Make Pipeline::write take an unsigned char const* (API change)

Jay Berkenbilt
1 parent d55c7ac5
Showing 59 changed files with 108 additions and 101 deletions
ChangeLog
examples/pdf-custom-filter.cc
include/qpdf/Pipeline.hh
include/qpdf/Pl_Buffer.hh
include/qpdf/Pl_Concatenate.hh
include/qpdf/Pl_Count.hh
include/qpdf/Pl_DCT.hh
include/qpdf/Pl_Discard.hh
include/qpdf/Pl_Flate.hh
include/qpdf/Pl_QPDFTokenizer.hh
include/qpdf/Pl_RunLength.hh
include/qpdf/Pl_StdioFile.hh
include/qpdf/QPDFCryptoImpl.hh
libqpdf/Pipeline.cc
libqpdf/Pl_AES_PDF.cc
libqpdf/Pl_ASCII85Decoder.cc
libqpdf/Pl_ASCIIHexDecoder.cc
libqpdf/Pl_Base64.cc
libqpdf/Pl_Buffer.cc
libqpdf/Pl_Concatenate.cc
+2022-05-03  Jay Berkenbilt  <ejb@ql.org>
+
+        * API change: Pipeline::write now takes "unsigned char const *"
+        instead of "unsigned char*". Callers shouldn't have to change
+        anything, though can stop using writable strings or
+        QUtil::unsigned_char_pointer. If you have implemented your own
+        pipelines, you should change your write method to take a const
+        pointer.
+
 2022-05-01  Jay Berkenbilt  <ejb@ql.org>
  
         * JSON: add reactors to the JSON parser, making it possible to
@@ -49,7 +49,7 @@ class Pl_XOR: public Pipeline
   public:
     Pl_XOR(char const* identifier, Pipeline* next, unsigned char key);
     virtual ~Pl_XOR() = default;
-    virtual void write(unsigned char* data, size_t len) override;
+    virtual void write(unsigned char const* data, size_t len) override;
     virtual void finish() override;
  
   private:
@@ -63,7 +63,7 @@ Pl_XOR::Pl_XOR(char const* identifier, Pipeline* next, unsigned char key) :
 }
  
 void
-Pl_XOR::write(unsigned char* data, size_t len)
+Pl_XOR::write(unsigned char const* data, size_t len)
 {
     for (size_t i = 0; i < len; ++i) {
         unsigned char p = data[i] ^ this->key;
@@ -63,15 +63,9 @@ class QPDF_DLL_CLASS Pipeline
  
     // Subclasses should implement write and finish to do their jobs
     // and then, if they are not end-of-line pipelines, call
-    // getNext()->write or getNext()->finish.  It would be really nice
-    // if write could take unsigned char const*, but this would make
-    // it much more difficult to write pipelines around legacy
-    // interfaces whose calls don't want pointers to const data.  As a
-    // rule, pipelines should generally not be modifying the data
-    // passed to them.  They should, instead, create new data to pass
-    // downstream.
+    // getNext()->write or getNext()->finish.
     QPDF_DLL
-    virtual void write(unsigned char* data, size_t len) = 0;
+    virtual void write(unsigned char const* data, size_t len) = 0;
     QPDF_DLL
     virtual void finish() = 0;
     QPDF_DLL
@@ -47,7 +47,7 @@ class QPDF_DLL_CLASS Pl_Buffer: public Pipeline
     QPDF_DLL
     virtual ~Pl_Buffer();
     QPDF_DLL
-    virtual void write(unsigned char*, size_t);
+    virtual void write(unsigned char const*, size_t);
     QPDF_DLL
     virtual void finish();
  
@@ -39,7 +39,7 @@ class QPDF_DLL_CLASS Pl_Concatenate: public Pipeline
     virtual ~Pl_Concatenate();
  
     QPDF_DLL
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
  
     QPDF_DLL
     virtual void finish();
@@ -36,7 +36,7 @@ class QPDF_DLL_CLASS Pl_Count: public Pipeline
     QPDF_DLL
     virtual ~Pl_Count();
     QPDF_DLL
-    virtual void write(unsigned char*, size_t);
+    virtual void write(unsigned char const*, size_t);
     QPDF_DLL
     virtual void finish();
     // Returns the number of bytes written
@@ -61,7 +61,7 @@ class QPDF_DLL_CLASS Pl_DCT: public Pipeline
     virtual ~Pl_DCT();
  
     QPDF_DLL
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     QPDF_DLL
     virtual void finish();
  
@@ -38,7 +38,7 @@ class QPDF_DLL_CLASS Pl_Discard: public Pipeline
     QPDF_DLL
     virtual ~Pl_Discard();
     QPDF_DLL
-    virtual void write(unsigned char*, size_t);
+    virtual void write(unsigned char const*, size_t);
     QPDF_DLL
     virtual void finish();
  
@@ -43,7 +43,7 @@ class QPDF_DLL_CLASS Pl_Flate: public Pipeline
     virtual ~Pl_Flate();
  
     QPDF_DLL
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     QPDF_DLL
     virtual void finish();
  
@@ -61,7 +61,7 @@ class QPDF_DLL_CLASS Pl_Flate: public Pipeline
  
   private:
     QPDF_DLL_PRIVATE
-    void handleData(unsigned char* data, size_t len, int flush);
+    void handleData(unsigned char const* data, size_t len, int flush);
     QPDF_DLL_PRIVATE
     void checkError(char const* prefix, int error_code);
     QPDF_DLL_PRIVATE
@@ -55,7 +55,7 @@ class QPDF_DLL_CLASS Pl_QPDFTokenizer: public Pipeline
     QPDF_DLL
     virtual ~Pl_QPDFTokenizer();
     QPDF_DLL
-    virtual void write(unsigned char* buf, size_t len);
+    virtual void write(unsigned char const* buf, size_t len);
     QPDF_DLL
     virtual void finish();
  
@@ -35,15 +35,15 @@ class QPDF_DLL_CLASS Pl_RunLength: public Pipeline
     virtual ~Pl_RunLength();
  
     QPDF_DLL
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     QPDF_DLL
     virtual void finish();
  
   private:
     QPDF_DLL_PRIVATE
-    void encode(unsigned char* data, size_t len);
+    void encode(unsigned char const* data, size_t len);
     QPDF_DLL_PRIVATE
-    void decode(unsigned char* data, size_t len);
+    void decode(unsigned char const* data, size_t len);
     QPDF_DLL_PRIVATE
     void flush_encode();
  
@@ -43,7 +43,7 @@ class QPDF_DLL_CLASS Pl_StdioFile: public Pipeline
     virtual ~Pl_StdioFile();
  
     QPDF_DLL
-    virtual void write(unsigned char* buf, size_t len);
+    virtual void write(unsigned char const* buf, size_t len);
     QPDF_DLL
     virtual void finish();
  
@@ -78,7 +78,9 @@ class QPDF_DLL_CLASS QPDFCryptoImpl
     // out_data = 0 means to encrypt/decrypt in place
     QPDF_DLL
     virtual void RC4_process(
-        unsigned char* in_data, size_t len, unsigned char* out_data = 0) = 0;
+        unsigned char const* in_data,
+        size_t len,
+        unsigned char* out_data = 0) = 0;
     QPDF_DLL
     virtual void RC4_finalize() = 0;
  
 #include <qpdf/Pipeline.hh>
  
+#include <cstring>
 #include <stdexcept>
  
 Pipeline::Pipeline(char const* identifier, Pipeline* next) :
@@ -72,10 +72,10 @@ Pl_AES_PDF::useStaticIV()
 }
  
 void
-Pl_AES_PDF::write(unsigned char* data, size_t len)
+Pl_AES_PDF::write(unsigned char const* data, size_t len)
 {
     size_t bytes_left = len;
-    unsigned char* p = data;
+    unsigned char const* p = data;
  
     while (bytes_left > 0) {
         if (this->offset == this->buf_size) {
@@ -13,7 +13,7 @@ Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const* identifier, Pipeline* next) :
 }
  
 void
-Pl_ASCII85Decoder::write(unsigned char* buf, size_t len)
+Pl_ASCII85Decoder::write(unsigned char const* buf, size_t len)
 {
     if (eod > 1) {
         return;
@@ -16,7 +16,7 @@ Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const* identifier, Pipeline* next) :
 }
  
 void
-Pl_ASCIIHexDecoder::write(unsigned char* buf, size_t len)
+Pl_ASCIIHexDecoder::write(unsigned char const* buf, size_t len)
 {
     if (this->eod) {
         return;
@@ -35,7 +35,7 @@ Pl_Base64::Pl_Base64(char const* identifier, Pipeline* next, action_e action) :
 }
  
 void
-Pl_Base64::write(unsigned char* data, size_t len)
+Pl_Base64::write(unsigned char const* data, size_t len)
 {
     if (finished) {
         throw std::logic_error("Pl_Base64 used after finished");
@@ -48,9 +48,9 @@ Pl_Base64::write(unsigned char* data, size_t len)
 }
  
 void
-Pl_Base64::decode(unsigned char* data, size_t len)
+Pl_Base64::decode(unsigned char const* data, size_t len)
 {
-    unsigned char* p = data;
+    unsigned char const* p = data;
     while (len > 0) {
         if (!QUtil::is_space(to_c(*p))) {
             this->buf[this->pos++] = *p;
@@ -64,9 +64,9 @@ Pl_Base64::decode(unsigned char* data, size_t len)
 }
  
 void
-Pl_Base64::encode(unsigned char* data, size_t len)
+Pl_Base64::encode(unsigned char const* data, size_t len)
 {
-    unsigned char* p = data;
+    unsigned char const* p = data;
     while (len > 0) {
         this->buf[this->pos++] = *p;
         if (this->pos == 3) {
@@ -24,7 +24,7 @@ Pl_Buffer::~Pl_Buffer()
 }
  
 void
-Pl_Buffer::write(unsigned char* buf, size_t len)
+Pl_Buffer::write(unsigned char const* buf, size_t len)
 {
     if (this->m->data.get() == 0) {
         this->m->data = std::make_shared<Buffer>(len);
@@ -12,7 +12,7 @@ Pl_Concatenate::~Pl_Concatenate()
 }
  
 void
-Pl_Concatenate::write(unsigned char* data, size_t len)
+Pl_Concatenate::write(unsigned char const* data, size_t len)
 {
     getNext()->write(data, len);
 }
@@ -21,7 +21,7 @@ Pl_Count::~Pl_Count()
 }
  
 void
-Pl_Count::write(unsigned char* buf, size_t len)
+Pl_Count::write(unsigned char const* buf, size_t len)
 {
     if (len) {
         this->m->count += QIntC::to_offset(len);
@@ -86,7 +86,7 @@ Pl_DCT::~Pl_DCT()
 }
  
 void
-Pl_DCT::write(unsigned char* data, size_t len)
+Pl_DCT::write(unsigned char const* data, size_t len)
 {
     this->m->buf.write(data, len);
 }
@@ -14,7 +14,7 @@ Pl_Discard::~Pl_Discard()
 }
  
 void
-Pl_Discard::write(unsigned char* buf, size_t len)
+Pl_Discard::write(unsigned char const* buf, size_t len)
 {
 }
  
@@ -84,7 +84,7 @@ Pl_Flate::warn(char const* msg, int code)
 }
  
 void
-Pl_Flate::write(unsigned char* data, size_t len)
+Pl_Flate::write(unsigned char const* data, size_t len)
 {
     if (this->m->outbuf.get() == 0) {
         throw std::logic_error(
@@ -96,7 +96,7 @@ Pl_Flate::write(unsigned char* data, size_t len)
     // Assume int is at least 32 bits.
     static size_t const max_bytes = 1 << 30;
     size_t bytes_left = len;
-    unsigned char* buf = data;
+    unsigned char const* buf = data;
     while (bytes_left > 0) {
         size_t bytes = (bytes_left >= max_bytes ? max_bytes : bytes_left);
         handleData(
@@ -109,14 +109,16 @@ Pl_Flate::write(unsigned char* data, size_t len)
 }
  
 void
-Pl_Flate::handleData(unsigned char* data, size_t len, int flush)
+Pl_Flate::handleData(unsigned char const* data, size_t len, int flush)
 {
     if (len > UINT_MAX) {
         throw std::runtime_error("Pl_Flate: zlib doesn't support data"
                                  " blocks larger than int");
     }
     z_stream& zstream = *(static_cast<z_stream*>(this->m->zdata));
-    zstream.next_in = data;
+    // zlib is known not to modify the data pointed to by next_in but
+    // doesn't declare the field value const unless compiled to do so.
+    zstream.next_in = const_cast<unsigned char*>(data);
     zstream.avail_in = QIntC::to_uint(len);
  
     if (!this->m->initialized) {
@@ -22,7 +22,7 @@ Pl_LZWDecoder::Pl_LZWDecoder(
 }
  
 void
-Pl_LZWDecoder::write(unsigned char* bytes, size_t len)
+Pl_LZWDecoder::write(unsigned char const* bytes, size_t len)
 {
     for (size_t i = 0; i < len; ++i) {
         this->buf[next++] = bytes[i];
@@ -11,7 +11,7 @@ Pl_MD5::Pl_MD5(char const* identifier, Pipeline* next) :
 }
  
 void
-Pl_MD5::write(unsigned char* buf, size_t len)
+Pl_MD5::write(unsigned char const* buf, size_t len)
 {
     if (this->enabled) {
         if (!this->in_progress) {
@@ -23,11 +23,11 @@ Pl_MD5::write(unsigned char* buf, size_t len)
         // Assume int is at least 32 bits.
         static size_t const max_bytes = 1 << 30;
         size_t bytes_left = len;
-        unsigned char* data = buf;
+        unsigned char const* data = buf;
         while (bytes_left > 0) {
             size_t bytes = (bytes_left >= max_bytes ? max_bytes : bytes_left);
             this->md5.encodeDataIncrementally(
-                reinterpret_cast<char*>(data), bytes);
+                reinterpret_cast<char const*>(data), bytes);
             bytes_left -= bytes;
             data += bytes;
         }
@@ -62,7 +62,7 @@ Pl_PNGFilter::Pl_PNGFilter(
 }
  
 void
-Pl_PNGFilter::write(unsigned char* data, size_t len)
+Pl_PNGFilter::write(unsigned char const* data, size_t len)
 {
     size_t left = this->incoming - this->pos;
     size_t offset = 0;
@@ -33,7 +33,7 @@ Pl_QPDFTokenizer::~Pl_QPDFTokenizer()
 }
  
 void
-Pl_QPDFTokenizer::write(unsigned char* data, size_t len)
+Pl_QPDFTokenizer::write(unsigned char const* data, size_t len)
 {
     this->m->buf.write(data, len);
 }
@@ -16,7 +16,7 @@ Pl_RC4::Pl_RC4(
 }
  
 void
-Pl_RC4::write(unsigned char* data, size_t len)
+Pl_RC4::write(unsigned char const* data, size_t len)
 {
     if (this->outbuf.get() == 0) {
         throw std::logic_error(
@@ -25,7 +25,7 @@ Pl_RC4::write(unsigned char* data, size_t len)
     }
  
     size_t bytes_left = len;
-    unsigned char* p = data;
+    unsigned char const* p = data;
  
     while (bytes_left > 0) {
         size_t bytes =
@@ -24,7 +24,7 @@ Pl_RunLength::~Pl_RunLength()
 }
  
 void
-Pl_RunLength::write(unsigned char* data, size_t len)
+Pl_RunLength::write(unsigned char const* data, size_t len)
 {
     if (this->m->action == a_encode) {
         encode(data, len);
@@ -34,7 +34,7 @@ Pl_RunLength::write(unsigned char* data, size_t len)
 }
  
 void
-Pl_RunLength::encode(unsigned char* data, size_t len)
+Pl_RunLength::encode(unsigned char const* data, size_t len)
 {
     for (size_t i = 0; i < len; ++i) {
         if ((this->m->state == st_top) != (this->m->length <= 1)) {
@@ -71,7 +71,7 @@ Pl_RunLength::encode(unsigned char* data, size_t len)
 }
  
 void
-Pl_RunLength::decode(unsigned char* data, size_t len)
+Pl_RunLength::decode(unsigned char const* data, size_t len)
 {
     for (size_t i = 0; i < len; ++i) {
         unsigned char ch = data[i];
@@ -15,7 +15,7 @@ Pl_SHA2::Pl_SHA2(int bits, Pipeline* next) :
 }
  
 void
-Pl_SHA2::write(unsigned char* buf, size_t len)
+Pl_SHA2::write(unsigned char const* buf, size_t len)
 {
     if (!this->in_progress) {
         this->in_progress = true;
@@ -25,7 +25,7 @@ Pl_SHA2::write(unsigned char* buf, size_t len)
     // Assume int is at least 32 bits.
     static size_t const max_bytes = 1 << 30;
     size_t bytes_left = len;
-    unsigned char* data = buf;
+    unsigned char const* data = buf;
     while (bytes_left > 0) {
         size_t bytes = (bytes_left >= max_bytes ? max_bytes : bytes_left);
         this->crypto->SHA2_update(data, bytes);
@@ -24,7 +24,7 @@ Pl_StdioFile::~Pl_StdioFile()
 }
  
 void
-Pl_StdioFile::write(unsigned char* buf, size_t len)
+Pl_StdioFile::write(unsigned char const* buf, size_t len)
 {
     size_t so_far = 0;
     while (len > 0) {
@@ -46,7 +46,7 @@ Pl_TIFFPredictor::Pl_TIFFPredictor(
 }
  
 void
-Pl_TIFFPredictor::write(unsigned char* data, size_t len)
+Pl_TIFFPredictor::write(unsigned char const* data, size_t len)
 {
     size_t left = this->bytes_per_row - this->pos;
     size_t offset = 0;
@@ -97,11 +97,8 @@ QPDFCrypto_gnutls::RC4_init(unsigned char const* key_data, int key_len)
  
 void
 QPDFCrypto_gnutls::RC4_process(
-    unsigned char* in_data, size_t len, unsigned char* out_data)
+    unsigned char const* in_data, size_t len, unsigned char* out_data)
 {
-    if (nullptr == out_data) {
-        out_data = in_data;
-    }
     gnutls_cipher_encrypt2(this->cipher_ctx, in_data, len, out_data, len);
 }
  
@@ -69,7 +69,7 @@ QPDFCrypto_native::RC4_init(unsigned char const* key_data, int key_len)
  
 void
 QPDFCrypto_native::RC4_process(
-    unsigned char* in_data, size_t len, unsigned char* out_data)
+    unsigned char const* in_data, size_t len, unsigned char* out_data)
 {
     this->rc4->process(in_data, len, out_data);
 }
@@ -217,11 +217,8 @@ QPDFCrypto_openssl::rijndael_init(
  
 void
 QPDFCrypto_openssl::RC4_process(
-    unsigned char* in_data, size_t len, unsigned char* out_data)
+    unsigned char const* in_data, size_t len, unsigned char* out_data)
 {
-    if (nullptr == out_data) {
-        out_data = in_data;
-    }
     int out_len = static_cast<int>(len);
     check_openssl(
         EVP_EncryptUpdate(cipher_ctx, out_data, &out_len, in_data, out_len));
@@ -180,7 +180,7 @@ namespace
       public:
         LastChar(Pipeline* next);
         virtual ~LastChar() = default;
-        virtual void write(unsigned char* data, size_t len);
+        virtual void write(unsigned char const* data, size_t len);
         virtual void finish();
         unsigned char getLastChar();
  
@@ -196,7 +196,7 @@ LastChar::LastChar(Pipeline* next) :
 }
  
 void
-LastChar::write(unsigned char* data, size_t len)
+LastChar::write(unsigned char const* data, size_t len)
 {
     if (len > 0) {
         this->last_char = data[len - 1];
@@ -1750,7 +1750,8 @@ QPDFWriter::unparseObject(
                 RC4 rc4(
                     QUtil::unsigned_char_pointer(this->m->cur_data_key),
                     QIntC::to_int(this->m->cur_data_key.length()));
-                rc4.process(QUtil::unsigned_char_pointer(tmp), vlen);
+                auto data = QUtil::unsigned_char_pointer(tmp);
+                rc4.process(data, vlen, data);
                 val = QPDF_String(std::string(tmp, vlen)).unparse();
             }
         } else if (flags & f_hex_string) {
@@ -207,7 +207,7 @@ iterate_rc4(
             key[j] = static_cast<unsigned char>(okey[j] ^ xor_value);
         }
         RC4 rc4(key, QIntC::to_int(key_len));
-        rc4.process(data, data_len);
+        rc4.process(data, data_len, data);
     }
 }
  
@@ -1163,7 +1163,8 @@ QPDF::decryptString(std::string&amp; str, int objid, int generation)
             // be freed even if rc4.process throws an exception.
             auto tmp = QUtil::make_unique_cstr(str);
             RC4 rc4(QUtil::unsigned_char_pointer(key), toI(key.length()));
-            rc4.process(QUtil::unsigned_char_pointer(tmp.get()), vlen);
+            auto data = QUtil::unsigned_char_pointer(tmp.get());
+            rc4.process(data, vlen, data);
             str = std::string(tmp.get(), vlen);
         }
     } catch (QPDFExc&) {
@@ -11,7 +11,7 @@ RC4::RC4(unsigned char const* key_data, int key_len) :
 }
  
 void
-RC4::process(unsigned char* in_data, size_t len, unsigned char* out_data)
+RC4::process(unsigned char const* in_data, size_t len, unsigned char* out_data)
 {
     this->crypto->RC4_process(in_data, len, out_data);
 }
@@ -37,13 +37,9 @@ RC4_native::RC4_native(unsigned char const* key_data, int key_len)
 }
  
 void
-RC4_native::process(unsigned char* in_data, size_t len, unsigned char* out_data)
+RC4_native::process(
+    unsigned char const* in_data, size_t len, unsigned char* out_data)
 {
-    if (out_data == 0) {
-        // Convert in place
-        out_data = in_data;
-    }
-
     for (size_t i = 0; i < len; ++i) {
         key.x = static_cast<unsigned char>((key.x + 1) % 256);
         key.y = static_cast<unsigned char>((key.state[key.x] + key.y) % 256);
@@ -20,7 +20,7 @@ class Pl_AES_PDF: public Pipeline
         size_t key_bytes);
     virtual ~Pl_AES_PDF() = default;
  
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     virtual void finish();
  
     // Use zero initialization vector; needed for AESV3
@@ -8,7 +8,7 @@ class Pl_ASCII85Decoder: public Pipeline
   public:
     Pl_ASCII85Decoder(char const* identifier, Pipeline* next);
     virtual ~Pl_ASCII85Decoder() = default;
-    virtual void write(unsigned char* buf, size_t len);
+    virtual void write(unsigned char const* buf, size_t len);
     virtual void finish();
  
   private:
@@ -8,7 +8,7 @@ class Pl_ASCIIHexDecoder: public Pipeline
   public:
     Pl_ASCIIHexDecoder(char const* identifier, Pipeline* next);
     virtual ~Pl_ASCIIHexDecoder() = default;
-    virtual void write(unsigned char* buf, size_t len);
+    virtual void write(unsigned char const* buf, size_t len);
     virtual void finish();
  
   private:
@@ -9,12 +9,12 @@ class Pl_Base64: public Pipeline
     enum action_e { a_encode, a_decode };
     Pl_Base64(char const* identifier, Pipeline* next, action_e);
     virtual ~Pl_Base64() = default;
-    virtual void write(unsigned char* buf, size_t len) override;
+    virtual void write(unsigned char const* buf, size_t len) override;
     virtual void finish() override;
  
   private:
-    void decode(unsigned char* buf, size_t len);
-    void encode(unsigned char* buf, size_t len);
+    void decode(unsigned char const* buf, size_t len);
+    void encode(unsigned char const* buf, size_t len);
     void flush();
     void flush_decode();
     void flush_encode();
@@ -12,7 +12,7 @@ class Pl_LZWDecoder: public Pipeline
     Pl_LZWDecoder(
         char const* identifier, Pipeline* next, bool early_code_change);
     virtual ~Pl_LZWDecoder() = default;
-    virtual void write(unsigned char* buf, size_t len);
+    virtual void write(unsigned char const* buf, size_t len);
     virtual void finish();
  
   private:
@@ -17,7 +17,7 @@ class Pl_MD5: public Pipeline
   public:
     Pl_MD5(char const* identifier, Pipeline* next);
     virtual ~Pl_MD5() = default;
-    virtual void write(unsigned char*, size_t);
+    virtual void write(unsigned char const*, size_t);
     virtual void finish();
     std::string getHexDigest();
     // Enable/disable. Disabling the pipeline causes it to become a
@@ -24,7 +24,7 @@ class Pl_PNGFilter: public Pipeline
         unsigned int bits_per_sample = 8);
     virtual ~Pl_PNGFilter() = default;
  
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     virtual void finish();
  
   private:
@@ -19,7 +19,7 @@ class Pl_RC4: public Pipeline
         size_t out_bufsize = def_bufsize);
     virtual ~Pl_RC4() = default;
  
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     virtual void finish();
  
   private:
@@ -22,7 +22,7 @@ class Pl_SHA2: public Pipeline
   public:
     Pl_SHA2(int bits = 0, Pipeline* next = 0);
     virtual ~Pl_SHA2() = default;
-    virtual void write(unsigned char*, size_t);
+    virtual void write(unsigned char const*, size_t);
     virtual void finish();
     void resetBits(int bits);
     std::string getHexDigest();
@@ -20,7 +20,7 @@ class Pl_TIFFPredictor: public Pipeline
         unsigned int bits_per_sample = 8);
     virtual ~Pl_TIFFPredictor() = default;
  
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     virtual void finish();
  
   private:
@@ -26,7 +26,7 @@ class QPDFCrypto_gnutls: public QPDFCryptoImpl
  
     virtual void RC4_init(unsigned char const* key_data, int key_len = -1);
     virtual void RC4_process(
-        unsigned char* in_data, size_t len, unsigned char* out_data = 0);
+        unsigned char const* in_data, size_t len, unsigned char* out_data = 0);
     virtual void RC4_finalize();
  
     virtual void SHA2_init(int bits);
@@ -24,7 +24,7 @@ class QPDFCrypto_native: public QPDFCryptoImpl
  
     virtual void RC4_init(unsigned char const* key_data, int key_len = -1);
     virtual void RC4_process(
-        unsigned char* in_data, size_t len, unsigned char* out_data = 0);
+        unsigned char const* in_data, size_t len, unsigned char* out_data = 0);
     virtual void RC4_finalize();
  
     virtual void SHA2_init(int bits);
@@ -37,7 +37,7 @@ class QPDFCrypto_openssl: public QPDFCryptoImpl
  
     void RC4_init(unsigned char const* key_data, int key_len = -1) override;
     void RC4_process(
-        unsigned char* in_data,
+        unsigned char const* in_data,
         size_t len,
         unsigned char* out_data = 0) override;
     void RC4_finalize() override;
@@ -11,9 +11,10 @@ class RC4
     // key_len of -1 means treat key_data as a null-terminated string
     RC4(unsigned char const* key_data, int key_len = -1);
  
-    // out_data = 0 means to encrypt/decrypt in place
+    // It is safe to pass the same pointer to in_data and out_data to
+    // encrypt/decrypt in place
     void
-    process(unsigned char* in_data, size_t len, unsigned char* out_data = 0);
+    process(unsigned char const* in_data, size_t len, unsigned char* out_data);
  
   private:
     std::shared_ptr<QPDFCryptoImpl> crypto;
@@ -10,8 +10,8 @@ class RC4_native
     RC4_native(unsigned char const* key_data, int key_len = -1);
  
     // out_data = 0 means to encrypt/decrypt in place
-    void
-    process(unsigned char* in_data, size_t len, unsigned char* out_data = 0);
+    void process(
+        unsigned char const* in_data, size_t len, unsigned char* out_data = 0);
  
   private:
     class RC4Key
@@ -18,7 +18,7 @@ other_tests()
     RC4 r(reinterpret_cast<unsigned char const*>("quack"));
     auto data = std::make_unique<unsigned char[]>(6);
     memcpy(data.get(), "potato", 6);
-    r.process(data.get(), 6);
+    r.process(data.get(), 6, data.get());
     assert(memcmp(data.get(), "\xa5\x6f\xe7\x27\x2b\x5c", 6) == 0);
     std::cout << "passed" << std::endl;
 }
@@ -68,12 +68,18 @@ For a detailed list of changes, please see the file
  
   - API: breaking changes
  
-    - Remove
+    - Pipeline::write now takes ``unsigned char const*`` instead of
+      ``unsigned char*``. Callers don't need to change anything, but
+      you no longer have to pass writable pointers to pipelines. If
+      you've implemented your own pipeline classes, you will need to
+      update them.
+
+    - Remove deprecated
       ``QPDFAcroFormDocumentHelper::copyFieldsFromForeignPage``. This
       method never worked and only did something in qpdf version
       10.2.x.
  
-    - Remove ``QPDFNameTreeObjectHelper`` and
+    - Remove deprecated ``QPDFNameTreeObjectHelper`` and
       ``QPDFNumberTreeObjectHelper`` constructors that don't take a
       ``QPDF&`` argument.
  
@@ -63,7 +63,7 @@ class ImageChecker: public Pipeline
   public:
     ImageChecker(size_t n);
     virtual ~ImageChecker() = default;
-    virtual void write(unsigned char* data, size_t len);
+    virtual void write(unsigned char const* data, size_t len);
     virtual void finish();
  
   private:
@@ -81,7 +81,7 @@ ImageChecker::ImageChecker(size_t n) :
 }
  
 void
-ImageChecker::write(unsigned char* data, size_t len)
+ImageChecker::write(unsigned char const* data, size_t len)
 {
     for (size_t i = 0; i < len; ++i) {
         size_t y = (this->offset + i) / width / stripesize;