Ogg, xtask: check packet ranges against the source first; stats skips directory links

crates/av1/src/decoder.rs

@@ -216,9 +216,6 @@ pub struct Decoder {
     out: VecDeque<Output>,
     /// pts of the temporal unit being decoded.
     pts: i64,
-    /// Bytes of the repeated-frame (`show_existing_frame`) pictures queued by the current
-    /// [`Decoder::decode_pts`] call; each is copied out in full when it is returned.
-    chunk_output_bytes: u64,
 }
 
 /// Whether `pictures` frames of `width` x `height`, padded as `FrameBuf::new` pads them, fit in
@@ -301,7 +298,6 @@ impl Decoder {
             memory_budget: deckcraft_bitstream::budget::DECODE_MEMORY_BUDGET,
             out: VecDeque::new(),
             pts: 0,
-            chunk_output_bytes: 0,
         }
     }
 
@@ -334,7 +330,6 @@ impl Decoder {
     /// [`Decoder::decode`] with a timestamp that the pictures shown by this chunk carry.
     pub fn decode_pts(&mut self, data: &[u8], pts: i64) -> Result<Vec<Picture>> {
         self.pts = pts;
-        self.chunk_output_bytes = 0;
         let parsed = self.parse(data);
         // Hand out what is finished, then report a parse error.
         let mut pics = Vec::new();
@@ -505,20 +500,6 @@ impl Decoder {
             let idx = fh.frame_to_show_map_idx;
             let slot = self.ref_frames[idx].clone().ok_or(Error::Invalid("show_existing_frame of an empty slot"))?;
             let info = self.refs[idx].clone();
-            // Every repeat is copied out whole, so a compact header must not queue more
-            // pictures than half the decoder budget allows.
-            let shape = deckcraft_bitstream::budget::PictureShape {
-                width: u64::from(info.upscaled_width),
-                height: u64::from(info.frame_height),
-                shift_x: u32::from(seq.color.subsampling_x),
-                shift_y: u32::from(seq.color.subsampling_y),
-                chroma_planes: if seq.color.mono_chrome { 0 } else { 2 },
-                bytes_per_sample: 2,
-            };
-            self.chunk_output_bytes = self.chunk_output_bytes.saturating_add(shape.bytes().unwrap_or(u64::MAX));
-            if self.chunk_output_bytes > self.memory_budget / 2 {
-                return Err(Error::Invalid("repeated frame outputs exceed the decoder memory budget"));
-            }
             let o = Output::Existing {
                 slot: slot.clone(),
                 seq: seq.clone(),

crates/hevc/src/decoder.rs

@@ -404,9 +404,7 @@ impl Decoder {
             chroma_planes: if chroma == 0 { 0 } else { 2 },
             bytes_per_sample: 2,
         };
-        // Output frames waiting to be returned stay allocated after they leave the DPB.
-        let queued = self.out_queue.iter().filter(|o| !self.dpb.entries.iter().any(|e| Arc::ptr_eq(&e.frame, &o.frame))).count();
-        let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64 + queued as u64;
+        let pictures = u64::from(sps.max_dec_pic_buffering) + 1 + self.max_in_flight as u64;
         ensure!(
             shape.fits(pictures, self.memory_budget),
             "{}x{} pictures with {pictures} in the decoder exceed the memory budget",

crates/ogg/src/lib.rs

@@ -415,6 +415,11 @@ impl CaptureScanner {
 }
 
 fn read_parts(src: &(impl ByteSource + ?Sized), parts: &[(u64, u32)]) -> Result<Vec<u8>> {
+    // Ranges come from a scan of some source; check them against this one before sizing a buffer.
+    let len = src.len();
+    if parts.iter().any(|&(o, n)| o.checked_add(u64::from(n)).is_none_or(|end| end > len)) {
+        return Err(Error::Invalid("packet range lies outside the source".into()));
+    }
     let mut v = Vec::with_capacity(parts.iter().map(|p| p.1 as usize).sum());
     for &(o, n) in parts {
         let a = v.len();

crates/ogg/src/tests.rs

@@ -274,3 +274,13 @@ fn a_budget_too_small_to_search_is_spent() {
     let f = opus_file(6, 312, 0);
     assert_eq!(scanner.find(&f, 0, f.len() as u64).unwrap(), None);
 }
+
+#[test]
+fn read_packet_checks_its_ranges_against_the_source_before_allocating() {
+    let f = opus_file(10, 312, 500);
+    let o = open(&f).unwrap();
+    let s = o.stream_of(Codec::Opus).unwrap();
+    // The last packet lies past the end of a source cut short: an error, not a read of missing bytes.
+    let short = &f[..f.len() / 2];
+    assert!(matches!(o.read_packet(&short, s, 9), Err(Error::Invalid(_))));
+}

crates/vp9/src/decoder.rs

@@ -166,17 +166,11 @@ impl Decoder {
         if frames.len() > 1 {
             self.stats.superframes += 1;
         }
-        let queued = self.pending.len();
         for f in frames {
             if f.is_empty() {
                 continue;
             }
-            if let Err(e) = self.decode_frame(f, pts) {
-                // A failed sample outputs nothing: drop what its earlier subframes queued so a
-                // later drain does not expand each repeat into its own picture.
-                self.pending.truncate(queued);
-                return Err(e);
-            }
+            self.decode_frame(f, pts)?;
         }
         Ok(self.drain(false))
     }

xtask/src/stats.rs

@@ -18,7 +18,13 @@ fn walk(dir: &Path, c: &mut Counts) {
         let p = e.path();
         let name = e.file_name();
         let name = name.to_string_lossy();
-        if p.is_dir() {
+        // `file_type` does not follow links, so a directory link is not walked (and aliases are
+        // not counted twice).
+        let Ok(kind) = e.file_type() else { continue };
+        if kind.is_symlink() {
+            continue;
+        }
+        if kind.is_dir() {
             // Nested fuzz workspaces and build output are not part of the crate.
             if name != "target" && name != "fuzz" && !name.starts_with('.') {
                 walk(&p, c);