Fix UB in PdfObject as_string, as_name, as_bytes

[messense]

These accessors returned borrows (&str / &[u8]) tied to &self, but MuPDF resolves indirect references first and returns a pointer into the document's shared xref entry, not into self. Freeing that entry via delete_object then leaves the reference dangling, and since indirect objects alias the xref the borrow checker cannot prevent it.

Return owned data instead: as_string() -> String, as_name() -> Vec<u8>, as_bytes() -> Vec<u8>. The returned copies outlive any mutation of the document, closing the soundness hole unconditionally with no new types, crates, or error variants.

Closes #207.

[Copilot]

Pull request overview

This PR fixes a soundness hole in the PDF object accessor APIs by changing PdfObject::{as_string, as_name, as_bytes} to return owned data (String / Vec<u8>) rather than borrows tied to &self, preventing dangling references when MuPDF’s resolved xref-backed storage is freed via delete_object.

Changes:

• Change PdfObject::as_string() to return String, and as_name() / as_bytes() to return Vec<u8> to eliminate UB from xref aliasing.
• Update internal call sites (page resources, destinations/links, document parsing, and tests) to use the new owned-return APIs.
• Add regression tests reproducing issue #207 by deleting indirect objects and attempting to observe dangling reads.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/pdf/object.rs	Changes accessor return types to owned data to close the dangling-borrow UB hole.
tests/test_issues.rs	Adds regression tests for issue #207 (indirect resolve + delete leading to dangling borrows).
src/pdf/page.rs	Updates resource-name extraction and matching logic for owned as_name() results.
src/pdf/links/extraction.rs	Updates link/destination parsing to use owned as_string() / as_name() results.
src/pdf/document.rs	Updates document parsing helpers that previously relied on borrowed as_string() results.
src/shape/finish.rs	Updates test code converting PDF names into Rust String using the new owned API.
src/destination.rs	Updates destination kind decoding to match on owned name bytes via .as_slice().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.