Struct DemuxLimits 

pub struct DemuxLimits { /* private fields */ }

What one demux session may spend: on any single packet, on any single attachment, on every attachment in the file together, and on the container’s chapter table.

Handed to FfmpegDemuxer::open_with rather than set afterwards, because the attachment budget is spent during the open — every attachment payload is captured before the first timed packet is read, which is what makes the demux tier’s delivery contract true by construction.

Implementations

impl DemuxLimits

pub const fn new() -> Self

The defaults: PacketLimits::new, DEFAULT_MAX_ATTACHMENT_BYTES and DEFAULT_MAX_TOTAL_ATTACHMENT_BYTES.

pub const fn max_probe_bytes(&self) -> u64

The ceiling on bytes libavformat may read while probing and analysing a container.

What this bounds, and what it does not

Bounded: the total bytes libavformat is handed during avformat_open_input and avformat_find_stream_info. It reaches two ways — as probesize and formatprobesize, which every entrypoint sets before the open, and, on the reader entrypoint, as a hard byte meter on the AVIOContext itself: past the budget the reader answers an I/O error, so the parser gets nothing more whatever it asks for.

Not bounded: allocation amplification inside a parser. A container can describe, in a handful of bytes, a structure whose in-memory form is much larger, and nothing outside libavformat can see that happen. What this seat guarantees is that the input to that amplification is finite and small; bounding its output is the substrate’s own hardening territory, and FFmpeg has its own max_streams / max_index_size / max_picture_buffer seats for exactly that — Self::max_streams sets the first of them.

Not bounded on the path entrypoint: the byte meter needs an AVIOContext this crate owns, and a path is opened by libavformat’s own protocol layer. probesize and formatprobesize still apply there; the hard meter does not. A caller who wants the meter on a file can open it as a reader.

pub const fn max_streams(&self) -> u32

The ceiling on streams a container may declare. See Self::max_probe_bytes for why a seat inside libavformat is worth setting at all.

pub const fn with_max_probe_bytes(self, value: u64) -> Self

Sets the probe-read ceiling (consuming builder).

pub const fn with_max_streams(self, value: u32) -> Self

Sets the declared-stream ceiling (consuming builder).

pub const fn max_chapters(&self) -> u32

The ceiling on chapters a container may declare.

Judged before the chapter table is reserved, so a header claiming an enormous table is refused rather than mirrored. Unlike Self::max_streams, which is handed to libavformat and enforced inside it, this one is this crate’s own: libavformat has no max_chapters knob, and an AVChapter is cheap enough there that the probe budget does not reach the count either.

A file over the ceiling fails to open, with TooManyChapters naming the declared count.

pub const fn max_total_chapter_title_bytes(&self) -> usize

The ceiling on bytes every chapter title in the file may hold together.

Charged title by title as the table is mirrored, and the open fails with ChapterTitleBudgetExhausted at the title that crosses it. The charge is made after that one title is read rather than before, the same way Self::max_total_attachment_bytes is charged: what bounds the overshoot is the 64 KiB the metadata reader already refuses any single value past.

pub const fn with_max_chapters(self, value: u32) -> Self

Sets the declared-chapter ceiling (consuming builder).

pub const fn with_max_total_chapter_title_bytes(self, value: usize) -> Self

Sets the whole-file chapter-title budget (consuming builder).

pub const fn set_max_chapters(&mut self, value: u32) -> &mut Self

Sets the declared-chapter ceiling in place.

pub const fn set_max_total_chapter_title_bytes( &mut self, value: usize, ) -> &mut Self

Sets the whole-file chapter-title budget in place.

pub const fn max_total_stream_metadata_bytes(&self) -> usize

The ceiling on bytes every stream’s retained metadata may hold together — the filename, mimetype and language a track row keeps, across every admitted stream.

Charged value by value as the track table is built, and the open fails with TrackMetadataBudgetExhausted at the value that crosses it — before that value is copied. The charge is the decoded size, because lossy decoding expands bytes that are not UTF-8 threefold, so the raw length would under-charge exactly the hostile case.

pub const fn with_max_total_stream_metadata_bytes(self, value: usize) -> Self

Sets the whole-file stream-metadata budget (consuming builder).

pub const fn set_max_total_stream_metadata_bytes( &mut self, value: usize, ) -> &mut Self

Sets the whole-file stream-metadata budget in place.

pub const fn packet(&self) -> PacketLimits

The per-packet budget timed packets are checked against.

pub const fn max_attachment_bytes(&self) -> usize

Most bytes one attachment may carry.

pub const fn max_total_attachment_bytes(&self) -> usize

Most bytes every attachment in the file may carry together.

pub const fn max_codec_parameter_bytes(&self) -> usize

Most heap bytes one stream’s codec parameters may hold — extradata, coded_side_data and a custom channel map together.

pub const fn max_total_codec_parameter_bytes(&self) -> usize

Most heap bytes every stream’s codec parameters may hold together.

pub const fn with_packet(self, value: PacketLimits) -> Self

Sets the per-packet budget (consuming builder).

pub const fn with_max_attachment_bytes(self, value: usize) -> Self

Sets the per-attachment ceiling (consuming builder).

pub const fn with_max_total_attachment_bytes(self, value: usize) -> Self

Sets the whole-file attachment budget (consuming builder).

pub const fn with_max_codec_parameter_bytes(self, value: usize) -> Self

Sets the per-stream codec-parameter ceiling (consuming builder).

pub const fn with_max_total_codec_parameter_bytes(self, value: usize) -> Self

Sets the whole-file codec-parameter budget (consuming builder).

pub const fn set_packet(&mut self, value: PacketLimits) -> &mut Self

Sets the per-packet budget in place.

pub const fn set_max_attachment_bytes(&mut self, value: usize) -> &mut Self

Sets the per-attachment ceiling in place.

pub const fn set_max_total_attachment_bytes( &mut self, value: usize, ) -> &mut Self

Sets the whole-file attachment budget in place.

pub const fn set_max_codec_parameter_bytes(&mut self, value: usize) -> &mut Self

Sets the per-stream codec-parameter ceiling in place.

pub const fn set_max_total_codec_parameter_bytes( &mut self, value: usize, ) -> &mut Self

Sets the whole-file codec-parameter budget in place.

Trait Implementations

impl Clone for DemuxLimits

fn clone(&self) -> DemuxLimits

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for DemuxLimits

impl Debug for DemuxLimits

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DemuxLimits

fn default() -> Self

Returns the “default value” for a type.

impl Eq for DemuxLimits

impl Hash for DemuxLimits

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for DemuxLimits

fn eq(&self, other: &DemuxLimits) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for DemuxLimits