Replace github.com/disintegration/imaging with standard library
(removing long standing CVE with parsing malicious TIFF files)
Dropped the disintegration/imaging dependency by implementing equivalent
thumbnail functionality using golang.org/x/image/draw (which was already
present as a transitive dependency). The two operations previously provided
by imaging — scale-to-fill with center-crop (imaging.Thumbnail) and
JPEG encoding (imaging.Encode) — are now handled by helpers in the
thumbs/imgutils package.
- Added
imgutils.Thumbnail— resizes and center-crops using CatmullRom
resampling (comparable quality to Lanczos). - Added
imgutils.EncodeJPEG— encodes to JPEG with specified quality and
applies the JFIF APP0 DPI fixup required by Kindle. - Unexported
SetJpegDPI,JpegDPIType, andDpi*constants since they
are now only used internally byEncodeJPEG. - Updated
thumbs/kfxandthumbs/mobireaders to use the new helpers.
Fix KFX parser failing on newer KFX files
The KFX entity table parser was too strict and used an outdated symbol
table, causing it to reject valid KFX files with entity IDs above 843.
- Bumped
largestKnownSymbolfrom 834 to 851, adding 17 missing
YJ_symbols (shapes/geometry: ellipse, rectangle, line, polygon, etc.)
to match the set known to the fb2cng parser. - Removed strict
FindByIDvalidation fromindexTableEntry.readFrom,
keeping only the bounds check. Entity IDs referencing local document
symbols beyond the known YJ_symbols range are now accepted, preventing
future breakage when Amazon extends the format.
Add thumbnail extraction tests
thumbs/imgutils/thumb_test.go— unit tests forThumbnail(output
dimensions across various aspect ratios, invalid inputs, pixel content)
andEncodeJPEG(valid JPEG output, JFIF APP0 header with 300 DPI).thumbs/kfx/reader_test.go— end-to-end test parsing_Test.azw8,
extracting a thumbnail, and verifying a valid 330×470 JPEG with JFIF
header is produced.thumbs/mobi/reader_test.go— end-to-end test parsing_Test.azw3,
extracting a thumbnail, and verifying a valid 330×470 JPEG with JFIF
header is produced.
Full Changelog: v1.4.1...v1.4.2