brushkit_preview/
procreate.rs

1//! Reading Procreate `.brush` and `.brushset` archives: the guarded zip and
2//! plist readers, the `Shape.png` decoder and the two name/member lookups the
3//! preview API needs.
4//!
5//! Every entry here parses untrusted bytes, so each size, count and dimension
6//! is checked against a ceiling before anything is allocated.
7
8use crate::GrayscaleBitmap;
9use std::io::{Cursor, Read};
10
11/// Defensive ceilings for untrusted archives: anything above them is treated
12/// as malformed rather than allocated from.
13pub const MAX_ENTRY_BYTES: usize = 256 * 1024 * 1024;
14pub const MAX_PNG_DIMENSION: u32 = 16384;
15pub const MAX_PLIST_BYTES: usize = 16 * 1024 * 1024;
16pub const MAX_PLIST_DEPTH: usize = 64;
17
18/// The declared uncompressed size is an attacker-controlled zip-header field,
19/// so it is only a clamped pre-allocation hint and the read is capped
20/// independently — a small declared size can hide a huge inflate.
21pub fn read_zip_entry(
22    zip: &mut zip::ZipArchive<Cursor<&[u8]>>,
23    path: &str,
24) -> Result<Vec<u8>, String> {
25    let file = zip.by_name(path).map_err(|_| format!("{path} not found"))?;
26    if file.size() > MAX_ENTRY_BYTES as u64 {
27        return Err(format!(
28            "{path}: declared size {} exceeds limit",
29            file.size()
30        ));
31    }
32    let mut buf = Vec::with_capacity((file.size() as usize).min(MAX_ENTRY_BYTES));
33    file.take(MAX_ENTRY_BYTES as u64 + 1)
34        .read_to_end(&mut buf)
35        .map_err(|e| format!("failed to read {path}: {e}"))?;
36    if buf.len() > MAX_ENTRY_BYTES {
37        return Err(format!("{path}: entry exceeds size limit"));
38    }
39    Ok(buf)
40}
41
42/// The streaming depth pre-check builds no tree, so it bails early: without it
43/// a deeply nested plist produces a `Value` whose recursive `Drop` overflows
44/// the call stack. The bytes are parsed twice, stream then tree.
45pub fn parse_plist_guarded(bytes: &[u8], label: &str) -> Result<plist::Value, String> {
46    if bytes.len() > MAX_PLIST_BYTES {
47        return Err(format!("{label}: plist size {} exceeds limit", bytes.len()));
48    }
49    let mut depth: usize = 0;
50    for event in plist::stream::Reader::new(Cursor::new(bytes)) {
51        match event.map_err(|e| format!("failed to parse {label}: {e}"))? {
52            plist::stream::Event::StartArray(_) | plist::stream::Event::StartDictionary(_) => {
53                depth += 1;
54                if depth > MAX_PLIST_DEPTH {
55                    return Err(format!("{label}: plist nesting depth exceeds limit"));
56                }
57            }
58            plist::stream::Event::EndCollection => depth = depth.saturating_sub(1),
59            _ => {}
60        }
61    }
62    plist::Value::from_reader(Cursor::new(bytes))
63        .map_err(|e| format!("failed to parse {label}: {e}"))
64}
65
66/// Why a `Shape.png` did not decode.
67#[derive(Debug, Clone, PartialEq, Eq)]
68pub enum ShapePngError {
69    TooLarge { width: u32, height: u32 },
70    Corrupt(String),
71}
72
73impl std::fmt::Display for ShapePngError {
74    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
75        match self {
76            ShapePngError::TooLarge { width, height } => write!(
77                f,
78                "Shape.png is {width}x{height}px; the maximum supported brush-tip dimension is {MAX_PNG_DIMENSION}px"
79            ),
80            ShapePngError::Corrupt(msg) => f.write_str(msg),
81        }
82    }
83}
84
85impl std::error::Error for ShapePngError {}
86
87/// Decode a Procreate `Shape.png` into a grayscale tip. White is stamp
88/// coverage, so the luminance is taken as-is.
89pub fn decode_tip_png(bytes: &[u8]) -> Result<GrayscaleBitmap, ShapePngError> {
90    let mut reader = image::ImageReader::new(Cursor::new(bytes))
91        .with_guessed_format()
92        .map_err(|e| ShapePngError::Corrupt(format!("failed to sniff Shape.png: {e}")))?;
93    let mut limits = image::Limits::default();
94    limits.max_image_width = Some(MAX_PNG_DIMENSION);
95    limits.max_image_height = Some(MAX_PNG_DIMENSION);
96    limits.max_alloc = Some(MAX_ENTRY_BYTES as u64);
97    reader.limits(limits);
98    let luma = reader
99        .decode()
100        .map_err(|e| match &e {
101            image::ImageError::Limits(l)
102                if matches!(l.kind(), image::error::LimitErrorKind::DimensionError) =>
103            {
104                match header_dimensions(bytes) {
105                    Some((width, height)) => ShapePngError::TooLarge { width, height },
106                    None => ShapePngError::Corrupt(format!("failed to decode Shape.png: {e}")),
107                }
108            }
109            _ => ShapePngError::Corrupt(format!("failed to decode Shape.png: {e}")),
110        })?
111        .to_luma8();
112    Ok(GrayscaleBitmap {
113        width: luma.width(),
114        height: luma.height(),
115        data: luma.into_raw(),
116    })
117}
118
119/// Dimensions straight off the PNG header, read on a second, unlimited reader
120/// that allocates no pixels. Used only to report what tripped the ceiling.
121fn header_dimensions(bytes: &[u8]) -> Option<(u32, u32)> {
122    image::ImageReader::new(Cursor::new(bytes))
123        .with_guessed_format()
124        .ok()?
125        .into_dimensions()
126        .ok()
127}
128
129/// The set name and the member uuids a `brushset.plist` declares, in its order.
130pub fn parse_brushset_plist(bytes: &[u8]) -> Result<(Option<String>, Vec<String>), String> {
131    let value = parse_plist_guarded(bytes, "brushset.plist")?;
132    let dict = value
133        .as_dictionary()
134        .ok_or("brushset.plist root is not a dictionary")?;
135    let name = dict
136        .get("name")
137        .and_then(|v| v.as_string())
138        .map(str::to_string);
139    let array = dict
140        .get("brushes")
141        .and_then(|v| v.as_array())
142        .ok_or("brushset.plist missing brushes array")?;
143    let uuids = array
144        .iter()
145        .enumerate()
146        .map(|(i, v)| {
147            v.as_string()
148                .map(|s| s.to_string())
149                .ok_or_else(|| format!("brushset.plist brushes[{i}] is not a string"))
150        })
151        .collect::<Result<Vec<_>, _>>()?;
152    Ok((name, uuids))
153}
154
155/// The NSKeyedArchiver settings dictionary lives at `$objects[1]`, and every
156/// non-scalar field of it is a UID into the same `$objects` array — so a
157/// caller needs the pair, not just the dictionary.
158pub fn archive_objects_and_main(
159    value: &plist::Value,
160) -> Result<(&[plist::Value], &plist::Dictionary), String> {
161    let root = value
162        .as_dictionary()
163        .ok_or("Brush.archive root is not a dictionary")?;
164    let objects = root
165        .get("$objects")
166        .and_then(|v| v.as_array())
167        .ok_or("Brush.archive missing $objects array")?;
168    let main_dict = objects
169        .get(1)
170        .and_then(|v| v.as_dictionary())
171        .ok_or("$objects[1] is not a dictionary")?;
172    Ok((objects, main_dict))
173}
174
175/// Follow a UID-valued field of the settings dictionary to the string it names,
176/// treating NSKeyedArchiver's literal `"$null"` marker as absent.
177pub fn resolve_string(
178    objects: &[plist::Value],
179    main_dict: &plist::Dictionary,
180    key: &str,
181) -> Option<String> {
182    main_dict
183        .get(key)
184        .and_then(|v| v.as_uid())
185        .and_then(|u| objects.get(u.get() as usize))
186        .and_then(|v| v.as_string())
187        .filter(|s| *s != "$null")
188        .map(str::to_string)
189}
190
191/// The display name stored in a `Brush.archive` (`$objects[1].name`), `None`
192/// when the archive has no readable name.
193pub fn brush_name(archive_bytes: &[u8]) -> Result<Option<String>, String> {
194    let value = parse_plist_guarded(archive_bytes, "Brush.archive")?;
195    let (objects, main_dict) = archive_objects_and_main(&value)?;
196    Ok(resolve_string(objects, main_dict, "name"))
197}
198
199/// Members of a set that has no `brushset.plist`: every top-level directory `d`
200/// with an entry named exactly `d/Brush.archive`, in first-appearance zip order.
201/// `d/Reset/Brush.archive` does not make `d/Reset` a member.
202pub fn members_in_zip_order(zip: &mut zip::ZipArchive<Cursor<&[u8]>>) -> Vec<String> {
203    // By index, not `file_names()`: only the index walk is guaranteed to follow
204    // the central directory, and the member order is part of the contract.
205    (0..zip.len())
206        .filter_map(|i| {
207            let dir = zip.name_for_index(i)?.strip_suffix("/Brush.archive")?;
208            (!dir.is_empty() && !dir.contains('/')).then(|| dir.to_string())
209        })
210        .collect()
211}
brushkit_preview/procreate.rs

brushkit_preview/
procreate.rs
