mirror of
https://github.com/storytold/effectcraft.git
synced 2026-10-31 13:37:37 -06:00
Christopher Linnett
d3d23c2f74
Triage found the pad bound lived only in the DoF callers: Image::padded was pub with a doc comment asking callers to bound pad, so a future caller could reintroduce the exact oversized-buffer OOM this PR fixes. The cap now lives inside padded(): pad is clamped so each output side stays <= MAX_PADDED_SIDE (30 000, mirroring project limits::MAX_SIZE; raster cannot depend on the project crate per layering), overflow unreachable by construction, no panic in any profile. The caller-side padded_size guards stay for reject-on-error UX. Adds raster regression tests: hostile pad (u32::MAX) clamps to cap with source intact at the clamped offset (fail-before: pre-fix sized an oversized buffer); legit pads byte-identical (anti-over-clamp). cargo test -p effectcraft-raster 35/35, -p effectcraft-render 238/238, clippy -D warnings clean, fmt clean.