Module limits 

Resource ceilings — the finite budgets every copy across the FFmpeg boundary is checked against before it allocates.

These seats are tier one and tier two of the resource governance contract: what this crate allocates itself, and the FFmpeg knobs it sets on the caller’s behalf. The contract also states what they do not bound, and what a deployment needing a hard memory bound puts underneath them — read it before sizing these for a hostile-input service.

Why these exist

0.9 made every exit copy (see the amputation contract). A copy is a decision to allocate whatever the file asks for, and a container is untrusted input: a header claiming 100000×100000 pixels, a packet claiming a gigabyte, a Matroska with a thousand attached “fonts” all cost nothing to write and everything to honour. Through 0.8 the frame and packet payloads were views, so an absurd claim cost a refcount; from 0.9 it costs memory, and the claim has to be judged before it is paid.

Every seat here is a finite default, not an Option. There is no “unlimited” spelling on purpose: the shape that lets a caller ask for no ceiling is the shape a caller reaches for once, in a hurry, and never revisits. A caller who needs more says how much more.

Two layers, one number

FrameLimits::max_pixels is enforced twice: once here, against the frame this crate is about to copy, and once inside libavcodec, by writing the same number to AVCodecContext.max_pixels when a decoder is opened. The second is the one that matters most — it makes the decoder refuse before allocating its huge frame, which this crate would otherwise only get to reject after FFmpeg had already paid for it.

The house shape

DEFAULT_* consts, Copy options structs with new / getters / with_* / set_*, and a with_* seat on each session — the same shape crate::VideoDecoder::with_max_probe_pending_bytes and its DEFAULT_MAX_PROBE_PENDING_BYTES already established for the probe-replay budget.

Structs

DecoderLimits

What opening and running one decoder may spend.

DemuxLimits

What one demux session may spend: on any single packet, on any single attachment, and on every attachment in the file together.

FrameLimits

What one decoded frame may cost.

PacketLimits

What one packet’s payload may cost.

Constants

DEFAULT_MAX_ATTACHMENT_BYTES

Default ceiling on one attachment’s payload — 64 MiB.

DEFAULT_MAX_CODEC_PARAMETER_BYTES

Default ceiling on one stream’s codec-parameter heap — 16 MiB.

DEFAULT_MAX_FRAME_BYTES

Default ceiling on the bytes one decoded frame may export — 512 MiB.

DEFAULT_MAX_IMAGE_INPUT_BYTES

Default ceiling on the compressed bytes one image decode may be handed — 64 MiB, the attachment family.

DEFAULT_MAX_IMAGE_SIDE_DATA_BYTES

Default ceiling on the side data one decoded still may carry — the same 16 MiB as DEFAULT_MAX_CODEC_PARAMETER_BYTES, and the same reason.

DEFAULT_MAX_PACKET_BYTES

Default ceiling on one packet’s payload — 1 GiB.

DEFAULT_MAX_PIXELS

Default ceiling on a decoded frame’s pixel count — 256 mebipixels.

DEFAULT_MAX_PROBE_BYTES

Default ceiling on the bytes libavformat may read while probing and analysing a container — 5 MiB, which is FFmpeg’s own probesize default.

DEFAULT_MAX_STREAMS

Default ceiling on the number of streams a container may declare — FFmpeg’s own max_streams default.

DEFAULT_MAX_TOTAL_ATTACHMENT_BYTES

Default ceiling on all attachments in one file, together — 256 MiB.

DEFAULT_MAX_TOTAL_CODEC_PARAMETER_BYTES

Default ceiling on every stream’s codec-parameter heap in one file, together — 64 MiB.