From 5725dccb1db905b1ff644420fa9c467f46437671 Mon Sep 17 00:00:00 2001 From: Andrew Frahn Date: Mon, 26 Oct 2026 11:41:51 +1100 Subject: [PATCH] Never crash: render_now refuses an oversize output size too Review follow-up: the synchronous render_now path checks the output box with check_output_size like export_job; the hostile-input test covers it. Co-Authored-By: Claude Opus 5.5 --- crates/engine/src/media.rs | 1 + crates/engine/src/tests_export.rs | 2 ++ 2 files changed, 3 insertions(+) diff --git a/crates/engine/src/media.rs b/crates/engine/src/media.rs index f17ec7703..10857d6fa 100644 --- a/crates/engine/src/media.rs +++ b/crates/engine/src/media.rs @@ -1645,6 +1645,7 @@ impl crate::Session { /// Synchronous render (CLI, MCP, tests). pub fn render_now(&mut self, id: PhotoId, max_w: usize, max_h: usize) -> Result { + lightcraft_pipeline::check_output_size(max_w, max_h)?; let job = self.render_job(id, max_w, max_h, false, true).ok_or("no such photo")?; let r = job.run(); self.accept(&r); diff --git a/crates/engine/src/tests_export.rs b/crates/engine/src/tests_export.rs index dbb7cd562..217e68ea1 100644 --- a/crates/engine/src/tests_export.rs +++ b/crates/engine/src/tests_export.rs @@ -1213,4 +1213,6 @@ fn huge_export_size_is_an_error() { let huge = usize::MAX >> 8; assert!(s.render_export(id, huge, huge, OutputSpace::Srgb, OutputDepth::U8).is_err()); assert!(s.render_export(id, 70_000, 10, OutputSpace::Srgb, OutputDepth::U8).is_err()); + assert!(s.render_now(id, huge, huge).is_err()); + assert!(s.render_now(id, 10, 70_000).is_err()); }