chore: promote HEIC FFI hardening for Windows retest

.github/workflows/windows-release.yml

@@ -19,6 +19,11 @@ on:
         description: Optional Chocolatey libreoffice-fresh package version. Empty uses latest.
         required: false
         type: string
+      stage_test_build:
+        description: Stage an owner-only draft test build instead of updating the version release.
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: write
@@ -142,9 +147,24 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           $version = node -p "require('./package.json').version"
-          $tag = "v$version"
+          $testMode = '${{ github.event.inputs.stage_test_build }}' -eq 'true'
+          $shortSha = $env:GITHUB_SHA.Substring(0, 7)
+          $tag = if ($testMode) { "test-windows-$version-$shortSha" } else { "v$version" }
           $notesPath = ".github/release-notes/$tag.md"
-          if (-not (Test-Path $notesPath)) { throw "Release notes not found at $notesPath" }
+          if (-not $testMode -and -not (Test-Path $notesPath)) {
+            throw "Release notes not found at $notesPath"
+          }
+
+          if ($testMode) {
+            $notesPath = Join-Path $env:RUNNER_TEMP 'windows-test-build.md'
+            @"
+          Temporary unsigned Windows x64 test build for issue #14.
+
+          - Exact source commit: `$env:GITHUB_SHA`
+          - This is not a release and must not be redistributed.
+          - Verify the accompanying SHA-256 before testing.
+          "@ | Set-Content -Path $notesPath -Encoding utf8NoBOM
+          }
 
           $installer = @(Get-ChildItem -Path src-tauri/target/release/bundle/nsis -Filter '*-setup.exe')
           if ($installer.Count -ne 1) { throw "Expected one NSIS installer, found $($installer.Count)." }
@@ -181,11 +201,15 @@ jobs:
             $isDraft = gh release view $tag --json isDraft --jq '.isDraft'
             if ($isDraft -ne 'true') { throw "Refusing to modify published release $tag." }
           } else {
-            gh release create $tag `
-              --verify-tag `
-              --draft `
-              --title "OffPDF $tag" `
-              --notes-file $notesPath
+            $releaseArgs = @(
+              'release', 'create', $tag,
+              '--verify-tag',
+              '--draft',
+              '--title', $(if ($testMode) { "OffPDF Windows test build ($shortSha)" } else { "OffPDF $tag" }),
+              '--notes-file', $notesPath
+            )
+            if ($testMode) { $releaseArgs += '--prerelease' }
+            & gh @releaseArgs
             if ($LASTEXITCODE -ne 0) { throw "Could not create draft release $tag." }
           }
 
@@ -199,7 +223,8 @@ jobs:
           gh release upload $tag $installer[0].FullName $checksumPath
           if ($LASTEXITCODE -ne 0) { throw "Could not upload Windows assets to $tag." }
 
-          "Staged unsigned Windows installer in draft release $tag." | Add-Content -Path $env:GITHUB_STEP_SUMMARY
+          $mode = if ($testMode) { 'owner-only test draft' } else { 'version draft' }
+          "Staged unsigned Windows installer in $mode $tag." | Add-Content -Path $env:GITHUB_STEP_SUMMARY
 
       - name: List bundle outputs
         shell: pwsh

src-tauri/Cargo.toml

@@ -42,7 +42,7 @@ image = { version = "0.25", default-features = false, features = [
 ] }
 # Decode iPhone/iPad HEIC and HEIF photos. libheif is built and linked into the
 # app so users do not need to install a system codec or upload their photos.
-heif-rs = "26.7"
+heif-rs = { path = "vendor/heif-rs" }
 
 [features]
 # By default Tauri uses custom protocols. Keep network features off.

src-tauri/src/pdf_engine/compress.rs

@@ -355,7 +355,10 @@ fn decode_heif(path: &Path) -> Result<image::DynamicImage, AppError> {
     }
     validate_heif_limits(metadata.len(), width, height, decoded_bytes)?;
 
-    let image = image::DynamicImage::from_decoder(decoder.with_threads(1)).map_err(|error| {
+    // Keep libheif's tile decoding on the calling thread. Its codec backend may
+    // still manage its own workers, but this removes libheif's background tile
+    // thread from the FFI path while decoding untrusted input.
+    let image = image::DynamicImage::from_decoder(decoder.with_threads(0)).map_err(|error| {
         AppError::new(
             "INVALID_IMAGE",
             "Could not decode this HEIC/HEIF image",

src-tauri/vendor/heif-rs/.gitignore

@@ -0,0 +1,2 @@
+/target/
+/Cargo.lock

src-tauri/vendor/heif-rs/Cargo.toml

@@ -0,0 +1,71 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2024"
+name = "heif-rs"
+version = "26.7.0"
+authors = ["Vinicius Egidio <me@vinicius.io>"]
+build = "build.rs"
+links = "heif"
+exclude = [
+    ".cargo/",
+    ".github/",
+    ".idea/",
+    ".editorconfig",
+    ".gitignore",
+    "assets/",
+    "examples/",
+    "scripts/",
+    "rustfmt.toml",
+]
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "Encode and decode HEIF/HEIC images with x265 and libde265, via statically-linked libheif."
+homepage = "https://github.com/vegidio/heif-rs"
+readme = "README.md"
+keywords = [
+    "heif",
+    "heic",
+    "image",
+    "hevc",
+    "encoding",
+]
+categories = [
+    "multimedia::images",
+    "encoding",
+]
+license = "Apache-2.0"
+repository = "https://github.com/vegidio/heif-rs"
+
+[lib]
+name = "heif"
+path = "src/lib.rs"
+
+[dependencies.image]
+version = "0.25"
+
+[dependencies.thiserror]
+version = "2"
+
+[build-dependencies.bindgen]
+version = "0.72.1"
+
+[build-dependencies.ureq]
+version = "3"
+
+[build-dependencies.zip]
+version = "8.6.0"
+features = ["deflate"]
+default-features = false