FreePDF 7.5.1

FreePDF 7.5.1

FreePDF 7.5.1 encrypts empty streams and strings in AES-encrypted documents,
which pyHanko could not read. Nothing else changes from 7.5.0.

Packages

• io7.FreePDF https://www.nuget.org/packages/io7.FreePDF/7.5.1
• io7.FreePDF.Layout https://www.nuget.org/packages/io7.FreePDF.Layout/7.5.1
• io7.FreePDF.Gdi https://www.nuget.org/packages/io7.FreePDF.Gdi/7.5.1
• io7.FreePDF.Layout.Gdi https://www.nuget.org/packages/io7.FreePDF.Layout.Gdi/7.5.1
• io7.FreePDF.Wpf https://www.nuget.org/packages/io7.FreePDF.Wpf/7.5.1
• io7.FreePDF.Layout.Wpf https://www.nuget.org/packages/io7.FreePDF.Layout.Wpf/7.5.1

dotnet add package io7.FreePDF --version 7.5.1
dotnet add package io7.FreePDF.Layout --version 7.5.1

Fixed

• Empty data in AES-encrypted documents. An empty stream or string in a
  document encrypted with AES-128 or AES-256 was written empty and unencrypted.
  AES turns empty data into an initialization vector and a padding block, 32
  bytes (ISO 32000-1, 7.6.2), and pyHanko failed to read such a file ("Invalid
  IV size (0)"). Examples are a form XObject or a signature appearance that draws
  nothing. With 7.5.0's encrypted Append mode, this also hit signed forms
  countersigned with an empty appearance. Empty data is now encrypted like any
  other data, in new documents and in Modify and Append mode. RC4 leaves empty
  data empty, so RC4 files are written exactly as before, and empty data that other
  tools wrote still reads as empty.
• With EncryptMetadata false, saving a metadata stream that holds only
  whitespace threw IndexOutOfRangeException. Such a stream, like an empty one,
  is left unencrypted, as metadata that holds XML is.
• A stream whose /Crypt filter parameters leave out /Type or /Name threw
  InvalidOperationException when read. It now uses the Identity crypt filter,
  as ISO 32000-1 specifies (Table 14).

Upgrading from 7.5.0

Update all FreePDF packages to 7.5.1 together and rebuild; the assembly version
is now 7.5.1.0. The public API is unchanged. Behaviour changes to check:

• Empty strings and streams in AES-encrypted files are 32 bytes instead of
  0, so such files are slightly larger; files without encryption and RC4 files
  are unchanged.
• An empty stream with invalid /Crypt filter parameters (a /Type other than
  /CryptFilterDecodeParms, or a /Name the document does not define) now
  fails to save, as a non-empty one already did.

Validation

All 7.5.0 release gates apply, plus:

• regression tests for empty streams, literal and hexadecimal strings in new
  documents and Append updates with RC4-128, AES-128 and AES-256, reading them
  back, files without encryption, empty AES data from another writer, blank
  metadata with EncryptMetadata false, and /Crypt parameters without /Type
  or /Name; 596 regression tests in all;
• pyHanko 0.29.1: a form that pyHanko encrypted with AES-256 and signed, filled
  and countersigned by FreePDF with an empty signature appearance, has both
  signatures VALID ("signing and form filling"), also in poppler's pdfsig; new
  AES-128 and AES-256 documents with an empty form XObject and an empty
  /Subject read in pyHanko and mutool without errors. With 7.5.0, both failed
  on the empty stream;
• an independent review in two rounds, whose findings were fixed before release.
  It found RC4 and unencrypted files byte for byte the same as 7.5.0's, unchanged
  Append-mode saves the same bytes, and 3,000 generated AES-256 files with
  unencrypted metadata read with the same outcome as in 7.5.0.

The attached packages are the verified CI artifacts from source revision 191cf0bd010a5e3df5cbc8c8d8d6a18c942f7f45, and the same files that were
uploaded to NuGet.org. SHA256SUMS and validation.json record their hashes and package-install evidence.
NuGet.org adds its repository signature, so a package downloaded from NuGet.org has a different hash from the attached file.

CI: https://github.com/io7/FreePDF/actions/runs/41848030351 (core),
https://github.com/io7/FreePDF/actions/runs/41848030180 (packages/API/independent checks),
https://github.com/io7/FreePDF/actions/runs/41848030302 (comparisons),
https://github.com/io7/FreePDF/actions/runs/41849814232 (NuGet publication).