Merge upstream main into keymap-batch

vendor/README.craft-reader.md

@@ -71,6 +71,15 @@ Hostile-input bounds (CodeRabbit findings):
 - A CID font's `/W2` run that starts past CID 65535 is skipped as in `/W`, instead of
   overflowing and discarding the whole table.
 
+Reader limits from the [PdfCraft revision a2ec27b4775f53c40cad3456936d9406611e3a8d ledger](https://github.com/storytold/pdfcraft/blob/a2ec27b4775f53c40cad3456936d9406611e3a8d/vendor/README.md),
+by its item ids: hayro-interpret (31), its overflow part: the largest 32-bit Type 0 sample is
+computed in 64 bits instead of overflowing `2_u32.pow(32)`. The flat sample array that (31)
+also brings is a performance change and is not part of this set. hayro-syntax (7), (22) and
+(25) are covered by the local bounds above: ASCII85 output stops at the decode limit,
+object-stream indexes are parsed once with checked offsets, and direct objects nest at most
+64 levels, stricter than PdfCraft's 128. Test:
+`function::type0::tests::thirty_two_bit_samples_do_not_overflow`.
+
 This remains the patched 0.7 backend. It retains the existing Bradford Lab conversion,
 floating component precision and codec versions, rather than claiming full 0.8
 equivalence. The independent color oracles, backend tests and facade contracts cover

vendor/hayro-interpret/SOURCE.json

@@ -332,7 +332,7 @@
       "path": "src/function/type0.rs",
       "source_sha256": "84cb6ccb45536ca5731394558883350f43b5e66330e07eb8d5a0e070c8e20704",
       "source_git_blob": "02bbc41b84caddc9b5dfc8f49b2da081eb281199",
-      "sha256": "84cb6ccb45536ca5731394558883350f43b5e66330e07eb8d5a0e070c8e20704"
+      "sha256": "89aab3f20d8c3c30629dbccc18ce099a39eff7e4a88b4ef4685fc0415008c233"
     },
     {
       "path": "src/function/type2.rs",

vendor/hayro-interpret/src/function/type0.rs

@@ -133,18 +133,12 @@ impl Type0 {
 
         let interpolated = interpolator.interpolate(&self.table)?;
 
+        // PdfCraft patch (31): `2_u32.pow(32)` overflowed (a panic with overflow checks on).
+        let max_sample = ((1u64 << self.bits_per_sample) - 1) as f32;
         let mut out = interpolated
             .iter()
             .zip(self.decode.iter())
-            .map(|(x, decode)| {
-                interpolate(
-                    *x,
-                    0.0,
-                    (2_u32.pow(self.bits_per_sample as u32) - 1) as f32,
-                    decode.0,
-                    decode.1,
-                )
-            })
+            .map(|(x, decode)| interpolate(*x, 0.0, max_sample, decode.0, decode.1))
             .collect::<SmallVec<_>>();
 
         self.clamper.clamp_output(&mut out);
@@ -325,3 +319,24 @@ impl Key {
         Some(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::function::Function;
+    use hayro_syntax::object::{FromBytes, Object};
+    use smallvec::smallvec;
+
+    /// PdfCraft patch (31): 32-bit samples scale by `2^32 - 1` without overflowing (adapted from
+    /// PdfCraft's `raster::tests::sampled_functions_interpolate_their_grid_as_before`).
+    #[test]
+    fn thirty_two_bit_samples_do_not_overflow() {
+        let mut data = b"<< /FunctionType 0 /Domain [0 1] /Range [0 1] /Size [2] /BitsPerSample 32 /Length 8 >>\nstream\n".to_vec();
+        data.extend_from_slice(&[0, 0, 0, 0, 0xff, 0xff, 0xff, 0xff]);
+        data.extend_from_slice(b"\nendstream");
+
+        let object = Object::from_bytes(&data).unwrap();
+        let function = Function::new(&object).unwrap();
+        assert_eq!(function.eval(smallvec![0.0]).unwrap().as_slice(), &[0.0]);
+        assert_eq!(function.eval(smallvec![1.0]).unwrap().as_slice(), &[1.0]);
+    }
+}