Apply review fixes

- crates/pptx/src/write/chart.rs

Cargo.lock

@@ -1038,7 +1038,7 @@ checksum = "0c87e182de0887fd5361989c677c4e8f5000cd9491d6d563161a8f3a5519fc7f"
 
 [[package]]
 name = "deckcraft"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "arboard",
  "chrono",
@@ -1060,7 +1060,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-anim"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-geom",
  "deckcraft-model",
@@ -1069,7 +1069,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-av1"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1078,14 +1078,14 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-bitstream"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "craft-media",
 ]
 
 [[package]]
 name = "deckcraft-cli"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-engine",
  "deckcraft-mcp",
@@ -1095,14 +1095,14 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-color"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "deckcraft-engine"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "chrono",
  "deckcraft-anim",
@@ -1128,7 +1128,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-fonts"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "epaint_default_fonts",
  "harfrust 0.13.3",
@@ -1140,7 +1140,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-format"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-model",
  "serde",
@@ -1151,7 +1151,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-geom"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "kurbo",
  "serde",
@@ -1159,7 +1159,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-h264"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1168,7 +1168,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-hevc"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1177,7 +1177,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-mcp"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-engine",
  "deckcraft-render",
@@ -1187,7 +1187,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-media"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "craft-audio",
  "craft-media",
@@ -1203,7 +1203,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-metafile"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "image",
  "kurbo",
@@ -1212,7 +1212,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-model"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-color",
  "deckcraft-geom",
@@ -1224,7 +1224,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-pdf"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "craft-pdf",
  "deckcraft-fonts",
@@ -1242,7 +1242,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-pptx"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-color",
  "deckcraft-engine",
@@ -1258,7 +1258,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-render"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-anim",
  "deckcraft-color",
@@ -1277,7 +1277,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-text"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "chrono",
  "deckcraft-color",
@@ -1291,7 +1291,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-ui-egui"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "craft-ui",
  "craft-update",
@@ -1317,7 +1317,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-vp9"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "deckcraft-bitstream",
  "rayon",
@@ -1326,7 +1326,7 @@ dependencies = [
 
 [[package]]
 name = "deckcraft-web"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "craft-web-api",
  "craft-web-host",
@@ -6311,7 +6311,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "serde_json",
 ]

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/deckcraft", "apps/deckcraft-cli"]
 
 [workspace.package]
-version = "0.18.0"
+version = "0.18.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"

crates/av1/src/decoder.rs

@@ -118,6 +118,8 @@ enum Output {
         grain: FilmGrainParams,
         apply_film_grain: bool,
         pts: i64,
+        /// What copying the picture out costs, in the reference's own format.
+        bytes: u64,
     },
 }
 
@@ -132,7 +134,7 @@ impl Output {
     fn take(self) -> Result<Picture> {
         match self {
             Output::Decoded(s) => s.wait().map(|p| Arc::try_unwrap(p).unwrap_or_else(|p| (*p).clone())),
-            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts } => {
+            Output::Existing { slot, seq, width, height, grain, apply_film_grain, pts, .. } => {
                 let rf = slot.wait()?;
                 Ok(output_picture(&seq, &rf, width, height, &grain, apply_film_grain, pts))
             }
@@ -379,8 +381,8 @@ impl Decoder {
         // Output policy (7.18.1 note): with scalability, show one frame per temporal unit, the
         // highest spatial layer present.
         let scalable = self.seq.as_ref().is_some_and(|s| s.op_idc != 0);
-        if !scalable {
-            self.out.extend(out.into_iter().map(|(o, _, _)| o));
+        let kept: Vec<Output> = if !scalable {
+            out.into_iter().map(|(o, _, _)| o).collect()
         } else {
             let mut last: Option<(usize, u32)> = None;
             let mut sel: Vec<Output> = Vec::new();
@@ -400,8 +402,27 @@ impl Decoder {
                     }
                 }
             }
-            self.out.extend(sel);
+            sel
+        };
+        // Every repeat is copied out whole, so the repeats this call keeps (after the layer
+        // selection) must not queue more than half the decoder budget; the first one over it and
+        // everything after is dropped.
+        let mut r = r;
+        let mut repeat_bytes = 0u64;
+        let mut ok = Vec::with_capacity(kept.len());
+        for o in kept {
+            if let Output::Existing { bytes, .. } = &o {
+                repeat_bytes = repeat_bytes.saturating_add(*bytes);
+                if repeat_bytes > self.memory_budget / 2 {
+                    if r.is_ok() {
+                        r = Err(Error::Invalid("repeated frame outputs exceed the decoder memory budget"));
+                    }
+                    break;
+                }
+            }
+            ok.push(o);
         }
+        self.out.extend(ok);
         r
     }
 
@@ -503,6 +524,15 @@ impl Decoder {
             let idx = fh.frame_to_show_map_idx;
             let slot = self.ref_frames[idx].clone().ok_or(Error::Invalid("show_existing_frame of an empty slot"))?;
             let info = self.refs[idx].clone();
+            // Sized in the reference's own format: a new sequence header may differ from it.
+            let shape = deckcraft_bitstream::budget::PictureShape {
+                width: u64::from(info.upscaled_width),
+                height: u64::from(info.frame_height),
+                shift_x: u32::from(info.subsampling_x),
+                shift_y: u32::from(info.subsampling_y),
+                chroma_planes: if info.mono_chrome { 0 } else { 2 },
+                bytes_per_sample: 2,
+            };
             let o = Output::Existing {
                 slot: slot.clone(),
                 seq: seq.clone(),
@@ -511,6 +541,7 @@ impl Decoder {
                 grain: fh.film_grain.clone(),
                 apply_film_grain: self.apply_film_grain,
                 pts: self.pts,
+                bytes: shape.bytes().unwrap_or(u64::MAX),
             };
             if fh.frame_type == KEY_FRAME as u8 {
                 // reference frame loading process (7.21) then refresh every slot (7.20)
@@ -629,6 +660,9 @@ impl Decoder {
                 ri.lf_deltas = fh.lf.deltas;
                 ri.seg_features = fh.seg.features;
                 ri.grain = fh.film_grain.clone();
+                ri.subsampling_x = job.seq.color.subsampling_x;
+                ri.subsampling_y = job.seq.color.subsampling_y;
+                ri.mono_chrome = job.seq.color.mono_chrome;
                 self.ref_frames[i] = Some(job.slot.clone());
             }
         }

crates/av1/src/header.rs

@@ -360,6 +360,10 @@ pub struct RefInfo {
     pub lf_deltas: LoopFilterDeltas,
     pub seg_features: SegmentationFeatures,
     pub grain: FilmGrainParams,
+    /// The colour format the frame was decoded in (a later sequence header may change it).
+    pub subsampling_x: u8,
+    pub subsampling_y: u8,
+    pub mono_chrome: bool,
 }
 
 /// A parsed uncompressed frame header with its derived variables.

crates/hevc/src/decoder.rs

@@ -404,10 +404,36 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 2,
         };
+        let frame_bytes = |f: &crate::picture::Frame| {
+            (f.width as u64)
+                .saturating_mul(f.height as u64)
+                .saturating_add((f.cwidth as u64).saturating_mul(f.cheight as u64).saturating_mul(2))
+                .saturating_mul(2)
+        };
+        // Output frames waiting to be returned stay allocated after they leave the DPB, at their
+        // own size: a resolution change in this call can leave pictures of the previous SPS.
+        let queued: u64 = self
+            .out_queue
+            .iter()
+            .filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame)) && !self.in_flight.iter().any(|f| Arc::ptr_eq(f, &o.frame)))
+            .map(|o| frame_bytes(&o.frame))
+            .fold(0, u64::saturating_add);
+        // Frames the DPB holds now count at their own size too (an SPS change flushes them into the
+        // queue before the new pictures are made): the DPB part is the larger of its new slots and that.
+        let held: u64 = self.dpb.entries.iter().map(|e| frame_bytes(&e.frame)).fold(0, u64::saturating_add);
+        // A queued frame still being decoded is one of the in-flight pictures already reserved, so the
+        // queue and the in-flight reservation overlap: charge the larger, not both.
         let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64;
+        let slots = shape.store_bytes(u64::from(sps.max_dec_pic_buffering));
+        let flight = shape.store_bytes(self.max_in_flight as u64);
+        let total = shape
+            .store_bytes(1)
+            .zip(slots)
+            .zip(flight)
+            .map(|((one, slots), flight)| slots.max(held).saturating_add(one).saturating_add(flight).saturating_add(queued));
         ensure!(
-            shape.fits(pictures, self.memory_budget),
-            "{}x{} pictures with {pictures} in the decoder exceed the memory budget",
+            total.is_some_and(|b| b <= self.memory_budget),
+            "{}x{} pictures with {pictures} in the decoder and {queued} bytes queued exceed the memory budget",
             sps.width,
             sps.height
         );

crates/pptx/src/custgeom.rs

@@ -15,14 +15,6 @@ use crate::xml::{A, El, W};
 
 const DEG: f64 = 60_000.0;
 
-/// Distinct path coordinate spaces whose guides are evaluated for one custom geometry; paths in
-/// further spaces are left out.
-const MAX_SPACES: usize = 16;
-
-/// Guide-name bytes all cached spaces may hold between them; the first space counts towards it but is always kept.
-/// Every space copies the names, which the XML limits bound only once.
-const MAX_SPACE_NAME_BYTES: usize = 4 << 20;
-
 /// Guide variables for one shape.
 pub struct Guides {
     vars: HashMap<String, f64>,
@@ -74,10 +66,6 @@ impl Guides {
         set("7cd8", 18_900_000.0);
         Guides { vars: v }
     }
-    /// Bytes of the guide names held.
-    fn name_bytes(&self) -> usize {
-        self.vars.keys().map(String::len).sum()
-    }
     pub fn get(&self, name: &str) -> f64 {
         let name = name.trim();
         if let Some(v) = self.vars.get(name) {
@@ -161,51 +149,16 @@ fn pt(g: &Guides, e: &El) -> (f64, f64) {
 /// Convert `a:custGeom` to custom paths. `w`/`h` is the shape size in EMU (used for guides and for
 /// paths that don't give their own coordinate space).
 pub fn read_cust_geom(cg: &El, w_emu: f64, h_emu: f64) -> Vec<CustomPath> {
-    read_cust_geom_counting(cg, w_emu, h_emu).0
-}
-
-/// [`read_cust_geom`], and how many paths were left out for lack of room in the guide caches
-/// (`(too many coordinate spaces, too many guide-name bytes)`); each cause is also logged once.
-fn read_cust_geom_counting(cg: &El, w_emu: f64, h_emu: f64) -> (Vec<CustomPath>, (usize, usize)) {
     let mut out = vec![];
-    let mut dropped = (0usize, 0usize);
-    let Some(pl) = cg.child("pathLst") else { return (out, dropped) };
-    let mut spaces: HashMap<(u64, u64), Guides> = HashMap::new();
-    let mut name_bytes = 0usize;
-    let mut budget_full = false;
-    // The cap on cached spaces saves guide evaluation: a geometry without guides has none to save.
-    let guided = ["avLst", "gdLst"].iter().any(|n| cg.child(n).is_some_and(|l| l.elements().next().is_some()));
+    let Some(pl) = cg.child("pathLst") else { return out };
     for p in pl.children_named("path").take(1000) {
         let pw = p.f64("w").unwrap_or(0.0);
         let ph = p.f64("h").unwrap_or(0.0);
         // Guides are evaluated in the path's own space when it has one.
         let (gw, gh) = if pw > 0.0 || ph > 0.0 { (pw, ph) } else { (w_emu, h_emu) };
-        // The guide lists are evaluated once per coordinate space, not once per path.
-        let key = (gw.to_bits(), gh.to_bits());
-        if !spaces.contains_key(&key) {
-            if guided && (budget_full || spaces.len() >= MAX_SPACES) {
-                if budget_full {
-                    dropped.1 += 1;
-                } else {
-                    dropped.0 += 1;
-                }
-                continue;
-            }
-            let mut g = Guides::new(gw, gh);
-            g.eval_list(cg.child("avLst"));
-            g.eval_list(cg.child("gdLst"));
-            // The first space is always kept; later ones only while the cache stays within budget.
-            let bytes = g.name_bytes();
-            if guided && !spaces.is_empty() && name_bytes.saturating_add(bytes) > MAX_SPACE_NAME_BYTES {
-                // Every space holds the same names, so no later space fits either.
-                budget_full = true;
-                dropped.1 += 1;
-                continue;
-            }
-            name_bytes = name_bytes.saturating_add(bytes);
-            spaces.insert(key, g);
-        }
-        let Some(g) = spaces.get(&key) else { continue };
+        let mut g = Guides::new(gw, gh);
+        g.eval_list(cg.child("avLst"));
+        g.eval_list(cg.child("gdLst"));
         let mut d = String::new();
         let mut cur = (0.0, 0.0);
         let mut start = (0.0, 0.0);
@@ -213,7 +166,7 @@ fn read_cust_geom_counting(cg: &El, w_emu: f64, h_emu: f64) -> (Vec<CustomPath>,
             match c.local() {
                 "moveTo" => {
                     if let Some(q) = c.child("pt") {
-                        cur = pt(g, q);
+                        cur = pt(&g, q);
                         start = cur;
                         d.push_str("M ");
                         num(&mut d, cur.0);
@@ -224,7 +177,7 @@ fn read_cust_geom_counting(cg: &El, w_emu: f64, h_emu: f64) -> (Vec<CustomPath>,
                 }
                 "lnTo" => {
                     if let Some(q) = c.child("pt") {
-                        cur = pt(g, q);
+                        cur = pt(&g, q);
                         d.push_str("L ");
                         num(&mut d, cur.0);
                         d.push(' ');
@@ -233,7 +186,7 @@ fn read_cust_geom_counting(cg: &El, w_emu: f64, h_emu: f64) -> (Vec<CustomPath>,
                     }
                 }
                 "cubicBezTo" => {
-                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(g, q)).collect();
+                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(&g, q)).collect();
                     if let [a, b, e] = pts.as_slice() {
                         d.push_str("C ");
                         for (x, y) in [a, b, e] {
@@ -246,7 +199,7 @@ fn read_cust_geom_counting(cg: &El, w_emu: f64, h_emu: f64) -> (Vec<CustomPath>,
                     }
                 }
                 "quadBezTo" => {
-                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(g, q)).collect();
+                    let pts: Vec<(f64, f64)> = c.children_named("pt").map(|q| pt(&g, q)).collect();
                     if let [a, e] = pts.as_slice() {
                         d.push_str("Q ");
                         for (x, y) in [a, e] {
@@ -283,16 +236,7 @@ fn read_cust_geom_counting(cg: &El, w_emu: f64, h_emu: f64) -> (Vec<CustomPath>,
         let (ow, oh) = if pw > 0.0 || ph > 0.0 { (pw, ph) } else { (w_emu.max(1.0), h_emu.max(1.0)) };
         out.push(CustomPath { w: ow, h: oh, d: d.trim_end().to_string(), fill, stroke: p.bool("stroke").unwrap_or(true) });
     }
-    if dropped.0 > 0 {
-        log::warn!("pptx: a custom geometry uses more than {MAX_SPACES} distinct path coordinate spaces; {} later path(s) are not kept", dropped.0);
-    }
-    if dropped.1 > 0 {
-        log::warn!(
-            "pptx: a custom geometry's guide names pass {MAX_SPACE_NAME_BYTES} bytes across its coordinate spaces; {} later path(s) are not kept",
-            dropped.1
-        );
-    }
-    (out, dropped)
+    out
 }
 
 /// Ellipse parametric angle for a visual angle `a` (radians).
@@ -526,46 +470,6 @@ mod tests {
         assert_eq!(paths[1].d, "M 1 1 Q 2 2 3 1");
     }
 
-    #[test]
-    fn paths_share_guides_and_distinct_spaces_are_capped() {
-        let path = |w: usize| format!(r#"<a:path w="{w}" h="10"><a:moveTo><a:pt x="mid" y="1"/></a:moveTo></a:path>"#);
-        let paths: String = (1..=40).map(|i| path(10 * i)).collect();
-        let x = format!(
-            r#"<a:custGeom xmlns:a="x"><a:gdLst><a:gd name="mid" fmla="*/ w 1 2"/></a:gdLst><a:pathLst>{paths}{}</a:pathLst></a:custGeom>"#,
-            path(10)
-        );
-        let d = parse(x.as_bytes()).unwrap();
-        let (out, dropped) = read_cust_geom_counting(&d.root, 1.0, 1.0);
-        assert_eq!(out.len(), MAX_SPACES + 1, "16 spaces plus the repeat of the first");
-        assert_eq!(dropped, (40 - MAX_SPACES, 0), "the paths of later spaces are counted, to be warned about");
-        assert!(out[0].d.starts_with("M 5 1"), "{}", out[0].d);
-        assert!(out[MAX_SPACES].d.starts_with("M 5 1"), "{}", out[MAX_SPACES].d);
-    }
-
-    #[test]
-    fn guide_name_bytes_across_spaces_are_budgeted() {
-        let name = "n".repeat(3 << 20);
-        let path = |w: usize| format!(r#"<a:path w="{w}" h="10"><a:moveTo><a:pt x="{name}" y="1"/></a:moveTo></a:path>"#);
-        let x = format!(
-            r#"<a:custGeom xmlns:a="x"><a:gdLst><a:gd name="{name}" fmla="*/ w 1 2"/></a:gdLst><a:pathLst>{}{}{}</a:pathLst></a:custGeom>"#,
-            path(10),
-            path(20),
-            path(10)
-        );
-        let d = parse(x.as_bytes()).unwrap();
-        let (out, dropped) = read_cust_geom_counting(&d.root, 1.0, 1.0);
-        assert_eq!(out.len(), 2, "the second 3 MiB space is over budget and left out; the first space's repeat stays");
-        assert_eq!(dropped, (0, 1), "the path left out is counted, to be warned about");
-    }
-
-    #[test]
-    fn guide_free_geometries_are_not_capped_by_space() {
-        let paths: String = (1..=40).map(|i| format!(r#"<a:path w="{}" h="10"><a:moveTo><a:pt x="1" y="1"/></a:moveTo></a:path>"#, 10 * i)).collect();
-        let x = format!(r#"<a:custGeom xmlns:a="x"><a:avLst/><a:gdLst/><a:pathLst>{paths}</a:pathLst></a:custGeom>"#);
-        let d = parse(x.as_bytes()).unwrap();
-        assert_eq!(read_cust_geom(&d.root, 1.0, 1.0).len(), 40);
-    }
-
     #[test]
     fn write_then_read_path() {
         let p = CustomPath { w: 100.0, h: 50.0, d: "M 0 0 L 100 0 C 100 10 90 50 50 50 Q 0 50 0 0 Z".into(), fill: FillMode::Norm, stroke: true };

crates/pptx/src/write/chart.rs

@@ -132,7 +132,20 @@ fn title(w: &mut W, text: &str, c: &Chart) {
     w.close("c:title");
 }
 
+/// Points one cache writes. Excel and PowerPoint hold 32,000 points per series, so this is far
+/// above any chart they make; a longer vector is cut here with a warning, not refused.
+const MAX_CACHE_POINTS: usize = 1_000_000;
+
+/// `vals` cut to [`MAX_CACHE_POINTS`].
+fn capped<T>(vals: &[T]) -> &[T] {
+    if vals.len() > MAX_CACHE_POINTS {
+        log::warn!("pptx: chart data cache cut from {} to {MAX_CACHE_POINTS} points", vals.len());
+    }
+    &vals[..vals.len().min(MAX_CACHE_POINTS)]
+}
+
 fn str_cache(w: &mut W, f: &str, vals: &[String]) {
+    let vals = capped(vals);
     w.open0("c:strRef");
     w.elt("c:f", f);
     w.open0("c:strCache");
@@ -147,6 +160,7 @@ fn str_cache(w: &mut W, f: &str, vals: &[String]) {
 }
 
 fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {
+    let vals = capped(vals);
     w.open0("c:numRef");
     w.elt("c:f", f);
     w.open0("c:numCache");
@@ -165,6 +179,7 @@ fn num_cache(w: &mut W, f: &str, vals: &[Option<f64>]) {
 
 /// Numbers written into the chart itself (`c:numLit`), with no worksheet range behind them.
 fn num_lit(w: &mut W, vals: &[Option<f64>]) {
+    let vals = capped(vals);
     w.open0("c:numLit");
     w.val("c:ptCount", vals.len());
     for (i, v) in vals.iter().enumerate() {
@@ -246,6 +261,9 @@ fn point_fills(w: &mut W, s: &Series, g: Group) {
     }
 }
 
+/// Data points (categories and values counted per series) one chart group writes to its caches.
+const MAX_EXPORT_POINTS: usize = 4_000_000;
+
 fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group) {
     w.open0("c:ser");
     w.val("c:idx", i);
@@ -305,7 +323,7 @@ fn series(w: &mut W, c: &Chart, s: &Series, i: usize, kind: ChartType, g: Group)
             trendline(w, t);
         }
     }
-    let n = c.categories.len().max(s.values.len());
+    let n = c.categories.len().max(s.values.len()).min(MAX_CACHE_POINTS);
     let last = n + 1;
     if let Some(e) = &s.error_bars {
         error_bars(w, e, g);
@@ -491,6 +509,24 @@ fn axes(w: &mut W, c: &Chart, g: Group) {
     w.close("c:valAx");
 }
 
+/// Points `series` writes into its caches for group `g`, synthesized vectors included.
+fn series_points(c: &Chart, s: &Series, g: Group) -> usize {
+    let v = s.values.len();
+    if matches!(g, Group::Scatter | Group::Bubble) {
+        let xs = if s.x_values.is_empty() { v } else { s.x_values.len() };
+        let sizes = if g != Group::Bubble {
+            0
+        } else if s.sizes.is_empty() {
+            v
+        } else {
+            s.sizes.len()
+        };
+        xs.saturating_add(v).saturating_add(sizes)
+    } else {
+        c.categories.len().saturating_add(v)
+    }
+}
+
 fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)]) {
     let g = group_of(kind);
     let grouping = if kind.percent() {
@@ -529,7 +565,17 @@ fn plot_group(w: &mut W, c: &Chart, kind: ChartType, list: &[(usize, &Series)])
     if g != Group::Stock {
         w.val("c:varyColors", vary);
     }
-    for (i, s) in list {
+    // Each series repeats the categories in its own cache, so the output grows with series times
+    // categories: stop adding series once a group's caches pass the budget (the first is always written).
+    // The first series is always written; each of its caches is cut at MAX_CACHE_POINTS.
+    let mut left = MAX_EXPORT_POINTS;
+    for (n, (i, s)) in list.iter().enumerate() {
+        let cost = series_points(c, s, g);
+        if n > 0 && cost > left {
+            log::warn!("pptx: chart export stopped after {n} series; the data caches passed {MAX_EXPORT_POINTS} points");
+            break;
+        }
+        left = left.saturating_sub(cost);
         series(w, c, s, *i, kind, g);
     }
     if c.data_labels {
@@ -870,6 +916,7 @@ fn cx_text(w: &mut W, t: &str) {
 
 /// A `cx:lvl` of points.
 fn cx_level(w: &mut W, pts: &[String], format: Option<&str>) {
+    let pts = capped(pts);
     let mut a = A::new().a("ptCount", pts.len());
     if let Some(f) = format {
         a = a.a("formatCode", f);
@@ -895,14 +942,39 @@ fn kept_region_layout(raw: &str) -> Option<String> {
     lp.name.starts_with("cx:").then(|| lp.to_xml())
 }
 
+/// Points one `chartEx` part may carry in all, categories repeated for every series: Excel's 255
+/// series x 32,000 points. Series past it are left out with a warning (the first is always written).
+const MAX_CHARTEX_POINTS: usize = 255 * 32_000;
+
+/// How many of `c`'s series fit [`MAX_CHARTEX_POINTS`] (at least one).
+fn chartex_series_within_budget(c: &Chart) -> usize {
+    let level = |v: &Vec<String>| v.len().min(MAX_CACHE_POINTS);
+    let cats = if c.categories.is_empty() {
+        0
+    } else {
+        level(&c.categories).saturating_add(c.category_levels.iter().map(level).fold(0usize, usize::saturating_add))
+    };
+    let mut left = MAX_CHARTEX_POINTS;
+    for (n, s) in c.series.iter().enumerate() {
+        let cost = cats.saturating_add(s.values.len().min(MAX_CACHE_POINTS));
+        if n > 0 && cost > left {
+            log::warn!("pptx: chart part stopped after {n} series; its data passed {MAX_CHARTEX_POINTS} points");
+            return n;
+        }
+        left = left.saturating_sub(cost);
+    }
+    c.series.len()
+}
+
 /// Writes an Office 2016 chart from the model, as PowerPoint lays the part out: one `cx:data`
 /// per series (categories and values), then the plot area with each series' layout, the axes
 /// the layout uses, the title and the legend.
 pub fn build_chartex(c: &Chart) -> Vec<u8> {
+    let n_series = chartex_series_within_budget(c);
     let mut w = W::new();
     w.open("cx:chartSpace", A::new().a("xmlns:a", NS_A).a("xmlns:r", NS_R).a("xmlns:cx", NS_CX));
     w.open0("cx:chartData");
-    for (i, s) in c.series.iter().enumerate() {
+    for (i, s) in c.series.iter().enumerate().take(n_series) {
         w.open("cx:data", A::new().a("id", i));
         if !c.categories.is_empty() {
             w.open("cx:strDim", A::new().a("type", "cat"));
@@ -942,7 +1014,7 @@ pub fn build_chartex(c: &Chart) -> Vec<u8> {
         _ => "clusteredColumn",
     };
     let one = !matches!(c.kind, ChartType::BoxWhisker);
-    for (i, s) in c.series.iter().enumerate().take(if one { 1 } else { usize::MAX }) {
+    for (i, s) in c.series.iter().enumerate().take(if one { 1 } else { n_series }) {
         w.open("cx:series", A::new().a("layoutId", layout).a("uniqueId", format!("{{DC00000{i}-0000-4000-8000-000000000000}}")));
         cx_text(&mut w, &s.name);
         if c.series_data_labels(s) {
@@ -1061,7 +1133,21 @@ mod region_map_tests {
 mod tests {
     use deckcraft_color::{ColorTransform, Rgba};
     use deckcraft_model::ColorRef;
-    use deckcraft_model::chart::{Chart, ChartType};
+    use deckcraft_model::chart::{Chart, ChartType, Series};
+
+    #[test]
+    fn export_cost_counts_the_caches_each_group_writes() {
+        let s = Series { values: vec![Some(1.0); 600], ..Default::default() };
+        let mut c = Chart::sample(ChartType::Column);
+        c.categories = vec!["a".into(); 1000];
+        // Category and value caches: 1,000 + 600, however the series is stored.
+        assert_eq!(super::series_points(&c, &s, super::Group::Bar), 1600);
+        // A bubble series without x values or sizes still writes three value-length caches.
+        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 1800);
+        assert_eq!(super::series_points(&c, &s, super::Group::Scatter), 1200);
+        let s = Series { values: vec![Some(1.0); 600], x_values: vec![Some(1.0); 5], sizes: vec![Some(1.0); 7], ..Default::default() };
+        assert_eq!(super::series_points(&c, &s, super::Group::Bubble), 612);
+    }
 
     /// The chart's text colour is written where PowerPoint keeps it (`c:txPr` on the axes, legend,
     /// data labels and chart, the title's run defaults) and read back as the same colour.
@@ -1122,3 +1208,33 @@ mod tests {
         assert!(!crate::read::chart::read_chart_xml(&super::chart_xml(&c).0).unwrap().cat_reversed);
     }
 }
+
+#[cfg(test)]
+mod cache_cap_tests {
+    use super::*;
+
+    #[test]
+    fn a_chartex_part_stops_adding_series_past_excels_point_count() {
+        const { assert!(MAX_CHARTEX_POINTS >= 255 * 32_000) };
+        let mut c = Chart::sample(ChartType::Waterfall);
+        c.categories = vec![String::new(); 32_000];
+        let mut s = c.series[0].clone();
+        s.values = Vec::new();
+        c.series = vec![s; 300];
+        // 32,000 categories per series: 255 fit exactly, the 256th does not.
+        assert_eq!(chartex_series_within_budget(&c), 255);
+        c.series.truncate(3);
+        assert_eq!(chartex_series_within_budget(&c), 3);
+    }
+
+    /// A cache longer than the cap is cut, never refused; anything a real chart holds (32,000
+    /// points per series) is far under it. Zero-sized elements, so the test allocates nothing.
+    #[test]
+    fn caches_are_cut_at_the_cap_not_refused() {
+        const { assert!(MAX_CACHE_POINTS >= 32_000) };
+        let over = vec![(); MAX_CACHE_POINTS + 1];
+        assert_eq!(capped(&over).len(), MAX_CACHE_POINTS);
+        let real = vec![(); 32_000];
+        assert_eq!(capped(&real).len(), 32_000);
+    }
+}

crates/vp9/src/decoder.rs

@@ -166,11 +166,17 @@ impl Decoder {
         if frames.len() > 1 {
             self.stats.superframes += 1;
         }
+        let queued = self.pending.len();
         for f in frames {
             if f.is_empty() {
                 continue;
             }
-            self.decode_frame(f, pts)?;
+            if let Err(e) = self.decode_frame(f, pts) {
+                // A failed sample outputs nothing: drop what its earlier subframes queued so a
+                // later drain does not expand each repeat into its own picture.
+                self.pending.truncate(queued);
+                return Err(e);
+            }
         }
         Ok(self.drain(false))
     }