Logging: escape control characters and mark continuation lines in log records

apps/deckcraft/src/logging.rs

@@ -148,7 +148,19 @@ pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
 /// One formatted log line: `<timestamp> <LEVEL> [<thread>] <target>: <message>\n`.
 pub fn format_line(ts: &str, level: log::Level, thread: &str, target: &str, message: &str) -> String {
     let message = message.strip_suffix('\n').unwrap_or(message);
-    format!("{ts} {level:<5} [{thread}] {target}: {message}\n")
+    // Messages can embed document-controlled text (a part name, a relationship id): control
+    // characters other than tab are escaped and each continuation line is marked, so such text
+    // cannot start a line that looks like a record of its own.
+    let mut text = String::with_capacity(message.len());
+    for c in message.chars() {
+        match c {
+            '\n' => text.push_str("\n    | "),
+            '\t' => text.push(c),
+            c if c.is_control() => text.extend(c.escape_default()),
+            c => text.push(c),
+        }
+    }
+    format!("{ts} {level:<5} [{thread}] {target}: {text}\n")
 }
 
 /// Where formatted lines go besides standard error: kept in memory until a file is attached,
@@ -446,8 +458,13 @@ mod tests {
             ),
             "2026-10-08T07:59:17.728Z WARN  [main] deckcraft_pptx::opc: pptx: skipping oversized part ppt/media/image1.png\n"
         );
-        // A multi-line message keeps its lines; the record still ends in exactly one newline.
-        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\nb\n"));
+        // A multi-line message keeps its lines, each continuation marked; the record still ends in
+        // exactly one newline.
+        assert!(format_line("t", log::Level::Error, "w", "x", "a\nb\n").ends_with("x: a\n    | b\n"));
+        // Injected line breaks and escape sequences cannot forge a record.
+        let line = format_line("t", log::Level::Warn, "w", "x", "part a\r\n2026 ERROR [m] y: forged\x1b[2J");
+        assert_eq!(line.matches('\n').count(), 2);
+        assert!(!line.contains('\r') && !line.contains('\x1b'));
     }
 
     #[test]

crates/av1/src/decoder.rs

@@ -216,9 +216,6 @@ pub struct Decoder {
     out: VecDeque<Output>,
     /// pts of the temporal unit being decoded.
     pts: i64,
-    /// Bytes of the repeated-frame (`show_existing_frame`) pictures queued by the current
-    /// [`Decoder::decode_pts`] call; each is copied out in full when it is returned.
-    chunk_output_bytes: u64,
 }
 
 /// Whether `pictures` frames of `width` x `height`, padded as `FrameBuf::new` pads them, fit in
@@ -301,7 +298,6 @@ impl Decoder {
             memory_budget: deckcraft_bitstream::budget::DECODE_MEMORY_BUDGET,
             out: VecDeque::new(),
             pts: 0,
-            chunk_output_bytes: 0,
         }
     }
 
@@ -334,7 +330,6 @@ impl Decoder {
     /// [`Decoder::decode`] with a timestamp that the pictures shown by this chunk carry.
     pub fn decode_pts(&mut self, data: &[u8], pts: i64) -> Result<Vec<Picture>> {
         self.pts = pts;
-        self.chunk_output_bytes = 0;
         let parsed = self.parse(data);
         // Hand out what is finished, then report a parse error.
         let mut pics = Vec::new();
@@ -505,20 +500,6 @@ impl Decoder {
             let idx = fh.frame_to_show_map_idx;
             let slot = self.ref_frames[idx].clone().ok_or(Error::Invalid("show_existing_frame of an empty slot"))?;
             let info = self.refs[idx].clone();
-            // Every repeat is copied out whole, so a compact header must not queue more
-            // pictures than half the decoder budget allows.
-            let shape = deckcraft_bitstream::budget::PictureShape {
-                width: u64::from(info.upscaled_width),
-                height: u64::from(info.frame_height),
-                shift_x: u32::from(seq.color.subsampling_x),
-                shift_y: u32::from(seq.color.subsampling_y),
-                chroma_planes: if seq.color.mono_chrome { 0 } else { 2 },
-                bytes_per_sample: 2,
-            };
-            self.chunk_output_bytes = self.chunk_output_bytes.saturating_add(shape.bytes().unwrap_or(u64::MAX));
-            if self.chunk_output_bytes > self.memory_budget / 2 {
-                return Err(Error::Invalid("repeated frame outputs exceed the decoder memory budget"));
-            }
             let o = Output::Existing {
                 slot: slot.clone(),
                 seq: seq.clone(),

crates/hevc/src/decoder.rs

@@ -404,9 +404,7 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 2,
         };
-        // Output frames waiting to be returned stay allocated after they leave the DPB.
-        let queued = self.out_queue.iter().filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame))).count();
-        let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64 + queued as u64;
+        let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64;
         ensure!(
             shape.fits(pictures, self.memory_budget),
             "{}x{} pictures with {pictures} in the decoder exceed the memory budget",

crates/vp9/src/decoder.rs

@@ -166,17 +166,11 @@ impl Decoder {
         if frames.len() > 1 {
             self.stats.superframes += 1;
         }
-        let queued = self.pending.len();
         for f in frames {
             if f.is_empty() {
                 continue;
             }
-            if let Err(e) = self.decode_frame(f, pts) {
-                // A failed sample outputs nothing: drop what its earlier subframes queued so a
-                // later drain does not expand each repeat into its own picture.
-                self.pending.truncate(queued);
-                return Err(e);
-            }
+            self.decode_frame(f, pts)?;
         }
         Ok(self.drain(false))
     }