mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-14 19:26:51 -04:00
agent-346022andphotocraft-agent UNCONFIGURED
649b1d5d92
* psd: harden the standalone binary parsers (gradients, swatches, patterns, filter effects, metadata, resources, tagged blocks) Correctness and robustness work on the psd crate's auxiliary parsers, with fuzz targets and property tests so the invariants are enforced, not just asserted. grd (gradients): - Split num()/finite() into a single guard with a saturating f64->f32 cast: only NaN has no value, everything else (including +/-inf and 1e300) saturates to the representable range so the mapping stays monotonic instead of snapping to a field default and inverting a hostile value. - Hue now wraps with rem_euclid(360) instead of clamping (370 -> 10, not 370 -> 360, which would be a different colour at the boundary). - Every colour model is bounded: RGB/CMYK/Gray to 0..=1, L* to 0..=100 and a*/b* to the CIELAB gamut (-128..=127), so a downstream converter never sees out-of-gamut input. aco/ase (swatches): - Share one io::utf16_units() helper that caps a name by UTF-16 code units without ever splitting a surrogate pair; keeping it in one place stops the fix from drifting between the two formats. Coverage: - New fuzz targets for grd, aco, ase, patterns, filter_effects, metadata, tagged and resources (wired into the fuzz CI matrix). - Property tests mirroring each fuzz invariant (round-trip stability, no panic on arbitrary bytes, documented colour/number ranges) so normal CI covers them; the fuzz jobs run on demand. 369 psd tests pass; clippy -D warnings and rustfmt clean; layering and wasm check pass; all psd fuzz targets build and run clean. * psd: address Gemini/Claude review of the parser hardening Follow-up to the previous commit, applying the substantive points from two independent code reviews (Gemini 3.8: ship; Claude: ship after small fixes). Production: - grd hue: an in-range value (0..=360, including exactly 360) is now kept verbatim; only an out-of-range hue wraps with rem_euclid. Wrapping unconditionally altered a legal 360 to 0 (and f32 round-off on a tiny negative could itself land on 360), changing the colour at the boundary for anything that interpolates in HSB. - ase: compile-time assert that MAX_NAME_UNITS < u16::MAX, since put_name writes the length as `units.len() as u16 + 1`; guards the invariant if the cap is ever raised. Stronger test/fuzz invariants (byte stability alone would pass even if the writer silently dropped a field; these assert semantic equality): - metadata fuzz: assert the parsed-then-written block re-parses to the same items (the weakened byte-only check was the fix the first fuzz run surfaced). - patterns fuzz: assert parse(write(parse(x))) == parse(x); channel offsets/padding are wire artifacts, not fields, so the round trip is lossless (confirmed, 2M execs). - filter_effects fuzz: assert back == fx as well as byte stability; also decode every cached slot, not just the mask. - resources fuzz: round-trip ResolutionInfo through to_bytes/from_bytes. Coverage: - tagged fuzz: select the block key from a table of every typed/strict key via the first byte, so the fuzzer reaches each branch instead of guessing a 4-byte key. - new property tests: damage-a-valid-block for metadata/patterns/filter_effects (pure random bytes rarely pass a header), and check_structure over every structural key. - grd_every_colour_model_is_clamped_and_finite now pins exact saturation values (a*/b* to +/-128, L* to 0/100, units to 0/1), so a weaker clamp is caught, not just an out-of-range value; grd_hue_wraps now pins the exact-360 and 0 boundaries. Verified: 371 psd tests pass; clippy -D warnings, rustfmt, layers and wasm clean; all 13 fuzz targets build and run clean (metadata 11.5M, patterns 2M, filter_effects 5.9M, resources 3.5M, tagged 5.4M execs); the a*/b* clamp-weakening and hue-guard-removal mutants are both killed by the strengthened tests. --------- Co-authored-by: photocraft-agent UNCONFIGURED <[email protected]>