Struct Limits 

#[non_exhaustive]
pub struct Limits {
    pub max_pixels: Option<u64>,
    pub max_total_pixels: Option<u64>,
    pub max_width: Option<u32>,
    pub max_height: Option<u32>,
    pub max_input_bytes: Option<u64>,
    pub max_frames: Option<u32>,
    pub max_animation_ms: Option<u64>,
    pub max_metadata_bytes: Option<u32>,
    pub max_output_bytes: Option<u64>,
}

Resource limits for decode/encode operations.

All fields are optional; None means no webpx-side limit (libwebp’s intrinsic 16383×16383 cap still applies). Codecs enforce what they can — not all limit types apply to every operation.

Field naming matches zencodec::ResourceLimits so cross-codec policy objects map cleanly. Threading is intentionally not in this struct — it’s a performance knob, not a DoS budget; use DecoderConfig::use_threads.

Enforcement matrix

“Auto” means webpx checks the field for you when you pass Limits to the listed entry point. “Manual” means the field is part of Limits for shape compatibility but webpx does not auto-check it on this path — call the corresponding check_* method yourself.

Field	DecoderConfig::limits	AnimationDecoder::with_options_limits	mux::*_with_limits	Encoder paths
max_input_bytes	Auto (pre-features)	Auto (pre-decoder)	Auto (pre-demux)	n/a
max_width / max_height / max_pixels	Auto (declared dims, post-scale)	Auto (canvas dims)	n/a	Manual via check_dimensions
max_total_pixels	Auto (still = w × h × 1)	Auto (w × h × frame_count)	n/a	n/a
max_frames	n/a	Auto (declared frame_count)	n/a	n/a
max_animation_ms	n/a	Auto in AnimationDecoder::decode_all (cumulative timestamp)	n/a	Manual via check_animation_ms
max_metadata_bytes	n/a	n/a	Auto (chunk size)	n/a
max_output_bytes	n/a	n/a	n/a	Manual via check_output_size on the encoded Vec

“Manual” fields are not lying about being available — they’re real caps you can apply with one line of caller code, just not yet wired into the encoder builder paths. A future minor release will lift the encoder caps to “Auto” without changing the public Limits shape.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

max_pixels: Option<u64>

Maximum pixels in a single frame (width × height).

Per-frame limit. For animations, each frame is checked independently. To bound the cumulative pixel count across all frames, use max_total_pixels too.

max_total_pixels: Option<u64>

Maximum pixels across all frames (width × height × frame_count).

A 1000×1000 animation with 200 frames has 200 million total pixels. max_pixels would pass each 1 MP frame individually — this field catches the cumulative cost.

max_width: Option<u32>

Maximum image width in pixels.

max_height: Option<u32>

Maximum image height in pixels.

max_input_bytes: Option<u64>

Maximum decode input size in bytes.

max_frames: Option<u32>

Maximum number of animation frames.

max_animation_ms: Option<u64>

Maximum total animation duration in milliseconds.

max_metadata_bytes: Option<u32>

Maximum size of an ICCP / EXIF / XMP chunk returned from the demuxer.

None means the webpx-internal hard cap (256 MiB) still applies. Some(n) rejects chunks larger than n (and is also bounded by the 256 MiB hard cap — a Some value larger than 256 MiB is effectively the hard cap).

max_output_bytes: Option<u64>

Maximum encoded output size in bytes (encode operations).

Implementations

impl Limits

pub fn none() -> Self

No webpx-side limits — only libwebp’s intrinsic caps apply.

Use this when you trust the input source unconditionally (decoding files you generated yourself, a tightly-controlled pipeline, etc.). For untrusted input, prefer Limits::default and override individual fields via the with_* builders.

pub fn with_max_pixels(self, max: u64) -> Self

Set max_pixels.

pub fn with_max_total_pixels(self, max: u64) -> Self

Set max_total_pixels.

pub fn with_max_width(self, max: u32) -> Self

Set max_width.

pub fn with_max_height(self, max: u32) -> Self

Set max_height.

pub fn with_max_input_bytes(self, max: u64) -> Self

Set max_input_bytes.

pub fn with_max_frames(self, max: u32) -> Self

Set max_frames.

pub fn with_max_animation_ms(self, max: u64) -> Self

Set max_animation_ms.

pub fn with_max_metadata_bytes(self, max: u32) -> Self

Set max_metadata_bytes.

pub fn with_max_output_bytes(self, max: u64) -> Self

Set max_output_bytes.

pub fn has_any(&self) -> bool

Whether any limits are set.

pub fn check_dimensions( &self, width: u32, height: u32, ) -> Result<(), LimitExceeded>

Check width × height against max_width, max_height, max_pixels.

pub fn check_input_size(&self, bytes: u64) -> Result<(), LimitExceeded>

Check input data size against max_input_bytes.

pub fn check_output_size(&self, bytes: u64) -> Result<(), LimitExceeded>

Check encoded output size against max_output_bytes.

pub fn check_frames(&self, count: u32) -> Result<(), LimitExceeded>

Check frame count against max_frames.

pub fn check_animation_ms(&self, ms: u64) -> Result<(), LimitExceeded>

Check animation duration against max_animation_ms.

pub fn check_total_pixels(&self, total: u64) -> Result<(), LimitExceeded>

Check total pixels across all frames against max_total_pixels.

pub fn check_metadata_bytes(&self, bytes: u32) -> Result<(), LimitExceeded>

Check a metadata chunk (ICCP / EXIF / XMP) byte count against max_metadata_bytes.

pub fn check_still_image( &self, width: u32, height: u32, ) -> Result<(), LimitExceeded>

Check a still image’s (width, height) plus a frame count of 1 against all dimension and pixel-budget limits in one call.

pub fn check_animation( &self, width: u32, height: u32, frame_count: u32, ) -> Result<(), LimitExceeded>

Check an animated image’s (width, height, frame_count) against max_width, max_height, max_pixels, max_frames, and max_total_pixels in one call.

Trait Implementations

impl Clone for Limits

fn clone(&self) -> Limits

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Limits

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Limits

Default Limits are opinionated production caps sized for typical web / image-server use, not “no limits.” If you need to decode larger inputs (very large camera RAW intermediates, archival scans, hand-built Photoshop output, etc.), construct with Limits::none() and add only the caps that matter to you, or override individual fields via the with_* builders on top of default().

The defaults are:

• max_pixels = 64 MiP (64 × 1024 × 1024) — per frame, ~256 MB at 4 bpp
• max_total_pixels = 256 MiP (256 × 1024 × 1024) — cumulative across animation frames
• max_width = max_height = 16383 — libwebp’s intrinsic bitstream limit
• max_input_bytes = 64 MiB — encoded bitstream
• max_frames = 4096
• max_animation_ms = 300_000 (5 minutes)
• max_metadata_bytes = 4 MiB — ICCP / EXIF / XMP
• max_output_bytes = 256 MiB — encoded output cap

These shipped with the addition of Limits::default() having content; prior releases (≤ 0.2.3) had Limits::default() == Limits::none(). Code that relies on the unbounded behavior must switch to Limits::none() explicitly.

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for Limits

fn eq(&self, other: &Limits) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for Limits

impl Eq for Limits

impl StructuralPartialEq for Limits