Expand description
Caller-set ceilings on what one decode may produce. Public: unlike the budget above, where the ceiling sits is the caller’s policy.
Not gated on decoder, and the difference is not cosmetic: the type is a
policy a caller states, so a crate that threads it through has to be able
to name it whether or not the decoder is compiled in. Only the checks the
decoder runs carry the gate.
Caller-set ceilings on what one decode may produce.
decode_budget and this module answer different
questions and both are needed. The budget is a backstop against a
reservation nothing backs – a header naming gigabytes over a stream that
carries none of them – and it is always on. These are the caller’s policy
on how large a decode may legitimately be, and they count what the file
honestly describes as well as what it lies about.
The reason the budget cannot do this job is measured: legitimate geometry
reaches four to five orders of magnitude more output than input, because a
constant attribute entropy-codes to a size independent of its count. A
stream of under a kilobyte decodes six million points, and refusing it
would be the interoperability bug decode_budget exists to have removed.
No ratio separates that from a hostile claim, so the only honest instrument
is an absolute ceiling, and only the caller knows where it sits.
SECURITY.md records that this decoder does not cap reconstructed geometry
by design. That stays true of the format; what changes is that the caller
can now say otherwise, and the default says it for them.
Structs§
- Decode
Limits - Ceilings on one decode, applied to what the stream reconstructs.