"), "Appearance: even-odd W* fill rule preserved");
+ // The original group still clips the image left behind, so the moved copy must carry its own.
+ let flat = str_content.split_whitespace().collect::>().join(" ");
+ assert_eq!(flat.matches("120 120 m 160 120 l 140 160 l h W* n").count(), 2, "Appearance: exact polygon clip preserved in both units");
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 2, "both images preserved");
+ for image in &after {
+ assert!(image.contains([140.0, 130.0]), "Appearance: inside the triangle shows");
+ assert!(!image.contains([125.0, 155.0]), "Appearance: inside its box but outside the triangle stays clipped");
+ }
+
+ // 3. Preservation: External Text and remaining original group content preserved
+ assert!(str_content.contains("External Text"), "Preservation: external text preserved");
+}
+
+#[test]
+fn image_remove_crop_after_arrange_keeps_position_under_outer_transform() {
+ // Arrange writes `cm inverse`, the clip, then the absolute placement; Remove Crop used to drop
+ // only the first, which drew the image under the outer translation twice.
+ let content = "1 0 0 1 50 50 cm q 100 0 0 100 0 0 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ crop(&mut doc, 0, 0, [50.0, 50.0, 100.0, 100.0]).unwrap();
+ assert_eq!(images::page_images(&doc, 0).unwrap()[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let mut doc = reopen(&doc);
+ let moved = images::page_images(&doc, 0).unwrap();
+ assert_eq!(moved[0].rect, [50.0, 50.0, 150.0, 150.0]);
+ assert_eq!(moved[0].visible_rect, Some([50.0, 50.0, 100.0, 100.0]));
+
+ remove_crop(&mut doc, 0, 0).unwrap();
+ let doc = reopen(&doc);
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1);
+ assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "the image stays where it was");
+ assert_eq!(after[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]), "the crop is gone");
+}
+
+#[test]
+fn image_arrange_refuses_to_move_past_a_clip_it_is_not_under() {
+ // The text after the image is drawn under a top-level clip; moving the image after it would
+ // crop the image to that clip.
+ let content = "q 100 0 0 100 50 50 cm /Im0 Do Q 0 0 60 60 re W n BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let before = page_content_bytes(&doc, 0);
+ assert_eq!(images::page_images(&doc, 0).unwrap()[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]));
+
+ for order in [images::ArrangeOrder::BringToFront, images::ArrangeOrder::BringForward] {
+ let err = arrange(&mut doc, 0, 0, order).unwrap_err();
+ assert!(err.to_string().contains("clipping path"), "{err}");
+ }
+ assert_eq!(page_content_bytes(&doc, 0), before, "nothing changes");
+}
+
+#[test]
+fn image_arrange_send_to_back_keeps_a_shared_clip() {
+ // The image after the text is clipped by a top-level clip set before both; behind the text it
+ // is no longer under that clip, so the moved unit has to draw it itself.
+ let content = "BT /F1 12 Tf 72 700 Td (External Text) Tj ET 0 0 60 60 re W n q 100 0 0 100 50 50 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).unwrap();
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ assert!(str_content.rfind("/Im0 Do").unwrap() < str_content.find("External Text").unwrap(), "the image moved behind the text");
+ assert_eq!(images::page_images(&doc, 0).unwrap()[0].visible_rect, Some([50.0, 50.0, 60.0, 60.0]), "still cropped to the clip");
+}
+
+#[test]
+fn unwrapped_image_moves_successfully() {
+ let content = "100 0 0 100 50 50 cm /Im0 Do BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 1);
+ assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+ // Initial order: /Im0 Do precedes Middle Text
+ let initial_bytes = page_content_bytes(&doc, 0);
+ let initial_str = String::from_utf8_lossy(&initial_bytes);
+ let init_do = initial_str.find("/Im0 Do").unwrap();
+ let init_text = initial_str.find("Middle Text").unwrap();
+ assert!(init_do < init_text, "/Im0 Do initially precedes Middle Text");
+
+ // Move unwrapped image to front (past Middle Text)
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ // 1. Position: /Im0 Do now follows Middle Text in the content stream AST
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let after_text = str_content.find("Middle Text").unwrap();
+ let after_do = str_content.rfind("/Im0 Do").unwrap();
+ assert!(after_text < after_do, "Position: /Im0 Do actually moved after Middle Text");
+
+ // 2. Appearance: image rect and visibility are unchanged
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1);
+ assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: image coordinates preserved");
+ assert_eq!(after[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]));
+
+ // 3. Preservation: Middle Text and CTM remain intact
+ assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET"), "Preservation: text operation preserved");
+ assert!(str_content.contains("100 0 0 100 50 50 cm"), "Preservation: original cm preserved");
+}
+
+#[test]
+fn test_arrange_unwrapped_image_extraction() {
+ let content = b"100 0 0 100 100 100 cm /Im0 Do /Im1 Do";
+ let ops = pdfcraft_content::parse(content).ops;
+ let target = ops.iter().position(|op| op.is("Do") && op.name(0) == Some(b"Im0")).expect("target /Im0 not found");
+
+ // Scope start for unwrapped image matches target because content_units isolates Do
+ let scope_start = target;
+
+ // Accumulate effective CTM prior to the image operation
+ let mut initial_ctm = pdfcraft_content::Matrix::IDENTITY;
+ for op in &ops[..target] {
+ if op.is("cm")
+ && let Some(m) = op.nums::<6>()
+ {
+ initial_ctm = pdfcraft_content::Matrix(m).then(&initial_ctm);
+ }
+ }
+ assert_eq!(initial_ctm, pdfcraft_content::Matrix([100.0, 0.0, 0.0, 100.0, 100.0, 100.0]));
+
+ let extracted = images::extract_scope_state(&ops, scope_start, target, initial_ctm)
+ .expect("extraction must not return Err")
+ .expect("extraction must return Some rather than None");
+
+ assert_eq!(extracted.do_op.op.as_slice(), b"Do");
+ assert_eq!(extracted.do_op.name(0), Some(b"Im0".as_slice()));
+}
+
+#[test]
+fn arrange_unwrapped_image_in_mixed_scope_succeeds() {
+ // Content unit contains text and an unwrapped image; scope extraction of unit fails on BT,
+ // so it safely falls back to extracting target Do directly.
+ let content = "q BT /F1 12 Tf 72 700 Td (Preceding Text) Tj ET 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 12 Tf 72 500 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 1);
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let text_pos = str_content.find("External Text").unwrap();
+ let do_pos = str_content.rfind("/Im0 Do").unwrap();
+ assert!(text_pos < do_pos, "moved image follows External Text");
+
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1);
+ assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0]);
+}
+
+#[test]
+fn image_arrange_with_transformed_clipping_path_succeeds() {
+ // Nested graphics state: outer scope establishes a scaled clipping path (cm + path + W n),
+ // inner scope draws the image.
+ let content = "q 0.5 0 0 0.5 0 0 cm 100 100 m 300 100 l 300 300 l 100 300 l h W n q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let before = images::page_images(&doc, 0).unwrap();
+ assert_eq!(before.len(), 1);
+ assert!(before[0].visible_rect.is_some());
+ let rect_before = before[0].rect;
+ let clip_before = before[0].visible_rect;
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1);
+ assert_eq!(after[0].rect, rect_before);
+ assert_eq!(after[0].visible_rect, clip_before);
+
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let text_pos = str_content.find("External Text").unwrap();
+ let do_pos = str_content.rfind("/Im0 Do").unwrap();
+ assert!(text_pos < do_pos, "image moved after text: {str_content}");
+}
+
+#[test]
+fn inherited_source_opacity_is_preserved() {
+ // Outer q sets /GS0 gs; inner q draws /Im0 Do; outer Q restores state before External Text
+ let content = "q /GS0 gs q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 1);
+ assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+ // Initial order: /Im0 Do precedes External Text
+ let initial_bytes = page_content_bytes(&doc, 0);
+ let initial_str = String::from_utf8_lossy(&initial_bytes);
+ let init_do = initial_str.find("/Im0 Do").unwrap();
+ let init_text = initial_str.find("External Text").unwrap();
+ assert!(init_do < init_text, "/Im0 Do initially precedes External Text");
+
+ // Move image to front (past External Text, outside its original outer q...Q scope)
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ // 1. Position: /Im0 Do now follows External Text in the AST
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let after_text = str_content.find("External Text").unwrap();
+ let after_do = str_content.rfind("/Im0 Do").unwrap();
+ assert!(after_text < after_do, "Position: /Im0 Do moved past External Text");
+
+ // 2. Appearance: effective appearance state (/GS0 gs) is injected and precedes /Im0 Do in the new unit
+ let after_gs = str_content.rfind("/GS0 gs").unwrap();
+ assert!(after_text < after_gs, "Appearance: /GS0 gs injected into the new unit at destination");
+ assert!(after_gs < after_do, "Appearance: /GS0 gs directly precedes /Im0 Do in the moved unit");
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1);
+ assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+ // 3. Preservation: External Text and original outer scope structure are preserved
+ assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: external text preserved");
+}
+
+#[test]
+fn destination_opacity_pollution_is_prevented() {
+ // /Im0 Do is fully opaque at the start; destination has active top-level /GS_translucent gs
+ let content = "100 0 0 100 50 50 cm /Im0 Do /GS_translucent gs BT /F1 12 Tf 72 700 Td (Translucent Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial_bytes = page_content_bytes(&doc, 0);
+
+ // Attempting to move opaque image 0 to front into active transparency scope must safely bail out with Err
+ let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+ assert!(res.is_err(), "must return an explicit Err rather than silently corrupting opacity");
+ let err_msg = res.unwrap_err().to_string();
+ assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+ // Preservation: the document contents are completely unmodified
+ let doc = reopen(&doc);
+ let after_bytes = page_content_bytes(&doc, 0);
+ assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+#[test]
+fn sequential_gs_operators_merging_properties_are_preserved() {
+ // Sequential gs calls: /GSalpha sets ca=0.6, /GSblend sets BM=/Multiply (without touching ca).
+ let content = "q /GSalpha gs /GSblend gs q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 1);
+ assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+
+ // 1. Position: /Im0 Do now follows External Text in the AST
+ let bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&bytes);
+ let after_text = str_content.find("External Text").unwrap();
+ let after_do = str_content.rfind("/Im0 Do").unwrap();
+ assert!(after_text < after_do, "Position: /Im0 Do moved past External Text");
+
+ // 2. Appearance: Both merged state operators (/GSalpha and /GSblend) are preserved and precede /Im0 Do
+ let after_alpha = str_content.rfind("/GSalpha gs").unwrap();
+ let after_blend = str_content.rfind("/GSblend gs").unwrap();
+ assert!(after_text < after_alpha, "Appearance: /GSalpha gs injected into moved unit");
+ assert!(after_text < after_blend, "Appearance: /GSblend gs injected into moved unit");
+ assert!(after_alpha < after_do, "Appearance: /GSalpha gs precedes /Im0 Do");
+ assert!(after_blend < after_do, "Appearance: /GSblend gs precedes /Im0 Do");
+
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1);
+ assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+ // 3. Preservation: External Text is intact
+ assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: external text preserved");
+}
+
+#[test]
+fn destination_differing_blend_mode_pollution_is_prevented() {
+ // /Im0 Do has default Normal blend mode; destination has active top-level /GSblend gs (BM = /Multiply)
+ let content = "100 0 0 100 50 50 cm /Im0 Do /GSblend gs BT /F1 12 Tf 72 700 Td (Blended Section) Tj ET";
+ let mut doc = image_page_with(content);
+ let initial_bytes = page_content_bytes(&doc, 0);
+
+ // Attempting to move Normal-blend image to front into active Multiply-blend scope must safely bail out with Err
+ let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+ assert!(res.is_err(), "must return an explicit Err rather than silently altering blend mode");
+ let err_msg = res.unwrap_err().to_string();
+ assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+ // Preservation: document contents are completely unmodified
+ let doc = reopen(&doc);
+ let after_bytes = page_content_bytes(&doc, 0);
+ assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+fn nested_soft_mask_page(content: &str) -> Document {
+ let objs: Vec = vec![
+ "<< /Type /Catalog /Pages 2 0 R >>".into(),
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /GroupA 9 0 R /GroupB 10 0 R >> /ExtGState << /GSA 7 0 R /GSB 8 0 R >> >> >>".into(),
+ format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+ "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+ "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+ "<< /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 9 0 R >> >>".into(),
+ "<< /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 10 0 R >> >>".into(),
+ "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 100 50 re f\nendstream".into(),
+ "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 50 100 re f\nendstream".into(),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offs = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offs.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+ }
+ let x = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offs {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+ Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn nested_soft_masks_replay_in_correct_order_and_effective_mask_is_rendered() {
+ let content = "q /GSA gs q /GSB gs 100 0 0 100 0 0 cm /Im0 Do Q Q BT /F1 12 Tf 10 90 Td (External Text) Tj ET";
+ let mut doc = nested_soft_mask_page(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 1);
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+ let content_bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&content_bytes);
+
+ // 1. Assert emitted stream order: outer /GSA gs must precede inner /GSB gs, which precedes /Im0 Do
+ let after_text = str_content.find("External Text").unwrap();
+ let after_a = str_content.rfind("/GSA gs").unwrap();
+ let after_b = str_content.rfind("/GSB gs").unwrap();
+ let after_do = str_content.rfind("/Im0 Do").unwrap();
+ assert!(after_text < after_a, "Position: /GSA gs relocated past external text");
+ assert!(after_a < after_b, "Order: outer /GSA gs must be replayed before inner /GSB gs");
+ assert!(after_b < after_do, "Order: inner /GSB gs must immediately precede /Im0 Do");
+
+ // 2. The image survives saving and reopening.
+ assert_eq!(images::page_images(&reopen(&doc), 0).unwrap().len(), 1);
+
+ // 3. Rendered-pixel assertion: render output and verify Mask B (left 50x100) is effective, not Mask A (bottom 100x50)
+ let pdf_bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes), pdfcraft_render::RenderConfig::default());
+ let page =
+ renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+ let px = |x: u32, y: u32| {
+ let idx = ((y * page.width + x) * 4) as usize;
+ page.rgba[idx..idx + 4].to_vec()
+ };
+ // Left half (inside Mask B): image is rendered black
+ assert_eq!(px(25, 25), vec![0, 0, 0, 255], "point (25, 25) is inside Mask B: image rendered");
+ assert_eq!(px(25, 75), vec![0, 0, 0, 255], "point (25, 75) is inside Mask B: image rendered");
+ // Right half (outside Mask B): masked out to white page background
+ assert_eq!(px(75, 25), vec![255, 255, 255, 255], "point (75, 25) is outside Mask B: masked out to white");
+ assert_eq!(px(75, 75), vec![255, 255, 255, 255], "point (75, 75) is outside Mask B: masked out to white");
+}
+
+#[test]
+fn destination_differing_mask_pollution_is_prevented() {
+ // /Im0 Do has no mask; destination has active top-level /GSA gs (Mask A)
+ let content = "100 0 0 100 0 0 cm /Im0 Do /GSA gs BT /F1 12 Tf 10 90 Td (Masked Section) Tj ET";
+ let mut doc = nested_soft_mask_page(content);
+ let initial_bytes = page_content_bytes(&doc, 0);
+
+ let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+ assert!(res.is_err(), "must return an explicit Err rather than corrupting mask state");
+ let err_msg = res.unwrap_err().to_string();
+ assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+ // Preservation: document contents are completely unmodified
+ let doc = reopen(&doc);
+ let after_bytes = page_content_bytes(&doc, 0);
+ assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+fn soft_mask_with_alpha_page(content: &str) -> Document {
+ let objs: Vec = vec![
+ "<< /Type /Catalog /Pages 2 0 R >>".into(),
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /GroupA 9 0 R >> /ExtGState << /GSA 7 0 R >> >> >>".into(),
+ format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+ "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+ "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+ "<< /Type /ExtGState /ca 0.25 /SMask << /Type /Mask /S /Alpha /G 9 0 R >> >>".into(),
+ "<< /Type /ExtGState /SMask /None >>".into(),
+ "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 100 50 re f\nendstream".into(),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offs = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offs.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+ }
+ let x = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offs {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+ Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn non_identity_cm_before_gs_preserves_mask_coordinates_and_rendering() {
+ let content = "q 2 0 0 2 10 10 cm /GSA gs 50 0 0 50 0 0 cm /Im0 Do Q BT /F1 12 Tf 10 180 Td (External Text) Tj ET";
+ let mut doc = soft_mask_with_alpha_page(content);
+
+ // Initial state: image bounds are [10, 10, 110, 110]
+ let initial_images = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial_images.len(), 1);
+ assert!(close(initial_images[0].rect, [10.0, 10.0, 110.0, 110.0]));
+
+ // Render baseline before reordering
+ let pdf_bytes_before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let mut renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes_before), pdfcraft_render::RenderConfig::default());
+ let page_before = renderer_before.render(pdfcraft_render::RenderRequest {
+ page: 0,
+ kind: pdfcraft_render::RequestKind::Pixels,
+ scale: 1.0,
+ ..Default::default()
+ });
+ let px_before = |x: u32, y: u32| {
+ let idx = ((y * page_before.width + x) * 4) as usize;
+ page_before.rgba[idx..idx + 4].to_vec()
+ };
+
+ // Arrange image: BringToFront
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+ let content_bytes = page_content_bytes(&doc, 0);
+ let str_content = String::from_utf8_lossy(&content_bytes);
+
+ // 1. Assert AST reordering succeeds and interleaves cm before gs
+ let text_pos = str_content.find("External Text").unwrap();
+ let cm_mask_pos = str_content.rfind("2 0 0 2 10 10 cm").unwrap();
+ let gs_pos = str_content.rfind("/GSA gs").unwrap();
+ let cm_img_pos = str_content.rfind("50 0 0 50 0 0 cm").unwrap();
+ let do_pos = str_content.rfind("/Im0 Do").unwrap();
+
+ assert!(text_pos < cm_mask_pos, "Image relocated after external text");
+ assert!(cm_mask_pos < gs_pos, "CTM for soft mask established before /GSA gs");
+ assert!(gs_pos < cm_img_pos, "/GSA gs executed before image cm");
+ assert!(cm_img_pos < do_pos, "image cm executed before /Im0 Do");
+
+ // 2. Assert image bounds remain unchanged after saving and reopening
+ let reopened_doc = reopen(&doc);
+ let reopened_images = images::page_images(&reopened_doc, 0).unwrap();
+ assert_eq!(reopened_images.len(), 1);
+ assert!(close(reopened_images[0].rect, [10.0, 10.0, 110.0, 110.0]), "Image bounds preserved: {:?}", reopened_images[0].rect);
+
+ // 3. Render reopened document and assert non-overlapping pixels remain unchanged
+ let pdf_bytes_after = write_incremental(&reopened_doc, &SaveOptions::default()).unwrap();
+ let mut renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes_after), pdfcraft_render::RenderConfig::default());
+ let page_after = renderer_after.render(pdfcraft_render::RenderRequest {
+ page: 0,
+ kind: pdfcraft_render::RequestKind::Pixels,
+ scale: 1.0,
+ ..Default::default()
+ });
+ let px_after = |x: u32, y: u32| {
+ let idx = ((y * page_after.width + x) * 4) as usize;
+ page_after.rgba[idx..idx + 4].to_vec()
+ };
+
+ // A point inside the masked image (e.g. at x=50, inside the image and bottom half of mask)
+ // Non-overlapping with text (text is at y=180).
+ // The pixel renders at [191, 191, 191, 255] (25% black over 100% white).
+ // In raster coordinates, raster y for PDF y=50 in a 200-high page is y=150.
+ let rendered_pixel_before = px_before(50, 150);
+ let rendered_pixel_after = px_after(50, 150);
+ assert_eq!(rendered_pixel_before, vec![191, 191, 191, 255], "baseline pixel rendered with 25% opacity mask");
+ assert_eq!(rendered_pixel_after, rendered_pixel_before, "rendered non-overlapping pixels remain unchanged");
+
+ // Outside the image: pure white background
+ assert_eq!(px_after(5, 5), vec![255, 255, 255, 255]);
+ assert_eq!(px_after(5, 5), px_before(5, 5));
+}
+
#[test]
fn form_artwork_edits_only_the_selected_placement() {
let mut doc = fixture(); // three pages share resources; pages 0 and 1 also share contents
@@ -4179,6 +5120,56 @@ fn the_graphics_state_carries_over_between_content_streams() {
assert!(close(l.rect[0], 100.0) && close(l.size, 10.0), "{l:?}");
}
+fn two_stream_image_page(first: &str, second: &str) -> Document {
+ let objs: Vec = vec![
+ "<< /Type /Catalog /Pages 2 0 R >>".into(),
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents [4 0 R 5 0 R] /Resources << /Font << /F1 6 0 R >> /XObject << /Im0 7 0 R /Im1 7 0 R >> >> >>".into(),
+ format!("<< /Length {} >>\nstream\n{first}\nendstream", first.len()),
+ format!("<< /Length {} >>\nstream\n{second}\nendstream", second.len()),
+ "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+ "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\0\0\0\0\0\0\0\0\nendstream".into(),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offs = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offs.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+ }
+ let x = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offs {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+ Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn arrange_and_crop_image_in_second_content_stream_succeeds() {
+ let first = "q 100 0 0 100 50 50 cm /Im0 Do Q";
+ let second = "q 100 0 0 100 200 200 cm /Im1 Do Q";
+ let mut doc = two_stream_image_page(first, second);
+ let before = images::page_images(&doc, 0).unwrap();
+ assert_eq!(before.len(), 2);
+ assert_eq!(before[0].name, "Im0");
+ assert_eq!(before[1].name, "Im1");
+
+ // Arrange second image (located in the second content stream)
+ arrange(&mut doc, 0, 1, images::ArrangeOrder::SendToBack).unwrap();
+ let after_arrange = images::page_images(&reopen(&doc), 0).unwrap();
+ assert_eq!(after_arrange.len(), 2);
+
+ // Crop image in second stream
+ crop(&mut doc, 0, 0, [210.0, 210.0, 290.0, 290.0]).unwrap();
+ let after_crop = images::page_images(&reopen(&doc), 0).unwrap();
+ assert_eq!(after_crop.len(), 2);
+ assert_eq!(after_crop[0].name, "Im1");
+ assert!(close(after_crop[0].visible_rect.unwrap(), [210.0, 210.0, 290.0, 290.0]));
+ assert_eq!(after_crop[1].name, "Im0");
+ assert_eq!(after_crop[1].visible_rect, Some(after_crop[1].rect));
+}
+
/// One page whose font draws a few Hebrew letters (ToUnicode): A ב, B ד, C י, D ו, E ק, F ש,
/// G ל, H ם. Content streams draw Hebrew in visual order, so "בדיוק" is `(EDCBA)`.
fn hebrew_page(content: &str) -> Document {
@@ -4584,6 +5575,41 @@ fn reading_follows_form_xobjects() {
assert!(own[0].is_form && own[0].object == Some(pdfcraft_cos::ObjRef::new(6, 0)), "{own:?}");
}
+/// A page's `/XObject` and a form's `/Resources` are read wherever they are stored, and a form with
+/// none of its own, or with something else there, uses the ones it was drawn with (PDF 1.1 files).
+/// Each of these pages shows one line of text and one picture through one form.
+#[test]
+fn reading_follows_forms_however_their_resources_are_stored() {
+ let body = "BT /F1 12 Tf 72 700 Td (In the form) Tj ET q 20 0 0 10 5 5 cm /Im Do Q";
+ let (font, direct) = ("/Font << /F1 5 0 R >>", "/XObject << /Fm 6 0 R /Im 7 0 R >>");
+ for (page, form) in [
+ (format!("<< {font} {direct} >>"), ""),
+ (format!("<< {font} /XObject 9 0 R >>"), ""),
+ (format!("<< /Font 10 0 R {direct} >>"), ""),
+ (format!("<< {font} {direct} >>"), "/Resources 99 0 R"),
+ (format!("<< {font} {direct} >>"), "/Resources 12"),
+ ("<< /XObject << /Fm 6 0 R >> >>".to_string(), "/Resources 8 0 R"),
+ ("<< /XObject 9 0 R >>".to_string(), "/Resources << /Font << /F1 5 0 R >> /XObject 9 0 R >>"),
+ ] {
+ let doc = build(&[
+ "<< /Type /Catalog /Pages 2 0 R >>",
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+ &format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Resources {page} /Contents 4 0 R >>"),
+ &stream("", "/Fm Do"),
+ "<< /Type /Font /Subtype /Type1 /BaseFont /Courier >>",
+ &stream(&format!("/Type /XObject /Subtype /Form /BBox [0 0 600 800] {form}"), body),
+ &stream("/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", "A"),
+ "<< /Font << /F1 5 0 R >> /XObject 9 0 R >>",
+ "<< /Fm 6 0 R /Im 7 0 R >>",
+ "<< /F1 5 0 R >>",
+ ]);
+ let blocks = text::reading_blocks(&doc, 0).unwrap();
+ let texts: Vec<(&str, &str)> = blocks.iter().map(|b| (b.text.as_str(), b.base_font.as_str())).collect();
+ assert_eq!(texts, [("In the form", "Courier")], "{page} {form}");
+ assert_eq!(images::reading_images(&doc, 0).unwrap().len(), 1, "{page} {form}");
+ }
+}
+
/// A chain of forms, each drawing the next twenty times, twelve deep: within the depth cap but
/// 20^11 visits without a budget. Reading stops at the page's visit budget instead of hanging.
#[test]
@@ -7495,6 +8521,155 @@ fn reading_keeps_dotted_leader_entries_whole_and_in_order() {
);
}
+#[cfg(test)]
+mod proptests {
+ use super::*;
+ use proptest::prelude::*;
+
+ proptest! {
+
+ #[test]
+ fn prop_is_entire_page_wrapped_arbitrary_bytes(bytes in proptest::collection::vec(any::(), 0..2048)) {
+ let pieces = pdfcraft_content::Pieces::join(&[&bytes]);
+ let ops = pieces.parse().ops;
+ let _ = images::is_entire_page_wrapped(&ops);
+ }
+
+ #[test]
+ fn prop_content_units_arbitrary_bytes(
+ bytes in proptest::collection::vec(any::(), 0..2048),
+ start in 0usize..50,
+ end in 0usize..50,
+ ) {
+ let pieces = pdfcraft_content::Pieces::join(&[&bytes]);
+ let ops = pieces.parse().ops;
+ let scan_start = start.min(ops.len());
+ let scan_end = end.min(ops.len()).max(scan_start);
+ let units = images::content_units(&ops, scan_start, scan_end);
+ for u in units {
+ prop_assert!(u.start <= u.end);
+ prop_assert!(u.end <= ops.len());
+ }
+ }
+
+ #[test]
+ fn prop_arrange_image_arbitrary_malformed(
+ index in 0usize..10,
+ order_idx in 0u8..4,
+ bytes in proptest::collection::vec(any::(), 0..1024),
+ ) {
+ let order = match order_idx {
+ 0 => images::ArrangeOrder::BringToFront,
+ 1 => images::ArrangeOrder::SendToBack,
+ 2 => images::ArrangeOrder::BringForward,
+ _ => images::ArrangeOrder::SendBackward,
+ };
+ let mut doc = image_page_with(&String::from_utf8_lossy(&bytes));
+ let _ = arrange(&mut doc, 0, index, order);
+ }
+
+ #[test]
+ fn prop_crop_image_malformed_inputs(
+ x1 in -500.0f64..500.0,
+ y1 in -500.0f64..500.0,
+ x2 in -500.0f64..500.0,
+ y2 in -500.0f64..500.0,
+ bytes in proptest::collection::vec(any::(), 0..1024),
+ ) {
+ let mut doc = image_page_with(&String::from_utf8_lossy(&bytes));
+ let _ = crop(&mut doc, 0, 0, [x1, y1, x2, y2]);
+ let _ = remove_crop(&mut doc, 0, 0);
+ }
+ }
+}
+
+/// One 600×800 page: Im0 (4×2 gray image), Fm0 (200×100 Form), ExtGState GSone (ca 1).
+fn regression_page(content: &str) -> Document {
+ let form = "0 g 0 0 200 100 re f";
+ let objs: Vec = vec![
+ "<< /Type /Catalog /Pages 2 0 R >>".into(),
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /Fm0 7 0 R >> /ExtGState << /GSone << /Type /ExtGState /ca 1 >> >> >> >>".into(),
+ format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+ "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+ "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+ format!("<< /Type /XObject /Subtype /Form /BBox [0 0 200 100] /Length {} >>\nstream\n{form}\nendstream", form.len()),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offs = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offs.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+ }
+ let x = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offs {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+ Document::open(Arc::new(out)).unwrap()
+}
+
+fn regression_rects(doc: &Document) -> Vec<[i64; 4]> {
+ let mut v: Vec<[i64; 4]> = images::page_images(doc, 0).unwrap().iter().map(|i| i.rect.map(|x| x.round() as i64)).collect();
+ v.sort();
+ v
+}
+
+/// A `cm` inside a BDC…EMC unit applies to later content; arranging the unit must not shift anything.
+#[test]
+fn arrange_keeps_cm_leaking_out_of_marked_content() {
+ let mut doc = regression_page("/Figure <> BDC 1 0 0 1 50 50 cm q 100 0 0 100 0 0 cm /Im0 Do Q EMC q 10 0 0 10 200 200 cm /Im0 Do Q");
+ let before = regression_rects(&doc);
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ assert_eq!(before, regression_rects(&reopen(&doc)), "other content moved");
+}
+
+/// Cropping a Form XObject to 100×100 keeps a 100×100 visible area (or is refused) — never 1×1.
+#[test]
+fn crop_form_xobject_keeps_requested_area() {
+ let mut doc = regression_page("q 1 0 0 1 100 100 cm /Fm0 Do Q");
+ if crop(&mut doc, 0, 0, [100.0, 100.0, 200.0, 200.0]).is_err() {
+ return; // refusing to crop vector art is also acceptable
+ }
+ let after = images::page_images(&reopen(&doc), 0).unwrap()[0].clone();
+ let v = after.visible_rect.unwrap_or(after.rect);
+ assert!((v[2] - v[0] - 100.0).abs() < 1.0 && (v[3] - v[1] - 100.0).abs() < 1.0, "expected 100x100 visible, got {v:?}");
+}
+
+/// A gs naming a missing ExtGState must not be read as 50% opacity and block the reorder.
+#[test]
+fn arrange_tolerates_missing_extgstate() {
+ let mut doc = regression_page("q /GSmissing gs 100 0 0 100 50 50 cm /Im0 Do Q /GSone gs q 10 0 0 10 200 200 cm /Im0 Do Q");
+ let r = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+ assert!(r.is_ok(), "{r:?}");
+}
+
+/// Bring to front on the image already in front must not report a change it didn't make.
+#[test]
+fn noop_arrange_is_not_ok_without_change() {
+ let mut doc = regression_page("q 10 0 0 10 200 200 cm /Im0 Do Q q 100 0 0 100 50 50 cm /Im0 Do Q");
+ let before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let r = arrange(&mut doc, 0, 1, images::ArrangeOrder::BringToFront);
+ let after = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ assert!(r.is_err() || before != after, "Ok with no change");
+}
+
+/// Cropping a turned image keeps the requested upright box in user space, rather than expanding
+/// to the bounding box of the turned image coordinates.
+#[test]
+fn crop_turned_image_preserves_requested_area() {
+ let mut doc = regression_page("q 70.71 70.71 -70.71 70.71 300 100 cm /Im0 Do Q");
+ let req = [270.0, 150.0, 330.0, 200.0];
+ crop(&mut doc, 0, 0, req).expect("crop succeeds");
+ let after = &images::page_images(&reopen(&doc), 0).unwrap()[0];
+ let v = after.visible_rect.expect("visible rect exists");
+ assert!((v[0] - req[0]).abs() < 1.0, "x0: expected {}, got {}", req[0], v[0]);
+ assert!((v[1] - req[1]).abs() < 1.0, "y0: expected {}, got {}", req[1], v[1]);
+ assert!((v[2] - req[2]).abs() < 1.0, "x1: expected {}, got {}", req[2], v[2]);
+ assert!((v[3] - req[3]).abs() < 1.0, "y1: expected {}, got {}", req[3], v[3]);
+}
+
/// Text set larger than the widest page PDF allows (14 400 pt) panicked when its paragraph was given
/// a width: the width is clamped between the font size and 14 400 pt, and `f64::clamp` panics when
/// its minimum is the larger. The width is now capped at 14 400 pt whatever the font size: from the
@@ -7758,6 +8933,122 @@ fn a_flatten_refused_on_a_later_page_changes_nothing() {
assert_eq!((*doc.get(first)).clone(), before, "the first page keeps its comment and content");
}
+#[test]
+fn arrange_preserves_clip_leaked_out_of_marked_unit() {
+ let content = "/Figure <> BDC 0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q EMC q 10 0 0 10 400 400 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ let initial = images::page_images(&doc, 0).unwrap();
+ assert_eq!(initial.len(), 2);
+ assert!(initial[0].visible_rect.is_some());
+ assert!(initial[1].visible_rect.is_none(), "second image is fully clipped initially");
+
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 2);
+ let img1 = after.iter().find(|img| (img.rect[0] - 400.0).abs() < 1e-3).expect("second image exists");
+ assert!(img1.visible_rect.is_none(), "second image must stay clipped after BringToFront");
+
+ // Conflicting leaking transform with leaking clip must be refused
+ let content_cm_clip =
+ "/Figure <> BDC 2 0 0 2 0 0 cm 0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q EMC q 10 0 0 10 400 400 cm /Im0 Do Q";
+ let mut doc3 = image_page_with(content_cm_clip);
+ let res3 = arrange(&mut doc3, 0, 0, images::ArrangeOrder::BringToFront);
+ assert!(res3.is_err(), "moving marked unit with both leaking cm and leaking clip must be refused");
+}
+
+#[test]
+fn arrange_preserves_leaked_color_and_text_state() {
+ let content = "/Figure <> BDC /DeviceRGB cs 1 0 0 sc /F1 14 Tf 2 Tc q 10 0 0 10 50 50 cm /Im0 Do Q EMC 0 0 10 10 re f q 10 0 0 10 200 200 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ let s = String::from_utf8_lossy(&bytes);
+ assert!(s.contains("1 0 0 sc"), "sc must be preserved in content stream: {s}");
+ assert!(s.contains("/F1 14 Tf"), "Tf must be preserved in content stream: {s}");
+ assert!(s.contains("2 Tc"), "Tc must be preserved in content stream: {s}");
+
+ // Pixel test: 0 0 10 10 re f still fills red [255, 0, 0] after arrange
+ let pdf_bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes), pdfcraft_render::RenderConfig::default());
+ let page =
+ renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+ let idx = (((page.height - 5) * page.width + 5) * 4) as usize;
+ assert_eq!(page.rgba[idx..idx + 3], [255, 0, 0], "point (5, 5 from bottom) inside 10x10 rect fills red");
+}
+
+#[test]
+fn arrange_preserves_inherited_drawing_state_for_stencil_and_form() {
+ // 1. Stencil mask test:
+ // Page has: q 1 0 0 rg q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET
+ // Non-overlapping stencil and text.
+ let content = "q 1 0 0 rg q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET";
+ let mut doc = stencil_page_with(content);
+
+ // Render before move:
+ let pdf_before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let mut renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(pdf_before), pdfcraft_render::RenderConfig::default());
+ let page_before = renderer_before.render(pdfcraft_render::RenderRequest {
+ page: 0,
+ kind: pdfcraft_render::RequestKind::Pixels,
+ scale: 1.0,
+ ..Default::default()
+ });
+ let stencil_pixel_idx = (((page_before.height - 75) * page_before.width + 75) * 4) as usize;
+ assert_eq!(page_before.rgba[stencil_pixel_idx..stencil_pixel_idx + 3], [255, 0, 0], "stencil starts red");
+
+ // Bring to front
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+ // Save and reopen
+ let doc = reopen(&doc);
+
+ // Verify content stream has inherited color
+ let bytes = page_content_bytes(&doc, 0);
+ let s = String::from_utf8_lossy(&bytes);
+ assert!(s.contains("1 0 0 rg"), "inherited 1 0 0 rg must be replayed in moved unit: {s}");
+
+ // Render after reopen and verify stencil remains red:
+ let pdf_after = write_incremental(&doc, &SaveOptions::default()).unwrap();
+ let mut renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(pdf_after), pdfcraft_render::RenderConfig::default());
+ let page_after = renderer_after.render(pdfcraft_render::RenderRequest {
+ page: 0,
+ kind: pdfcraft_render::RequestKind::Pixels,
+ scale: 1.0,
+ ..Default::default()
+ });
+ assert_eq!(page_after.rgba[stencil_pixel_idx..stencil_pixel_idx + 3], [255, 0, 0], "stencil stays red after BringToFront and reopen");
+
+ // 2. Form XObject test:
+ // Page has: q 0 1 0 rg q 1 0 0 1 50 50 cm /Fm0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET
+ let form_content = "q 0 1 0 rg q 1 0 0 1 50 50 cm /Fm0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET";
+ let mut form_doc = form_page_with(form_content);
+
+ let form_pdf_before = write_incremental(&form_doc, &SaveOptions::default()).unwrap();
+ let mut form_renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(form_pdf_before), pdfcraft_render::RenderConfig::default());
+ let form_page_before = form_renderer_before.render(pdfcraft_render::RenderRequest {
+ page: 0,
+ kind: pdfcraft_render::RequestKind::Pixels,
+ scale: 1.0,
+ ..Default::default()
+ });
+ let form_pixel_idx = (((form_page_before.height - 75) * form_page_before.width + 75) * 4) as usize;
+ assert_eq!(form_page_before.rgba[form_pixel_idx..form_pixel_idx + 3], [0, 255, 0], "form starts green");
+
+ arrange(&mut form_doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let form_doc = reopen(&form_doc);
+
+ let form_pdf_after = write_incremental(&form_doc, &SaveOptions::default()).unwrap();
+ let mut form_renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(form_pdf_after), pdfcraft_render::RenderConfig::default());
+ let form_page_after = form_renderer_after.render(pdfcraft_render::RenderRequest {
+ page: 0,
+ kind: pdfcraft_render::RequestKind::Pixels,
+ scale: 1.0,
+ ..Default::default()
+ });
+ assert_eq!(form_page_after.rgba[form_pixel_idx..form_pixel_idx + 3], [0, 255, 0], "form stays green after BringToFront and reopen");
+}
/// Existing-row alignment is explicitly refused without mutating the paragraph.
#[test]
fn one_row_of_a_paragraph_takes_its_own_alignment_is_refused_without_changing_the_document() {
@@ -8500,6 +9791,120 @@ fn a_run_of_spaces_in_a_subset_without_a_space_glyph_keeps_its_width() {
assert_eq!(content.matches("[-330] TJ").count(), 5, "{content}");
}
+#[test]
+fn image_exclusive_scope_resets_path_on_scope_exit() {
+ // An earlier scope has a path operation closed by Q (with 'h' closepath).
+ // The subsequent image in its own scope must cleanly extract and allow crop removal.
+ let content = "q 0 0 m 10 10 l h Q q 200 0 0 100 100 100 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ crop(&mut doc, 0, 0, [100.0, 100.0, 250.0, 180.0]).unwrap();
+ let before = images::page_images(&doc, 0).unwrap();
+ assert_eq!(before.len(), 1);
+ remove_crop(&mut doc, 0, 0).unwrap();
+}
+
+#[test]
+fn content_units_does_not_swallow_subsequent_units_on_standalone_gs() {
+ // /GS0 gs followed by Q and subsequent images must isolate each Do unit properly
+ let content = "q /GS0 gs Q q 200 0 0 100 100 100 cm /Im0 Do Q q 10 0 0 10 300 300 cm /Im0 Do Q";
+ let pieces = pdfcraft_content::Pieces::join(&[content.as_bytes()]);
+ let ops = pieces.parse().ops;
+ let units = images::content_units(&ops, 0, ops.len());
+ assert_eq!(units.len(), 2);
+}
+
+#[test]
+fn different_inline_soft_masks_have_distinct_identities() {
+ let doc = Document::new_empty();
+ let mut dict1 = Dict::default();
+ let mut mask1 = Dict::default();
+ mask1.set(b"Type".to_vec(), Object::Name(b"Mask1".to_vec()));
+ dict1.set(b"SMask".to_vec(), Object::Dict(mask1));
+
+ let mut dict2 = Dict::default();
+ let mut mask2 = Dict::default();
+ mask2.set(b"Type".to_vec(), Object::Name(b"Mask2".to_vec()));
+ dict2.set(b"SMask".to_vec(), Object::Dict(mask2));
+
+ let mut state1 = images::EffectiveGState::default();
+ state1.merge_dict(&dict1, &doc, pdfcraft_content::Matrix::IDENTITY);
+
+ let mut state2 = images::EffectiveGState::default();
+ state2.merge_dict(&dict2, &doc, pdfcraft_content::Matrix::IDENTITY);
+
+ assert!(state1.visually_differs(&state2), "two different inline soft masks must visually differ");
+}
+
+#[test]
+fn is_entire_page_wrapped_with_nested_scopes() {
+ let wrapped = "q 1 0 0 1 0 0 cm q 0 0 10 10 re f Q 200 0 0 100 100 100 cm /Im0 Do Q";
+ let pieces = pdfcraft_content::Pieces::join(&[wrapped.as_bytes()]);
+ let ops = pieces.parse().ops;
+ assert!(images::is_entire_page_wrapped(&ops), "page wrapped in outer q...Q with inner nested q...Q is wrapped");
+
+ let unwrapped = "q 1 0 0 1 0 0 cm Q q 200 0 0 100 100 100 cm /Im0 Do Q";
+ let pieces2 = pdfcraft_content::Pieces::join(&[unwrapped.as_bytes()]);
+ let ops2 = pieces2.parse().ops;
+ assert!(!images::is_entire_page_wrapped(&ops2), "page with two separate top-level q...Q scopes is not wrapped");
+}
+
+#[test]
+fn hostile_page_with_many_gs_and_nested_q_does_not_hang_or_oom() {
+ use std::fmt::Write as _;
+ let mut stream = String::new();
+ for i in 0..10_000 {
+ let _ = write!(stream, "/G{i} gs ");
+ }
+ for _ in 0..500 {
+ stream.push_str("q ");
+ }
+ stream.push_str("100 0 0 100 0 0 cm /Im0 Do ");
+ for _ in 0..500 {
+ stream.push_str("Q ");
+ }
+ let doc = image_page_with(&stream);
+ let start = std::time::Instant::now();
+ let imgs = images::page_images(&doc, 0).unwrap();
+ assert_eq!(imgs.len(), 1);
+ assert!(start.elapsed().as_secs() < 5, "page_images on hostile 10k gs must finish in under 5s, took {:?}", start.elapsed());
+}
+
+#[test]
+fn crop_image_with_leading_cm_in_scope_places_clip_before_internal_cm() {
+ let content = "q 10 0 0 10 50 50 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ let before = images::page_images(&doc, 0).unwrap();
+ assert_eq!(before.len(), 1);
+ crop(&mut doc, 0, 0, [50.0, 50.0, 55.0, 55.0]).unwrap();
+ let doc = reopen(&doc);
+ let after = images::page_images(&doc, 0).unwrap();
+ assert_eq!(after.len(), 1);
+ assert!(after[0].visible_rect.is_some());
+ let (v0, v1, v2, v3) =
+ (after[0].visible_rect.unwrap()[0], after[0].visible_rect.unwrap()[1], after[0].visible_rect.unwrap()[2], after[0].visible_rect.unwrap()[3]);
+ assert!((v0 - 50.0).abs() < 1e-3 && (v2 - 55.0).abs() < 1e-3, "visible rect must match crop coordinates: {:?}", after[0].visible_rect);
+ assert!((v1 - 50.0).abs() < 1e-3 && (v3 - 55.0).abs() < 1e-3, "visible rect must match crop coordinates: {:?}", after[0].visible_rect);
+}
+
+#[test]
+fn remove_crop_preserves_cm_before_extgstate() {
+ let content = "q 2 0 0 2 0 0 cm /GS0 gs 0 0 100 100 re W n 10 0 0 10 50 50 cm /Im0 Do Q";
+ let mut doc = image_page_with(content);
+ let before = images::page_images(&doc, 0).unwrap();
+ assert_eq!(before.len(), 1);
+ crop(&mut doc, 0, 0, [100.0, 100.0, 110.0, 110.0]).unwrap();
+ remove_crop(&mut doc, 0, 0).unwrap();
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ let s = String::from_utf8_lossy(&bytes);
+ assert!(s.contains("W n"), "the author clipping path must remain: {s}");
+ assert!(!s.contains("PdfCraftImageCrop"), "the editor crop must be removed: {s}");
+ // Verify that the initial cm appears before /GS0 gs
+ let cm_pos = s.find("2 0 0 2 0 0 cm").expect("cm must be preserved");
+ let gs_pos = s.find("/GS0 gs").expect("gs must be preserved");
+ assert!(cm_pos < gs_pos, "cm must precede /GS0 gs so soft mask space is preserved: {s}");
+}
+
/// Inside a text object `q`/`Q` save and restore the text and text line matrices (ISO 32000-2
/// §9.4.1, as corrected by the PDF Association's errata, issue 368), as the renderer does: the
/// text after `Q` is found, and stays, where it is drawn.
@@ -8576,3 +9981,363 @@ fn styled_existing_justification_is_refused_instead_of_silently_left_aligning()
assert_eq!(page_content_bytes(&doc, 0), before);
assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
}
+
+#[test]
+fn image_arrange_refuses_crossed_scope_boundaries_without_changes() {
+ for content in ["/P <> BDC q 10 0 0 10 0 0 cm /Im0 Do EMC Q /Im0 Do", "q /P <> BDC /Im0 Do Q EMC /Im0 Do"] {
+ let mut doc = image_page_with(content);
+ let before = page_content_bytes(&doc, 0);
+ assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).is_err(), "{content}");
+ assert_eq!(page_content_bytes(&doc, 0), before);
+ }
+}
+
+#[test]
+fn removing_a_crop_preserves_author_clips_and_works_under_outer_clip() {
+ for content in ["0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q", "q 50 50 8 8 re W n 10 0 0 10 50 50 cm /Im0 Do Q"] {
+ let mut doc = image_page_with(content);
+ let original = images::page_images(&doc, 0).unwrap()[0].clone();
+ crop(&mut doc, 0, 0, [52.0, 52.0, 55.0, 55.0]).unwrap();
+ let mut doc = reopen(&doc);
+ remove_crop(&mut doc, 0, 0).unwrap();
+ let mut doc = reopen(&doc);
+ let restored = images::page_images(&doc, 0).unwrap()[0].clone();
+ assert_eq!(restored.rect, original.rect);
+ assert_eq!(restored.visible_rect, original.visible_rect);
+ assert_eq!(restored.contains([59.0, 59.0]), original.contains([59.0, 59.0]));
+ assert!(remove_crop(&mut doc, 0, 0).is_err());
+ }
+}
+
+#[test]
+fn remove_crop_refuses_an_unmarked_author_clip_without_changes() {
+ let mut doc = image_page_with("q 50 50 8 8 re W n 10 0 0 10 50 50 cm /Im0 Do Q");
+ let before = page_content_bytes(&doc, 0);
+ assert!(remove_crop(&mut doc, 0, 0).is_err());
+ assert_eq!(page_content_bytes(&doc, 0), before);
+}
+
+#[test]
+fn arrange_refuses_unrestorable_extended_print_state() {
+ let mut unexpectedly_moved = Vec::new();
+ for (key, value) in [
+ ("TR", Object::name("Identity")),
+ ("TR2", Object::name("Default")),
+ ("OP", Object::Bool(true)),
+ ("op", Object::Bool(true)),
+ ("OPM", Object::Int(1)),
+ ("BG", Object::name("Default")),
+ ("BG2", Object::name("Default")),
+ ("UCR", Object::name("Default")),
+ ("UCR2", Object::name("Default")),
+ ("HT", Object::name("Default")),
+ ] {
+ let mut doc = image_page_with("q 100 0 0 100 50 50 cm /Im0 Do Q /Print gs BT /F1 12 Tf 20 700 Td (Text) Tj ET");
+ let page = pdfcraft_model::pages(&doc)[0].clone();
+ let mut resources = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+ resources.set(
+ b"ExtGState".to_vec(),
+ Object::Dict(Dict::from_iter([(b"Print".to_vec(), Object::Dict(Dict::from_iter([(key.as_bytes().to_vec(), value)])))])),
+ );
+ doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+ let before = page_content_bytes(&doc, 0);
+ match arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront) {
+ Ok(()) => unexpectedly_moved.push(key),
+ Err(error) => {
+ assert!(error.to_string().contains("graphics state"), "{key}: {error}");
+ assert_eq!(page_content_bytes(&doc, 0), before, "{key} refusal changes nothing");
+ }
+ }
+ }
+ assert!(unexpectedly_moved.is_empty(), "unrestorable destination state was accepted: {unexpectedly_moved:?}");
+}
+
+#[test]
+fn arrange_keeps_implicit_device_spaces_before_sc_and_scn() {
+ for (select, color) in [("0 g", "0.5 sc"), ("0 0 0 rg", "1 0 0 sc"), ("0 0 0 1 k", "0 1 1 0 scn")] {
+ for stroke in [false, true] {
+ let (select, color) = if stroke { (select.to_uppercase(), color.to_uppercase()) } else { (select.into(), color.into()) };
+ for content in [
+ format!("q {select} {color} q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET"),
+ format!("q {select} q {color} 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET"),
+ ] {
+ let mut doc = stencil_page_with(&content);
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ let ops = pdfcraft_content::parse(&bytes).ops;
+ let do_index = ops.iter().rposition(|op| op.is("Do")).unwrap();
+ let start = ops[..do_index].iter().rposition(|op| op.is("q")).unwrap();
+ let relocated = &ops[start..do_index];
+ let selector = select.split_whitespace().last().unwrap();
+ let color_op = color.split_whitespace().last().unwrap();
+ let space_index = relocated.iter().position(|op| op.is(selector));
+ let color_index = relocated.iter().position(|op| op.is(color_op));
+ assert!(
+ space_index.is_some() && space_index < color_index,
+ "{select} must select its device space before {color}: {}",
+ String::from_utf8_lossy(&bytes)
+ );
+ }
+ }
+ }
+}
+
+#[test]
+fn arrange_restores_initial_rendering_intent_from_ri_and_gs() {
+ for selection in ["/Saturation ri", "/Print gs"] {
+ let mut doc = image_page_with(&format!("q 100 0 0 100 50 50 cm /Im0 Do Q {selection} BT /F1 12 Tf 20 700 Td (Text) Tj ET"));
+ let page = pdfcraft_model::pages(&doc)[0].clone();
+ let mut resources = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+ resources.set(
+ b"ExtGState".to_vec(),
+ Object::Dict(Dict::from_iter([(b"Print".to_vec(), Object::Dict(Dict::from_iter([(b"RI".to_vec(), Object::name("Saturation"))])))])),
+ );
+ doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let doc = reopen(&doc);
+ let bytes = page_content_bytes(&doc, 0);
+ assert!(
+ String::from_utf8_lossy(&bytes).contains("/RelativeColorimetric ri"),
+ "default rendering intent must be restored after {selection}: {}",
+ String::from_utf8_lossy(&bytes)
+ );
+ }
+}
+
+#[test]
+fn editor_crop_moves_with_repeated_group_translation() {
+ let mut doc = image_page();
+ let caption_rect = text::text_lines(&doc, 0).unwrap()[0].rect;
+ crop(&mut doc, 0, 0, [150.0, 120.0, 250.0, 170.0]).unwrap();
+ let start = images::page_images(&doc, 0).unwrap()[0].clone();
+ let mut count = 0;
+ for iteration in 0..20 {
+ images::translate_images(&mut doc, 0, &[0], [1.0, -2.0]).unwrap();
+ let ops = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops;
+ if iteration == 0 {
+ count = ops.len();
+ }
+ assert_eq!(ops.len(), count, "repeated moves fold the same transform");
+ }
+ let shifted = |r: [f64; 4]| [r[0] + 20.0, r[1] - 40.0, r[2] + 20.0, r[3] - 40.0];
+ let doc = reopen(&doc);
+ let after = &images::page_images(&doc, 0).unwrap()[0];
+ assert!(close(after.rect, shifted(start.rect)));
+ assert!(
+ close(after.visible_rect.unwrap(), shifted(start.visible_rect.unwrap())),
+ "the editor crop moves with its pixels: {:?}",
+ after.visible_rect
+ );
+ assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Caption");
+ assert_eq!(text::text_lines(&doc, 0).unwrap()[0].rect, caption_rect);
+}
+
+#[test]
+fn arranging_original_image_keeps_it_independent_of_added_items() {
+ for update in [false, true] {
+ let mut doc = image_page();
+ let caption_rect = text::text_lines(&doc, 0).unwrap()[0].rect;
+ add_content(
+ &mut doc,
+ 0,
+ &Content::Text(AddedText { rect: [20.0, 250.0, 250.0, 290.0], text: "Added caption".into(), ..AddedText::default() }),
+ )
+ .unwrap();
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let mut doc = reopen(&doc);
+ assert_eq!(list_added(&doc).len(), 1, "the added item stays editable");
+ if update {
+ update_content(
+ &mut doc,
+ 0,
+ 0,
+ &Content::Text(AddedText { rect: [20.0, 250.0, 250.0, 290.0], text: "Updated caption".into(), ..AddedText::default() }),
+ )
+ .unwrap();
+ } else {
+ delete_content(&mut doc, 0, 0).unwrap();
+ }
+ let doc = reopen(&doc);
+ assert_eq!(images::page_images(&doc, 0).unwrap().len(), 1, "editing/deleting an added item must preserve arranged original artwork");
+ assert_eq!(images::page_images(&doc, 0).unwrap()[0].rect, [100.0, 100.0, 300.0, 200.0]);
+ let text = text::text_lines(&doc, 0).unwrap().into_iter().map(|line| line.text).collect::>();
+ assert!(text.iter().any(|line| line == "Caption"), "the original caption survives");
+ assert_eq!(text.iter().any(|line| line == "Updated caption"), update);
+ assert_eq!(text::text_lines(&doc, 0).unwrap().iter().find(|line| line.text == "Caption").unwrap().rect, caption_rect);
+ }
+}
+
+#[test]
+fn arranging_nested_marked_image_refuses_without_losing_tags() {
+ for marked in ["/Figure <> BDC", "/Figure BMC"] {
+ let mut doc = image_page_with(&format!(
+ "q {marked} 100 0 0 100 50 50 cm /Im0 Do EMC BT /F1 12 Tf 20 700 Td (Text) Tj ET Q BT /F1 12 Tf 20 720 Td (Outside) Tj ET"
+ ));
+ let before = page_content_bytes(&doc, 0);
+ let error = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap_err();
+ assert!(error.to_string().contains("marked-content"), "{error}");
+ assert_eq!(page_content_bytes(&doc, 0), before);
+ assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
+ }
+}
+
+#[test]
+fn editor_crop_group_move_keeps_an_outer_author_clip_fixed() {
+ let mut doc = image_page_with("0 0 220 300 re W n q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 10 250 Td (Caption) Tj ET");
+ crop(&mut doc, 0, 0, [150.0, 120.0, 210.0, 170.0]).unwrap();
+ let mut operators = 0;
+ for i in 0..20 {
+ images::translate_images(&mut doc, 0, &[0], [1.0, -2.0]).unwrap();
+ let count = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops.len();
+ if i == 0 {
+ operators = count;
+ }
+ assert_eq!(count, operators, "moves under an inherited clip must fold their transform");
+ }
+ let doc = reopen(&doc);
+ let image = &images::page_images(&doc, 0).unwrap()[0];
+ assert!(close(image.rect, [120.0, 60.0, 320.0, 160.0]));
+ assert!(
+ close(image.visible_rect.unwrap(), [170.0, 80.0, 220.0, 130.0]),
+ "the editor crop moves but its author's outer clip stays fixed: {:?}",
+ image.visible_rect
+ );
+ let bytes = page_content_bytes(&doc, 0);
+ assert!(String::from_utf8_lossy(&bytes).starts_with("0 0 220 300 re W n"));
+ assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Caption");
+}
+
+fn review_state_raster(doc: &Document) -> Vec {
+ let bytes = write_full(doc, &SaveOptions::default()).unwrap();
+ let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(bytes), Default::default());
+ renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() }).rgba.to_vec()
+}
+
+#[test]
+fn review_arrange_form_keeps_inherited_text_spacing() {
+ for (spacing, later_spacing) in [(0, false), (12, false), (0, true)] {
+ let initial = if later_spacing { String::new() } else { format!("BT {spacing} Tc ET") };
+ let later = if later_spacing { "BT 12 Tc ET" } else { "" };
+ let content = format!("q {initial} q 1 0 0 1 20 20 cm /Fm0 Do Q Q {later} q 0 0 1 rg 200 200 5 5 re f Q");
+ let mut doc = form_page_with(&content);
+ let form = pdfcraft_cos::ObjRef::new(6, 0);
+ let dict = doc.get(form).as_dict().unwrap().clone();
+ doc.set(form, Object::Stream(pdfcraft_cos::Stream::from_raw(dict, b"BT /F1 20 Tf 0 15 Td (ABC) Tj ET".to_vec())));
+ let doc_before = reopen(&doc);
+ let before = review_state_raster(&doc_before);
+ assert!(before.as_chunks::<4>().0.iter().any(|p| p[0] == 0 && p[1] == 0 && p[2] == 0), "the Form actually paints text");
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ let saved = reopen(&doc);
+ assert_eq!(images::page_images(&saved, 0).unwrap()[0].rect, images::page_images(&doc_before, 0).unwrap()[0].rect);
+ assert_eq!(review_state_raster(&saved), before, "inherited {spacing} Tc must survive arranging the Form and reopening");
+ }
+}
+
+fn review_shared_mask_page(states: &str, luminosity_b: bool, mask_paint: &str) -> Document {
+ let content = format!("q {states} q 100 0 0 100 20 20 cm /Im0 Do Q Q q 0 0 1 rg 200 200 5 5 re f Q");
+ let stream = format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len());
+ let subtype = if luminosity_b { "Luminosity" } else { "Alpha" };
+ let mask_b = format!("<< /Type /ExtGState /SMask << /S /{subtype} /G 8 0 R >> >>");
+ let group = format!(
+ "<< /Type /XObject /Subtype /Form /BBox [0 0 300 300] /Group << /S /Transparency /I true /CS /DeviceGray >> /Length {} >>\nstream\n{mask_paint}\nendstream",
+ mask_paint.len()
+ );
+ build(&[
+ "<< /Type /Catalog /Pages 2 0 R >>",
+ "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+ "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> /ExtGState << /A 6 0 R /B 7 0 R >> >> >>",
+ &stream,
+ "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\0\0\0\0\nendstream",
+ "<< /Type /ExtGState /SMask << /S /Alpha /G 8 0 R >> >>",
+ &mask_b,
+ &group,
+ ])
+}
+
+#[test]
+fn review_repeated_gs_keeps_alpha_vs_luminosity_mask_chronology() {
+ for states in ["/A gs", "/A gs /B gs", "/A gs /B gs /A gs"] {
+ let mut doc = review_shared_mask_page(states, true, "0.25 g 0 0 300 300 re f");
+ let before = review_state_raster(&reopen(&doc));
+ assert!(before.as_chunks::<4>().0.iter().any(|p| p[0] == p[1] && p[1] == p[2] && p[0] < 230), "the masked image is visible");
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ assert_eq!(review_state_raster(&reopen(&doc)), before, "mask application order must survive: {states}");
+ }
+}
+
+#[test]
+fn review_repeated_gs_keeps_last_mask_establishment_ctm() {
+ for states in [
+ "1 0 0 1 50 0 cm /A gs 1 0 0 1 -50 0 cm",
+ "/A gs 1 0 0 1 50 0 cm /B gs 1 0 0 1 -50 0 cm",
+ "/A gs 1 0 0 1 50 0 cm /B gs 1 0 0 1 -50 0 cm /A gs",
+ ] {
+ let mut doc = review_shared_mask_page(states, false, "0.25 g 0 0 60 300 re f");
+ let before = review_state_raster(&reopen(&doc));
+ arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ assert_eq!(review_state_raster(&reopen(&doc)), before, "mask CTM must survive: {states}");
+ }
+}
+
+#[test]
+fn review_soft_masks_sharing_a_group_keep_distinct_configurations() {
+ let doc = Document::new_empty();
+ let mask = |subtype: &str| {
+ Dict::from_iter([(
+ b"SMask".to_vec(),
+ Object::Dict(Dict::from_iter([(b"S".to_vec(), Object::name(subtype)), (b"G".to_vec(), Object::Ref(pdfcraft_cos::ObjRef::new(8, 0)))])),
+ )])
+ };
+ let mut alpha = images::EffectiveGState::default();
+ let mut luminosity = images::EffectiveGState::default();
+ alpha.merge_dict(&mask("Alpha"), &doc, pdfcraft_content::Matrix::IDENTITY);
+ luminosity.merge_dict(&mask("Luminosity"), &doc, pdfcraft_content::Matrix::IDENTITY);
+ assert!(alpha.visually_differs(&luminosity), "a shared group does not make Alpha and Luminosity the same mask");
+ for (key, value) in [
+ (b"BC".to_vec(), Object::Array(vec![Object::Real(0.5)])),
+ (
+ b"TR".to_vec(),
+ Object::Dict(Dict::from_iter([
+ (b"FunctionType".to_vec(), Object::Int(2)),
+ (b"Domain".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(1)])),
+ (b"N".to_vec(), Object::Int(2)),
+ ])),
+ ),
+ ] {
+ let mut changed = mask("Luminosity");
+ let Object::Dict(definition) = changed.get_mut(b"SMask").unwrap() else { panic!("mask dictionary") };
+ definition.set(key, value);
+ let mut state = images::EffectiveGState::default();
+ state.merge_dict(&changed, &doc, pdfcraft_content::Matrix::IDENTITY);
+ assert!(state.visually_differs(&luminosity), "mask backdrop and transfer function belong to its definition");
+ }
+}
+
+#[test]
+fn review_inside_scope_group_move_matches_direct_transform_under_outer_scale() {
+ for scale in [1, 2] {
+ let content = format!("{scale} 0 0 {scale} 0 0 cm q 40 0 0 40 10 10 cm /Im0 Do Q q 0 0 1 rg 75 75 5 5 re f Q");
+ let mut cropped = image_page_with(&content);
+ let keep = if scale == 2 { [30.0, 30.0, 70.0, 70.0] } else { [15.0, 15.0, 35.0, 35.0] };
+ crop(&mut cropped, 0, 0, keep).unwrap();
+ arrange(&mut cropped, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+ for offset in [[10.0, 0.0], [0.0, 10.0], [-10.0, 3.0]] {
+ let mut grouped = reopen(&cropped);
+ let mut direct = reopen(&cropped);
+ let before = images::page_images(&grouped, 0).unwrap()[0].clone();
+ images::translate_images(&mut grouped, 0, &[0], offset).unwrap();
+ images::change_image(&mut direct, 0, 0, &images::ImageChange::Transform([1.0, 0.0, 0.0, 1.0, offset[0], offset[1]])).unwrap();
+ let moved = |r: [f64; 4]| [r[0] + offset[0], r[1] + offset[1], r[2] + offset[0], r[3] + offset[1]];
+ let saved = reopen(&grouped);
+ let image = &images::page_images(&saved, 0).unwrap()[0];
+ assert!(close(image.rect, moved(before.rect)), "scale {scale} offset {offset:?}: {:?}", image.rect);
+ assert!(close(image.visible_rect.unwrap(), moved(before.visible_rect.unwrap())), "the crop follows the complete displacement");
+ assert_eq!(
+ review_state_raster(&saved),
+ review_state_raster(&reopen(&direct)),
+ "group and direct transforms must agree, preserving other artwork"
+ );
+ }
+ }
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 98824c7694..0fb00324b6 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -24,6 +24,7 @@ use crate::EditError;
mod regions;
#[path = "text_session.rs"]
mod session;
+pub use fallback::strip_subset_tag;
use regions::{alignment_frame, group_blocks, is_centred, rewrite_styled_block};
pub use session::TextSession;
@@ -47,13 +48,13 @@ pub use editor::{TextEditLayout, TextEditorFont, register_text_font, text_edit_l
pub(crate) use fallback::SOURCE_SPACE_CALLS;
use fallback::{
MAX_TYPE3_GLYPHS, Type3Glyph, fallback_face, needs_type3, no_fallback_font, no_glyph_for, same_base_font, same_font, source_encodes,
- source_family, source_program, source_show, source_space, source_width, strip_subset_tag, type3_faces, type3_glyph, write_type3_glyphs,
+ source_family, source_program, source_show, source_space, source_width, type3_faces, type3_glyph, write_type3_glyphs,
};
#[cfg(test)]
use fallback::{add_type3_font, is_type3_fallback};
use interp::{Origin, Paint, union};
use lines::page_dict;
-pub(crate) use lines::{FormBudget, content_streams, content_streams_within, form_call, rewritten_contents, splice};
+pub(crate) use lines::{FormBudget, content_streams, content_streams_within, dict_in_place, form_call, resource_dict, rewritten_contents, splice};
pub use lines::{MAX_FORM_DEPTH, MAX_FORM_VISITS, glyph_text_lines, text_lines};
pub use rewrite::{LineEdit, replace_line, rewrite_block};
use rewrite::{coincident_ops, rewrite_block_from};
diff --git a/crates/edit/src/text/fallback.rs b/crates/edit/src/text/fallback.rs
index b8f45a221f..78f9014a20 100644
--- a/crates/edit/src/text/fallback.rs
+++ b/crates/edit/src/text/fallback.rs
@@ -163,7 +163,7 @@ pub(crate) fn same_base_font(a: &str, b: &str) -> bool {
}
/// `ABCDEF+Arial` → `Arial`. A name without a subset tag is returned unchanged.
-pub(crate) fn strip_subset_tag(name: &str) -> &str {
+pub fn strip_subset_tag(name: &str) -> &str {
let bytes = name.as_bytes();
let is_tag = bytes.get(6) == Some(&b'+') && bytes.get(..6).is_some_and(|tag| tag.iter().all(u8::is_ascii_uppercase));
if is_tag { name.get(7..).unwrap_or(name) } else { name }
diff --git a/crates/edit/src/text/interp.rs b/crates/edit/src/text/interp.rs
index 2b55e51ef8..2a9f6da61a 100644
--- a/crates/edit/src/text/interp.rs
+++ b/crates/edit/src/text/interp.rs
@@ -773,8 +773,9 @@ pub(super) fn interpret(
// `Some(properties)`: read `/ActualText`, looking named property lists up in `properties`.
logical_text: Option<&Dict>,
) -> Result, EditError> {
- let fonts_res = resources.get(b"Font").map(|f| doc.resolve(f)).and_then(|f| f.as_dict().cloned()).unwrap_or_default();
- let states = resources.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
+ let (mut held_fonts, mut held_states, none) = (None, None, Dict::new());
+ let fonts_res = super::resource_dict(doc, resources, b"Font", &mut held_fonts).unwrap_or(&none);
+ let states = super::resource_dict(doc, resources, b"ExtGState", &mut held_states).unwrap_or(&none);
let mut out: Vec = Vec::new();
let mut ts = carry.ts.clone();
let mut at_bt = (0usize, ts.clone());
@@ -881,8 +882,12 @@ pub(super) fn interpret(
if let Some(name) = op.name(0) {
select_gs(&mut ts.ext_gstate, name);
}
- let params = op.name(0).and_then(|name| states.get(name)).map(|p| doc.resolve(p));
- if let Some(params) = params.as_deref().and_then(Object::as_dict) {
+ let mut held = None;
+ let params = match op.name(0).and_then(|name| states.get(name)) {
+ Some(p) => super::dict_in_place(doc, p, &mut held),
+ None => None,
+ };
+ if let Some(params) = params {
ts.gs.apply(doc, params);
// `/LW` sets the line width as `w` does (ISO 32000-2 §8.4.5).
let lw = params.get(b"LW").and_then(|w| doc.resolve(w).as_f64()).filter(|w| w.is_finite());
diff --git a/crates/edit/src/text/lines.rs b/crates/edit/src/text/lines.rs
index f811f34ea6..85209a5472 100644
--- a/crates/edit/src/text/lines.rs
+++ b/crates/edit/src/text/lines.rs
@@ -1,3 +1,5 @@
+use std::sync::Arc;
+
use super::fallback::{same_font, same_paint};
use super::interp::{Carry, Origin, Pen, Shown, TextState, Ts, direction, interpret, to_frame, union};
use super::{DecodeBudget, Dict, Document, EditError, HashMap, Matrix, Object, Op, Pieces, Stream, TextLine, parse, serialize_ops};
@@ -452,10 +454,41 @@ impl FormBudget {
pub(crate) struct FormCall {
pub(crate) obj: Option,
pub(crate) data: Vec,
- pub(crate) resources: Dict,
+ /// The form, and its `/Resources` when they are an object of their own, which is what
+ /// [`FormCall::resources`] reads.
+ form: Arc,
+ own: Option>,
pub(crate) ctm: Matrix,
}
+impl FormCall {
+ /// The resources its content is read with: its own, or if it has none, `drawn_with`, the ones
+ /// it was drawn with (PDF 1.1 files). Read in place, as a page can draw a form thousands of times:
+ /// a copy for each took time in the square of them.
+ pub(crate) fn resources<'a>(&'a self, drawn_with: &'a Dict) -> &'a Dict {
+ let direct = || match &*self.form {
+ Object::Stream(s) => s.dict.get(b"Resources").and_then(Object::as_dict),
+ _ => None,
+ };
+ self.own.as_deref().and_then(Object::as_dict).or_else(direct).unwrap_or(drawn_with)
+ }
+}
+
+/// `o` as a dictionary, read in place for the same reason as [`FormCall::resources`]. `held` keeps it
+/// when it is an object of its own. Nothing else is one, and [`Document::resolve`] would copy it.
+pub(crate) fn dict_in_place<'a>(doc: &Document, o: &'a Object, held: &'a mut Option>) -> Option<&'a Dict> {
+ match o {
+ Object::Dict(dict) => Some(dict),
+ Object::Ref(_) => held.insert(doc.resolve(o)).as_dict(),
+ _ => None,
+ }
+}
+
+/// The dictionary at `key` of `resources`, `/XObject` or `/Font`, say, as each form reads these.
+pub(crate) fn resource_dict<'a>(doc: &Document, resources: &'a Dict, key: &[u8], held: &'a mut Option>) -> Option<&'a Dict> {
+ dict_in_place(doc, resources.get(key)?, held)
+}
+
/// The form XObject `name` in `resources`, drawn with `ctm`. `None` for images, missing names
/// and forms already being read (`path`), and for forms nested too deep or past the page's
/// budget, which `budget` records as truncated; each form entered counts one visit.
@@ -472,13 +505,15 @@ pub(crate) fn form_call(
if limited && budget.truncated {
return None;
}
- let xobjects = resources.get(b"XObject").map(|x| doc.resolve(x)).and_then(|x| x.as_dict().cloned())?;
- let o = xobjects.get(name)?;
- let obj = o.as_ref();
+ let mut held = None;
+ let o = resource_dict(doc, resources, b"XObject", &mut held)?.get(name)?;
+ // Only a reference can name a stream, so nothing else needs reading, or copying.
+ let obj = Some(o.as_ref()?);
if obj.is_some_and(|r| path.contains(&r)) {
return None;
}
- let Object::Stream(s) = &*doc.resolve(o) else { return None };
+ let form = doc.resolve(o);
+ let Object::Stream(s) = &*form else { return None };
if s.dict.name(b"Subtype") != Some(b"Form") {
return None;
}
@@ -492,8 +527,7 @@ pub(crate) fn form_call(
let v: Vec = a.iter().filter_map(|x| doc.resolve(x).as_f64()).collect();
<[f64; 6]>::try_from(v).ok().filter(|v| v.iter().all(|x| x.is_finite()))
});
- // A form without its own resources uses the ones it was drawn with (PDF 1.1 files).
- let own = s.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned());
+ let own = s.dict.get(b"Resources").filter(|r| matches!(r, Object::Ref(_))).map(|r| doc.resolve(r));
let data = match budget.decode.decode(s) {
Ok(data) => data,
Err(_) if budget.decode.remaining() == 0 => {
@@ -503,7 +537,7 @@ pub(crate) fn form_call(
Err(_) => Vec::new(),
};
budget.visits = budget.visits.saturating_add(1);
- Some(FormCall { obj, data, resources: own.unwrap_or_else(|| resources.clone()), ctm: m.map_or(ctm, |m| Matrix(m).then(&ctm)) })
+ Some(FormCall { obj, data, form, own, ctm: m.map_or(ctm, |m| Matrix(m).then(&ctm)) })
}
/// The lines a page shows as it reads, including text drawn by form XObjects (which
@@ -522,8 +556,9 @@ pub(super) fn reading_lines(doc: &Document, page: usize) -> Result<(Vec usize) -> Result<(), EditError> {
let mut cache = HashMap::new();
let mut invoked = Vec::new();
- let properties = resources.get(b"Properties").and_then(|o| w.doc.dict(o)).unwrap_or_default();
- let shown = interpret(w.doc, ops, resources, &mut cache, carry, Some(&mut invoked), Some(&properties))?;
+ let (mut held, none) = (None, Dict::new());
+ let properties = resource_dict(w.doc, resources, b"Properties", &mut held).unwrap_or(&none);
+ let shown = interpret(w.doc, ops, resources, &mut cache, carry, Some(&mut invoked), Some(properties))?;
let mut last = None;
let mut last_stream = None;
let mut forms = invoked.into_iter().peekable();
@@ -556,7 +591,7 @@ pub(super) fn reading_lines(doc: &Document, page: usize) -> Result<(Vec,
}
+/// What an action's log says of the images a Reduce File Size step left, if there are any.
+fn images_refused_note(images: usize) -> Option {
+ (images > 0).then(|| format!("Reduce file size: {images} image(s) stayed as they were, past what one run may decode"))
+}
+
fn apply_step(s: &mut Session, id: DocId, step: &Step, log: &mut Vec) -> Result, EditError> {
let pages = s.get(id).map_or(0, |d| d.info.pages.len());
let all: Vec = (0..pages).collect();
@@ -156,9 +161,10 @@ fn apply_step(s: &mut Session, id: DocId, step: &Step, log: &mut Vec) ->
return Ok(None);
}
Step::ReduceFileSize => {
- let (bytes, _) = s.optimized_bytes(id, &crate::optimize::Settings::default(), &[])?;
+ let (bytes, report) = s.optimized_bytes(id, &crate::optimize::Settings::default(), &[])?;
let before = s.get(id).map_or(0, |d| d.bytes.len());
log.push(format!("Reduce file size: {} → {} bytes", before, bytes.len()));
+ log.extend(images_refused_note(report.optimize.images_refused));
let name = s.get(id).map(|d| d.name.clone()).unwrap_or_default();
s.close(id);
let new = s.open(name, None, bytes, None).map_err(|e| EditError::Reopen(e.to_string()))?;
@@ -222,3 +228,16 @@ pub fn run_on(action: &Action, name: &str, bytes: Arc>, mut progress: im
let bytes = if d.is_signed() { s.save_bytes(id) } else { s.save_full_bytes(id) }.map_err(|e| e.to_string())?;
Ok(FileResult { name: name.to_string(), bytes, log })
}
+
+#[cfg(test)]
+mod tests {
+ use super::images_refused_note;
+
+ /// A log line only for images that stayed, saying how many.
+ #[test]
+ fn the_log_says_when_images_stayed_as_they_were() {
+ assert_eq!(images_refused_note(0), None);
+ assert!(images_refused_note(1).is_some_and(|note| note.contains("1 image(s)")));
+ assert!(images_refused_note(3).is_some_and(|note| note.contains("3 image(s)")));
+ }
+}
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 6bfe9fa826..0647726452 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -163,6 +163,8 @@ const HELP: Option<&str> = Some("Help");
/// Every command, in menu order.
pub const COMMANDS: &[CommandSpec] = &[
+ c("view.select_tool", "Select", None, None, Document, "mouse-pointer-2"),
+ c("view.hand_tool", "Hand", None, None, Document, "hand"),
c("file.open", "Open…", FILE, Some(Shortcut::cmd("O")), Nothing, "folder-open"),
c("file.open_recent", "Open Recent", FILE, None, Nothing, "clock"),
// Shown at the foot of File ▸ Open Recent and on Home, not as its own File menu item.
@@ -259,6 +261,7 @@ pub const COMMANDS: &[CommandSpec] = &[
c("comment.underline", "Underline text", None, None, Annotate, "underline"),
c("comment.strikeout", "Strikethrough text", None, None, Annotate, "strikethrough"),
c("comment.squiggly", "Squiggly underline text", None, None, Annotate, "spline"),
+ c("comment.freehand_highlight", "Freehand-Highlight", None, None, Annotate, "highlighter"),
c("comment.ink", "Draw freehand", None, None, Annotate, "pencil"),
c("comment.line", "Draw a line", None, None, Annotate, "minus"),
c("comment.arrow", "Draw an arrow", None, None, Annotate, "move-right"),
diff --git a/crates/engine/src/comments.rs b/crates/engine/src/comments.rs
index eee799ed2f..c8262a7241 100644
--- a/crates/engine/src/comments.rs
+++ b/crates/engine/src/comments.rs
@@ -82,6 +82,7 @@ pub fn comment_type_name(subtype: &str) -> &str {
/// [`comment_type_name`], telling callouts, clouds and typewriter text apart by `/IT`.
pub fn comment_kind(a: &pdfcraft_render::Annotation) -> &str {
match a.intent.as_deref() {
+ Some("FreehandHighlight") if a.subtype == "Ink" => "Freehand Highlight",
Some("FreeTextCallout") => "Callout",
Some("PolygonCloud") => "Cloud",
Some("FreeTextTypeWriter") => "Typewriter",
diff --git a/crates/engine/src/compare.rs b/crates/engine/src/compare.rs
index dca1e24af5..24512b566b 100644
--- a/crates/engine/src/compare.rs
+++ b/crates/engine/src/compare.rs
@@ -173,14 +173,15 @@ pub struct OfficeExport {
/// The exported file.
pub bytes: Vec,
/// Pages (0-based) that draw forms nested deeper than [`MAX_FORM_DEPTH`] or more of them
- /// than [`MAX_FORM_VISITS`], or pictures past [`MAX_EXPORT_IMAGE_BYTES`]: export stops
- /// reading there to stay bounded on hostile files, so the text and images of those forms, or
+ /// than [`MAX_FORM_VISITS`], or pictures past [`MAX_EXPORT_IMAGE_BYTES`] or past what one export
+ /// may decode: export stops reading there to stay bounded on hostile files, so the text and images of those forms, or
/// those pictures, are missing from `bytes`.
pub truncated_pages: Vec,
}
/// An image object prepared for Office export: its file extension and encoded bytes, or why it is
-/// left out (`Err(true)`: past [`MAX_EXPORT_IMAGE_BYTES`]; `Err(false)`: it can't be encoded).
+/// left out (`Err(true)`: past [`MAX_EXPORT_IMAGE_BYTES`], or what the export may decode;
+/// `Err(false)`: it can't be encoded).
type PreparedImage = Result<(&'static str, Arc<[u8]>), bool>;
impl crate::Document {
@@ -194,6 +195,18 @@ impl crate::Document {
/// pictures went past `image_budget` bytes ([`OfficeExport::truncated_pages`]). Without
/// `images` no picture is prepared.
pub(crate) fn export_pages_checked(&self, images: bool, image_budget: usize) -> (Vec, Vec) {
+ let Some(editor) = self.editor.as_ref() else { return (Vec::new(), Vec::new()) };
+ self.export_pages_within(images, image_budget, &mut pdfcraft_cos::ImageBudget::new(&editor.cos))
+ }
+
+ /// [`Self::export_pages_checked`], its pictures decoded within `image_work`, which is shared
+ /// by the whole export: a picture past it is left out like one past `image_budget`.
+ pub(crate) fn export_pages_within(
+ &self,
+ images: bool,
+ image_budget: usize,
+ image_work: &mut pdfcraft_cos::ImageBudget,
+ ) -> (Vec, Vec) {
let Some(cos) = self.editor.as_ref().map(|e| &e.cos) else { return (Vec::new(), Vec::new()) };
let mut truncated = Vec::new();
// Each image object is encoded once and shared by every place that draws it.
@@ -244,7 +257,9 @@ impl crate::Document {
.filter_map(|im| {
let object = im.object?;
let prepared = encoded.entry(object).or_insert_with(|| {
- let (ext, bytes) = pdfcraft_create::image_file(cos, object).map_err(|_| false)?;
+ let refused = image_work.refused();
+ let (ext, bytes) =
+ pdfcraft_create::image_file_within(cos, object, &mut *image_work).map_err(|_| image_work.refused() > refused)?;
image_bytes = image_bytes.checked_sub(bytes.len()).ok_or(true)?;
Ok((if ext == "jpg" { "jpg" } else { "png" }, Arc::from(bytes)))
});
diff --git a/crates/engine/src/copy_image.rs b/crates/engine/src/copy_image.rs
index b377903ee4..53b890f27c 100644
--- a/crates/engine/src/copy_image.rs
+++ b/crates/engine/src/copy_image.rs
@@ -18,9 +18,8 @@ impl Document {
/// [`Document::page_images`]: a raster image, or Form artwork that holds one.
pub fn page_image_at(&self, page: usize, at: [f64; 2]) -> Option {
let editor = self.editor.as_ref()?;
- let inside = |r: &[f64; 4]| (r[0]..=r[2]).contains(&at[0]) && (r[1]..=r[3]).contains(&at[1]);
self.page_images(page).iter().rposition(|i| {
- inside(&i.rect)
+ i.contains(at)
&& match (i.is_form, i.object) {
(false, Some(_)) => true,
(true, Some(form)) => picture_in_form(&editor.cos, form).is_some(),
diff --git a/crates/engine/src/doc_state.rs b/crates/engine/src/doc_state.rs
index d28429de6f..91b33ad017 100644
--- a/crates/engine/src/doc_state.rs
+++ b/crates/engine/src/doc_state.rs
@@ -1,4 +1,4 @@
-use super::{Arc, EditError, Hidden, SignatureInfo, TrustStore, optimize};
+use super::{Arc, ArrangeOrder, EditError, Hidden, SignatureInfo, TrustStore, optimize};
/// A change to an existing page image.
#[derive(Clone, Debug, PartialEq)]
@@ -20,6 +20,12 @@ pub enum ImageEdit {
bytes: Arc>,
},
Delete,
+ /// Affine transform [a, b, c, d, e, f] applied to the image's matrix.
+ Transform([f64; 6]),
+ /// Change the stacking order.
+ Arrange(ArrangeOrder),
+ /// Remove any private crop on the image.
+ RemoveCrop,
}
/// Forms ▸ Merge data files into spreadsheet: the field values of each file (FDF, XFDF or a
diff --git a/crates/engine/src/edit/labels.rs b/crates/engine/src/edit/labels.rs
index c3339453af..5343804ef3 100644
--- a/crates/engine/src/edit/labels.rs
+++ b/crates/engine/src/edit/labels.rs
@@ -111,10 +111,17 @@ pub const EDIT_LABELS: &[&str] = &[
"Move object",
"Move objects",
"Move image",
+ "Transform image",
"Rotate image",
+ "Crop image",
"Flip image",
"Replace image",
"Delete image",
+ "Bring to front",
+ "Bring forward",
+ "Send backward",
+ "Send to back",
+ "Remove crop",
"Add header & footer",
"Update header & footer",
"Add watermark",
@@ -254,11 +261,19 @@ impl Edit {
Edit::MoveObjects { objects, .. } => plural("Move object", "Move objects", objects.len()),
Edit::EditPageImage { change, .. } => Label::of(match change {
ImageEdit::Move(_) => "Move image",
+ ImageEdit::Transform(_) => "Transform image",
ImageEdit::Rotate(_) | ImageEdit::RotateBy(_) => "Rotate image",
ImageEdit::Crop(_) => "Crop image",
ImageEdit::Flip { .. } => "Flip image",
ImageEdit::Replace { .. } => "Replace image",
ImageEdit::Delete => "Delete image",
+ ImageEdit::Arrange(ord) => match ord {
+ pdfcraft_edit::ArrangeOrder::BringToFront => "Bring to front",
+ pdfcraft_edit::ArrangeOrder::BringForward => "Bring forward",
+ pdfcraft_edit::ArrangeOrder::SendBackward => "Send backward",
+ pdfcraft_edit::ArrangeOrder::SendToBack => "Send to back",
+ },
+ ImageEdit::RemoveCrop => "Remove crop",
}),
Edit::AddHeaderFooter { replace: false, .. } => Label::of("Add header & footer"),
Edit::AddHeaderFooter { .. } => Label::of("Update header & footer"),
@@ -312,6 +327,7 @@ fn add_annotation(s: &Shape) -> &'static str {
Shape::Oval { .. } => "Add oval",
Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Add arrow",
Shape::Line { .. } => "Add line",
+ Shape::FreehandHighlight { .. } => "Add freehand highlight",
Shape::Ink { .. } => "Add drawing",
Shape::TextBox { .. } => "Add text box",
Shape::Typewriter { .. } => "Add text",
diff --git a/crates/engine/src/edit/run.rs b/crates/engine/src/edit/run.rs
index 17841128d7..c1c83eda09 100644
--- a/crates/engine/src/edit/run.rs
+++ b/crates/engine/src/edit/run.rs
@@ -4,6 +4,7 @@ use super::{
};
use crate::SourceProblem;
use crate::sources::{comment_source, import_pdf_comments};
+use pdfcraft_content::Matrix;
/// Whether the opening password allows an edit (§7.6.4.2, Table 22).
pub(crate) fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), EditError> {
@@ -257,6 +258,169 @@ impl EditCtx {
}
}
+fn run_edit_page_image(doc: &mut pdfcraft_cos::Document, page: usize, index: usize, change: &ImageEdit) -> Result<(), EditError> {
+ match change {
+ ImageEdit::Move(to) if !to.iter().all(|v| v.is_finite()) => {
+ return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid position".into())));
+ }
+ ImageEdit::Transform(t) => {
+ let [a, b, c, d, _, _] = *t;
+ let determinant = a * d - b * c;
+ if !t.iter().all(|v| v.is_finite()) || !determinant.is_finite() || determinant.abs() < 1e-9 {
+ return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("the image transform must be finite and nonsingular".into())));
+ }
+ }
+ ImageEdit::Crop(keep) if !keep.iter().all(|v| v.is_finite()) => {
+ return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid crop".into())));
+ }
+ _ => {}
+ }
+ let img = pdfcraft_edit::page_images(doc, page)?
+ .into_iter()
+ .nth(index)
+ .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
+ let c = match change {
+ ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
+ ImageEdit::Transform(t) => pdfcraft_edit::ImageChange::Transform(*t),
+ ImageEdit::Rotate(q) => {
+ pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
+ }
+ ImageEdit::RotateBy(degrees) => {
+ let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
+ .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
+ pdfcraft_edit::ImageChange::Transform(t)
+ }
+ ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
+ img.visible_rect.unwrap_or(img.rect),
+ 0,
+ *horizontal,
+ !*horizontal,
+ )),
+ ImageEdit::Replace { name, bytes } => {
+ if img.is_form {
+ return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("grouped Form artwork cannot be replaced with a bitmap".into())));
+ }
+ pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
+ }
+ ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
+ ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
+ ImageEdit::Arrange(order) => pdfcraft_edit::ImageChange::Arrange(*order),
+ ImageEdit::RemoveCrop => pdfcraft_edit::ImageChange::RemoveCrop,
+ };
+ let page_model = pdfcraft_model::pages(doc)
+ .into_iter()
+ .nth(page)
+ .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} not found", page + 1))))?;
+ let target_stream_obj = match page_model.dict.get(b"Contents") {
+ None => None,
+ Some(c) => match &*doc.resolve(c) {
+ pdfcraft_cos::Object::Array(a) => a.get(img.stream).and_then(|o| o.as_ref()),
+ _ if img.stream == 0 => c.as_ref(),
+ _ => None,
+ },
+ };
+
+ let added_items: Vec<(usize, pdfcraft_edit::Added)> = pdfcraft_edit::list_added(doc).into_iter().filter(|a| a.page == page).enumerate().collect();
+ // Ownership belongs to the drawing stream, not the XObject: original and added images may
+ // show the same resource without sharing an editable item.
+ let shows_image = |a: &pdfcraft_edit::Added| img.object.is_some_and(|t| matches!(&a.content, AddedContent::Image(ai) if ai.image == t));
+ let matched_added = added_items.iter().find(|(_, a)| target_stream_obj == Some(a.obj) && (img.object.is_none() || shows_image(a)));
+
+ let mut ai_to_update = None;
+ if let Some((added_idx, added_item)) = matched_added
+ && let AddedContent::Image(ai) = added_item.content.clone()
+ {
+ let has_active_crop = ai.crop.iter().any(|v| v.abs() > 1e-6)
+ || img.visible_rect.is_some_and(|v| {
+ (v[0] - img.rect[0]).abs() > 1e-4
+ || (v[1] - img.rect[1]).abs() > 1e-4
+ || (v[2] - img.rect[2]).abs() > 1e-4
+ || (v[3] - img.rect[3]).abs() > 1e-4
+ });
+ let non_axis_transform = matches!(change, ImageEdit::Transform([a, b, c, d, _, _])
+ if !((b.abs() < 1e-5 && c.abs() < 1e-5) || (a.abs() < 1e-5 && d.abs() < 1e-5)));
+ let should_promote = has_active_crop
+ || non_axis_transform
+ || matches!(change, ImageEdit::Crop(_) | ImageEdit::RemoveCrop | ImageEdit::RotateBy(_) | ImageEdit::Arrange(_) | ImageEdit::Delete);
+
+ if should_promote {
+ doc.update_dict(added_item.obj, |d| {
+ d.remove(b"PCAdded");
+ d.remove(b"PCMark");
+ })
+ .map_err(|e| EditError::Edit(pdfcraft_edit::EditError::Invalid(e.to_string())))?;
+ } else {
+ ai_to_update = Some((*added_idx, ai));
+ }
+ }
+
+ if let Some((added_idx, mut ai)) = ai_to_update {
+ let view = Matrix(page_model.view_matrix(doc));
+ let to_display = view.invert().ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid page transform".into())))?;
+
+ match change {
+ ImageEdit::Move(to) => {
+ ai.rect = to_display.bbox(*to);
+ pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+ }
+ ImageEdit::Transform(_) | ImageEdit::Flip { .. } => {
+ let pdfcraft_edit::ImageChange::Transform(t) = c else {
+ return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("expected transform".into())));
+ };
+ let t_display = view.then(&Matrix(t)).then(&to_display);
+ let [ta, tb, tc, td, _, _] = t_display.0;
+ let is_parallel = tb.abs() < 1e-5 && tc.abs() < 1e-5;
+ let is_perpendicular = ta.abs() < 1e-5 && td.abs() < 1e-5;
+
+ let (quarters_ccw, disp_flip_h, disp_flip_v) = if is_parallel {
+ (0, ta < 0.0, td < 0.0)
+ } else if is_perpendicular {
+ match (tb > 0.0, tc > 0.0) {
+ (true, false) => (1, false, false),
+ (false, true) => (3, false, false),
+ (true, true) => (1, false, true),
+ (false, false) => (1, true, false),
+ }
+ } else {
+ return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
+ "non-axis-aligned transforms are not supported for added images".into(),
+ )));
+ };
+ let (toggle_h, toggle_v) = if ai.rotation % 2 == 1 { (disp_flip_v, disp_flip_h) } else { (disp_flip_h, disp_flip_v) };
+ ai.flip_h ^= toggle_h;
+ ai.flip_v ^= toggle_v;
+ ai.rotation = (ai.rotation + quarters_ccw) % 4;
+ ai.rect = t_display.bbox(ai.rect);
+ pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+ }
+ ImageEdit::Rotate(q) => {
+ let k = ((4 - q.rem_euclid(4)) % 4) as u8;
+ ai.rotation = (ai.rotation + k) % 4;
+ let r = ai.rect;
+ let (cx, cy) = ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+ if k % 2 == 1 {
+ let (w, h) = (r[2] - r[0], r[3] - r[1]);
+ ai.rect = [cx - h / 2.0, cy - w / 2.0, cx + h / 2.0, cy + w / 2.0];
+ }
+ pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+ }
+ ImageEdit::Replace { .. } => {
+ let pdfcraft_edit::ImageChange::Replace(new_image) = c else {
+ return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("expected replace".into())));
+ };
+ ai.image = new_image;
+ pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+ }
+ ImageEdit::Crop(_) | ImageEdit::RemoveCrop | ImageEdit::RotateBy(_) | ImageEdit::Arrange(_) | ImageEdit::Delete => {
+ pdfcraft_edit::change_image(doc, page, index, &c)?;
+ }
+ }
+ } else {
+ pdfcraft_edit::change_image(doc, page, index, &c)?;
+ }
+ Ok(())
+}
+
/// Perform an edit on a working copy (the caller discards it on error).
pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) -> Result<(), EditError> {
match edit {
@@ -532,40 +696,7 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
Edit::AddOcrText { page, words } => {
pdfcraft_edit::stamp(doc, *page, "OCR", pdfcraft_ocr::text_layer(words))?;
}
- Edit::EditPageImage { page, index, change } => {
- let img = pdfcraft_edit::page_images(doc, *page)?
- .into_iter()
- .nth(*index)
- .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
- let c = match change {
- ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
- ImageEdit::Rotate(q) => {
- pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
- }
- ImageEdit::RotateBy(degrees) => {
- let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
- .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
- pdfcraft_edit::ImageChange::Transform(t)
- }
- ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
- img.visible_rect.unwrap_or(img.rect),
- 0,
- *horizontal,
- !*horizontal,
- )),
- ImageEdit::Replace { name, bytes } => {
- if img.is_form {
- return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
- "grouped Form artwork cannot be replaced with a bitmap".into(),
- )));
- }
- pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
- }
- ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
- ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
- };
- pdfcraft_edit::change_image(doc, *page, *index, &c)?;
- }
+ Edit::EditPageImage { page, index, change } => run_edit_page_image(doc, *page, *index, change)?,
Edit::MoveObjects { page, objects, offset } => pdfcraft_edit::move_objects(doc, *page, objects, *offset)?,
Edit::EditTextBlock { page, block, text, style } => {
pdfcraft_edit::rewrite_block(doc, *page, *block, Some(text), style)?;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 69036d9d52..dfabec2d5d 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -54,6 +54,7 @@ mod stamp_preview;
mod test_hooks;
pub mod text_fonts;
mod text_preview;
+pub mod text_script;
pub mod text_style_bookmarks;
pub mod word_count;
pub mod xfa;
@@ -64,6 +65,7 @@ use std::sync::Arc;
pub use links::{
MAX_REMOTE_DOCUMENT_BYTES, RemoteDocumentPathError, read_remote_document, remote_document_path_is_absolute, resolve_remote_document_path,
};
+pub use pdfcraft_edit::strip_subset_tag;
pub use signature_image::{ImageSignaturePreview, SignatureImage};
pub use signature_scan::{PhotoRect, ScanError, SignaturePhoto, Turn};
pub use stamp_preview::{CommentLayer, StampPreview};
@@ -139,7 +141,7 @@ pub use history::Label;
use layers::{apply_layer_state, set_default_layer_state, use_layer_choices};
pub use open::{OpenContext, PreparedDocument};
pub use page_filter::{PageOrientation, PageParity, filter_pages};
-pub use pictures::MarkFile;
+pub use pictures::{MarkFile, image_dimensions};
use pictures::{embed_image, fit_picture, mark_source};
use protection::unrestricted;
pub use protection::{Changes, Printing, Protection, SecuritySummary};
@@ -156,6 +158,8 @@ use xfa_form::{
mod clock;
mod doc_state;
+pub use pdfcraft_edit::ArrangeOrder;
+
use clock::{local_utc_offset, parse_ymd};
pub use doc_state::{DocId, ImageEdit, OptimizeReport, RecoverySnapshot, SplitPart, guard, merge_data_files};
use doc_state::{LOW_RESOLUTION_PRINT_DPI, render_threads, renderer_password, signatures_of, writable};
diff --git a/crates/engine/src/pictures.rs b/crates/engine/src/pictures.rs
index b29941720a..49d76f07c0 100644
--- a/crates/engine/src/pictures.rs
+++ b/crates/engine/src/pictures.rs
@@ -2,6 +2,8 @@
use std::sync::Arc;
+use image::ImageDecoder;
+
use crate::EditError;
/// A picture for a watermark or background (Acrobat: Source ▸ File): an image, or `page`
@@ -57,3 +59,69 @@ pub(crate) fn mark_source(doc: &mut pdfcraft_cos::Document, f: &MarkFile) -> Res
Ok(pdfcraft_edit::MarkSource { xobject, size, image: true })
}
}
+
+/// The dimensions of an image from its bytes (JPEG, PNG, TIFF), without decoding the full raster.
+pub fn image_dimensions(bytes: &[u8]) -> Option<(u32, u32)> {
+ let format = image::guess_format(bytes).ok()?;
+ let mut reader = image::ImageReader::with_format(std::io::Cursor::new(bytes), format);
+ let mut limits = image::Limits::default();
+ limits.max_alloc = Some(64_000_000 * 4);
+ reader.limits(limits);
+ let mut decoder = reader.into_decoder().ok()?;
+ let (mut w, mut h) = image::ImageDecoder::dimensions(&decoder);
+ if w == 0 || h == 0 {
+ return None;
+ }
+ if format == image::ImageFormat::Jpeg
+ && u64::from(w) * u64::from(h) <= (64 << 20)
+ && let Ok(orientation) = decoder.orientation()
+ && matches!(
+ orientation,
+ image::metadata::Orientation::Rotate90
+ | image::metadata::Orientation::Rotate270
+ | image::metadata::Orientation::Rotate90FlipH
+ | image::metadata::Orientation::Rotate270FlipH
+ )
+ {
+ std::mem::swap(&mut w, &mut h);
+ }
+ Some((w, h))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ fn phone_jpeg(w: u32, h: u32, orientation: u8) -> Vec {
+ use image::codecs::jpeg::JpegEncoder;
+ let mut jpeg = Vec::new();
+ let mut encoder = JpegEncoder::new(&mut jpeg);
+ encoder.encode_image(&image::RgbImage::from_pixel(w, h, image::Rgb([20, 20, 20]))).expect("valid jpeg");
+ let mut exif = b"Exif\0\0II\x2a\0\x08\0\0\0\x01\0\x12\x01\x03\0\x01\0\0\0".to_vec();
+ exif.extend_from_slice(&[orientation, 0, 0, 0, 0, 0, 0, 0]);
+ let mut out = jpeg[..2].to_vec();
+ out.extend_from_slice(&[0xff, 0xe1]);
+ out.extend_from_slice(&((exif.len() + 2) as u16).to_be_bytes());
+ out.extend_from_slice(&exif);
+ out.extend_from_slice(&jpeg[2..]);
+ out
+ }
+
+ #[test]
+ fn jpeg_exif_orientation_swaps_dimensions_for_quarter_turns() {
+ let turned_6 = phone_jpeg(60, 20, 6);
+ assert_eq!(image_dimensions(&turned_6), Some((20, 60)));
+
+ let turned_8 = phone_jpeg(60, 20, 8);
+ assert_eq!(image_dimensions(&turned_8), Some((20, 60)));
+
+ let upright_1 = phone_jpeg(60, 20, 1);
+ assert_eq!(image_dimensions(&upright_1), Some((60, 20)));
+ }
+
+ #[test]
+ fn invalid_inputs_return_none() {
+ assert_eq!(image_dimensions(&[]), None);
+ assert_eq!(image_dimensions(b"not an image"), None);
+ }
+}
diff --git a/crates/engine/src/session/editing.rs b/crates/engine/src/session/editing.rs
index a8b07c73e1..c13e8f5c55 100644
--- a/crates/engine/src/session/editing.rs
+++ b/crates/engine/src/session/editing.rs
@@ -419,6 +419,7 @@ impl Session {
| Edit::DeleteContent { .. }
| Edit::ReplaceImage { .. }
| Edit::PasteContent { .. }
+ | Edit::EditPageImage { .. }
) || matches!(e, Edit::MoveObjects { objects, .. } if objects.iter().any(|o| o.kind == ObjectKind::Added))
});
let touches_marks = edit.is_none_or(|e| {
diff --git a/crates/engine/src/session/files.rs b/crates/engine/src/session/files.rs
index 34d75e5c82..553ddd6aa3 100644
--- a/crates/engine/src/session/files.rs
+++ b/crates/engine/src/session/files.rs
@@ -71,12 +71,12 @@ impl Session {
/// Reduce File Size: Acrobat's defaults (colour and grey images above 225 ppi to 150 ppi,
/// JPEG medium quality; black-and-white averaged down to 300 ppi above 450 ppi, and stored as
/// CCITT Group 4 whenever smaller; thumbnails dropped), identical resources merged, unused
- /// objects dropped, objects packed into compressed object streams. Returns the bytes and how
- /// many objects were merged. The open document is not changed (Acrobat saves the reduced copy
- /// as a new file).
- pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc>, usize), EditError> {
+ /// objects dropped, objects packed into compressed object streams. Returns the bytes, how
+ /// many objects were merged and how many images stayed as they were, past what one run may
+ /// decode. The open document is not changed (Acrobat saves the reduced copy as a new file).
+ pub fn reduced_bytes(&self, id: DocId) -> Result<(Arc>, usize, usize), EditError> {
let (bytes, report) = self.optimized_bytes(id, &optimize::Settings::default(), &[])?;
- Ok((bytes, report.merged))
+ Ok((bytes, report.merged, report.optimize.images_refused))
}
/// Optimize PDF ▸ Advanced optimization: `settings` for images and objects, plus Remove
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 71a212671c..256f86a980 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -33,6 +33,39 @@ pub(crate) fn fixture(n: usize) -> Vec {
out
}
+fn fixture_with_rotation_and_user_unit(rotate: i64, user_unit: f64) -> Vec {
+ let mut objs: Vec> = vec![b"<< /Type /Catalog /Pages 2 0 R >>".to_vec()];
+ objs.push(b"<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec());
+ objs.push(b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_vec());
+ let mut page_dict = String::from("<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 3 0 R >> >>");
+ if rotate != 0 {
+ page_dict.push_str(&format!(" /Rotate {rotate}"));
+ }
+ if (user_unit - 1.0).abs() > 1e-6 {
+ page_dict.push_str(&format!(" /UserUnit {user_unit}"));
+ }
+ page_dict.push_str(" >>");
+ objs.push(page_dict.into_bytes());
+ let body = "BT /F1 24 Tf 20 150 Td (Page 1) Tj ET";
+ objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()).into_bytes());
+
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offsets = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offsets.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+ out.extend_from_slice(o);
+ out.extend_from_slice(b"\nendobj\n");
+ }
+ let xref = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offsets {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+ out
+}
+
fn session_with(n: usize) -> (Session, DocId) {
let mut s = Session::new().with_clock(|| 1_700_000_000);
let id = s.open("fixture.pdf", None, Arc::new(fixture(n)), None).expect("opens");
@@ -3624,7 +3657,7 @@ fn create_and_reduce() {
)
.unwrap();
let full = s2.save_full_bytes(id2).unwrap();
- let (reduced, _) = s2.reduced_bytes(id2).unwrap();
+ let (reduced, ..) = s2.reduced_bytes(id2).unwrap();
assert!(reduced.len() <= full.len(), "{} > {}", reduced.len(), full.len());
let mut s3 = Session::new();
let r = s3.open("r.pdf", None, reduced, None).unwrap();
@@ -6213,24 +6246,27 @@ fn a_static_xfa_form_takes_many_data_values_as_one_by_one() {
/// Opening a static XFA form whose datasets fill thousands of fields took minutes: each value
/// read the whole form again (twice), so the time grew with the square of the fields. Eight
/// times the fields now takes at most about eight times as long (it took about fifty).
+///
+/// Each round opens the small form and then the large one, so a busy spell on a shared machine
+/// slows both, and the best round's ratio is checked. Timing every small opening before the
+/// large ones let such a spell fall on the large ones alone.
#[test]
fn opening_a_static_xfa_form_grows_linearly_with_its_data_values() {
- let time = |n: usize| {
- let bytes = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(n));
- (0..3)
- .map(|_| {
- let mut s = Session::new();
- let start = std::time::Instant::now();
- s.open("many.pdf", None, bytes.clone(), None).expect("opens");
- start.elapsed()
- })
- .min()
- .unwrap_or_default()
+ let small = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(100));
+ let large = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(800));
+ let time = |bytes: &Arc>| {
+ let mut s = Session::new();
+ let start = std::time::Instant::now();
+ s.open("many.pdf", None, bytes.clone(), None).expect("opens");
+ start.elapsed()
};
- let small = time(100);
- let large = time(800);
- let ratio = large.as_secs_f64() / small.as_secs_f64().max(1e-6);
- assert!(ratio < 16.0, "100 fields: {small:?}, 800 fields: {large:?} ({ratio:.1}x)");
+ // The first openings also pay for what the process sets up once.
+ time(&small);
+ time(&large);
+ let rounds: Vec<_> = (0..5).map(|_| (time(&small), time(&large))).collect();
+ let ratio = |(s, l): &(std::time::Duration, std::time::Duration)| l.as_secs_f64() / s.as_secs_f64().max(1e-6);
+ let best = rounds.iter().map(ratio).fold(f64::INFINITY, f64::min);
+ assert!(best < 16.0, "100 and 800 fields, by round: {rounds:?} (best {best:.1}x)");
}
/// A date goes into the XFA data in the field's data picture (``), as other
@@ -8156,6 +8192,13 @@ fn copy_image_finds_the_image_under_a_point_and_decodes_it_at_full_size() {
assert_eq!((w, h), (3, 2));
assert_eq!(rgba, px.into_raw());
assert!(d.page_image_rgba(0, 1).is_err());
+
+ // When the image is cropped, page_image_at only hit-tests the visible cropped region:
+ let crop_keep = [r[0] + (r[2] - r[0]) * 0.25, r[1] + (r[3] - r[1]) * 0.25, r[0] + (r[2] - r[0]) * 0.75, r[1] + (r[3] - r[1]) * 0.75];
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop(crop_keep) }).unwrap();
+ let d = s.get(id).unwrap();
+ assert_eq!(d.page_image_at(0, [(r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0]), Some(0));
+ assert_eq!(d.page_image_at(0, [r[0] + 0.1, r[1] + 0.1]), None, "cropped-away corner must not hit-test positive");
}
/// Copy Image: a JPEG drawn through grouped Form artwork (as Word, InDesign and scanners write
@@ -8208,6 +8251,130 @@ fn copy_image_finds_a_picture_inside_form_artwork_under_text() {
assert!(d.page_image_copy_file(0, 1).is_err());
}
+/// Copy Image reads a JBIG2 image's `/JBIG2Globals`: here they hold the page information, and the
+/// image's own stream only an extension segment decoders skip, so it has a picture only through
+/// them. Its default pixel is black.
+#[test]
+fn copy_image_reads_the_globals_of_a_jbig2_picture() {
+ let mut globals = vec![0, 0, 0, 0, 48, 0, 1, 0, 0, 0, 19];
+ globals.extend_from_slice(&16u32.to_be_bytes());
+ globals.extend_from_slice(&2u32.to_be_bytes());
+ globals.extend_from_slice(&[0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0]); // resolution, flags, striping
+ let image = [0, 0, 0, 1, 62, 0, 1, 0, 0, 0, 0];
+ let stream = |dict: &str, data: &[u8]| {
+ let mut o = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+ o.extend_from_slice(data);
+ o.extend_from_slice(b"\nendstream");
+ o
+ };
+ let objs: Vec> = vec![
+ b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+ b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec(),
+ b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >>".to_vec(),
+ stream("", b"q 160 0 0 20 20 100 cm /Im1 Do Q"),
+ stream(
+ "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter /JBIG2Decode /DecodeParms << /JBIG2Globals 6 0 R >>",
+ &image,
+ ),
+ stream("", &globals),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offsets = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offsets.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+ out.extend_from_slice(o);
+ out.extend_from_slice(b"\nendobj\n");
+ }
+ let xref = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offsets {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+ let mut s = Session::new();
+ let id = s.open("scan.pdf", None, Arc::new(out), None).unwrap();
+ let d = s.get(id).unwrap();
+ let (w, h, rgba) = d.page_image_rgba(0, 0).unwrap();
+ assert_eq!((w, h), (16, 2));
+ assert!(rgba.chunks(4).all(|p| p == [0, 0, 0, 255]), "the page's default pixel, from the globals");
+ // An Office export shares one allowance across its pictures. One past it is left out, and the
+ // export says the page is missing something, as for a picture past its bytes.
+ let (pages, truncated) = d.export_pages_within(true, 1 << 20, &mut pdfcraft_cos::ImageBudget::with_work(u64::MAX));
+ assert_eq!((pages[0].images.len(), truncated.len()), (1, 0));
+ let (pages, truncated) = d.export_pages_within(true, 1 << 20, &mut pdfcraft_cos::ImageBudget::with_work(0));
+ assert!(pages[0].images.is_empty());
+ assert_eq!(truncated, [0]);
+}
+
+/// An Office export leaves out a picture it can't encode, as it did. That isn't a page cut short:
+/// only a picture past what the export may do is reported as one.
+#[test]
+fn an_office_export_doesnt_call_an_unreadable_picture_truncated() {
+ let pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+ 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >> endobj\n\
+ 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n\
+ 4 0 obj << /Length 31 >> stream\nq 160 0 0 20 20 100 cm /Im1 Do Q\nendstream endobj\n\
+ 5 0 obj << /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /JPXDecode /Length 4 >> stream\nnone\nendstream endobj\n\
+ trailer << /Root 1 0 R >>\n%%EOF"
+ .to_vec();
+ let mut s = Session::new();
+ let id = s.open("picture.pdf", None, Arc::new(pdf), None).unwrap();
+ let (pages, truncated) = s.get(id).unwrap().export_pages_within(true, 1 << 20, &mut pdfcraft_cos::ImageBudget::with_work(u64::MAX));
+ assert!(pages[0].images.is_empty());
+ assert_eq!(truncated, Vec::::new());
+}
+
+/// Copy Image takes a JBIG2 picture as its pixels and as a PNG file, behind another filter
+/// (ASCIIHexDecode) too: Export's decoding, through `ImageBudget::decode`.
+#[test]
+fn copy_image_copies_a_jbig2_picture_behind_another_filter() {
+ // 16 × 2: the left half of the top row black, the rest white.
+ let bits = [0x00, 0xFF, 0xFF, 0xFF];
+ let coded = pdfcraft_filters::encode_jbig2_generic(&bits, 16, 2).unwrap();
+ let hex: Vec = coded.iter().flat_map(|b| format!("{b:02x}").into_bytes()).chain(*b">").collect();
+ let stream = |dict: &str, data: &[u8]| {
+ let mut o = format!("<< {dict} /Length {} >>\nstream\n", data.len()).into_bytes();
+ o.extend_from_slice(data);
+ o.extend_from_slice(b"\nendstream");
+ o
+ };
+ let objs: Vec> = vec![
+ b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+ b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec(),
+ b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >>".to_vec(),
+ stream("", b"q 160 0 0 20 20 100 cm /Im1 Do Q"),
+ stream(
+ "/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 1 /Filter [/ASCIIHexDecode /JBIG2Decode]",
+ &hex,
+ ),
+ ];
+ let mut out = b"%PDF-1.7\n".to_vec();
+ let mut offsets = Vec::new();
+ for (i, o) in objs.iter().enumerate() {
+ offsets.push(out.len());
+ out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+ out.extend_from_slice(o);
+ out.extend_from_slice(b"\nendobj\n");
+ }
+ let xref = out.len();
+ out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+ for o in offsets {
+ out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+ }
+ out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+ let mut s = Session::new();
+ let id = s.open("scan.pdf", None, Arc::new(out), None).unwrap();
+ let d = s.get(id).unwrap();
+ assert_eq!(d.page_image_at(0, [30.0, 115.0]), Some(0));
+ assert_eq!(d.page_image_copy_file(0, 0).unwrap().0, "png");
+ let (w, h, rgba) = d.page_image_rgba(0, 0).unwrap();
+ assert_eq!((w, h), (16, 2));
+ let grey: Vec = rgba.chunks(4).map(|px| px[0]).collect();
+ let expected: Vec = (0..32).map(|i| if i < 8 { 0 } else { 255 }).collect();
+ assert_eq!(grey, expected, "the picture, black as 0");
+}
+
/// `fixture(2)` with the catalog pointing at a page tree object the file does not have (#1656).
fn fixture_without_page_tree() -> Vec {
let bytes = fixture(2);
@@ -9127,6 +9294,61 @@ fn a_fields_own_script_may_not_save_as_or_show_a_panel() {
assert_eq!(o.requests, [js::Request::SaveAs]);
}
+/// A page of `count` pictures of one flat grey, `side` pixels square, each an object of its own.
+fn page_of_pictures(count: usize, side: usize) -> Vec {
+ let data = pdfcraft_filters::encode_flate(&vec![0x80; side * side]);
+ let names: String = (0..count).map(|i| format!("/Im{i} {} 0 R ", 5 + i)).collect();
+ let content: String = (0..count).map(|i| format!("q 10 0 0 10 0 0 cm /Im{i} Do Q\n")).collect();
+ let mut pdf = format!(
+ "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+ 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >> endobj\n\
+ 3 0 obj << /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << /XObject << {names}>> >> >> endobj\n\
+ 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n",
+ content.len()
+ )
+ .into_bytes();
+ for i in 0..count {
+ let dict = format!(
+ "{} 0 obj << /Type /XObject /Subtype /Image /Width {side} /Height {side} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /FlateDecode /Length {} >> stream\n",
+ 5 + i,
+ data.len()
+ );
+ pdf.extend_from_slice(dict.as_bytes());
+ pdf.extend_from_slice(&data);
+ pdf.extend_from_slice(b"\nendstream endobj\n");
+ }
+ pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF");
+ pdf
+}
+
+/// The allowance is the export's, not each picture's: a page of many small pictures stops where it
+/// runs out, the rest are left out and counted, and the page is listed, which is what the export's
+/// warning goes by. A few large pictures are well within it, and all come through.
+#[test]
+fn a_page_of_many_pictures_stops_at_the_exports_allowance() {
+ let export = |pdf: Vec, work: &mut pdfcraft_cos::ImageBudget| {
+ let mut s = Session::new();
+ let id = s.open("pictures.pdf", None, Arc::new(pdf), None).unwrap();
+ s.get(id).unwrap().export_pages_within(true, 1 << 30, work)
+ };
+ let mut one = pdfcraft_cos::ImageBudget::with_work(u64::MAX);
+ export(page_of_pictures(1, 2), &mut one);
+ let cost = u64::MAX - one.work_left();
+ assert!(cost > 0);
+
+ let mut work = pdfcraft_cos::ImageBudget::with_work(100 * cost);
+ let (pages, truncated) = export(page_of_pictures(10_000, 2), &mut work);
+ assert_eq!(pages[0].images.len(), 100);
+ assert_eq!(truncated, vec![0]);
+ assert_eq!(work.refused(), 9_900);
+
+ let mut s = Session::new();
+ let id = s.open("large.pdf", None, Arc::new(page_of_pictures(3, 1_000)), None).unwrap();
+ let (pages, truncated) = s.get(id).unwrap().export_pages_checked(true, 1 << 30);
+ assert_eq!(pages[0].images.len(), 3);
+ assert_eq!(truncated, Vec::::new());
+}
+
/// A page whose forms go past the reading limit and whose picture goes past the image budget is
/// listed once among the truncated pages.
#[test]
@@ -9173,6 +9395,474 @@ fn a_page_truncated_for_forms_and_pictures_is_listed_once() {
assert_eq!(truncated, [0]);
}
+/// Moving an added image, then rotating it, must keep the moved position.
+#[test]
+fn added_image_move_then_rotate_keeps_position() {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+ }
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+ let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([120.0, 120.0, 160.0, 160.0]) }).unwrap();
+ let moved = rect(&s);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+ let rotated = rect(&s);
+ let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+ let (a, b) = (c(moved), c(rotated));
+ assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate moved the centre from {a:?} to {b:?}");
+}
+
+/// Transforming an added image, then rotating it, must keep the moved position.
+#[test]
+fn added_image_transform_then_rotate_keeps_position() {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+ }
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+ let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+ // Translate by (100, 100): matrix [1, 0, 0, 1, 100, 100]
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, 1.0, 100.0, 100.0]) }).unwrap();
+ let transformed = rect(&s);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+ let rotated = rect(&s);
+ let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+ let (a, b) = (c(transformed), c(rotated));
+ assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate moved the centre from {a:?} to {b:?}");
+}
+
+/// Moving an added image, then rotating by degrees, must keep the moved position.
+#[test]
+fn added_image_move_then_rotate_by_keeps_position() {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+ }
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+ let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([120.0, 120.0, 160.0, 160.0]) }).unwrap();
+ let moved = rect(&s);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::RotateBy(90.0) }).unwrap();
+ let rotated = rect(&s);
+ let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+ let (a, b) = (c(moved), c(rotated));
+ assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate_by moved the centre from {a:?} to {b:?}");
+}
+
+/// Arranging an added image moves it into the document stream and converts it to an ordinary
+/// page image (dropping the PCAdded marker), so no empty shell remains in list_added.
+#[test]
+fn added_image_arrange_converts_to_ordinary_image() {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+ }
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p1.png".into(), bytes: Arc::new(png.clone()) }).unwrap();
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([100.0, 100.0, 200.0, 200.0]), name: "p2.png".into(), bytes: Arc::new(png) }).unwrap();
+ assert_eq!(s.get(id).unwrap().page_images(0).len(), 2);
+ assert_eq!(s.get(id).unwrap().added().len(), 2);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 1, change: ImageEdit::Arrange(ArrangeOrder::SendToBack) }).unwrap();
+ assert_eq!(s.get(id).unwrap().page_images(0).len(), 2);
+ assert_eq!(s.get(id).unwrap().added().len(), 1, "arranged image is converted and no longer an added-item shell");
+}
+
+#[test]
+fn added_image_crop_then_move_keeps_crop() {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+ }
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 100.0, 100.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop([30.0, 30.0, 70.0, 70.0]) }).unwrap();
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([50.0, 50.0, 130.0, 130.0]) }).unwrap();
+ let img = s.get(id).unwrap().page_images(0)[0].clone();
+ assert_eq!(img.visible_rect, Some([60.0, 60.0, 100.0, 100.0]));
+}
+
+#[test]
+fn added_image_move_and_transform_on_rotated_and_user_unit_pages() {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+ }
+ let png_bytes = Arc::new(png);
+
+ let cases = [(90, 1.0), (180, 1.0), (270, 1.0), (0, 2.0), (90, 2.0)];
+
+ for (rotate, user_unit) in cases {
+ let pdf = fixture_with_rotation_and_user_unit(rotate, user_unit);
+ let mut s = Session::new().with_clock(|| 1_700_000_000);
+ let id = s.open("test.pdf", None, Arc::new(pdf), None).expect("opens");
+
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([10.0, 10.0, 50.0, 50.0]), name: "img.png".into(), bytes: png_bytes.clone() }).unwrap();
+
+ // Target user-space rectangle R
+ let r = [30.0, 40.0, 80.0, 90.0];
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move(r) }).unwrap();
+
+ let painted = s.get(id).unwrap().page_images(0)[0].rect;
+ for i in 0..4 {
+ assert!(
+ (painted[i] - r[i]).abs() < 1e-3,
+ "Move: rotate={rotate}, user_unit={user_unit}: painted[{i}] = {}, expected {}",
+ painted[i],
+ r[i]
+ );
+ }
+
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let added = pdfcraft_edit::list_added(&cos);
+ assert_eq!(added.len(), 1);
+ let stream_obj = match &*cos.get(added[0].obj) {
+ pdfcraft_cos::Object::Stream(s) => s.clone(),
+ other => panic!("expected stream, got {other:?}"),
+ };
+ let pc_rect = stream_obj
+ .dict
+ .get(b"PCAdded")
+ .and_then(|o| cos.resolve(o).as_dict().cloned())
+ .and_then(|d| d.get(b"Rect").cloned())
+ .and_then(|o| cos.resolve(&o).as_array().cloned())
+ .unwrap();
+ let pc_box: [f64; 4] =
+ [pc_rect[0].as_f64().unwrap(), pc_rect[1].as_f64().unwrap(), pc_rect[2].as_f64().unwrap(), pc_rect[3].as_f64().unwrap()];
+ let content = String::from_utf8(stream_obj.decoded().unwrap()).unwrap();
+ let re_idx = content.find(" re W n").expect("re W n in content stream");
+ let prefix = &content[..re_idx];
+ let nums: Vec =
+ prefix.split_whitespace().rev().take(4).collect::>().into_iter().rev().map(|val| val.parse::().unwrap()).collect();
+ assert_eq!(nums.len(), 4);
+ let (rx, ry, rw, rh) = (nums[0], nums[1], nums[2], nums[3]);
+ assert!((rx - pc_box[0]).abs() < 1e-3, "re x {rx} != pc_box[0] {}", pc_box[0]);
+ assert!((ry - pc_box[1]).abs() < 1e-3, "re y {ry} != pc_box[1] {}", pc_box[1]);
+ assert!((rw - (pc_box[2] - pc_box[0])).abs() < 1e-3, "re w {rw} != {}", pc_box[2] - pc_box[0]);
+ assert!((rh - (pc_box[3] - pc_box[1])).abs() < 1e-3, "re h {rh} != {}", pc_box[3] - pc_box[1]);
+
+ // Transform test: user-space translation by (10, 10)
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, 1.0, 10.0, 10.0]) }).unwrap();
+
+ let expected_transformed = [r[0] + 10.0, r[1] + 10.0, r[2] + 10.0, r[3] + 10.0];
+ let painted_transformed = s.get(id).unwrap().page_images(0)[0].rect;
+ for i in 0..4 {
+ assert!(
+ (painted_transformed[i] - expected_transformed[i]).abs() < 1e-3,
+ "Transform: rotate={rotate}, user_unit={user_unit}: painted[{i}] = {}, expected {}",
+ painted_transformed[i],
+ expected_transformed[i]
+ );
+ }
+ }
+}
+
+#[test]
+fn replace_on_added_image_replaces_xobject_and_undo_restores() {
+ let make_png = |rgb: [u8; 3]| {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+ enc.write_header().unwrap().write_image_data(&data).unwrap();
+ }
+ Arc::new(png)
+ };
+ let png1 = make_png([255, 0, 0]);
+ let png2 = make_png([0, 0, 255]);
+
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "img1.png".into(), bytes: png1 }).unwrap();
+
+ let old_obj = s.get(id).unwrap().page_images(0)[0].object.expect("initial image object ref");
+
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Replace { name: "img2.png".into(), bytes: png2 } }).unwrap();
+
+ let new_obj = s.get(id).unwrap().page_images(0)[0].object.expect("new image object ref");
+ assert_ne!(new_obj, old_obj, "after Replace the page references the new XObject");
+
+ s.undo(id).unwrap();
+
+ let restored_obj = s.get(id).unwrap().page_images(0)[0].object.expect("restored image object ref");
+ assert_eq!(restored_obj, old_obj, "undo restores the old XObject");
+
+ // Also test replacement on an image with active crop (promoted path)
+ let png3 = make_png([0, 255, 0]);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop([25.0, 25.0, 55.0, 55.0]) }).unwrap();
+ let crop_obj = s.get(id).unwrap().page_images(0)[0].object.expect("crop image object ref");
+ assert_eq!(crop_obj, old_obj);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Replace { name: "img3.png".into(), bytes: png3 } }).unwrap();
+ let promoted_new_obj = s.get(id).unwrap().page_images(0)[0].object.expect("promoted replace object ref");
+ assert_ne!(promoted_new_obj, crop_obj);
+ s.undo(id).unwrap();
+ assert_eq!(s.get(id).unwrap().page_images(0)[0].object.expect("undo promoted replace"), crop_obj);
+}
+
+#[test]
+fn mirroring_transform_on_added_image_flips_and_non_finite_is_refused() {
+ let make_png = |rgb: [u8; 3]| {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+ enc.write_header().unwrap().write_image_data(&data).unwrap();
+ }
+ Arc::new(png)
+ };
+ let png1 = make_png([255, 0, 0]);
+
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([0.0, 0.0, 80.0, 40.0]), name: "img1.png".into(), bytes: png1 }).unwrap();
+
+ let initial_img = s.get(id).unwrap().page_images(0)[0].clone();
+ assert_eq!(initial_img.rect, [0.0, 0.0, 80.0, 40.0]);
+ assert!(initial_img.matrix[0] > 0.0, "initially unflipped");
+
+ // Mirroring transform: [-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]) }).unwrap();
+
+ let flipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+ assert!(flipped_img.matrix[0] < 0.0, "horizontal mirror flips matrix x-axis, got matrix: {:?}", flipped_img.matrix);
+
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let added = pdfcraft_edit::list_added(&cos);
+ assert_eq!(added.len(), 1);
+ let AddedContent::Image(ai) = &added[0].content else { panic!("expected added image") };
+ assert!(ai.flip_h, "PCAdded record must have flip_h = true");
+
+ // Mirroring horizontally again flips it back
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]) }).unwrap();
+ let unflipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+ assert!(unflipped_img.matrix[0] > 0.0, "double horizontal mirror restores positive x-axis");
+ let cos2 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let AddedContent::Image(ai2) = &pdfcraft_edit::list_added(&cos2)[0].content else { panic!("expected added image") };
+ assert!(!ai2.flip_h, "PCAdded record must have flip_h = false");
+
+ // Mirroring vertically: [1.0, 0.0, 0.0, -1.0, 0.0, 40.0]
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, -1.0, 0.0, 40.0]) }).unwrap();
+ let v_flipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+ assert!(v_flipped_img.matrix[3] < 0.0, "vertical mirror flips matrix y-axis, got matrix: {:?}", v_flipped_img.matrix);
+ let cos3 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let AddedContent::Image(ai3) = &pdfcraft_edit::list_added(&cos3)[0].content else { panic!("expected added image") };
+ assert!(ai3.flip_v, "PCAdded record must have flip_v = true");
+
+ // Non-finite transform must be refused with error
+ let res = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([f64::NAN, 0.0, 0.0, 1.0, 0.0, 0.0]) });
+ assert!(res.is_err(), "NaN transform must be refused");
+
+ let res_inf = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, f64::INFINITY, 0.0, 0.0]) });
+ assert!(res_inf.is_err(), "infinite transform must be refused");
+
+ let res_move = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([f64::NAN, 20.0, 100.0, 60.0]) });
+ assert!(res_move.is_err(), "NaN position must be refused");
+}
+
+#[test]
+fn transform_on_added_image_folds_quarter_turns_and_promotes_non_axis_aligned() {
+ let make_png = |rgb: [u8; 3]| {
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 2, 2);
+ enc.set_color(png::ColorType::Rgb);
+ let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+ enc.write_header().unwrap().write_image_data(&data).unwrap();
+ }
+ Arc::new(png)
+ };
+ let png1 = make_png([0, 128, 255]);
+
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([100.0, 100.0, 200.0, 150.0]), name: "img.png".into(), bytes: png1 }).unwrap();
+
+ // 1. A pure 90° clockwise rotation matrix about the image centre:
+ let rot_90_cw = pdfcraft_edit::turn_about_centre([100.0, 100.0, 200.0, 150.0], 1, false, false);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_90_cw) }).unwrap();
+
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let added = pdfcraft_edit::list_added(&cos);
+ assert_eq!(added.len(), 1, "stays as PCAdded image");
+ let AddedContent::Image(ai) = &added[0].content else { panic!("expected added image") };
+ assert_eq!(ai.rotation, 3, "quarter turn clockwise folds into ai.rotation = 3 (270° CCW)");
+ // Centre is (150, 125); rotated width=50, height=100 -> [125, 75, 175, 175]
+ assert!((ai.rect[0] - 125.0).abs() < 1e-4);
+ assert!((ai.rect[1] - 75.0).abs() < 1e-4);
+ assert!((ai.rect[2] - 175.0).abs() < 1e-4);
+ assert!((ai.rect[3] - 175.0).abs() < 1e-4);
+
+ // 2. A pure 90° counter-clockwise rotation matrix:
+ let rot_90_ccw = pdfcraft_edit::turn_about_centre(ai.rect, 3, false, false);
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_90_ccw) }).unwrap();
+
+ let cos2 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let AddedContent::Image(ai2) = &pdfcraft_edit::list_added(&cos2)[0].content else { panic!("expected added image") };
+ assert_eq!(ai2.rotation, 0, "quarter turn counter-clockwise restores ai.rotation = 0");
+ assert!((ai2.rect[0] - 100.0).abs() < 1e-4);
+ assert!((ai2.rect[1] - 100.0).abs() < 1e-4);
+ assert!((ai2.rect[2] - 200.0).abs() < 1e-4);
+ assert!((ai2.rect[3] - 150.0).abs() < 1e-4);
+
+ // Arbitrary transforms promote the added image, just like RotateBy.
+ let initial_matrix = s.get(id).unwrap().page_images(0)[0].matrix;
+ let rot_45 = pdfcraft_edit::turn_by_degrees([100.0, 100.0, 200.0, 150.0], 45.0).unwrap();
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_45) }).unwrap();
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ assert!(pdfcraft_edit::list_added(&cos).is_empty(), "arbitrary transform promotes the image");
+ assert_eq!(s.get(id).unwrap().page_images(0).len(), 1);
+ let expected = pdfcraft_content::Matrix(initial_matrix).then(&pdfcraft_content::Matrix(rot_45)).0;
+ let actual = s.get(id).unwrap().page_images(0)[0].matrix;
+ assert!(actual.into_iter().zip(expected).all(|(a, b)| (a - b).abs() < 1e-3), "{actual:?} != {expected:?}");
+ s.undo(id).unwrap();
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ assert_eq!(pdfcraft_edit::list_added(&cos).len(), 1, "undo restores added-image editability");
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.5, 0.0, 1.0, 0.0, 0.0]) }).unwrap();
+ assert_eq!(s.get(id).unwrap().page_images(0).len(), 1);
+}
+
+#[test]
+fn test_added_image_transform_reflections_with_rotation() {
+ let make_asymmetric_png = || {
+ let mut px = Vec::with_capacity(20 * 20 * 3);
+ for y in 0..20 {
+ for x in 0..20 {
+ let color = match (x < 10, y < 10) {
+ (true, true) => [255, 0, 0], // TL: Red
+ (false, true) => [0, 255, 0], // TR: Green
+ (true, false) => [0, 0, 255], // BL: Blue
+ (false, false) => [255, 255, 0], // BR: Yellow
+ };
+ px.extend_from_slice(&color);
+ }
+ }
+ let mut png = Vec::new();
+ {
+ let mut enc = png::Encoder::new(&mut png, 20, 20);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&px).unwrap();
+ }
+ Arc::new(png)
+ };
+
+ let colour_at = |s: &Session, id: DocId, x: u32, y_from_top: u32| -> [u8; 3] {
+ let doc = s.get(id).unwrap();
+ let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), Default::default());
+ let out = r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+ let i = ((y_from_top * out.width + x) * 4) as usize;
+ [out.rgba[i], out.rgba[i + 1], out.rgba[i + 2]]
+ };
+
+ let is_red = |c: [u8; 3]| c[0] > 200 && c[1] < 50 && c[2] < 50;
+ let is_green = |c: [u8; 3]| c[0] < 50 && c[1] > 200 && c[2] < 50;
+ let is_blue = |c: [u8; 3]| c[0] < 50 && c[1] < 50 && c[2] > 200;
+ let is_yellow = |c: [u8; 3]| c[0] > 200 && c[1] > 200 && c[2] < 50;
+
+ let check_quadrants =
+ |s: &Session, id: DocId, tl: fn([u8; 3]) -> bool, tr: fn([u8; 3]) -> bool, bl: fn([u8; 3]) -> bool, br: fn([u8; 3]) -> bool, label: &str| {
+ let c_tl = colour_at(s, id, 75, 125);
+ let c_tr = colour_at(s, id, 125, 125);
+ let c_bl = colour_at(s, id, 75, 175);
+ let c_br = colour_at(s, id, 125, 175);
+ assert!(tl(c_tl), "{label} TL mismatch: got {:?}", c_tl);
+ assert!(tr(c_tr), "{label} TR mismatch: got {:?}", c_tr);
+ assert!(bl(c_bl), "{label} BL mismatch: got {:?}", c_bl);
+ assert!(br(c_br), "{label} BR mismatch: got {:?}", c_br);
+ };
+
+ // --- CASE 1: 90° clockwise rotation (ImageEdit::Rotate(1), ai.rotation = 3) ---
+ // Unrotated: TL=Red, TR=Green, BL=Blue, BR=Yellow.
+ // After 90° CW: TL=Blue, TR=Red, BL=Yellow, BR=Green.
+ {
+ // 1a: Flip Horizontal after 90° rotation
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+ .unwrap();
+ check_quadrants(&s, id, is_red, is_green, is_blue, is_yellow, "initial");
+
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+ check_quadrants(&s, id, is_blue, is_red, is_yellow, is_green, "90° CW");
+
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: true } }).unwrap();
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+ assert_eq!(ai.rotation, 3);
+ assert!(!ai.flip_h, "at 90° rotation, horizontal flip toggles flip_v, not flip_h");
+ assert!(ai.flip_v, "at 90° rotation, horizontal flip toggles flip_v");
+ // Flipping horizontally on screen swaps left & right columns: TL=Red, TR=Blue, BL=Green, BR=Yellow
+ check_quadrants(&s, id, is_red, is_blue, is_green, is_yellow, "90° CW + flip horizontal");
+ }
+
+ {
+ // 1b: Flip Vertical after 90° rotation
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+ .unwrap();
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: false } }).unwrap();
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+ assert_eq!(ai.rotation, 3);
+ assert!(ai.flip_h, "at 90° rotation, vertical flip toggles flip_h");
+ assert!(!ai.flip_v, "at 90° rotation, vertical flip toggles flip_h, not flip_v");
+ // Flipping vertically on screen swaps top & bottom rows: TL=Yellow, TR=Green, BL=Blue, BR=Red
+ check_quadrants(&s, id, is_yellow, is_green, is_blue, is_red, "90° CW + flip vertical");
+ }
+
+ // --- CASE 2: 270° clockwise rotation (ImageEdit::Rotate(3), ai.rotation = 1) ---
+ // Unrotated: TL=Red, TR=Green, BL=Blue, BR=Yellow.
+ // After 270° CW: TL=Green, TR=Yellow, BL=Red, BR=Blue.
+ {
+ // 2a: Flip Horizontal after 270° rotation
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+ .unwrap();
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(3) }).unwrap();
+ check_quadrants(&s, id, is_green, is_yellow, is_red, is_blue, "270° CW");
+
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: true } }).unwrap();
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+ assert_eq!(ai.rotation, 1);
+ assert!(!ai.flip_h, "at 270° rotation, horizontal flip toggles flip_v, not flip_h");
+ assert!(ai.flip_v, "at 270° rotation, horizontal flip toggles flip_v");
+ // Flipping horizontally on screen swaps left & right columns: TL=Yellow, TR=Green, BL=Blue, BR=Red
+ check_quadrants(&s, id, is_yellow, is_green, is_blue, is_red, "270° CW + flip horizontal");
+ }
+
+ {
+ // 2b: Flip Vertical after 270° rotation
+ let (mut s, id) = session_with(1);
+ s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+ .unwrap();
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(3) }).unwrap();
+
+ s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: false } }).unwrap();
+ let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+ let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+ assert_eq!(ai.rotation, 1);
+ assert!(ai.flip_h, "at 270° rotation, vertical flip toggles flip_h");
+ assert!(!ai.flip_v, "at 270° rotation, vertical flip toggles flip_h, not flip_v");
+ // Flipping vertically on screen swaps top & bottom rows: TL=Red, TR=Blue, BL=Green, BR=Yellow
+ check_quadrants(&s, id, is_red, is_blue, is_green, is_yellow, "270° CW + flip vertical");
+ }
+}
+
/// ISO 32000-2 Table 192, 12.7.5.2.3 and Table 228 (Comb): a check box, a push button, a comb
/// field the file leaves to the viewer. The page as displayed and printed as an image shows the
/// check box's caption symbol in its text colour, the button's grey face and the comb's cells in
@@ -9523,3 +10213,35 @@ fn saving_without_deleting_pages_stays_incremental() {
let saved = s.save_bytes(id).unwrap();
assert!(saved.starts_with(original.as_slice()), "an edit that deletes nothing is still appended");
}
+
+#[test]
+fn original_image_edit_does_not_match_an_added_sibling_of_the_same_xobject() {
+ let mut document = pdfcraft_cos::Document::open(Arc::new(jpeg_cover_pdf(650))).unwrap();
+ let original = pdfcraft_edit::page_images(&document, 0).unwrap()[0].clone();
+ let added = AddedImage::new([20.0, 30.0, 80.0, 90.0], original.object.unwrap());
+ pdfcraft_edit::add_content(&mut document, 0, &AddedContent::Image(added.clone())).unwrap();
+ let bytes = pdfcraft_cos::write_full(&document, &pdfcraft_cos::SaveOptions::default()).unwrap();
+ let mut session = Session::new();
+ let id = session.open("shared-image.pdf", None, Arc::new(bytes), None).unwrap();
+ let before_added = session.get(id).unwrap().added()[0].content.clone();
+ session.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([40.0, 50.0, 140.0, 150.0]) }).unwrap();
+ let doc = session.get(id).unwrap();
+ assert_eq!(doc.added()[0].content, before_added, "matching an original Do must not select the added sibling's metadata");
+ assert_eq!(doc.page_images(0)[0].rect, [40.0, 50.0, 140.0, 150.0]);
+}
+
+#[test]
+fn image_transform_engine_refuses_singular_matrices_without_mutation() {
+ let mut png = Vec::new();
+ let mut enc = png::Encoder::new(&mut png, 1, 1);
+ enc.set_color(png::ColorType::Rgb);
+ enc.write_header().unwrap().write_image_data(&[100, 150, 200]).unwrap();
+ let mut s = Session::new();
+ let bytes = s.create_from_images(&[("pixel.png".into(), png)]).unwrap();
+ let id = s.open("image.pdf", None, bytes, None).unwrap();
+ for matrix in [[0.0, 0.0, 0.0, 1.0, 0.0, 0.0], [1.0, 1.0, 1.0, 1.0 + 1e-12, 0.0, 0.0], [1e308, 0.0, 0.0, 1e308, 0.0, 0.0]] {
+ let before = s.get(id).unwrap().bytes.clone();
+ assert!(s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(matrix) }).is_err());
+ assert_eq!(s.get(id).unwrap().bytes, before);
+ }
+}
diff --git a/crates/engine/src/text_fonts.rs b/crates/engine/src/text_fonts.rs
index 859bc1a6f8..e2b413d88d 100644
--- a/crates/engine/src/text_fonts.rs
+++ b/crates/engine/src/text_fonts.rs
@@ -32,17 +32,29 @@ pub fn installed_directories() -> Vec {
}
}
-/// Bounded, symlink-free scan. Only standalone, openly licensed, embeddable faces are listed.
+/// Bounded scan with resolved roots and no descendant symlinks.
+/// Only standalone, openly licensed, embeddable faces are listed.
/// The caller controls roots (automation resolves confinement before calling this).
pub fn discover(roots: &[PathBuf]) -> Vec {
+ discover_budgeted(roots, 64u64 << 20)
+}
+
+/// Bounded scan with resolved roots and no descendant symlinks. `budget` caps the total
+/// size of the fonts listed: a rejected file (unreadable, not openly licensed, a duplicate)
+/// does not spend it. Every file read
+/// counts against four times the budget, so a folder of unusable fonts cannot stall the scan.
+pub fn discover_budgeted(roots: &[PathBuf], mut budget: u64) -> Vec {
use std::io::Read;
- let mut pending: Vec<_> = roots.iter().take(16).map(|r| (r.clone(), 0usize)).collect();
+ // User font directories themselves are often links. Resolve only the explicitly
+ // supplied roots; links found below them must not escape an automation read root.
+ let mut pending: Vec<_> = roots.iter().take(16).filter_map(|r| r.canonicalize().ok()).map(|r| (r, 0usize)).collect();
let mut files = Vec::new();
let mut entries = 0usize;
- let mut budget = 64u64 << 20;
+ let mut read_allowance = budget.saturating_mul(4);
let mut seen = std::collections::HashSet::new();
+ let mut seen_face_content = std::collections::HashSet::new();
while let Some((path, depth)) = pending.pop() {
- if entries >= 4096 || budget == 0 {
+ if entries >= 4096 || budget == 0 || read_allowance == 0 {
break;
}
entries += 1;
@@ -53,26 +65,194 @@ pub fn discover(roots: &[PathBuf]) -> Vec {
if meta.is_dir() && depth < 4 {
if let Ok(children) = std::fs::read_dir(&path) {
let remaining = 4096usize.saturating_sub(entries.saturating_add(pending.len()));
- pending.extend(children.take(remaining).filter_map(Result::ok).map(|p| (p.path(), depth + 1)));
+ // Best effort: unreadable entries are skipped and do not count against the entry allowance.
+ let mut sorted_children: Vec<_> = children.filter_map(Result::ok).take(remaining).map(|p| p.path()).collect();
+ sorted_children.sort();
+ pending.extend(sorted_children.into_iter().rev().map(|p| (p, depth + 1)));
}
} else if meta.is_file() && meta.len() <= (16 << 20) && font_extension(&path) {
- if meta.len() > budget {
+ if meta.len() > budget || meta.len() > read_allowance {
continue;
}
- budget = budget.saturating_sub(meta.len());
+ read_allowance = read_allowance.saturating_sub(meta.len());
let mut bytes = Vec::new();
- let read = std::fs::File::open(&path).and_then(|f| f.take((16 << 20) + 1).read_to_end(&mut bytes));
- if read.is_err() || pdfcraft_fonts::embedding::validate_document_input(&bytes).is_err() {
+ let read = std::fs::File::open(&path).and_then(|f| f.take(meta.len().saturating_add(1)).read_to_end(&mut bytes));
+ if read.is_err() || bytes.len() != meta.len() as usize {
+ continue;
+ }
+ if pdfcraft_fonts::embedding::validate_document_input(&bytes).is_err() {
continue;
}
if let Ok((family, face)) = pdfcraft_fonts::embedding::names(&bytes) {
- files.push(FontFile { path, family, face });
+ let key = font_content_key(&bytes);
+ if seen_face_content.insert((face.clone(), key)) {
+ budget = budget.saturating_sub(meta.len());
+ files.push(FontFile { path, family, face });
+ }
}
}
}
files.sort_by(|a, b| a.face.cmp(&b.face).then(a.path.cmp(&b.path)));
files
}
+
+fn font_content_key(bytes: &[u8]) -> (usize, u64) {
+ use std::hash::{DefaultHasher, Hasher};
+ let mut h = DefaultHasher::new();
+ h.write(bytes);
+ (bytes.len(), h.finish())
+}
fn font_extension(path: &Path) -> bool {
path.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("ttf") || e.eq_ignore_ascii_case("otf"))
}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[cfg(unix)]
+ #[test]
+ fn a_linked_font_root_is_scanned_but_descendant_links_are_not() {
+ let root = std::env::temp_dir().join(format!("pdfcraft-font-links-{}", std::process::id()));
+ let real = root.join("real");
+ std::fs::create_dir_all(&real).unwrap();
+ let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+ std::fs::copy(&source, real.join("regular.ttf")).unwrap();
+ let link = root.join("linked");
+ std::os::unix::fs::symlink(&real, &link).unwrap();
+ std::os::unix::fs::symlink(&real, real.join("cycle")).unwrap();
+ std::os::unix::fs::symlink(source.with_file_name("Inter-Medium.ttf"), real.join("escape.ttf")).unwrap();
+ let found = discover(&[link]);
+ let expected = real.canonicalize().unwrap().join("regular.ttf");
+ std::fs::remove_dir_all(&root).unwrap();
+ assert_eq!(found.len(), 1);
+ assert_eq!(found.first().unwrap().face, "Inter-Regular");
+ assert_eq!(found.first().unwrap().path, expected);
+ }
+
+ #[test]
+ fn discovery_keeps_all_valid_faces_within_its_scan_budget() {
+ let root = std::env::temp_dir().join(format!("pdfcraft-font-count-{}", std::process::id()));
+ std::fs::create_dir_all(&root).unwrap();
+ let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+ let bytes = std::fs::read(source).unwrap();
+ for id in 0..501u32 {
+ let mut font = bytes.clone();
+ // Valid standalone fonts with distinct bytes: an unreferenced trailer
+ // does not change their tables or embedding licence.
+ font.extend_from_slice(&id.to_le_bytes());
+ std::fs::write(root.join(format!("font-{id:03}.ttf")), font).unwrap();
+ }
+ let found = discover_budgeted(std::slice::from_ref(&root), (bytes.len() as u64 + 4) * 501);
+ std::fs::remove_dir_all(&root).unwrap();
+ assert_eq!(found.len(), 501, "do not silently discard accepted fonts after sorting");
+ }
+
+ #[test]
+ fn test_installed_directories() {
+ let dirs = installed_directories();
+ assert!(!dirs.is_empty());
+ }
+
+ #[test]
+ fn test_font_extension() {
+ assert!(font_extension(Path::new("Arial.ttf")));
+ assert!(font_extension(Path::new("Noto.otf")));
+ assert!(font_extension(Path::new("CUSTOM.TTF")));
+ assert!(font_extension(Path::new("ROBOTO.OTF")));
+ assert!(!font_extension(Path::new("document.pdf")));
+ assert!(!font_extension(Path::new("font.woff")));
+ assert!(!font_extension(Path::new("font.woff2")));
+ assert!(!font_extension(Path::new("no_extension")));
+ }
+
+ #[test]
+ fn test_font_content_key() {
+ let empty = font_content_key(&[]);
+ assert_eq!(empty.0, 0);
+
+ let a = font_content_key(b"TrueType font sample data bytes");
+ let b = font_content_key(b"TrueType font sample data bytes");
+ let c = font_content_key(b"Different font sample data bytes");
+
+ assert_eq!(a, b, "identical bytes must produce identical keys");
+ assert_ne!(a, c, "differing bytes must produce distinct keys");
+ assert_eq!(a.0, b"TrueType font sample data bytes".len());
+ }
+
+ #[test]
+ fn test_discover_empty_and_nonexistent_roots() {
+ let empty = discover(&[]);
+ assert!(empty.is_empty());
+
+ let nonexistent = discover(&[PathBuf::from("Z:\\nonexistent_font_path_xyz_12345")]);
+ assert!(nonexistent.is_empty());
+ }
+
+ #[test]
+ fn test_discover_deduplicates_non_adjacent_same_content() {
+ let root = std::env::temp_dir().join(format!("pdfcraft-font-dedup-test-{}", std::process::id()));
+ let dir_a = root.join("a");
+ let dir_b = root.join("b");
+ let dir_c = root.join("c");
+ let _ = std::fs::create_dir_all(&dir_a);
+ let _ = std::fs::create_dir_all(&dir_b);
+ let _ = std::fs::create_dir_all(&dir_c);
+
+ let inter_reg = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+ let inter_med = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Medium.ttf");
+
+ if inter_reg.exists() && inter_med.exists() {
+ let _ = std::fs::copy(&inter_reg, dir_a.join("FontA.ttf"));
+ let _ = std::fs::copy(&inter_med, dir_b.join("FontB.ttf"));
+ let _ = std::fs::copy(&inter_reg, dir_c.join("FontC.ttf"));
+
+ let discovered = discover(std::slice::from_ref(&root));
+ let _ = std::fs::remove_dir_all(&root);
+
+ assert_eq!(discovered.len(), 2, "identical content in non-adjacent paths is deduplicated");
+ let faces: Vec<&str> = discovered.iter().map(|f| f.face.as_str()).collect();
+ assert!(faces.contains(&"Inter-Regular"));
+ assert!(faces.contains(&"Inter-Medium"));
+ } else {
+ let _ = std::fs::remove_dir_all(&root);
+ }
+ }
+
+ #[test]
+ fn rejected_fonts_do_not_spend_the_budget_and_the_order_is_deterministic() {
+ let root = std::env::temp_dir().join(format!("pdfcraft-font-budget-test-{}", std::process::id()));
+ let _ = std::fs::remove_dir_all(&root);
+ std::fs::create_dir_all(&root).unwrap();
+
+ let fonts = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts");
+ let reg_len = std::fs::metadata(fonts.join("Inter-Regular.ttf")).unwrap().len();
+ let med_len = std::fs::metadata(fonts.join("Inter-Medium.ttf")).unwrap().len();
+
+ // An unusable candidate, scanned first (sorted before the real fonts).
+ std::fs::write(root.join("00_candidate_invalid.ttf"), vec![0u8; 400_000]).unwrap();
+ std::fs::copy(fonts.join("Inter-Regular.ttf"), root.join("01_Inter-Regular.ttf")).unwrap();
+
+ // The budget fits Inter-Regular alone; the rejected file must not use it up first.
+ let run1 = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+ let run2 = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+ let faces = |run: &[FontFile]| run.iter().map(|f| (f.face.clone(), f.path.clone())).collect::>();
+ assert_eq!(run1.iter().map(|f| f.face.as_str()).collect::>(), ["Inter-Regular"], "a rejected file spends no budget");
+ assert_eq!(faces(&run1), faces(&run2));
+
+ // Accepted fonts do spend it: Inter-Medium no longer fits after Inter-Regular.
+ std::fs::copy(fonts.join("Inter-Medium.ttf"), root.join("02_Inter-Medium.ttf")).unwrap();
+ let one = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+ assert_eq!(one.iter().map(|f| f.face.as_str()).collect::>(), ["Inter-Regular"]);
+ let both = discover_budgeted(std::slice::from_ref(&root), reg_len + med_len);
+ assert_eq!(both.len(), 2);
+
+ // Reading stops at four times the budget, whatever was rejected.
+ for i in 0..4 {
+ std::fs::write(root.join(format!("00_unusable_{i}.ttf")), vec![0u8; reg_len as usize]).unwrap();
+ }
+ let capped = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+ let _ = std::fs::remove_dir_all(&root);
+ assert!(capped.is_empty(), "the read allowance ends the scan before the real fonts");
+ }
+}
diff --git a/crates/engine/src/text_script.rs b/crates/engine/src/text_script.rs
new file mode 100644
index 0000000000..04866eda60
--- /dev/null
+++ b/crates/engine/src/text_script.rs
@@ -0,0 +1,272 @@
+//! Superscript and subscript as Unicode characters (Edit a PDF ▸ Format text): `2` ↔ `²` and
+//! `2` ↔ `₂`.
+//!
+//! The text keeps its font, size and baseline; its characters change to the forms Unicode encodes
+//! for raised and lowered text, so the font must have those glyphs, and extracted text contains
+//! them. Characters Unicode has no such form for are left as they are.
+//!
+//! A selection mixing plain and target-script characters is normalized: `H₂2` becomes `H₂₂`,
+//! then `H22` on the next subscript toggle; superscript follows the same policy. Two toggles
+//! restore uniformly plain or uniformly scripted input, but do not reconstruct an original
+//! mixture. Restoring that exact prior text requires the caller's edit history (Undo).
+
+use std::ops::Range;
+
+/// Raised or lowered text.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Script {
+ Super,
+ Sub,
+}
+
+/// Each character Unicode raises, and its superscript form.
+const SUPERSCRIPT: &[(char, char)] = &[
+ ('0', '⁰'),
+ ('1', '¹'),
+ ('2', '²'),
+ ('3', '³'),
+ ('4', '⁴'),
+ ('5', '⁵'),
+ ('6', '⁶'),
+ ('7', '⁷'),
+ ('8', '⁸'),
+ ('9', '⁹'),
+ ('+', '⁺'),
+ ('−', '⁻'),
+ ('=', '⁼'),
+ ('(', '⁽'),
+ (')', '⁾'),
+ ('a', 'ᵃ'),
+ ('b', 'ᵇ'),
+ ('c', 'ᶜ'),
+ ('d', 'ᵈ'),
+ ('e', 'ᵉ'),
+ ('f', 'ᶠ'),
+ ('g', 'ᵍ'),
+ ('h', 'ʰ'),
+ ('i', 'ⁱ'),
+ ('j', 'ʲ'),
+ ('k', 'ᵏ'),
+ ('l', 'ˡ'),
+ ('m', 'ᵐ'),
+ ('n', 'ⁿ'),
+ ('o', 'ᵒ'),
+ ('p', 'ᵖ'),
+ ('r', 'ʳ'),
+ ('s', 'ˢ'),
+ ('t', 'ᵗ'),
+ ('u', 'ᵘ'),
+ ('v', 'ᵛ'),
+ ('w', 'ʷ'),
+ ('x', 'ˣ'),
+ ('y', 'ʸ'),
+ ('z', 'ᶻ'),
+ ('A', 'ᴬ'),
+ ('B', 'ᴮ'),
+ ('D', 'ᴰ'),
+ ('E', 'ᴱ'),
+ ('G', 'ᴳ'),
+ ('H', 'ᴴ'),
+ ('I', 'ᴵ'),
+ ('J', 'ᴶ'),
+ ('K', 'ᴷ'),
+ ('L', 'ᴸ'),
+ ('M', 'ᴹ'),
+ ('N', 'ᴺ'),
+ ('O', 'ᴼ'),
+ ('P', 'ᴾ'),
+ ('R', 'ᴿ'),
+ ('T', 'ᵀ'),
+ ('U', 'ᵁ'),
+ ('V', 'ⱽ'),
+ ('W', 'ᵂ'),
+];
+
+/// Each character Unicode lowers, and its subscript form.
+const SUBSCRIPT: &[(char, char)] = &[
+ ('0', '₀'),
+ ('1', '₁'),
+ ('2', '₂'),
+ ('3', '₃'),
+ ('4', '₄'),
+ ('5', '₅'),
+ ('6', '₆'),
+ ('7', '₇'),
+ ('8', '₈'),
+ ('9', '₉'),
+ ('+', '₊'),
+ ('−', '₋'),
+ ('=', '₌'),
+ ('(', '₍'),
+ (')', '₎'),
+ ('a', 'ₐ'),
+ ('e', 'ₑ'),
+ ('h', 'ₕ'),
+ ('i', 'ᵢ'),
+ ('j', 'ⱼ'),
+ ('k', 'ₖ'),
+ ('l', 'ₗ'),
+ ('m', 'ₘ'),
+ ('n', 'ₙ'),
+ ('o', 'ₒ'),
+ ('p', 'ₚ'),
+ ('r', 'ᵣ'),
+ ('s', 'ₛ'),
+ ('t', 'ₜ'),
+ ('u', 'ᵤ'),
+ ('v', 'ᵥ'),
+ ('x', 'ₓ'),
+];
+
+impl Script {
+ fn pairs(self) -> &'static [(char, char)] {
+ match self {
+ Script::Super => SUPERSCRIPT,
+ Script::Sub => SUBSCRIPT,
+ }
+ }
+
+ /// `c` raised or lowered, or `None` when Unicode has no distinct reversible form for it.
+ /// Mathematical minus U+2212 has a form; ASCII hyphen-minus stays unchanged to avoid a lossy collision.
+ pub fn form(self, c: char) -> Option {
+ self.pairs().iter().find(|(plain, _)| *plain == c).map(|&(_, form)| form)
+ }
+
+ /// The character `c` is the raised or lowered form of, or `None` when it is no such form.
+ pub fn plain(self, c: char) -> Option {
+ self.pairs().iter().find(|(_, form)| *form == c).map(|&(plain, _)| plain)
+ }
+}
+
+/// `range` (UTF-8 bytes of `text`) clamped to it and widened to whole characters, or all of `text`
+/// when there is none.
+fn span(text: &str, range: Option<&Range>) -> Range {
+ let Some(range) = range else { return 0..text.len() };
+ let mut start = range.start.min(text.len());
+ while !text.is_char_boundary(start) {
+ start = start.saturating_sub(1);
+ }
+ let mut end = range.end.min(text.len());
+ while !text.is_char_boundary(end) {
+ end = end.saturating_add(1);
+ }
+ start..end
+}
+
+/// Whether the characters of `text` in `range` (UTF-8 bytes; all of it when `None`) are already in
+/// `script`: at least one of them is, and none of the others could be. Characters Unicode has no
+/// form for (a space, a `q`) don't count toward that state.
+pub fn is_in(text: &str, range: Option<&Range>, script: Script) -> bool {
+ let target = text.get(span(text, range)).unwrap_or_default();
+ target.chars().any(|c| script.plain(c).is_some()) && target.chars().all(|c| script.plain(c).is_some() || script.form(c).is_none())
+}
+
+/// Superscript or Subscript on the characters of `text` in `range` (UTF-8 bytes; all of it when
+/// `None`): back to plain characters when they are already in `script` ([`is_in`]), and otherwise
+/// each character that has a form takes it. Returns the new text and the range the converted
+/// characters now take, or `None` when nothing changes.
+///
+/// Mixed plain/scripted input normalizes to the target script and then to plain text; for
+/// example, `H₂2` → `H₂₂` → `H22`. This stateless conversion does not remember the original
+/// mixture. Use edit history to restore it, rather than treating a second toggle as Undo.
+pub fn toggle(text: &str, range: Option<&Range>, script: Script) -> Option<(String, Range)> {
+ let span = span(text, range);
+ let target = text.get(span.clone()).filter(|t| !t.is_empty())?;
+ let converted: String = if is_in(text, Some(&span), script) {
+ target.chars().map(|c| script.plain(c).unwrap_or(c)).collect()
+ } else {
+ target.chars().map(|c| script.form(c).unwrap_or(c)).collect()
+ };
+ if converted == target {
+ return None;
+ }
+ let mut out = String::with_capacity(text.len().saturating_add(converted.len()));
+ out.push_str(text.get(..span.start).unwrap_or_default());
+ out.push_str(&converted);
+ out.push_str(text.get(span.end..).unwrap_or_default());
+ let end = span.start.saturating_add(converted.len());
+ Some((out, span.start..end))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn every_form_toggles_back_to_its_character() {
+ for script in [Script::Super, Script::Sub] {
+ for &(plain, form) in script.pairs() {
+ let s = plain.to_string();
+ let (raised, range) = toggle(&s, None, script).unwrap();
+ assert_eq!(raised, form.to_string());
+ assert_eq!(range, 0..raised.len());
+ assert_eq!(toggle(&raised, None, script).unwrap().0, s, "{script:?} {plain}");
+ }
+ }
+ assert_eq!(toggle("-", None, Script::Super), None);
+ assert_eq!(toggle("-", None, Script::Sub), None);
+ }
+
+ #[test]
+ fn review_script_round_trips_preserve_both_minus_characters() {
+ for script in [Script::Super, Script::Sub] {
+ let text = "−2 -3";
+ let once = toggle(text, None, script).unwrap().0;
+ assert_eq!(toggle(&once, None, script).unwrap().0, text);
+ }
+ }
+
+ #[test]
+ fn text_with_characters_unicode_cannot_raise_toggles_back() {
+ // q has no superscript form and Q no subscript one; the space neither.
+ for (script, text, toggled) in [(Script::Super, "x2 q", "ˣ² q"), (Script::Sub, "CO2 Q", "CO₂ Q")] {
+ let (once, _) = toggle(text, None, script).unwrap();
+ assert_eq!(once, toggled);
+ assert!(is_in(&once, None, script));
+ assert_eq!(toggle(&once, None, script).unwrap().0, text, "{script:?}");
+ }
+ // Nothing to raise: nothing changes.
+ assert_eq!(toggle("q Q", None, Script::Super), None);
+ assert!(!is_in("q Q", None, Script::Super));
+ }
+
+ #[test]
+ fn a_range_converts_only_its_characters_and_follows_them() {
+ let (text, range) = toggle("E = mc2", Some(&(6..7)), Script::Super).unwrap();
+ assert_eq!((text.as_str(), range.clone()), ("E = mc²", 6..8));
+ assert_eq!(toggle(&text, Some(&range), Script::Super).unwrap(), ("E = mc2".to_string(), 6..7));
+ // A mixed range takes the form throughout.
+ assert_eq!(toggle("H₂2", None, Script::Sub).unwrap().0, "H₂₂");
+ assert!(!is_in("H₂2", None, Script::Sub));
+ }
+
+ #[test]
+ fn mixed_plain_and_scripted_text_normalizes_instead_of_round_tripping() {
+ for (script, mixed, uniform, plain) in [(Script::Super, "Q²2", "Q²²", "Q22"), (Script::Sub, "H₂2", "H₂₂", "H22")] {
+ assert!(!is_in(mixed, None, script));
+ let (once, range) = toggle(mixed, None, script).unwrap();
+ assert_eq!(once, uniform);
+ assert_eq!(range, 0..uniform.len());
+ assert!(is_in(&once, None, script));
+ let (twice, range) = toggle(&once, None, script).unwrap();
+ assert_eq!(twice, plain);
+ assert_eq!(range, 0..plain.len());
+ assert_ne!(twice, mixed, "a second toggle normalizes the original mixture");
+ assert_eq!(toggle(&twice, None, script).unwrap().0, uniform);
+ }
+ }
+
+ #[test]
+ fn hostile_ranges_are_clamped_to_whole_characters() {
+ // Byte 1 is inside ²: widened to the whole character on each side.
+ assert_eq!(toggle("²x", Some(&(1..1)), Script::Super).unwrap(), ("2x".to_string(), 0..1));
+ assert_eq!(toggle("²x", Some(&(2..2)), Script::Super), None);
+ assert_eq!(toggle("x2", Some(&(1..usize::MAX)), Script::Super).unwrap(), ("x²".to_string(), 1..3));
+ assert_eq!(toggle("x2", Some(&(5..9)), Script::Super), None);
+ #[allow(clippy::reversed_empty_ranges)]
+ let backwards = 2..1;
+ assert_eq!(toggle("x2", Some(&backwards), Script::Super), None);
+ assert_eq!(toggle("", None, Script::Sub), None);
+ assert!(!is_in("", None, Script::Sub));
+ }
+}
diff --git a/crates/filters/Cargo.toml b/crates/filters/Cargo.toml
index aa8aaa0c4d..bfb930fe5f 100644
--- a/crates/filters/Cargo.toml
+++ b/crates/filters/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "pdfcraft-filters"
-description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding and Group 3 and 4 decoding"
+description = "PDF stream filters (ISO 32000-2 §7.4): Flate, LZW, predictors, ASCII85, ASCIIHex, RunLength, CCITT Group 4 encoding and Group 3 and 4 decoding, JBIG2 encoding and decoding"
version.workspace = true
edition.workspace = true
license.workspace = true
@@ -12,13 +12,12 @@ workspace = true
[dependencies]
fax.workspace = true
-# CCITT fax decoding (`decode_ccitt`); already in the tree through hayro.
+# CCITT fax and JBIG2 decoding (`decode_ccitt`, `decode_jbig2`); already in the tree through hayro.
hayro-ccitt.workspace = true
+hayro-jbig2.workspace = true
flate2.workspace = true
thiserror.workspace = true
[dev-dependencies]
-hayro-ccitt.workspace = true
-hayro-jbig2.workspace = true
proptest.workspace = true
weezl.workspace = true
diff --git a/crates/filters/README.md b/crates/filters/README.md
index 0c34857c43..90e1485177 100644
--- a/crates/filters/README.md
+++ b/crates/filters/README.md
@@ -3,7 +3,7 @@
PDF stream filters: the decoders and encoders behind `/Filter` and `/DecodeParms`.
- **Layer:** L0, standalone. No dependency on any other PdfCraft crate. `cos` depends on it (architecture §3 rule 3).
-- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder; CCITT decoding (T.4 and T.6) is the `hayro-ccitt` crate's (MIT OR Apache-2.0, already in the tree through hayro), bounded here. JBIG2 generic region encoding is written from the public ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999); Annex H.2 checks the arithmetic coder byte for byte.
+- **Licence:** MIT OR Apache-2.0. Clean-room: written from ISO 32000-2 §7.4, RFC 1950/1951 (through `flate2` with the pure-Rust `miniz_oxide` backend), TIFF 6.0 §14 (predictor 2) and RFC 2083 §6 (PNG filters). CCITT Group 4 encoding (ITU-T T.6) is the `fax` crate's (MIT, already in the tree through `tiff`), checked here by round trips through an independent decoder; CCITT decoding (T.4 and T.6) is the `hayro-ccitt` crate's, and JBIG2 decoding the `hayro-jbig2` crate's (both MIT OR Apache-2.0, already in the tree through hayro), bounded here. JBIG2 generic region encoding is written from the public ISO/IEC 14492 Final Committee Draft (WG1 N1359, 1999); Annex H.2 checks the arithmetic coder byte for byte.
- `#![forbid(unsafe_code)]`. Builds for `wasm32-unknown-unknown`.
@@ -15,17 +15,20 @@ Filter::from_name(b"FlateDecode" | b"Fl" | ...) -> Filter // full names and in
Filter::name(&self) -> &str; Filter::is_image_codec(&self) -> bool
pub struct Params { predictor, colors, bits_per_component, columns, early_change } // i64s; Default = 1, 1, 8, 1, 1
-pub enum FilterError { Corrupt { filter, detail }, LimitExceeded(usize), Unsupported(String) }
+pub enum FilterError { Corrupt { filter, detail }, LimitExceeded(usize), Unsupported(String), Spent }
decode(chain, data, max_output) -> Result, FilterError>
decode_counted(chain, data, max_output) -> Result<(Vec, usize /*decoded*/), (FilterError, usize /*decoded*/)>
decode_tolerant(chain, data, max_output) -> Result<(Vec, bool /*partial*/), FilterError>
decode_tolerant_counted(chain, data, max_output) -> Result<(Vec, bool /*partial*/, usize /*decoded*/), (FilterError, usize /*decoded*/)>
+decode_tolerant_within(chain, data, max_output, work: &mut u64) -> Result, FilterError>
+decode_within(chain, data, max_output, work: &mut u64) -> Result, FilterError>
encode(filter, params, data) -> Result, FilterError>
encode_flate(data) -> Vec // zlib, level 6
encode_g4(data, columns, rows) -> Result, FilterError> // 1-bit rows as CCITT Group 4; columns <= MAX_G4_COLUMNS
pub struct CcittParams { k, columns, rows, end_of_line, encoded_byte_align, end_of_block, black_is_1 } // Table 11; Default = its defaults
decode_ccitt(data, ¶ms, max_rows) -> Result, FilterError> // CCITT fax as CCITTFaxDecode gives it; columns <= MAX_CCITT_COLUMNS
+decode_jbig2(data, globals, columns, rows, max) -> Result, FilterError> // JBIG2 as JBIG2Decode gives it; a page of columns × rows, within max and MAX_JBIG2_PIXELS
encode_jbig2_generic(data, columns, rows) -> Result, FilterError> // 1-bit rows as lossless JBIG2 for JBIG2Decode; columns <= MAX_JBIG2_COLUMNS
encode_jbig2(data, columns, rows) -> Result, FilterError> // 1-bit rows as lossless JBIG2 for JBIG2Decode, symbol coded when that is smaller; columns <= MAX_JBIG2_COLUMNS
```
@@ -34,6 +37,7 @@ encode_jbig2(data, columns, rows) -> Result 
| **VectorCraft** | Vector illustration | [GitHub](https://github.com/storytold/vectorcraft) | [Website](https://getartcraft.com/apps/vectorcraft) |
| 
| **FilmCraft** | Video editing, color and sound | [GitHub](https://github.com/storytold/filmcraft) | [Website](https://getartcraft.com/apps/filmcraft) |
| 
| **LightCraft** | Photo library and raw development | [GitHub](https://github.com/storytold/lightcraft) | [Website](https://getartcraft.com/apps/lightcraft) |
-| 
| **PdfCraft** | **Reading, organizing and protecting PDFs · you are here** | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
+| 
| **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
| 
| **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
+| 
| **FigCraft** | Interface design and prototyping | [GitHub](https://github.com/storytold/figcraft) | [Website](https://getartcraft.com/apps/figcraft) |
+| 
| **WordCraft** | Word processing and documents | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
+| 
| **SoundCraft** | Audio recording and editing | [GitHub](https://github.com/storytold/soundcraft) | [Website](https://getartcraft.com/apps/soundcraft) |
+| 
| **DeckCraft** | Presentations and slide decks | [GitHub](https://github.com/storytold/deckcraft) | [Website](https://getartcraft.com/apps/deckcraft) |
+| 
| **CADCraft** | Computer-aided design | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
+| 
| **GridCraft** | Spreadsheets and data | [GitHub](https://github.com/storytold/gridcraft) | [Website](https://getartcraft.com/apps/gridcraft) |
+| 
| **TextureCraft** | 3D texture painting | [GitHub](https://github.com/storytold/texturecraft) | [Website](https://getartcraft.com/apps/texturecraft) |
+| 
| **Craft Anything** | See how any software works, then build your own | [GitHub](https://github.com/storytold/craft-anything) | [Website](https://getartcraft.com/apps/craft-anything) |
+| 
| **SolidCraft** | Parametric 3D CAD by Tangency Labs (community app) | [GitHub](https://github.com/tangency-labs/solidcraft) | |
And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video studio for artists who want real control.
diff --git a/ROADMAP.md b/ROADMAP.md
index 5a8f9ab294..c0f1823c7f 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,11 @@
# PdfCraft roadmap
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 further review: inherited drawing/text state, affine image gestures, paste/selection ownership, no-op scripts and menu permissions; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 latest comments: explicit image-paste events, mixed-size field refresh, and documented mixed-script normalization with Undo; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 review follow-up: preserve image crop/tag/stream ownership, resize in page orientation, harden clipboard and text formatting, and reload installed fonts; estimates unchanged)
+
> **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
> **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
> **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
@@ -213,6 +219,18 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
## Progress log
+- **2026-11-01 (M7, #5657):** Header/footer, watermark and background additions and replacements stage the complete call before committing. Synthetic later-page failures preserve exact incremental bytes, object count, dirty state and allocation cursor; success controls retain other marks and shared/inherited resources. Estimates unchanged.
+
+- **2026-11-01 (M14, #5572):** Preferences ▸ Documents and view sets how many recent files to keep, from 0 to 50 with 12 by default. At 0 Home has no Recent section and File ▸ Open Recent is disabled. The list is cut when Preferences closes, so the number can pass through 0 on its way to another.
+
+- **2026-11-01 (M5/M14, customizable hotbar, freehand highlight, and moveable navigation rail):** Added Freehand-Highlight (`/Subtype /Ink`, `/IT /FreehandHighlight`, Multiply blending, 100 pt max line width) inside the standard Highlight flyout and headless `comment_add`; added a customizable floating or side-docked hotbar with a full-side chrome strip mode, settings gear icon anchored at the bar end, and 24–64 px sizing; and added Left/Right docking for the navigation rail (`rail_side`). Focused unit and integration tests pass across `annot`, `automation`, and `ui-egui`. Estimates unchanged.
+- 2026-11-01: PR #2155 further review preserves inherited Form text state and soft-mask chronology during Arrange, composes crop-group moves in the proper scope, and uses affine/press-relative image resize plus a shared rotation pivot. No-op script buttons preserve hidden source text; paste coordinates, visible selection ownership, and Snapshot/Export permissions have dedicated regressions. Candidate only; estimates unchanged.
+
+- 2026-11-01: PR #2155 latest follow-up handles explicit image-paste events without release-time guesses, refreshes the font-size field when a selection becomes mixed, and specifies mixed-script normalization with exact Undo restoration. Candidate only; estimates unchanged.
+
+- 2026-11-01: PR #2155 review follow-up preserves editor crops through group moves and keeps arranged artwork outside added-item streams; unsafe nested-tag extraction is refused. Image handles and flips follow page orientation, added images accept general transforms, and clipboard/text/Home/font-discovery edge cases have focused regressions. Candidate only; estimates unchanged.
+- 2026-11-01: PR #2155 maintainer edits remove redundant image/text helpers and add regressions for crop ownership, arrange scope/state fidelity, clipboard precedence, crop-drag bounds, and font scanning. Transform and Unicode-script tools complete the headless paths.
+
- **2026-10-18 (M3, #1354, local candidate):** Integrated --two-paged with current main, retaining upstream modal/picker ownership and single-tab reuse. Native launch/opening/password regressions, negative checks against the old wrapper, visual inspection, formatting, strict scoped Clippy, layers, assets, parity and scoped WASM compilation pass. Three existing socket tests are unavailable in this workspace; one existing network test remains ignored. No push or GitHub merge; estimates unchanged.
- **2026-10-31 (M2, PR #4172 review):** Added same-machine pixel oracles for GBK Song, Hei, Kai and FangSong, including all four subset-prefixed Founder aliases. Reference PDFs use explicit Unicode mappings and independently selected installed faces; font data and rasters remain in memory. All eight cases ran; wrong-glyph and wrong-family production mutations each failed the new assertion and were restored. Validation: 422 renderer unit tests, renderer all-target Clippy with -D warnings, formatting, layers/assets/parity and renderer WASM checks passed; existing optional-patch/WASM warnings and parity notes remain. Estimates unchanged.
@@ -728,6 +746,7 @@ Newest first: the date, what moved, and the new overall estimate.
| Date | Change | Summary |
|---|---|---|
+| 2026-11-01 | patch | M7 #5657: header/footer, watermark and background operations commit all selected pages together; later-page errors preserve marks, content, shared/inherited resources and pending edits; estimates unchanged. |
| 2026-10-28 | patch | M2, PR #4172: integrate main 5af10276 and retain both roadmap histories; viewer-only CJK and print/output font policies and estimates unchanged. |
| 2026-10-27 | minor | M10: OCR stages SHA-256-verified ONNX models after the upstream RTEN URL brownout; discovery prefers a complete ONNX pair per directory, falls back to a complete RTEN pair, and never mixes formats or directories; language/web limits and estimates unchanged. |
| 2026-10-23 | minor | M8, #3205 follow-up: phone-pattern redaction includes the +39 country code on labelled Italian geographic numbers with a slash; dates, protocol identifiers and whole-run guards remain. Estimates unchanged. |
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index d2a75c5941..5bc5c5c372 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -10,7 +10,7 @@
//! --theme light|dark|system --language auto|