diff --git a/crates/forms/README.md b/crates/forms/README.md index ba9dc18f48..0c8f5ad9b9 100644 --- a/crates/forms/README.md +++ b/crates/forms/README.md @@ -50,7 +50,10 @@ let cells: Vec = grid.cells_for(names)?; // "Table1_1", "Table keeps it: `/V` is stored as typed, the appearance draws `?` for those characters, the widget is marked with the first one (`pdfcraft_fonts::UNDRAWN_MARK`, cleared once all of it can be drawn) and the form sets `/NeedAppearances`, so other viewers draw the field from its value with fonts - that have them. Not in a document that declares PDF/A, which forbids that flag (`declares_pdfa`). + that have them. Not in a document that declares PDF/A, which forbids that flag (`declares_pdfa`: + the bytes `pdfaid:part` in XMP metadata each filter stage of which decodes within 8 MiB, the cap + preflight's Standards panel reads it with; preflight reads the identifier by its namespace, so a + packet that gives that namespace another prefix declares PDF/A there and not here). `undrawn_fields` lists the marked fields; the engine reports each edit that draws one, and flattening refuses to make that `?` permanent. - Displaying a form that leaves its appearances to the viewer (`/NeedAppearances`, or a text or diff --git a/crates/forms/src/appearances.rs b/crates/forms/src/appearances.rs index 64569fa3ca..02c1eec5bc 100644 --- a/crates/forms/src/appearances.rs +++ b/crates/forms/src/appearances.rs @@ -212,13 +212,24 @@ impl FieldAppearanceCache { } } -/// Whether the document's XMP metadata declares PDF/A conformance (`pdfaid:part`). +/// The most each filter stage of the XMP metadata stream may decode for its PDF/A declaration to +/// be read, the cap preflight's Standards panel reads it with: past it, metadata declares nothing +/// there either. +pub(crate) const MAX_XMP_BYTES: usize = 8 << 20; + +/// Whether the document's XMP metadata declares PDF/A conformance (the bytes `pdfaid:part`). +/// Metadata a filter stage of which decodes past [`MAX_XMP_BYTES`] doesn't. pub fn declares_pdfa(doc: &Document) -> bool { let Some(root) = doc.root() else { return false }; let Some(m) = doc.get(root).as_dict().and_then(|c| c.get(b"Metadata").cloned()) else { return false }; let m = doc.resolve(&m); match &*m { - Object::Stream(s) => s.decoded().is_ok_and(|b| b.windows(11).any(|w| w == b"pdfaid:part")), + // Not a `DecodeBudget`, which counts every stage against one allowance: preflight bounds + // each stage, and the two must agree on metadata stored through a chain of filters. + // `/DecodeParms` is read only when direct, as preflight and organize read metadata too: + // PDF/A asks for it unfiltered, so only a file that breaks that reaches parameters here, + // and the readers go to `with_direct_parms` together or they disagree. + Object::Stream(s) => s.decoded_within(MAX_XMP_BYTES).is_ok_and(|b| b.windows(11).any(|w| w == b"pdfaid:part")), _ => false, } } diff --git a/crates/forms/src/author/edit.rs b/crates/forms/src/author/edit.rs index 2d05600ae2..6bb62cfb73 100644 --- a/crates/forms/src/author/edit.rs +++ b/crates/forms/src/author/edit.rs @@ -583,10 +583,15 @@ fn apply_late_widget_props( } /// Name field `old` `new` in each field's Calculate script that reads it -/// ([`crate::af::rename_in_calculation`]). +/// ([`crate::af::rename_in_calculation`]). Script streams share one budget, as a reading of the +/// form's scripts does, however many fields name the same stream; past it, a script is left as +/// it is, like one that won't decode. A Calculate action several fields share by reference is +/// read and rewritten once, in place, so they all read the new name. fn rename_in_calculations(doc: &mut Document, all: &[Field], old: &str, new: &str) -> Result<(), FormError> { let aa_of = |doc: &Document, r: ObjRef| doc.get(r).as_dict().and_then(|d| d.get(b"AA").map(|a| doc.resolve(a))).and_then(|a| a.as_dict().cloned()); + let mut scripts = crate::script_budget(); + let mut shared = std::collections::HashSet::new(); for f in all { // The script is the field's, or its only widget's when the field has none, as // `actions_of` reads it. @@ -595,12 +600,16 @@ fn rename_in_calculations(doc: &mut Document, all: &[Field], old: &str, new: &st _ => None, }; let Some((owner, mut aa)) = aa_of(doc, f.obj).map(|aa| (f.obj, aa)).or_else(only_widget) else { continue }; + let by_ref = aa.get(b"C").and_then(Object::as_ref); + if by_ref.is_some_and(|r| !shared.insert(r)) { + continue; + } let Some(mut action) = aa.get(b"C").and_then(|a| doc.resolve(a).as_dict().cloned()) else { continue }; let js = match action.get(b"JS").map(|js| doc.resolve(js)).as_deref() { Some(Object::String(s)) => s.to_text(), // A stream that isn't UTF-8 reads with replacement characters, which must not be // written back in place of what it holds. - Some(Object::Stream(s)) => match s.decoded().ok().and_then(|b| String::from_utf8(b).ok()) { + Some(Object::Stream(s)) => match scripts.decode(s).ok().and_then(|b| String::from_utf8(b).ok()) { Some(js) => js, None => continue, }, @@ -608,6 +617,10 @@ fn rename_in_calculations(doc: &mut Document, all: &[Field], old: &str, new: &st }; let Some(js) = crate::af::rename_in_calculation(&js, old, new) else { continue }; action.set(b"JS".to_vec(), PdfString::text(&js)); + if let Some(r) = by_ref { + doc.update_dict(r, |d| *d = action)?; + continue; + } aa.set(b"C".to_vec(), Object::Dict(action)); doc.update_dict(owner, |d| d.set(b"AA".to_vec(), Object::Dict(aa)))?; } diff --git a/crates/forms/src/detect.rs b/crates/forms/src/detect.rs index 386671f433..94ad7adb37 100644 --- a/crates/forms/src/detect.rs +++ b/crates/forms/src/detect.rs @@ -6,7 +6,7 @@ //! the shapes from a page's content, [`raster::shapes`] from a picture of the page (a scan). use pdfcraft_content::{Matrix, Pieces}; -use pdfcraft_cos::{Document, Object}; +use pdfcraft_cos::{DecodeBudget, Document, Object}; pub mod raster; @@ -49,6 +49,60 @@ pub struct Candidate { /// points along its sides (#2942: a cell drawn with a midpoint on each vertical side). const MAX_RECT_POINTS: usize = 16; +/// Graphics states saved (`q`) and kept at once while detecting; deeper saves are counted, not kept. +const MAX_SAVES: usize = 256; + +/// The graphics states a page saves (`q`) as detection follows its matrix: at most [`MAX_SAVES`] +/// kept, deeper ones counted so each `Q` still closes its own. Of those not kept: the matrix when +/// the first was made, which closing the last restores; the shallowest a `cm` changed the matrix +/// in; and whether a `Q` has closed that one, so the matrix isn't known until the last closes. +struct Saves { + kept: Vec, + lost: usize, + lost_base: Matrix, + moved_at: usize, + unknown: bool, +} + +impl Default for Saves { + fn default() -> Self { + Saves { kept: Vec::new(), lost: 0, lost_base: Matrix::IDENTITY, moved_at: usize::MAX, unknown: false } + } +} + +impl Saves { + fn save(&mut self, ctm: Matrix) { + if self.kept.len() < MAX_SAVES && self.lost == 0 { + self.kept.push(ctm); + } else { + if self.lost == 0 { + self.lost_base = ctm; + } + self.lost = self.lost.saturating_add(1); + } + } + + fn restore(&mut self, ctm: &mut Matrix) { + if self.lost == 0 { + *ctm = self.kept.pop().unwrap_or(*ctm); + return; + } + self.lost -= 1; + if self.lost == 0 { + (*ctm, self.moved_at, self.unknown) = (self.lost_base, usize::MAX, false); + } else if self.lost < self.moved_at { + self.unknown = true; + } + } + + /// A `cm` changed the matrix at the current depth. + fn moved(&mut self) { + if self.lost > 0 { + self.moved_at = self.moved_at.min(self.lost); + } + } +} + /// The rectangles and horizontal segments a page draws (stroked or filled), in user space. #[derive(Default)] struct DetectionPath { @@ -125,7 +179,15 @@ impl DetectionPath { } } +/// The shapes page `page`'s content draws, its streams decoded within one page's allowance +/// ([`DecodeBudget::page`]), however often `/Contents` lists the same stream. pub fn page_shapes(doc: &Document, page: usize) -> Shapes { + shapes_within(doc, page, &mut DecodeBudget::page()) +} + +/// [`page_shapes`], decoding against `budget`: a stream `/Contents` lists again is charged again, +/// and one past what is left reads as empty. +pub(crate) fn shapes_within(doc: &Document, page: usize, budget: &mut DecodeBudget) -> Shapes { let mut out = Shapes::default(); let Some(p) = pdfcraft_model::pages(doc).into_iter().nth(page) else { return out }; let list: Vec = match p.dict.get(b"Contents").map(|c| doc.resolve(c)) { @@ -139,24 +201,36 @@ pub fn page_shapes(doc: &Document, page: usize) -> Shapes { let mut pieces = Vec::new(); for o in list { if let Object::Stream(s) = &*doc.resolve(&o) { - pieces.push(s.decoded().unwrap_or_default()); + pieces.push(budget.decode(s).unwrap_or_default()); } } let mut ctm = Matrix::IDENTITY; - let mut stack = Vec::new(); + let mut saves = Saves::default(); let mut path_boxes: Vec<[f64; 4]> = Vec::new(); let mut subpaths: Vec = Vec::new(); let mut path = DetectionPath::default(); let mut cur: Option<[f64; 2]> = None; - for op in Pieces::join(&pieces).parse().ops { + let joined = Pieces::join(&pieces); + drop(pieces); + // An operator at a time: dense content (`n n n …`) parsed whole holds about 80 bytes for each + // byte it decoded. + for op in pdfcraft_content::ops(joined.data()) { match op.op.as_slice() { - b"q" => stack.push(ctm), - b"Q" => ctm = stack.pop().unwrap_or(ctm), + b"q" => saves.save(ctm), + b"Q" => saves.restore(&mut ctm), b"cm" => { if let Some(m) = op.nums::<6>() { ctm = Matrix(m).then(&ctm); + saves.moved(); } } + // Painted where the matrix isn't known: dropped, as `n` drops a path. + b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" if saves.unknown => { + path_boxes.clear(); + subpaths.clear(); + path = DetectionPath::default(); + cur = None; + } b"re" => { path.finish(&mut subpaths); if let Some([x, y, w, h]) = op.nums::<4>() { diff --git a/crates/forms/src/read.rs b/crates/forms/src/read.rs index e689c0e813..34775ee75e 100644 --- a/crates/forms/src/read.rs +++ b/crates/forms/src/read.rs @@ -192,11 +192,17 @@ fn actions_of(doc: &Document, d: &Dict, widgets: &[ObjRef], scripts: &mut Decode out } -fn values_of(doc: &Document, o: Option<&Object>) -> Vec { +/// Text streams of field values (`/V`, `/DV`) one reading of the form may decode in all, however +/// many fields name the same stream. +pub(crate) const MAX_VALUE_BYTES: usize = 64 << 20; + +/// A field's value or default value (`/V`, `/DV`). A text stream is decoded against `budget`, and +/// reads as no value once it is spent, as one that won't decode does. +fn values_of(doc: &Document, o: Option<&Object>, budget: &mut DecodeBudget) -> Vec { let Some(o) = o else { return Vec::new() }; match &*doc.resolve(o) { Object::Array(a) => a.iter().filter_map(|x| text_of(&doc.resolve(x))).collect(), - Object::Stream(s) => s.decoded().ok().map(|b| PdfString::literal(b).to_text()).into_iter().collect(), + Object::Stream(s) => budget.decode(s).ok().map(|b| PdfString::literal(b).to_text()).into_iter().collect(), other => text_of(other).filter(|s| s != "Off" && !s.is_empty()).into_iter().collect(), } } @@ -345,7 +351,12 @@ pub(crate) fn enumerate(doc: &Document) -> (Vec, usize) { None => Inherited::default(), }; let mut out = Vec::new(); - let mut seen = Seen { fields: std::collections::HashSet::new(), widgets: std::collections::HashSet::new(), scripts: script_budget() }; + let mut seen = Seen { + fields: std::collections::HashSet::new(), + widgets: std::collections::HashSet::new(), + scripts: script_budget(), + values: DecodeBudget::new(MAX_VALUE_BYTES, 0), + }; if let Some(af) = &af { for f in af.get(b"Fields").map(|o| doc.resolve(o)).and_then(|o| o.as_array().cloned()).unwrap_or_default() { if let Some(r) = f.as_ref() { @@ -416,13 +427,14 @@ fn unlisted_root(doc: &Document, r: ObjRef, seen: &std::collections::HashSet, /// A widget belongs to the first field that lists it, however often it is listed. widgets: std::collections::HashSet, scripts: DecodeBudget, + values: DecodeBudget, } /// Read the field at `r` and the fields under it into `out`, with what they inherit from @@ -549,8 +561,8 @@ fn walk( name: inh.name.clone(), obj: r, kind, - value: values_of(doc, inh.v.as_ref()), - default: values_of(doc, inh.dv.as_ref()), + value: values_of(doc, inh.v.as_ref(), &mut seen.values), + default: values_of(doc, inh.dv.as_ref(), &mut seen.values), flags: ff, max_len: inh.max_len, options, diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs index cca4cb4881..38b5f5059f 100644 --- a/crates/forms/src/tests.rs +++ b/crates/forms/src/tests.rs @@ -3575,6 +3575,149 @@ fn repeated_script_references_share_one_decode_budget() { assert!(calculate > 0 && calculate <= limit, "{calculate} bytes of field scripts"); } +/// An unfiltered stream of `body`, as an object of [`document`]. +fn raw_stream(body: &str) -> String { + format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()) +} + +/// 300 fields whose value is one 1 MiB text stream: a reading of the form decodes their values +/// within one budget, not 300 MiB. +#[test] +fn repeated_value_streams_share_one_decode_budget() { + let fields_list: String = (0..300).map(|i| format!("{} 0 R ", i + 3)).collect(); + let mut objs = vec![format!("<< /Type /Catalog /AcroForm << /Fields [{fields_list}] >> >>"), raw_stream(&"x".repeat(1 << 20))]; + objs.extend((0..300).map(|i| format!("<< /FT /Tx /T (f{i}) /V 2 0 R /DV 2 0 R >>"))); + let all = fields(&document(&objs)); + assert_eq!(all.len(), 300); + let read: usize = all.iter().flat_map(|f| f.value.iter().chain(&f.default)).map(String::len).sum(); + assert!(read > 0 && read <= crate::read::MAX_VALUE_BYTES, "{read} bytes of values"); + assert_eq!(all[0].value, ["x".repeat(1 << 20)], "the first field still reads its value"); +} + +/// Clear form leaves a field as it is when its default is a stream the value budget didn't reach: +/// 70 fields typed in, whose default is one 1 MiB text stream, keep a value, the first ones +/// their default and the rest what was typed, none of them emptied. +#[test] +fn clear_form_keeps_a_field_whose_default_was_not_read() { + let n = 70; + let fields_list: String = (0..n).map(|i| format!("{} 0 R ", i + 3)).collect(); + let mut objs = vec![format!("<< /Type /Catalog /AcroForm << /Fields [{fields_list}] >> >>"), raw_stream(&"d".repeat(1 << 20))]; + objs.extend((0..n).map(|i| format!("<< /FT /Tx /T (f{i}) /V (typed) /DV 2 0 R >>"))); + let mut doc = document(&objs); + reset(&mut doc, None).unwrap(); + let values: Vec = (0..n) + .map(|i| { + let field = doc.get(ObjRef::new(i as u32 + 3, 0)); + field.as_dict().and_then(|d| d.get(b"V")).and_then(|v| v.as_string().map(PdfString::to_text)).unwrap_or_default() + }) + .collect(); + assert!(values.iter().all(|v| !v.is_empty()), "no field is emptied"); + assert_eq!(values[0], "d".repeat(1 << 20), "the first field goes back to its default"); + assert_eq!(values[n - 1], "typed", "the last field, whose default wasn't read, keeps its value"); + // A value the reading didn't decode, with no default, is cleared: it isn't known to be empty. + let mut objs = vec![format!("<< /Type /Catalog /AcroForm << /Fields [{fields_list}] >> >>"), raw_stream(&"v".repeat(1 << 20))]; + objs.extend((0..n).map(|i| format!("<< /FT /Tx /T (f{i}) /V 2 0 R >>"))); + let mut doc = document(&objs); + reset(&mut doc, None).unwrap(); + let last = doc.get(ObjRef::new(n as u32 + 2, 0)); + assert!(last.as_dict().and_then(|d| d.get(b"V")).is_none_or(|v| !matches!(v, Object::Ref(_))), "the last field's unread value is cleared"); +} + +/// Renaming a field that 300 calculations read through one shared Calculate action, whose script +/// is a 256 KiB stream, decodes and rewrites that action once, in place: every calculation reads +/// the new name, and nothing is decoded or written 300 times. +#[test] +fn a_rename_rewrites_a_shared_calculation_once() { + let n = 300; + let refs = |from: usize| -> String { (from..from + n).map(|i| format!("{i} 0 R ")).collect() }; + let js = format!("AFSimple_Calculate(\"SUM\", new Array (\"a\"));{}", " ".repeat(256 << 10)); + let mut objs = vec![ + "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(), + format!("<< /Type /Page /Parent 2 0 R /Annots [5 0 R {}] >>", refs(8)), + format!("<< /Fields [5 0 R {}] /DA (/Helv 0 Tf 0 g) >>", refs(8)), + "<< /Type /Annot /Subtype /Widget /FT /Tx /T (a) /Rect [50 700 250 720] /P 3 0 R >>".into(), + "<< /S /JavaScript /JS 7 0 R >>".into(), + raw_stream(&js), + ]; + objs.extend((0..n).map(|i| format!("<< /Type /Annot /Subtype /Widget /FT /Tx /T (c{i}) /Rect [50 10 250 30] /P 3 0 R /AA << /C 6 0 R >> >>"))); + let mut doc = document(&objs); + set_props(&mut doc, "a", &FieldProps { name: Some("qty".into()), ..FieldProps::default() }).unwrap(); + let action = ObjRef::new(6, 0); + let renamed = (8..8 + n).all(|i| { + let field = doc.get(ObjRef::new(i as u32, 0)); + field.as_dict().and_then(|d| d.get(b"AA")).and_then(|aa| aa.as_dict()?.get(b"C")?.as_ref()) == Some(action) + }); + assert!(renamed, "every calculation still names the one shared action"); + let js = doc.get(action).as_dict().and_then(|d| d.get(b"JS")?.as_string().map(PdfString::to_text)).unwrap_or_default(); + assert!(js.contains("\"qty\"") && !js.contains("\"a\""), "the shared action reads the new name"); + assert!(js.len() <= MAX_SCRIPT_BYTES, "{} bytes written once", js.len()); +} + +/// A page whose `/Contents` lists one 1 MiB stream ten times is read within the budget given: +/// pieces past it read as empty, so their rectangles aren't found. +#[test] +fn page_shapes_decode_a_repeated_content_stream_within_the_budget() { + let piece = format!("%{}\n10 10 20 20 re S\n", "x".repeat(1 << 20)); + let doc = document(&[ + "<< /Type /Catalog /Pages 2 0 R >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(), + format!("<< /Type /Page /Parent 2 0 R /Contents [{}] >>", "4 0 R ".repeat(10)), + raw_stream(&piece), + ]); + assert_eq!(crate::detect::page_shapes(&doc, 0).boxes.len(), 10, "one page's allowance reads them all"); + let mut budget = DecodeBudget::new(4 << 20, 0); + let boxes = crate::detect::shapes_within(&doc, 0, &mut budget).boxes.len(); + assert!((1..=4).contains(&boxes), "{boxes} rectangles read within 4 MiB"); + assert_eq!(budget.remaining(), 0, "the budget is spent"); +} + +/// Field detection keeps at most 256 saved graphics states, and each `Q` still restores its own +/// `q` past that: a scale set 300 saves deep is gone once they are all restored. +#[test] +fn page_shapes_restore_saves_past_the_cap() { + let content = format!("{} 2 0 0 2 0 0 cm {} 10 10 20 20 re S", "q ".repeat(300), "Q ".repeat(300)); + let doc = document(&[ + "<< /Type /Catalog /Pages 2 0 R >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(), + "<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>".into(), + raw_stream(&content), + ]); + assert_eq!(crate::detect::page_shapes(&doc, 0).boxes, [[10.0, 10.0, 30.0, 30.0]]); + // A scale set past the cap and closed by its own `Q` leaves a matrix that can't be known until + // the last lost save closes: what is drawn in between isn't reported at the scaled place. + let content = format!("{} q 2 0 0 2 0 0 cm Q 10 10 20 20 re S {} 40 40 10 10 re S", "q ".repeat(257), "Q ".repeat(257)); + let doc = document(&[ + "<< /Type /Catalog /Pages 2 0 R >>".into(), + "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(), + "<< /Type /Page /Parent 2 0 R /Contents 4 0 R >>".into(), + raw_stream(&content), + ]); + assert_eq!(crate::detect::page_shapes(&doc, 0).boxes, [[40.0, 40.0, 50.0, 50.0]]); +} + +/// The PDF/A declaration is read from metadata each filter stage of which decodes within +/// [`crate::appearances::MAX_XMP_BYTES`], as preflight decodes it: a field drawn with characters its +/// font lacks decodes no more than that a stage. +#[test] +fn a_pdfa_declaration_is_read_from_metadata_within_its_cap() { + let declared = |xmp: String| declares_pdfa(&document(&["<< /Type /Catalog /Metadata 2 0 R >>".into(), raw_stream(&xmp)])); + let pdfa = |padding: usize| format!("2{}", " ".repeat(padding)); + assert!(declared(pdfa(1 << 20))); + assert!(!declared(pdfa(crate::appearances::MAX_XMP_BYTES)), "metadata past the cap declares nothing"); + assert!(!declared("pdfaid".into()), "metadata without pdfaid:part declares nothing"); + // 3.5 MiB stored as hex, then Flate: its stages decode 7 and 3.5 MiB, each within the cap. + let xmp = pdfa(7 << 19); + let hex: Vec = xmp.bytes().flat_map(|b| [b"0123456789ABCDEF"[usize::from(b >> 4)], b"0123456789ABCDEF"[usize::from(b & 15)]]).collect(); + let mut stream = pdfcraft_cos::Stream::flate(pdfcraft_cos::Dict::new(), &hex); + stream.dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name("FlateDecode"), Object::name("ASCIIHexDecode")])); + let mut doc = Document::new_empty(); + let metadata = doc.add(Object::Stream(stream)); + let catalog = doc.add(Object::Dict([(b"Metadata".to_vec(), Object::Ref(metadata))].into_iter().collect())); + doc.trailer_mut().set(b"Root".to_vec(), Object::Ref(catalog)); + assert!(declares_pdfa(&doc), "metadata through a chain of filters declares PDF/A, as preflight decodes it"); +} + /// A widget listed many times, by one field's `/Kids` or by a `/Kids` array several fields share, /// is read once: the first field to list it owns it. #[test] diff --git a/crates/forms/src/values.rs b/crates/forms/src/values.rs index e8615567b6..cf191c2240 100644 --- a/crates/forms/src/values.rs +++ b/crates/forms/src/values.rs @@ -470,7 +470,9 @@ fn redraw(doc: &mut Document, f: &Field, values: &[String], scripts: &mut dyn Sc /// document that declares PDF/A, which forbids it: there the widget's mark /// (`pdfcraft_fonts::UNDRAWN_MARK`) is all, and the edit's report says the `?` shows everywhere. pub(crate) fn ask_viewers_to_redraw(doc: &mut Document) -> Result<(), FormError> { - if declares_pdfa(doc) || need_appearances(doc) { + // The form's own flag first: once it is set, the metadata needn't be decoded again for each + // field drawn after. + if need_appearances(doc) || declares_pdfa(doc) { return Ok(()); } let Some(root) = doc.root() else { return Ok(()) }; @@ -625,6 +627,22 @@ pub fn clear_password_values(doc: &mut Document) -> Result { Ok(targets.len()) } +/// Whether `field`'s `key` (`/V` or `/DV`, its own or inherited) is a stream with data, which +/// [`fields`] reads as empty once its value budget is spent. +fn unread_stream(doc: &Document, field: ObjRef, key: &[u8]) -> bool { + let mut node = Some(field); + for _ in 0..64 { + let Some(r) = node else { break }; + let obj = doc.get(r); + let Some(d) = obj.as_dict() else { break }; + if let Some(value) = d.get(key) { + return matches!(&*doc.resolve(value), Object::Stream(s) if !s.raw.is_empty()); + } + node = d.reference(b"Parent"); + } + false +} + /// Acrobat's Clear form: every field (or the named ones) back to its default value. pub fn reset(doc: &mut Document, names: Option<&[String]>) -> Result { let all = fields(doc); @@ -638,7 +656,11 @@ pub fn reset(doc: &mut Document, names: Option<&[String]>) -> Result