* H.264: bound decoder work from overlapping slices, gaps and queued output
- A macroblock that an earlier slice of the same picture already decoded is
refused, so overlapping slices cannot redo the picture's reconstruction
once per slice.
- The memory budget check counts pictures waiting in the output queue that
have left the DPB (one decode call may carry many access units) and the
DPB's actual size, counting shared buffers once.
- frame_num gap concealment advances the POC state across the skipped run in
constant time instead of once per missing frame_num.
- Storing a reference picture evicts until the DPB is under capacity, rather
than evicting one picture and inserting regardless.
* address review: charge pictures already held at their own size in the decoder budget
* address review: keep the h264 output-queue byte total incrementally
Skipped where the receiver type is generic or not evident without a compiler (wrapping_neg, total_cmp, exists, to_vec, as_ref, split_first, Option::into_inner).
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
The dsf 512 / mvCol [32767, 0] check sat inside loops that never
produce that pair, so it never ran. It is now a direct assertion after
the sweep.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The temporal direct derivation truncated (mvCol · DistScaleFactor + 128) >> 8
with `as i16`, wrapping mvL0 past the spec's motion-vector range on crafted
streams, and mvL0 − mvCol then panicked a debug build with "attempt to
subtract with overflow". The scale and the subtraction now run in i32 (dsf is
already clamped to ±1024, so they cannot overflow) and only the results are
clipped to −2^15..2^15−1, as ITU-T H.264 8.4.1.2.4 reads — mvL1 scaled from
the unclamped mvL0, the shape review settled for the same decoder code in
SoundCraft (soundcraft#994): dsf 512, mvCol 32767 keeps mvL1 at 32767.
Extends the grouped robustness audit's codec-overflow list (#1183), which
covers the POC/MMCO/latency sites but not this one.
Co-Authored-By: GLM-5.3 <noreply@z.ai>
The dequantisation wraps by design (huge_levels_dequantise_without_
overflow_panics), so idct4_add and idct8_add receive any i32 coefficient,
and their plain-i32 butterflies panicked a debug build with "attempt to
add with overflow" on extreme values. A dequantised r outside
-2^15..2^15-1 leaves the transforms' output unspecified (ITU-T H.264
8.5.12.1, 8.5.13.1), so those inputs are clamped to that range —
bit-exact for every conforming stream — instead of panicking.
Debug-only (release wraps), memory-safe either way; the sibling SoundCraft
decoder fixed the same class (its audit's H.264 arithmetic findings).
Extends the grouped robustness audit's codec-overflow list (#1183), which
covers the POC/MMCO/latency sites but not these transforms.
Co-Authored-By: GLM-5.3 <noreply@z.ai>
- #178: ToUnicode ranges looked up without indexing
- #465: frame_num gaps are concealed (bounded) even when the SPS forbids them; cut streams keep playing
- #471: control request lines up to 256 MB so picture/media inserts still fit
- #473: a merge that loses its only row or column is removed, with regression tests
- #521: AutoCorrect no longer rewrites real words (cant, wont, im)
- #654: inherit_placeholder_geometry's doc comment back on its function
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Per-axis size caps let AV1 accept 65536x65536 frames (over 8 GiB of luma)
and did not count references or pictures in flight. A shared budget module
in deckcraft-bitstream sizes a picture with checked arithmetic, and the
AV1, VP9, HEVC and H.264 decoders refuse a picture size whose current
picture, reference slots and in-flight pictures would exceed 4 GiB (1 GiB
on 32-bit), before allocating. set_memory_budget lowers it for hosts and tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Exp-Golomb values read with `read_ue()` can be as large as u32::MAX, so
`read_ue()? + N`, `log2_min + read_ue()?` and the cropping / conformance
window arithmetic overflowed: a panic in debug builds, and in release a
silent wrap (e.g. pic_width_in_mbs_minus1 = u32::MAX became a width of 0,
which passed the `<= 1024` check).
- bitstream: add `BitReader::read_ue_plus(n)`, an overflow-checked
`ue(v) + n` that returns InvalidExpGolomb.
- h264/hevc: use it for every `read_ue()? + N`; saturate the log2 size
sums (the existing range checks then reject them); validate the H.264
crop in u64; make HEVC `crop_rect` saturating; validate the HEVC RPS
delta range before casting to i32.
- Regression tests for each (they fail on the previous code).
- crates/media: probe (duration, rate/channels, size/fps; WMA/WMV recognised), audio decode to
f32 PCM (MP3, AAC M4A/ADTS, ALAC, WAV, AIFF, CAF, FLAC, Vorbis via symphonia; Opus with our
decoder in Ogg/WebM/MKV), video decode (MP4/MOV/WebM/MKV) with YUV->RGBA, poster frames,
trim/fade/volume, Player mixer + per-voice clock (device-clocked or wall-clocked), VideoFeed.
- Codec crates ported from FilmCraft: bitstream, h264, hevc, vp9, av1, isobmff, matroska, ogg, opus.
- insert.audio/insert.video probe and store duration/size and a poster frame; unplayable media
is embedded with a warning. New media.play/pause/toggle/stop/seek/info/posterFrame.
- UI: MediaHost (cpal output injected by the desktop app), control bar under media, video frames
on canvas and in the show; autoplay, click to play, loop, rewind, across slides, hide, full screen.
- Tests with in-code WAV/AIFF and CC0 self-generated fixtures (make.sh, ATTRIBUTION.md rows).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dylan M. Taylor
Brandon Thomas
SusieeTheFemboyandClaude Opus 5.5
Harrison Booth
Nikita RakitinandCursor
Nikita
Pedro Jose Soto Rivera