Module decode 

Bounds-checked primitives for reading bytes the process did not produce: compiled payloads loaded off disk, and the artist-supplied image files the cook pipeline imports. Both are external input, so a truncated, corrupt, or hostile buffer has to surface as an error rather than a panic.

Two failure modes matter here and neither is caught by ordinary slicing: running off the end of the buffer, and size arithmetic that overflows before it is ever compared against the buffer length. A width * height * 4 that wraps produces a small product, passes the length check that follows it, and decodes from the wrong offsets. ByteReader covers the first, the size helpers cover the second.

Re-exports

pub use reader::ByteReader;

pub use size::checked_product;

Modules

reader

Sequential bounds-checked reader over a byte buffer. Every accessor returns Result, so a decoder written against it cannot index past the end of its input no matter what lengths the input declares. Reading a fixed-width integer goes through array, which yields an owned [u8; N] and removes the try_into().unwrap() that hand-rolled cursors need.

size

Checked arithmetic over sizes read out of an untrusted buffer. Decoders take dimensions from the payload itself, so every product and sum derived from them is attacker-reachable and has to be range-checked before it is used as a length.