pdf-object: address review feedback on CCITTFaxDecode

- Fix `from_dictionary` doc to note caller must resolve indirect refs
- Add Group 3 RTC (6-EOL end-of-block) detection for K=0 and K>0
- Fix K>0: decode_2d_row None now breaks instead of emitting all-white
- Fix encoded_g4_one_white_row fixture bytes (was off by one bit)
- Add test_1d_rtc_with_eol and test_1d_rtc_no_eol to cover RTC paths

Agent-Logs-Url: https://github.com/Velli20/safe-pdf/sessions/99845e2b-7343-4c89-ac0c-50a3dffa3002

Co-authored-by: Velli20 <25138671+Velli20@users.noreply.github.com>

Author: Copilot

crates/pdf-object/src/ccitt.rs

@@ -54,12 +54,13 @@ impl Default for CCITTFaxParams {
 }
 
 impl CCITTFaxParams {
-    /// Parse decode parameters directly from a PDF `/DecodeParms` dictionary.
+    /// Parse decode parameters from a PDF `/DecodeParms` dictionary.
     ///
-    /// Values are extracted by directly matching [`ObjectVariant`] variants;
-    /// no [`ObjectResolver`][crate::object_resolver::ObjectResolver] is needed
-    /// because decode-parameter dictionaries are always inline in the stream
-    /// dictionary and never indirect references.
+    /// Values are extracted by directly matching [`ObjectVariant`] variants in the
+    /// provided [`Dictionary`]. This function does not resolve indirect references
+    /// on its own; if the `/DecodeParms` entry is an indirect reference (as allowed
+    /// by the PDF specification), the caller must resolve it to a dictionary before
+    /// calling this method.
     pub fn from_dictionary(dict: &Dictionary) -> Self {
         let mut p = Self::default();
 
@@ -793,6 +794,15 @@ pub fn decode(data: &[u8], params: &CCITTFaxParams) -> Result<Vec<u8>, ObjectErr
             if params.end_of_line && read_eol(&mut reader, params.encoded_byte_align).is_err() {
                 break;
             }
+            // With `end_of_line=true` the row EOL has just been consumed; with
+            // `end_of_line=false` we are at the start of the next row.  In both
+            // cases, an EOL bit pattern here is the beginning of the
+            // Return-to-Control (RTC) end-of-block sequence (T.4: six consecutive
+            // EOLs).  Stop rather than passing the remaining EOLs into the Huffman
+            // row decoder.
+            if params.end_of_block && reader.peek_bits(EOL_LEN) == Some(EOL_BITS) {
+                break;
+            }
 
             let row = decode_1d_row(&mut reader, columns)?;
             output.extend_from_slice(&pack_row(&row, params.black_is1));
@@ -803,15 +813,27 @@ pub fn decode(data: &[u8], params: &CCITTFaxParams) -> Result<Vec<u8>, ObjectErr
                 break;
             }
 
+            // After the row EOL, a second consecutive EOL signals the start of
+            // the RTC end-of-block sequence.  Stop rather than mis-reading the
+            // second EOL as a row-encoding tag bit.
+            if params.end_of_block && reader.peek_bits(EOL_LEN) == Some(EOL_BITS) {
+                break;
+            }
+
             // The bit after the EOL selects the row encoding:
             //   1 = 1D (Modified Huffman), 0 = 2D.
             let is_1d = reader.read_bit().unwrap_or(true);
 
             let row = if is_1d {
                 decode_1d_row(&mut reader, columns)?
             } else {
-                decode_2d_row(&mut reader, &ref_row, columns)?
-                    .unwrap_or_else(|| vec![false; columns])
+                match decode_2d_row(&mut reader, &ref_row, columns)? {
+                    Some(row) => row,
+                    // `decode_2d_row` returns `None` when it encounters an EOL or
+                    // EOFB marker before completing the row, signalling the end of
+                    // the encoded data.
+                    None => break,
+                }
             };
 
             output.extend_from_slice(&pack_row(&row, params.black_is1));
@@ -977,6 +999,71 @@ mod tests {
         assert_eq!(output, vec![0xCC]); // W W B B W W B B → 1 1 0 0 1 1 0 0
     }
 
+    // ── Group 3 1D RTC (end-of-block) ────────────────────────────────────────
+
+    /// Group 3 1D, end_of_line=true, end_of_block=true: one all-white row
+    /// followed by two consecutive EOLs (start of the 6-EOL RTC sequence).
+    ///
+    /// Bit layout:
+    ///   Row EOL:   000000000001  (12 bits, pos  0-11, '1' at pos 11)
+    ///   white-8:   10011         ( 5 bits, pos 12-16, '1' at pos 12, 15, 16)
+    ///   RTC EOL1:  000000000001  (12 bits, pos 17-28, '1' at pos 28)
+    ///   RTC EOL2:  000000000001  (12 bits, pos 29-40, '1' at pos 40)
+    ///   Padding:   0000000       ( 7 bits)
+    ///   Total: 48 bits = 6 bytes
+    ///
+    ///   byte 0 (pos  0-7):  0 0 0 0 0 0 0 0 = 0x00
+    ///   byte 1 (pos  8-15): 0 0 0 1 1 0 0 1 = 0x19
+    ///   byte 2 (pos 16-23): 1 0 0 0 0 0 0 0 = 0x80
+    ///   byte 3 (pos 24-31): 0 0 0 0 1 0 0 0 = 0x08
+    ///   byte 4 (pos 32-39): 0 0 0 0 0 0 0 0 = 0x00
+    ///   byte 5 (pos 40-47): 1 0 0 0 0 0 0 0 = 0x80
+    #[test]
+    fn test_1d_rtc_with_eol() {
+        let data = vec![0x00, 0x19, 0x80, 0x08, 0x00, 0x80];
+        let params = CCITTFaxParams {
+            k: 0,
+            columns: 8,
+            rows: 0,
+            end_of_line: true,
+            end_of_block: true,
+            ..Default::default()
+        };
+        // Decoder must stop cleanly at RTC without error and emit exactly one row.
+        let output = decode(&data, &params).expect("RTC should terminate cleanly");
+        assert_eq!(output, vec![0xFF]); // all-white row
+    }
+
+    /// Group 3 1D, end_of_line=false, end_of_block=true: one all-white row
+    /// followed by two consecutive EOLs (start of RTC) that trigger termination.
+    ///
+    /// Bit layout:
+    ///   white-8:  10011         ( 5 bits, pos  0-4, '1' at pos 0, 3, 4)
+    ///   RTC EOL1: 000000000001  (12 bits, pos  5-16, '1' at pos 16)
+    ///   RTC EOL2: 000000000001  (12 bits, pos 17-28, '1' at pos 28)
+    ///   Padding:  000           ( 3 bits)
+    ///   Total: 32 bits = 4 bytes
+    ///
+    ///   byte 0 (pos  0-7):  1 0 0 1 1 0 0 0 = 0x98
+    ///   byte 1 (pos  8-15): 0 0 0 0 0 0 0 0 = 0x00
+    ///   byte 2 (pos 16-23): 1 0 0 0 0 0 0 0 = 0x80
+    ///   byte 3 (pos 24-31): 0 0 0 0 1 0 0 0 = 0x08
+    #[test]
+    fn test_1d_rtc_no_eol() {
+        let data = vec![0x98, 0x00, 0x80, 0x08];
+        let params = CCITTFaxParams {
+            k: 0,
+            columns: 8,
+            rows: 0,
+            end_of_line: false,
+            end_of_block: true,
+            ..Default::default()
+        };
+        // Decoder must stop cleanly at RTC without error and emit exactly one row.
+        let output = decode(&data, &params).expect("RTC should terminate cleanly");
+        assert_eq!(output, vec![0xFF]); // all-white row
+    }
+
     // ── Group 4 (K < 0) ──────────────────────────────────────────────────────
 
     /// Build a Group 4 stream for one all-white 8-pixel row followed by EOFB.
@@ -992,11 +1079,11 @@ mod tests {
     ///
     ///   bits: 1 000000000001 000000000001 0000000  (padded to 32 bits)
     ///   byte0: 10000000 = 0x80
-    ///   byte1: 00000100 = 0x04   (bits 8..15: 0 0 0 0 0 1 0 0)
-    ///   byte2: 00000001 = 0x01   (bits 16..23: 0 0 0 0 0 0 0 1)
-    ///   byte3: 00000000 = 0x00   (padding)
+    ///   byte1: 00001000 = 0x08   (bits 8..15: 0 0 0 0 1 0 0 0, EOL1's '1' at pos 12)
+    ///   byte2: 00000000 = 0x00   (bits 16..23: all zero)
+    ///   byte3: 10000000 = 0x80   (bit 24 = EOL2's '1', bits 25..31 padding)
     fn encoded_g4_one_white_row() -> Vec<u8> {
-        vec![0x80, 0x08, 0x01, 0x00]
+        vec![0x80, 0x08, 0x00, 0x80]
     }
 
     #[test]