jpeg: CodeRabbit fixes: the max_alloc and damaged docs describe the combined check and block budget, SOF2's message names its coding

crates/jpeg/README.md

@@ -55,14 +55,15 @@ if img.damaged { /* warn: part of the image is missing */ }
     inverted convention (maximum = no ink) and are inverted back. With Adobe transform 2 (YCCK),
     C, M and Y are converted from YCbCr, which yields ink amounts directly, and K is inverted.
 - `damaged` is set when entropy-coded data was cut short or corrupt after at least one MCU had
-  decoded, or the stream had more than 500 scans. The rest of that scan is left out; those
-  blocks keep what earlier scans decoded. A stream with no decodable image data is an error.
+  decoded, or its scans would decode more than 64 passes over the frame's blocks. The rest of
+  that scan, and every scan past the budget, is left out; those blocks keep what earlier scans
+  decoded. A stream with no decodable image data is an error.
 
 ## Limits
 
 `Limits { max_pixels, max_alloc }` is checked against the frame header before anything is
-allocated: `width × height` against `max_pixels`, and both the output buffer and the decoder's
-own coefficient and sample buffers against `max_alloc`. The defaults are 2³⁰ pixels and 8 GiB on
+allocated: `width × height` against `max_pixels`, and the output buffer plus the decoder's own
+coefficient and sample buffers, together, against `max_alloc`. The defaults are 2³⁰ pixels and 8 GiB on
 64-bit targets, 1 GiB on 32-bit ones (wasm32). Fields are public, so an app sets one and keeps
 the other default:
 

crates/jpeg/src/lib.rs

@@ -71,8 +71,8 @@ fn unsupported(m: impl Into<String>) -> Error {
 pub struct Limits {
     /// Maximum `width * height`.
     pub max_pixels: u64,
-    /// Maximum bytes for the decoded output, and separately for the decoder's own
-    /// coefficient and sample buffers.
+    /// Maximum bytes for the decoded output and the decoder's own coefficient and sample
+    /// buffers together.
     pub max_alloc: u64,
 }
 
@@ -361,7 +361,7 @@ fn parse_frame(marker: u8, seg: &[u8], limits: &Limits) -> Result<Frame, Error>
         0xC0 | 0xC1 => (false, false),
         0xC9 => (true, false),
         0xCA => (true, true),
-        0xC2 => return Err(unsupported("progressive JPEG with 12-bit samples is not supported")),
+        0xC2 => return Err(unsupported("progressive Huffman-coded JPEG is not supported")),
         0xC3 | 0xCB => return Err(unsupported("lossless JPEG is not supported")),
         _ => return Err(unsupported("hierarchical JPEG is not supported")),
     };