review: refuse an eraser result that exceeds the stored ink point cap

crates/annot/src/modify.rs

@@ -875,6 +875,12 @@ pub fn erase_ink(doc: &mut Document, page: usize, index: usize, path: &[[f64; 2]
         delete_annotation(doc, page, index)?;
         return Ok(true);
     }
+    // The retained runs are stored as the new `/InkList`: past the cap, writing them would leave a
+    // drawing that later `resize_ink` and `erase_ink` refuse to read.
+    let points: usize = kept.iter().map(Vec::len).sum();
+    if points > MAX_STORED_INK_POINTS {
+        return Err(AnnotError::Invalid(format!("the drawing has more than {MAX_STORED_INK_POINTS} points")));
+    }
     let width = d.get(b"BS").and_then(|b| b.as_dict()).and_then(|b| b.get(b"W")).and_then(|w| w.as_f64()).unwrap_or(1.0);
     let rect = grow(bounds(kept.iter().flatten().copied()).unwrap_or_default(), width / 2.0 + 1.0);
     doc.update_dict(r, |d| {