The accepting thread drained each connection it refused as busy for up
to 250 ms before accepting the next, so refused peers that stayed
connected without writing delayed every connection after them. Each
drain now runs on a thread of its own, up to 16 at once; past that, a
refused connection gets the busy reply and is closed without a drain.
connection_limit_refuses_then_frees_slot now uses a 30 s idle timeout:
its first client sends nothing, and under load the 300 ms timeout
closed it before the third client connected.
When every connection slot was taken, the accepting thread wrote the busy
reply and dropped the socket. A peer that had already written a line saw a
reset instead of the reason. The busy path now closes the same way a
rejected line does: it sends the FIN and drains the socket for at most
250 ms, or the write timeout when that is shorter.
The drain set its read timeout on the writing handle and read through a
clone of the socket. On Windows, a read timeout set on one handle of a
try_clone pair can fail to apply to reads through the other. On Windows 11
a rejected peer that stayed connected then kept its slot until the idle
timeout (10 minutes by default) instead of the write timeout. The timeout
is now set on the handle that reads.
Two tests failed intermittently. a_pipelined_peer_still_reads_why_its_line_was_rejected
connected 12 peers through 2 slots, and a slot comes back only after the
thread serving the previous peer ends; each peer now has a slot of its own.
blocked_ui_times_out_and_full_queue_is_busy relied on a 50 ms sleep to
order two requests from two connections; it now accepts either order.
* fix(pptx): harden import resource budgets, deduplication, and lookup caching
- Chart sidecars (Finding 2): Enforce an import-wide retained byte budget
and cache captured sidecars by chart part to prevent memory amplification.
- Content types cache (Finding 6): Cache parsed [Content_Types].xml defaults
and overrides in Package.ct_cache.
- Text run splitting and font lengths (Finding 8): Bound typeface attribute
lengths and cap paragraph runs to prevent multiplication on text splitting.
- Inner namespace decls (Finding 15): Use HashSet/HashMap indexing and cap
inner declarations to 1,000.
- Slide and notes deduplication (Finding 16): Deduplicate slide paths and
cache parsed notes slide bodies by target.
- Diagram media caching (Finding 22): Cache diagram media payloads in
imp.media_by_part.
- Master slide deduplication (Finding 28): Deduplicate master paths before
loading.
- Layout target deduplication (Finding 30): Deduplicate layout targets
across master slides.
- Chart value axis indexing (Finding 32): Index valAx by axId using a HashMap.
- ChartEx series output budget (Finding 34): Charge series point vectors
against an aggregate output budget and cap series count.
- ChartEx point allocation bounds (Finding 36): Allocate point vectors
only to actual point span bounded by budget rather than declared ptCount.
- SmartArt recursion depth (Finding 38): Limit SmartArt recursion depth to 8.
* fix(pptx): address review feedback on sidecar cache, series budget, and inner decls
* fix(pptx): preserve cached sidecar bytes and non-empty category fallback
- Row 31: Use HashMap for comment author lookup in author_slot
- Row 37: Index preserved parts by ID before resolving graphic frame relationships
- Row 10: Index kept chart parts by normalized path and avoid duplicate payload scans
- Row 39: Update existing relationship parts instead of appending duplicates in PackageOut
* fix(metafile): harden EMF+ parsing, clipping complexity, and memory accounting
- Row 72: Use checked tail slicing in comment header offset calculations
- Row 78: Break FillRects and DrawRects loops early when canvas is full
- Row 75: Pre-check dimensions in decode_compressed before RGBA pixel allocation
- Row 85: Account for EMF+ object table image/path memory against MAX_BYTES
- Row 42: Replace O(N^2) prefix copying in wrap_line with linear measurement
- Row 43 & 54: Share immutable clip regions Arc across placed items and charge canvas regions
- Row 48: Bound text transformation scale and glyph curve geometry in Picture::place and draw_text
- Row 52 & 68: Impose work budget bounds on Sutherland-Hodgman polygon clipping and bitmap masking
* fix(metafile): collapse nested if statement per clippy
Skipped where the receiver type is generic or not evident without a compiler (wrapping_neg, total_cmp, exists, to_vec, as_ref, split_first, Option::into_inner).
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* chore: resolve SonarCloud maintainability issues
* fix: address shellcheck SC2059 and fix generic cast ambiguity
* style: apply rustfmt formatting
* fix: restore compile and behaviour in Sonar refactors
- fonts: char::is_alphanumeric takes &self, so filter needs a closure
- h264: keep the mvd accumulator as i32 (prefix is usize)
- model: annotate the non-stacked range accumulators as f64
- engine: chart.options still clears the raw chart XML for upDownBars
and quartiles; smartart goes back to the glob import (cmd! macro)
- web: keep the original viewport meta (behaviour change)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Assign positional parameters to locals in sha256 verification
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Dylan Taylor <dylan@craftmaker.dev>
* Media: use craft-media for bitstream, isobmff and matroska
deckcraft-bitstream, deckcraft-isobmff and deckcraft-matroska re-export
craft_media::{bitstream, isobmff, matroska} from craft-libs. The packages
and their public paths stay, so the codec crates build unchanged.
deckcraft-bitstream keeps the decoder memory budget as its own module
(budget). deckcraft-media names the new CodecConfig::Apv entry.
* Media: pin craft-media to storytold/craft-libs at f97c84d2 (#245)
* Media: pin craft-media to storytold/craft-libs at f0ad6c1e (#246)
An unclamped hostile selection end (text.select caret [1e18, 0]) made
covered_paragraphs iterate for effectively forever.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Otherwise presenter_grid stayed true and held auto-advance and rehearsal for the
rest of the show (CodeRabbit).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A Wingdings or Webdings face without private-use coverage no longer gets
Symbol's mapping (0xD8 drew as ¬).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The format repair clamps a crop to 0..1, but an unrepaired negative value still
took the stretch path in paint_frame (CodeRabbit on #1008).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dotCooCoo