opus_codec/

decoder.rs

//! Opus decoder implementation with safe wrappers

#[cfg(feature = "dred")]
use crate::bindings::OPUS_SET_DNN_BLOB_REQUEST;
use crate::bindings::{
    OPUS_GET_FINAL_RANGE_REQUEST, OPUS_GET_GAIN_REQUEST, OPUS_GET_LAST_PACKET_DURATION_REQUEST,
    OPUS_GET_PHASE_INVERSION_DISABLED_REQUEST, OPUS_GET_PITCH_REQUEST,
    OPUS_GET_SAMPLE_RATE_REQUEST, OPUS_RESET_STATE, OPUS_SET_GAIN_REQUEST,
    OPUS_SET_PHASE_INVERSION_DISABLED_REQUEST, OpusDecoder, opus_decode, opus_decode_float,
    opus_decoder_create, opus_decoder_ctl, opus_decoder_destroy, opus_decoder_get_nb_samples,
    opus_decoder_get_size, opus_decoder_init,
};
use crate::constants::{is_frame_size_2_5ms_aligned, max_frame_samples_for};
use crate::error::{Error, Result};
use crate::packet;
use crate::types::{Bandwidth, Channels, SampleRate};
use crate::{AlignedBuffer, Ownership, RawHandle};
use std::marker::PhantomData;
use std::num::NonZeroUsize;
use std::ops::Deref;
use std::ptr::{self, NonNull};

#[cfg(feature = "dred")]
struct RetainedDnnBlob {
    data: Box<[u32]>,
    len: i32,
}

#[cfg(feature = "dred")]
impl RetainedDnnBlob {
    fn parts(&self) -> (*const u8, i32) {
        (self.data.as_ptr().cast::<u8>(), self.len)
    }
}

/// Safe wrapper around a libopus `OpusDecoder`.
pub struct Decoder {
    raw: RawHandle<OpusDecoder>,
    sample_rate: SampleRate,
    channels: Channels,
    // External-weight builds retain pointers into DNN blobs. Keep each copy,
    // including copies used by failed non-transactional load attempts, until
    // after the C decoder has been destroyed. Field declaration order makes
    // `raw` drop before this storage.
    #[cfg(feature = "dred")]
    dnn_blobs: Vec<RetainedDnnBlob>,
    #[cfg(feature = "dred")]
    active_dnn_blob: Option<usize>,
}

unsafe impl Send for Decoder {}

/// Borrowed wrapper around a decoder state.
///
/// The owning handle cannot be moved out of this borrowed wrapper:
///
/// ```compile_fail
/// use opus_codec::decoder::DecoderRef;
/// use opus_codec::Decoder;
/// fn extract<'a>(state: &mut DecoderRef<'a>, replacement: Decoder) -> Decoder {
///     std::mem::replace(&mut **state, replacement)
/// }
/// ```
pub struct DecoderRef<'a> {
    inner: Decoder,
    #[cfg(feature = "dred")]
    active_dnn_blob: Option<(*const u8, i32)>,
    _marker: PhantomData<&'a mut OpusDecoder>,
}

unsafe impl Send for DecoderRef<'_> {}

impl Decoder {
    fn from_raw(
        ptr: NonNull<OpusDecoder>,
        sample_rate: SampleRate,
        channels: Channels,
        ownership: Ownership,
    ) -> Self {
        Self {
            raw: RawHandle::new(ptr, ownership, opus_decoder_destroy),
            sample_rate,
            channels,
            #[cfg(feature = "dred")]
            dnn_blobs: Vec::new(),
            #[cfg(feature = "dred")]
            active_dnn_blob: None,
        }
    }

    /// Size in bytes of a decoder state for external allocation.
    ///
    /// # Errors
    /// Returns [`Error::BadArg`] if the channel count is invalid or libopus reports
    /// an impossible size.
    pub fn size(channels: Channels) -> Result<usize> {
        let raw = unsafe { opus_decoder_get_size(channels.as_i32()) };
        if raw <= 0 {
            return Err(Error::BadArg);
        }
        usize::try_from(raw).map_err(|_| Error::InternalError)
    }

    /// Initialize a previously allocated decoder state.
    ///
    /// # Safety
    /// The caller must provide a valid pointer to `Decoder::size()` bytes,
    /// aligned to at least `align_of::<usize>()` (malloc-style alignment).
    ///
    /// # Errors
    /// Returns [`Error::BadArg`] if `ptr` is null, or a mapped libopus error.
    pub unsafe fn init_in_place(
        ptr: *mut OpusDecoder,
        sample_rate: SampleRate,
        channels: Channels,
    ) -> Result<()> {
        if ptr.is_null() {
            return Err(Error::BadArg);
        }
        if !crate::opus_ptr_is_aligned(ptr.cast()) {
            return Err(Error::BadArg);
        }
        let r = unsafe { opus_decoder_init(ptr, sample_rate.as_i32(), channels.as_i32()) };
        if r != 0 {
            return Err(Error::from_code(r));
        }
        Ok(())
    }

    /// Create a new decoder for a given sample rate and channel layout.
    ///
    /// # Errors
    /// Returns an error if allocation fails or arguments are invalid.
    pub fn new(sample_rate: SampleRate, channels: Channels) -> Result<Self> {
        // Validate sample rate
        if !sample_rate.is_valid() {
            return Err(Error::BadArg);
        }

        let mut error = 0i32;
        let decoder = unsafe {
            opus_decoder_create(
                sample_rate.as_i32(),
                channels.as_i32(),
                std::ptr::addr_of_mut!(error),
            )
        };

        if error != 0 {
            return Err(Error::from_code(error));
        }

        let decoder = NonNull::new(decoder).ok_or(Error::AllocFail)?;

        Ok(Self::from_raw(
            decoder,
            sample_rate,
            channels,
            Ownership::Owned,
        ))
    }

    /// Decode a packet into 16-bit PCM.
    ///
    /// - `input`: Opus packet bytes. Pass empty slice to invoke PLC.
    /// - `output`: Interleaved output buffer sized to `frame_size * channels`.
    /// - `fec`: Enable in-band FEC if available.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder handle is invalid, [`Error::BadArg`]
    /// for invalid buffer sizes or frame sizes, or a mapped libopus error via
    /// [`Error::from_code`].
    pub fn decode(&mut self, input: &[u8], output: &mut [i16], fec: bool) -> Result<usize> {
        // Errors: InvalidState, BadArg, or libopus error mapped.
        // Validate buffer sizes up-front
        if !input.is_empty() && input.len() > i32::MAX as usize {
            return Err(Error::BadArg);
        }
        if output.is_empty() {
            return Err(Error::BadArg);
        }
        if !output.len().is_multiple_of(self.channels.as_usize()) {
            return Err(Error::BadArg);
        }
        let frame_size = output.len() / self.channels.as_usize();
        let frame_size = NonZeroUsize::new(frame_size).ok_or(Error::BadArg)?;
        let max_frame = max_frame_samples_for(self.sample_rate);
        if frame_size.get() > max_frame {
            return Err(Error::BadArg);
        }
        // libopus requires PLC/FEC frame sizes to be multiples of 2.5 ms.
        if (input.is_empty() || fec)
            && !is_frame_size_2_5ms_aligned(frame_size.get(), self.sample_rate)
        {
            return Err(Error::BadArg);
        }

        let input_len_i32 = if input.is_empty() {
            0
        } else {
            i32::try_from(input.len()).map_err(|_| Error::BadArg)?
        };
        let frame_size_i32 = i32::try_from(frame_size.get()).map_err(|_| Error::BadArg)?;

        let result = unsafe {
            opus_decode(
                self.raw.as_ptr(),
                if input.is_empty() {
                    ptr::null()
                } else {
                    input.as_ptr()
                },
                input_len_i32,
                output.as_mut_ptr(),
                frame_size_i32,
                i32::from(fec),
            )
        };

        if result < 0 {
            return Err(Error::from_code(result));
        }

        usize::try_from(result).map_err(|_| Error::InternalError)
    }

    /// Decode a packet into `f32` PCM.
    ///
    /// See [`Self::decode`] for parameter semantics.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder handle is invalid, [`Error::BadArg`]
    /// for invalid buffer sizes or frame sizes, or a mapped libopus error via
    /// [`Error::from_code`].
    pub fn decode_float(&mut self, input: &[u8], output: &mut [f32], fec: bool) -> Result<usize> {
        // Validate buffer sizes up-front
        if !input.is_empty() && input.len() > i32::MAX as usize {
            return Err(Error::BadArg);
        }
        if output.is_empty() {
            return Err(Error::BadArg);
        }
        if !output.len().is_multiple_of(self.channels.as_usize()) {
            return Err(Error::BadArg);
        }
        let frame_size = output.len() / self.channels.as_usize();
        let frame_size = NonZeroUsize::new(frame_size).ok_or(Error::BadArg)?;
        let max_frame = max_frame_samples_for(self.sample_rate);
        if frame_size.get() > max_frame {
            return Err(Error::BadArg);
        }
        // libopus requires PLC/FEC frame sizes to be multiples of 2.5 ms.
        if (input.is_empty() || fec)
            && !is_frame_size_2_5ms_aligned(frame_size.get(), self.sample_rate)
        {
            return Err(Error::BadArg);
        }

        let input_len_i32 = if input.is_empty() {
            0
        } else {
            i32::try_from(input.len()).map_err(|_| Error::BadArg)?
        };
        let frame_size_i32 = i32::try_from(frame_size.get()).map_err(|_| Error::BadArg)?;

        let result = unsafe {
            opus_decode_float(
                self.raw.as_ptr(),
                if input.is_empty() {
                    ptr::null()
                } else {
                    input.as_ptr()
                },
                input_len_i32,
                output.as_mut_ptr(),
                frame_size_i32,
                i32::from(fec),
            )
        };

        if result < 0 {
            return Err(Error::from_code(result));
        }

        usize::try_from(result).map_err(|_| Error::InternalError)
    }

    /// Return the number of samples (per channel) in an Opus `packet` at this decoder's rate.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, [`Error::BadArg`] for
    /// overlong input, or a mapped libopus error.
    pub fn packet_samples(&self, packet: &[u8]) -> Result<usize> {
        // Errors: InvalidState or libopus error mapped.
        if packet.is_empty() {
            return Err(Error::BadArg);
        }
        if packet.len() > i32::MAX as usize {
            return Err(Error::BadArg);
        }
        let len_i32 = i32::try_from(packet.len()).map_err(|_| Error::BadArg)?;
        let result =
            unsafe { opus_decoder_get_nb_samples(self.raw.as_ptr(), packet.as_ptr(), len_i32) };

        if result < 0 {
            return Err(Error::from_code(result));
        }

        usize::try_from(result).map_err(|_| Error::InternalError)
    }

    /// Return the bandwidth encoded in an Opus `packet`.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or [`Error::InvalidPacket`]
    /// if the packet cannot be parsed.
    pub fn packet_bandwidth(&self, packet: &[u8]) -> Result<Bandwidth> {
        // Errors: InvalidState or InvalidPacket.
        packet::packet_bandwidth(packet)
    }

    /// Return the number of channels described by an Opus `packet`.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or [`Error::InvalidPacket`]
    /// if the packet cannot be parsed.
    pub fn packet_channels(&self, packet: &[u8]) -> Result<Channels> {
        // Errors: InvalidState or InvalidPacket.
        packet::packet_channels(packet)
    }

    /// Reset the decoder to its initial state.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error
    /// if resetting fails.
    pub fn reset(&mut self) -> Result<()> {
        // Errors: InvalidState or request failure.
        // OPUS_RESET_STATE takes no additional argument. Passing extras is undefined behavior.
        let result = unsafe { opus_decoder_ctl(self.raw.as_ptr(), OPUS_RESET_STATE as i32) };

        if result != 0 {
            return Err(Error::from_code(result));
        }

        #[cfg(feature = "dred")]
        self.reload_active_dnn_blob()?;
        Ok(())
    }

    /// The decoder's configured sample rate.
    #[must_use]
    pub const fn sample_rate(&self) -> SampleRate {
        self.sample_rate
    }

    /// The decoder's channel configuration.
    #[must_use]
    pub const fn channels(&self) -> Channels {
        self.channels
    }

    #[cfg_attr(not(feature = "dred"), allow(dead_code))]
    pub(crate) fn as_mut_ptr(&mut self) -> *mut OpusDecoder {
        self.raw.as_ptr()
    }

    /// Query decoder output sample rate.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn get_sample_rate(&mut self) -> Result<i32> {
        self.get_int_ctl(OPUS_GET_SAMPLE_RATE_REQUEST as i32)
    }

    /// Query pitch (fundamental period) of the last decoded frame (in samples at 48 kHz domain).
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn get_pitch(&mut self) -> Result<i32> {
        self.get_int_ctl(OPUS_GET_PITCH_REQUEST as i32)
    }

    /// Duration (per channel) of the last decoded packet.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn get_last_packet_duration(&mut self) -> Result<i32> {
        self.get_int_ctl(OPUS_GET_LAST_PACKET_DURATION_REQUEST as i32)
    }

    /// Final RNG state after the last decode.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn final_range(&mut self) -> Result<u32> {
        let mut v: u32 = 0;
        let r = unsafe {
            opus_decoder_ctl(
                self.raw.as_ptr(),
                OPUS_GET_FINAL_RANGE_REQUEST as i32,
                &mut v,
            )
        };
        if r != 0 {
            return Err(Error::from_code(r));
        }
        Ok(v)
    }

    /// Set post-decode gain in Q8 dB units.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn set_gain(&mut self, q8_db: i32) -> Result<()> {
        self.simple_ctl(OPUS_SET_GAIN_REQUEST as i32, q8_db)
    }
    /// Query post-decode gain in Q8 dB units.
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn gain(&mut self) -> Result<i32> {
        self.get_int_ctl(OPUS_GET_GAIN_REQUEST as i32)
    }

    /// Returns true if phase inversion is disabled (CELT stereo decorrelation).
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn phase_inversion_disabled(&mut self) -> Result<bool> {
        Ok(self.get_int_ctl(OPUS_GET_PHASE_INVERSION_DISABLED_REQUEST as i32)? != 0)
    }

    /// Disable/enable phase inversion (CELT stereo decorrelation).
    ///
    /// # Errors
    /// Returns [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub fn set_phase_inversion_disabled(&mut self, disabled: bool) -> Result<()> {
        self.simple_ctl(
            OPUS_SET_PHASE_INVERSION_DISABLED_REQUEST as i32,
            i32::from(disabled),
        )
    }

    #[cfg(feature = "dred")]
    /// Set DNN blob for DRED (feature-gated; will error if unsupported).
    ///
    /// # Safety
    /// `ptr` must be valid for reads of `len` bytes for the duration of this call and point to a
    /// complete, correctly formatted libopus DNN blob. The bytes are copied into aligned storage
    /// owned by the decoder, so the caller's allocation need not remain alive after this returns.
    /// Some external-weight libopus builds do not safely handle malformed model records.
    ///
    /// # Errors
    /// Returns [`Error::BadArg`] if `ptr` is null or `len` is non-positive,
    /// [`Error::InvalidState`] if the decoder is invalid, or a mapped libopus error.
    pub unsafe fn set_dnn_blob(&mut self, ptr: *const u8, len: i32) -> Result<()> {
        let blob_index = unsafe { self.retain_dnn_blob_copy(ptr, len)? };
        let (owned_ptr, owned_len) = self.dnn_blobs[blob_index].parts();
        if let Err(error) = unsafe { self.apply_dnn_blob(owned_ptr, owned_len) } {
            if error == Error::Unimplemented {
                // An unsupported CTL never inspected or retained the pointer.
                // Other failures may leave model fields pointing into the blob.
                let removed = self.dnn_blobs.pop();
                debug_assert!(removed.is_some());
            }
            return Err(error);
        }
        self.active_dnn_blob = Some(blob_index);
        Ok(())
    }

    #[cfg(feature = "dred")]
    unsafe fn retain_dnn_blob_copy(&mut self, ptr: *const u8, len: i32) -> Result<usize> {
        if ptr.is_null() || len <= 0 {
            return Err(Error::BadArg);
        }
        let byte_len = usize::try_from(len).map_err(|_| Error::BadArg)?;
        let word_len = byte_len.div_ceil(std::mem::size_of::<u32>());
        let mut blob = vec![0u32; word_len].into_boxed_slice();
        unsafe {
            std::ptr::copy_nonoverlapping(ptr, blob.as_mut_ptr().cast::<u8>(), byte_len);
        }
        let index = self.dnn_blobs.len();
        self.dnn_blobs.push(RetainedDnnBlob { data: blob, len });
        Ok(index)
    }

    #[cfg(feature = "dred")]
    unsafe fn apply_dnn_blob(&mut self, ptr: *const u8, len: i32) -> Result<()> {
        let r = unsafe {
            opus_decoder_ctl(
                self.raw.as_ptr(),
                OPUS_SET_DNN_BLOB_REQUEST as i32,
                ptr,
                len,
            )
        };
        if r != 0 {
            return Err(Error::from_code(r));
        }
        Ok(())
    }

    #[cfg(feature = "dred")]
    fn reload_active_dnn_blob(&mut self) -> Result<()> {
        let Some(index) = self.active_dnn_blob else {
            return Ok(());
        };
        let (ptr, len) = self.dnn_blobs[index].parts();
        unsafe { self.apply_dnn_blob(ptr, len) }
    }

    // --- internal helpers for CTLs ---
    fn simple_ctl(&mut self, req: i32, val: i32) -> Result<()> {
        let r = unsafe { opus_decoder_ctl(self.raw.as_ptr(), req, val) };
        if r != 0 {
            return Err(Error::from_code(r));
        }
        Ok(())
    }
    fn get_int_ctl(&mut self, req: i32) -> Result<i32> {
        let mut v: i32 = 0;
        let r = unsafe { opus_decoder_ctl(self.raw.as_ptr(), req, &mut v) };
        if r != 0 {
            return Err(Error::from_code(r));
        }
        Ok(v)
    }
}

impl<'a> DecoderRef<'a> {
    /// Wrap an externally-initialized decoder without taking ownership.
    ///
    /// # Safety
    /// - `ptr` must point to valid, initialized memory of at least [`Decoder::size()`] bytes
    /// - `ptr` must be aligned to at least `align_of::<usize>()` (malloc-style alignment)
    /// - `sample_rate` and `channels` must exactly match the decoder state already stored at `ptr`
    /// - The memory must remain valid for the lifetime `'a`
    /// - Caller is responsible for freeing the memory after this wrapper is dropped
    /// - If the external state already uses runtime-loaded DNN weights, register that blob again
    ///   through `DecoderRef::set_dnn_blob` before calling `DecoderRef::reset`
    ///
    /// Passing mismatched metadata is undefined behavior: later safe methods may validate buffer
    /// sizes against the wrong channel/rate and then call libopus with out-of-bounds buffers.
    ///
    /// # Panics
    /// Panics if `ptr` is null or not pointer-aligned.
    ///
    /// Use [`Decoder::init_in_place`] to initialize the memory before calling this.
    #[must_use]
    pub unsafe fn from_raw(
        ptr: *mut OpusDecoder,
        sample_rate: SampleRate,
        channels: Channels,
    ) -> Self {
        let decoder = Decoder::from_raw(
            crate::checked_non_null(ptr, "DecoderRef::from_raw"),
            sample_rate,
            channels,
            Ownership::Borrowed,
        );
        Self {
            inner: decoder,
            #[cfg(feature = "dred")]
            active_dnn_blob: None,
            _marker: PhantomData,
        }
    }

    /// Initialize and wrap an externally allocated buffer.
    ///
    /// # Errors
    /// Returns [`Error::BadArg`] if the buffer is too small, or a mapped libopus error.
    pub fn init_in(
        buf: &'a mut AlignedBuffer,
        sample_rate: SampleRate,
        channels: Channels,
    ) -> Result<Self> {
        let required = Decoder::size(channels)?;
        if buf.capacity_bytes() < required {
            return Err(Error::BadArg);
        }
        let ptr = buf.as_mut_ptr::<OpusDecoder>();
        unsafe { Decoder::init_in_place(ptr, sample_rate, channels)? };
        Ok(unsafe { Self::from_raw(ptr, sample_rate, channels) })
    }

    delegate_ref_mut_methods! {
        fn decode(input: &[u8], output: &mut [i16], fec: bool) -> Result<usize>;
        fn decode_float(input: &[u8], output: &mut [f32], fec: bool) -> Result<usize>;
        fn get_sample_rate() -> Result<i32>;
        fn get_pitch() -> Result<i32>;
        fn get_last_packet_duration() -> Result<i32>;
        fn final_range() -> Result<u32>;
        fn set_gain(q8_db: i32) -> Result<()>;
        fn gain() -> Result<i32>;
        fn phase_inversion_disabled() -> Result<bool>;
        fn set_phase_inversion_disabled(disabled: bool) -> Result<()>;
    }

    /// Reset the decoder and restore the last successfully registered external DNN model.
    ///
    /// # Errors
    /// Returns a mapped libopus error if the reset or model restoration fails.
    pub fn reset(&mut self) -> Result<()> {
        self.inner.reset()?;
        #[cfg(feature = "dred")]
        if let Some((ptr, len)) = self.active_dnn_blob {
            unsafe { self.inner.apply_dnn_blob(ptr, len)? };
        }
        Ok(())
    }

    #[cfg(feature = "dred")]
    /// Load an external DNN blob into this borrowed decoder state.
    ///
    /// Unlike [`Decoder::set_dnn_blob`], a borrowed wrapper cannot attach owned storage to the
    /// external state. This method therefore passes the caller's allocation directly to libopus.
    ///
    /// # Safety
    /// - `ptr` must point to `len` readable bytes containing a complete, correctly formatted
    ///   libopus DNN blob, and must be aligned to at least `align_of::<u32>()`.
    /// - The allocation must remain fixed and readable until the external decoder state is
    ///   destroyed or will never be used again, even if this method returns an error. Dropping
    ///   this Rust wrapper alone does not end that requirement.
    ///
    /// # Errors
    /// Returns [`Error::BadArg`] for invalid pointer metadata or alignment, or a mapped libopus
    /// error when loading fails.
    pub unsafe fn set_dnn_blob(&mut self, ptr: *const u8, len: i32) -> Result<()> {
        if ptr.is_null() || len <= 0 || !ptr.addr().is_multiple_of(std::mem::align_of::<u32>()) {
            return Err(Error::BadArg);
        }
        unsafe { self.inner.apply_dnn_blob(ptr, len)? };
        self.active_dnn_blob = Some((ptr, len));
        Ok(())
    }
}

impl Deref for DecoderRef<'_> {
    type Target = Decoder;

    fn deref(&self) -> &Self::Target {
        &self.inner
    }
}

#[cfg(all(test, feature = "dred"))]
mod tests {
    use super::*;
    use crate::types::{Channels, SampleRate};

    #[test]
    fn dnn_blob_is_copied_into_retained_aligned_storage() {
        let mut decoder = Decoder::new(SampleRate::Hz48000, Channels::Mono).unwrap();
        let source = [0u8, 1, 2, 3, 4];
        let unaligned = unsafe { source.as_ptr().add(1) };

        let index = unsafe { decoder.retain_dnn_blob_copy(unaligned, 4) }.unwrap();
        let (retained, len) = decoder.dnn_blobs[index].parts();

        assert_eq!(len, 4);
        assert_eq!((retained as usize) % std::mem::align_of::<u32>(), 0);
        assert_eq!(
            unsafe { std::slice::from_raw_parts(retained, 4) },
            &source[1..]
        );
        assert_eq!(decoder.dnn_blobs.len(), 1);
    }
}