Dylan M. Taylor
81e1dcec5a
The bridge fell back to decoding in the calling process whenever no worker was configured, or the worker failed to start, which is exactly the case the audit called out: acadrust allocates from sizes a hostile file declares, and an allocation failure or stack overflow ends the process. Conversions are now refused without a worker, a worker that cannot start is an error, and allow_in_process() is the explicit opt-in for input known to be trusted.
craft-dwg
A byte-level bridge between DWG and DXF. It does not expose acadrust types: callers pass bytes,
choose limits, and receive converted bytes plus notes about data the conversion could not preserve.
Application document mapping remains with the caller.
The default limits reject DWG inputs over 512 MiB and stop DXF output over 1 GiB. The bridge
also catches panics from the dependency and validates its conversion diagnostics. Because a small
hostile file can declare very large internal sections, size checks alone cannot prevent an
allocation failure inside the decoder. On native applications, call use_own_worker() during
startup and call serve_if_asked() before normal argument handling. Subsequent decode and
encode_* calls then run in a child process with a 30-minute timeout; a crash or stack overflow
is contained to that child. The worker has no operating-system memory limit yet. Without a
configured worker, conversions are refused rather than run in the current process: call
allow_in_process() only for input that is known to be trusted (tests, or bytes this process
produced itself). Coordinates, once a worker is configured but cannot start, also fail closed.
The bridge is not built for wasm32 or FreeBSD/aarch64. Those targets retain the public API and
return a clear unsupported-build error. The acadrust 0.6.6 dependency is used unmodified under
MPL-2.0; its license and third-party notices are in licenses/dwg/ at the workspace root.