[YangtseSu]

Both image decode sites handed the image crate a single budget derived from the finished
RGBA8 raster, while Limits::max_alloc accounts for every allocation the decoder makes —
its own sample buffer, palette and row buffers included. A picture whose raster fits the
limits therefore failed with Memory limit exceeded before those limits were consulted.

Site 1 — ImageDecoder::decode (crates/rofd-render/src/images.rs)

crates/rofd-render/tests/images.rs::decoded_limits_have_exact_and_one_over_boundaries is red
on main (no CI job runs the suite today):

thread 'decoded_limits_have_exact_and_one_over_boundaries' panicked at crates/rofd-render/tests/images.rs:222:5:
assertion failed: decoder.decode(&resource, &exact).is_ok()
Err(ImageDecode { resource_id: 10, path: "Doc_0/image.bin", message: "Memory limit exceeded" })

max_decoded_image_bytes bounds the finished RGBA8 image, which validate_dimensions already
checks before decoding; passing that size as the allocator budget rejects an image that is
exactly at its limit.

Site 2 — decode_seal_raster (crates/rofd-render/src/cairo_renderer.rs)

Stamp annotations (electronic seals) rasterize their picture through the same crate with the
default limits, min(max_decoded_image_bytes, max_raster_bytes) as the budget. Consequences,
measured with the real decoder on 16-bit RGBA PNGs:

seal	decoded RGBA8	decoder buffers	old budget	with this change
6000×6000	137 MiB	274 MiB	Err — seal silently dropped	decodes
8192×8192 RGBA8	256 MiB	256 MiB	Err — dropped	decodes, then RasterBudgetExceeded
10240×10240	400 MiB	400 MiB	Err "Memory limit exceeded"	decodes, then RasterBudgetExceeded
14336×14336	784 MiB	784 MiB	Err	Err (still bounded)

Both limits are documented to bound the finished image, so a seal inside them must render;
today it is dropped without a diagnostic, and a seal outside them reports a decode failure
instead of the designed RasterBudgetExceeded.

Change

Budget the decoder with three times the finished raster, and leave the raster checks as the
authority (the pre-decode dimension limit and the post-decode RasterBudgetExceeded comparison
are unchanged): a decoder holds its own buffer (up to 8 bytes per pixel for 16-bit channels) and
the RGBA8 conversion (4 bytes per pixel) at the same time, so the exact boundary of the caller's
budget decodes while the wall stays proportional to it.

Verification

• cargo test -p rofd-render --test images → 14/14 (1/14 fails at 140b936)
• cargo test -p rofd-render → green
• cargo fmt --all -- --check, cargo clippy -p rofd-render --all-targets -- -D warnings → clean
• New regression test
  crates/rofd-render/tests/cairo_stamp.rs::a_large_seal_raster_within_the_document_limits_is_not_called_over_budget
  uses a generated 6000×6000 16-bit RGBA seal (420 KiB, ~11 s): it fails before the change
  (the stamp pixel stays page-white) and passes after. The fixture is generated by the few
  lines recorded in crates/rofd-render/tests/fixtures/images/PROVENANCE.md.
• Throwaway probes reproduced the table above (and confirmed the 16-bit path is over the old
  budget while the RGBA8 path only is on compressible input).

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adjusts decoder budgeting so its intermediate allocations are accounted for separately from the validated final RGBA8 image, allowing exact-limit images to decode without allowing images beyond the caller's dimensions or decoded-size limits.

Sequence diagram for decoder memory budgeting

sequenceDiagram
    participant Caller
    participant Decoder as ImageDecoder
    participant Limits as DimensionAndSizeValidation
    participant Buffers as DecoderBuffers
    participant RGBA as RGBA8Image

    Caller->>Decoder: decode_pixels()
    Decoder->>Limits: validate_dimensions(width, height)
    Limits-->>Decoder: dimensions within max_decoded_image_bytes
    Decoder->>Decoder: max_alloc = max_decoded_image_bytes.saturating_mul(3)
    Decoder->>Buffers: decode intermediate samples, palette, and rows
    Decoder->>RGBA: convert to finished RGBA8 buffer
    RGBA-->>Caller: decoded image

Loading

Flow diagram for exact decoded-image budget boundaries

flowchart LR
    Input[Image resource] --> Validate[Validate dimensions and final RGBA8 size]
    Validate -->|within caller budget| Budget[Set decoder max_alloc to 3x final size]
    Budget --> Decode[Decode intermediate buffers and RGBA8 output]
    Decode --> Exact[Exact-limit image succeeds]
    Validate -->|exceeds caller budget| Reject[Reject before decoding]
    Decode -->|decoder budget exceeded| RejectDecode[Reject with ImageLimitExceeded]

Loading

File-Level Changes

Change	Details	Files
Increase the image decoder's allocation budget to account for intermediate decoder buffers alongside the final RGBA8 output.	Keep the existing pre-decode width, height, and decoded-image-size validation unchanged. Set the decoder's running allocation limit to three times the caller's decoded RGBA8 byte budget, using saturating arithmetic. Document the memory rationale, including simultaneous 16-bit source buffers and RGBA8 conversion storage.	crates/rofd-render/src/images.rs
Verify exact-boundary decoding and preserve rejection of over-limit images across rendering and related workspace checks.	Confirm the existing image boundary test passes at the exact limit and fails one byte below. Exercise 16-bit RGBA and full-palette PNG cases, plus formatting, clippy, and workspace tests.	crates/rofd-render/tests/images.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

Hi @YangtseSu. Thanks for your PR.

I'm waiting for a linuxdeepin member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[YangtseSu]

I have read the CLA Document and I hereby sign the CLA.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lzwind, YangtseSu

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment