mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-29 04:17:11 -06:00
Bound decoded PNG text and XMP by one shared max_alloc budget before growing output, retaining CRC validation and malformed ancillary handling. Cover compressed, plain, Unicode and post-IDAT metadata with small synthetic regression fixtures, and document the budget's scope. Opt Streetblock into public GitHub profile-name credits at their request. Co-authored-by: GPT-6 (Codex) <noreply@openai.com>