diff --git a/crates/codecs/src/lib.rs b/crates/codecs/src/lib.rs index 404646c8d..a20a47d14 100644 --- a/crates/codecs/src/lib.rs +++ b/crates/codecs/src/lib.rs @@ -339,14 +339,11 @@ pub fn decode_thumbnail_with(bytes: &[u8], opts: &ThumbnailOptions) -> Result Option { - (width as u64).checked_mul(height as u64).and_then(|n| n.checked_mul(ch as u64)).filter(|&n| n > 0 && n <= MAX_SAMPLES) + (width as u64).checked_mul(height as u64).and_then(|n| n.checked_mul(ch as u64)).filter(|&n| n > 0) } #[cfg(test)] @@ -355,14 +352,15 @@ mod checked_arithmetic_tests { #[test] fn checked_sample_buf_len_wrap_inputs_rejected() { - // 2^30 px × 4 ch = 2^32 samples wraps on 32-bit usize and is past the 2^30-sample cap. - assert_eq!(checked_sample_buf_len(1 << 30, 1, 4), None); - assert_eq!(checked_sample_buf_len(u32::MAX as usize, 1, 2), None); + assert_eq!(checked_sample_buf_len(usize::MAX, usize::MAX, 4), None); + assert_eq!(checked_sample_buf_len(0, 1, 3), None); } #[test] fn checked_sample_buf_len_normal_accepted() { assert_eq!(checked_sample_buf_len(100, 1, 3), Some(300)); assert_eq!(checked_sample_buf_len(1, 1, 1), Some(1)); + // 300 Mpx RGBA is within the default pixel limit, so it must not be refused by sample count. + assert_eq!(checked_sample_buf_len(20_000, 15_000, 4), Some(1_200_000_000)); } }