Close out #83/#84 hardening residue (MCID, field encoding, wordwrap, list markers, justify, sig page) - #93
Merged
Merged
Conversation
Implements the remaining sub-items from the 2026-06-12 review. #83 (Document/Forms): - ParentTree sized by max(MCID)+1 per page (sparse arrays valid; only negative MCIDs rejected; duplicate-MCID guard kept) so non-contiguous MCIDs no longer abort Save. Marked-content<->structure mapping unchanged. - AcroForm field names/values/choice options use proper PDF text-string encoding (Latin-1 when representable, else UTF-16BE+BOM) instead of lossy '?'. Appearance text the Standard-14 font cannot render now throws. - PdfSignatureSettings.SignaturePage selects the signature widget page (default 0, out-of-range rejected); wired through the signing path. #84 (Layout): - WordWrap normalises \r\n and lone \r to line breaks and splits on Unicode whitespace (no stray CR glyph; tabs/multi-space handled). - Nested ordered list markers honour the configured scheme via ListElement.FormatMarker instead of hardcoded decimal. - Justified word-gap counting shares one tokenization for measure and draw, consistent across embedded and Standard-14 fonts. Tests: new HardeningV155CloseoutTests in both test projects; the obsolete out-of-range-MCID-throws test updated to assert the new sparse behaviour. 632 Kernel + 187 Layout pass, format clean, AOT smoke passes. Bump 1.5.5.
This was referenced Jun 16, 2026
Tim81
added a commit
that referenced
this pull request
Jun 16, 2026
…94) A self-review of #93 (v1.5.5) found a regression: the per-page ParentTree array is sized by (max MCID + 1), and PdfStructElem.Mcid is a public setter, so a hand-built structure tree with a huge MCID (or int.MaxValue) would attempt a multi-gigabyte allocation or overflow the length to a negative value — crashing mid-Save instead of failing cleanly. Cap the per-page MCID at 1,000,000 (far above any real page's marked-content count, which is bounded by content-stream size) and throw a clear InvalidOperationException above it, before the array is sized. Documents tagged through the canvas are unaffected: their per-page MCIDs are dense and sequential. Bump to 1.5.6.
This was referenced Jun 17, 2026
This was referenced Jul 1, 2026
This was referenced Jul 15, 2026
This was referenced Aug 19, 2026
This was referenced Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #83 and #84 — the residual sub-items from the 2026-06-12 full-library review (most were already fixed across v1.5.1–v1.5.4; this finishes the rest).
#83 — Document/Forms
max(MCID)+1instead of leaf-element count, so non-contiguous/sparse MCIDs produce a valid sparse array (null holes) instead of abortingSave. Only negative MCIDs are rejected; the duplicate-MCID guard (the bijection veraPDF checks) is kept; each element is still placed atindex == MCID.?. Appearance text the Standard-14 font cannot render now throws a clear error instead of writing?.PdfSignatureSettings.SignaturePage(0-based, default 0) selects the widget page; out-of-range rejected. Also fixed a latent bug where the signing path'seffectiveSettingsrebuild dropped new settings whenSigningTimewas unset.#84 — Layout
\r\nand lone\rto line breaks and splits on Unicode whitespace — Windows text no longer leaves a stray CR glyph; tabs and runs of spaces wrap correctly.ListElement.FormatMarkerinstead of hardcoded decimal.Tests
HardeningV155CloseoutTestsin both test projects; the pre-existing out-of-range-MCID-throws test updated to assert the new sparse-array (no-throw) behaviour.dotnet format --verify-no-changesclean; AOT smoke passes.The MCID change is the sharp edge — the existing
PdfUA1_*/PdfA2a_*veraPDF oracles (CI) are the conformance safety net. Bumps version to 1.5.5.