Fix png.DECODER_WORKBUF_LEN_MAX_INCL_WORST_CASE
diff --git a/release/c/wuffs-unsupported-snapshot.c b/release/c/wuffs-unsupported-snapshot.c
index 81cbe2d..89de1fc 100644
--- a/release/c/wuffs-unsupported-snapshot.c
+++ b/release/c/wuffs-unsupported-snapshot.c
@@ -9176,7 +9176,7 @@
// ---------------- Public Consts
-#define WUFFS_PNG__DECODER_WORKBUF_LEN_MAX_INCL_WORST_CASE 0
+#define WUFFS_PNG__DECODER_WORKBUF_LEN_MAX_INCL_WORST_CASE 2251799562027015
#define WUFFS_PNG__DECODER_SRC_IO_BUFFER_LENGTH_MIN_INCL 8
diff --git a/std/png/common_consts.wuffs b/std/png/common_consts.wuffs
index 47a0fe9..f930081 100644
--- a/std/png/common_consts.wuffs
+++ b/std/png/common_consts.wuffs
@@ -29,7 +29,7 @@
pri status "#internal error: inconsistent workbuf length"
pri status "#internal error: zlib decoder did not exhaust its input"
-pub const DECODER_WORKBUF_LEN_MAX_INCL_WORST_CASE : base.u64 = 0
+pub const DECODER_WORKBUF_LEN_MAX_INCL_WORST_CASE : base.u64 = 0x0007_FFFF_F100_0007
// DECODER_SRC_IO_BUFFER_LENGTH_MIN_INCL is the minimum length of the src
// wuffs_base__io_buffer passed to the decoder.
diff --git a/std/png/decode_png.wuffs b/std/png/decode_png.wuffs
index 899847c..0326ba8 100644
--- a/std/png/decode_png.wuffs
+++ b/std/png/decode_png.wuffs
@@ -17,7 +17,7 @@
pub struct decoder? implements base.image_decoder(
// The 0x00FF_FFFF limit is arbitrary (the PNG spec says 0x7FFF_FFFF) but
- // it means that (width * height * bytes_per_pixel) doesn't overflow.
+ // it means that (width * height * bytes_per_pixel) doesn't overflow a u64.
width : base.u32[..= 0x00FF_FFFF],
height : base.u32[..= 0x00FF_FFFF],
@@ -26,6 +26,10 @@
workbuf_wi : base.u64,
workbuf_hist_pos_base : base.u64,
+
+ // The inclusive upper bound, DECODER_WORKBUF_LEN_MAX_INCL_WORST_CASE, is
+ // derived from the width and height upper bounds at up to 8 bytes per
+ // pixel. It equals (((8 * M) + 1) * M), where M is 0x00FF_FFFF.
overall_workbuf_length : base.u64[..= 0x0007_FFFF_F100_0007],
pass_workbuf_length : base.u64[..= 0x0007_FFFF_F100_0007],
