* security(exr): validate chunks before frame allocation
* exr: raise the decoded-buffer cap to 2 GiB so 8K float plates open
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(prores): bound decoded plane storage
* prores: raise the decoded-plane cap to 1 GiB so 8K 4444 with alpha decodes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(vp9): bound frame allocation
* vp9: raise the frame-size cap to 2^26 luma samples so level 6.x 8K frames decode
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* vp9: keep the frame-size cap below the imports
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(vp8): bound frame allocation
* vp8: raise the frame-size cap to 2^26 luma samples so 8K frames still decode
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(bitstream): validate NAL prefix size
* bitstream: accept every NAL length width the avcC/hvcC field can declare (1 to 4)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(engine): confine stored media filesystem access
* relink: index symlinked files; skip only symlinked folders
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(render): bound expanded frame plans
* render: count plan layers as they are pushed instead of re-summing every step
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(mxf): share resolved descriptor metadata
* mxf: keep every source-package track in the no-material-package fallback
Two packages may reuse a track id and number; comparing only those dropped a real track.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(text): keep font scans within configured folders
* fonts: still find symlinked font files; skip only symlinked folders
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fonts: rustfmt
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(ui): bound export folder elision work
* export mode: keep location_link's doc comment on the function
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(tts): make malformed-token scanning linear
* tts-text: find a pause marker's ] by byte, so a multi-byte character at byte 64 doesn't hide it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(control): bound synthetic pointer events
* control: check ui.click's count before queuing any input events
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(engine): bound graphic template thumbnails
* graphic templates: scale a capped thumbnail to fit both sides of the canvas
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* security(proxies): reserve outputs atomically
* proxies: ReservedOutput::file returns an Option instead of expect()
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bound outer export batches by actual renderer-pool capacity before nested Rayon work can steal a sibling frame. Cover image sequences, GIF, stepped export and overlapping audio with the original one-renderer regression.
Addresses #1956.
Full original GPU contribution preserved at `preserve/861-gpu-export-original` (674e8cd68d).
Co-authored-by: Codex <noreply@openai.com>
