pub fn write_image(
folder: &Path,
kind: Kind,
where_: (usize, usize),
bytes: &[u8],
) -> Result<Written, String>Expand description
Writes one image of a known kind, under the name that says what it is.
The general form of write_beside, carrying the same two guards — the
bytes are validated, and nothing is ever written over. where_ is the pair
positions gives for this image.
Validation decodes every pixel and checks the container’s end. PNG checks every chunk CRC and IDAT Adler-32; animated PNG is refused. JPEG uses strict decoding, but has no checksum to detect every alteration that leaves a decodable stream, including some streams repaired with an early EOI marker.
Input is limited to 32 MiB, 8192 pixels per axis and 16 million pixels, with at most 64 JPEG scans or 16384 container parts. The decoded-output budget is 128 MiB, separate from the PNG decoder’s best-effort 16 MiB internal budget; neither is a total process-memory cap. A five-second cooperative deadline is checked during reads and PNG rows and again before publication, without forcibly interrupting a codec’s computation between those checks. No external image helper is required.
The folder is created if it is not there, because the images that are not the cover go into a subfolder that will not exist the first time.
Err means an unsupported, invalid or excessive image, or a failed write.