Phase 2 of NIGIG_PDF_FEATURE_PARITY_PLAN.md, the item it calls "the biggest
parse-side gap". Design and merge criteria in
REVIEWS/adr/0013-pdf-xref-streams.md.
The parser could not open a PDF 1.5 file. Not render it wrong - not open it:
PARSE FAILED: PDF error at byte 382: expected xref keyword
XRefTable::parse_section required the literal bytes `xref` at the startxref
offset. A PDF 1.5+ file has an indirect object there instead - the xref
stream - so the parse aborted and the entire document was unreadable. Every
feature built on top of the parser (encryption, signatures, forms, structure
tree, transparency) was unreachable on any file produced in the last twenty
years. ObjStm, XRefStm and /Type /XRef appeared nowhere in the crate.
Implemented on the read side:
- Xref streams: the packed binary table, /W field widths, /Index sparse
subsections, and types 0/1/2. A zero-width /W column means "use the
default" (type 1) - missing that rule yields a table of all-free entries
and an apparently empty document rather than an error.
- Object streams: type-2 entries resolve through /ObjStm, reading the
header pairs and /First. The xref's index is used but verified against
the object number it claims to be, because a wrong-but-in-range index
would silently return a different object.
- Hybrid files: a traditional table plus /XRefStm. Both are read, with the
traditional table winning on conflict, which is the point of the layout.
Bounds and refusals rather than silent degradation: /W widths are clamped
and every field read is checked against the decoded buffer; a truncated
table is flagged, not padded with free entries; an object claiming to live
inside itself is refused; a /Type that is not /XRef is named in the error.
Scope note: the writer is untouched. ADR 0003 keeps appending a traditional
xref section, which remains correct - the appended trailer carries /Prev to
the stream, so the chain stays readable by us and by conforming readers.
Also verified against the rest of Phase 2: inline images, XObject Do,
shading, and the full text state (Tc/Tw/TL/Tz/Ts/Td/TD/Tm/Tf) are already
implemented and tested. Type 3 fonts and the streaming interpreter remain
genuine gaps, but each degrades one feature rather than the whole file.
6 corpus fixtures, 9 acceptance tests asserting real page content rather
than a successful parse, and a parse_xref_stream fuzz target because the
table is attacker-controlled binary. Mutation-checked: restoring the old
error fails 5 of the 9.
TEST_TARGET=pdf 606 -> 615, TEST_TARGET=pdf-ui 651 -> 660.
rustfmt and clippy -D warnings clean.
