photocraft

0 Fork 0

mirror of https://github.com/storytold/photocraft.git synced 2026-11-07 10:54:10 +00:00

Files

T

Dylan M. Taylor 9779daf357 security(affinity): charge allocation records, empty subpaths, paint lists, tile indexes and shape lookups (#10966 )

* security(affinity): charge allocation records, empty subpaths, paint lists, tile indexes and shape lookups

Several readers still did work per occurrence of a shared object that no
document-wide budget counted:

- Archive::open walked every allocation table's records, and overlapping tables
  could reparse one long run thousands of times. Records are now charged against
  MAX_TABLE_RECORDS before each table is walked.
- curves() charged a subpath's records but not the subpath, so a shared curve
  full of empty subpaths was walked for free. Each subpath now costs one record.
- Colours and gradient positions decoded their whole float record (up to 64 KiB)
  to read two to five components; only those are decoded now.
- Paint selection collected whole BFFl/LIFl/LILn lists without charging their
  slots; the lists are charged and walked once without collecting.
- Dash patterns were copied per occurrence with no length limit; they are capped
  at 64 entries and charged against the document budget.
- The raster tile index skipped null Idx slots uncharged; every slot walked is
  charged now.
- shapes::last rescanned all fields per lookup and CTyp/ShCR were copied whole;
  the field index records last occurrences too, and only four corners are read.

* test(affinity): cover the allocation record budget across chained tables

* test(affinity): directory records count against the allocation record budget

2026-11-03 06:03:23 -05:00

access.rs

Affinity reader: keep curve records in one buffer and index objects without a hash map

2026-10-25 11:55:21 +01:00

container.rs

security(affinity): charge allocation records, empty subpaths, paint lists, tile indexes and shape lookups (#10966 )

2026-11-03 06:03:23 -05:00

geometry.rs

security(affinity): charge allocation records, empty subpaths, paint lists, tile indexes and shape lookups (#10966 )

2026-11-03 06:03:23 -05:00

lib.rs

…