Fix integer overflow in sampleImage for huge sample points

Found while testing crates/expr/src/sample.rs:102

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

crates/expr/src/sample.rs

@@ -99,8 +99,8 @@ pub fn sample_image(ctx: EvalCtx, comp: ItemId, layer: &Layer, point: [f64; 2],
     };
     let mut acc = [0.0f64; 4];
     let mut n = 0.0;
-    for y in y0..=y1.min(y0 + 4096) {
-        for x in x0..=x1.min(x0 + 4096) {
+    for y in y0..=y1.min(y0.saturating_add(4096)) {
+        for x in x0..=x1.min(x0.saturating_add(4096)) {
             let p = b.img.get(x, y);
             for k in 0..4 {
                 acc[k] += p[k] as f64;

crates/expr/src/tests.rs

@@ -1166,6 +1166,13 @@ fn sample_image_reads_rendered_pixels() {
     assert_close!(f.num(&code("thisComp.layer(\"B\").sampleImage([-50, -50])"), 0.0), 0.0);
 }
 
+/// A huge sample point saturates the pixel coordinates; it must not overflow the loop bounds.
+#[test]
+fn sample_image_huge_point_is_transparent() {
+    let f = fx();
+    assert_close!(f.num("var c = thisComp.layer(\"B\").sampleImage([1e300, 1e300]); c[3]", 0.0), 0.0);
+}
+
 fn data_item(p: &mut Project, name: &str, text: &str) {
     let f = effectcraft_project::Footage {
         path: format!("/data/{name}"),