Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/desktop.yml:
- Around line 34-62: The desktop workflow is missing run deduplication, so every
update can start a new job even when an older one is still running. Add a
workflow-level concurrency block to the desktop job definition in desktop.yml,
using a stable group based on the workflow name and branch/PR ref and enabling
cancellation of in-progress runs. This should be placed alongside the existing
top-level jobs/desktop configuration so the actions for checkout,
rust-toolchain, and cargo checks inherit it automatically.

In `@apps/desktop/README.md`:
- Line 15: The fenced code blocks in the README are missing language specifiers,
which triggers markdownlint MD040. Update the architecture tree block and the
data flow diagram block to use a text language tag so the markdown renderer and
linting both treat them correctly. Make the change in the README’s fenced blocks
identified by the architecture tree and the data flow diagram sections.
- Around line 15-47: The architecture tree in README.md is out of date, so
update the `apps/desktop/src` layout to reflect the real module structure.
Replace the single-file `app.rs` entry with the `app/` module directory and its
actual submodules (`app/mod.rs`, `app/calls.rs`, `app/chats.rs`,
`app/media/mod.rs`, `app/messages.rs`), and fix the components listing so
`input_area.rs` becomes `input_area_view.rs`. Keep the rest of the tree aligned
with the current Rust module/file names, using the existing section around
`components` and `app` as the reference points.

In `@apps/desktop/src/app/calls.rs`:
- Around line 30-32: The set_incoming method in Calls currently overwrites any
existing pending IncomingCall without notice, which can orphan the earlier offer
in CallRegistry.pending. Update set_incoming to detect when self.incoming is
already Some and either reject the new incoming call or at least log a warning
before replacing it, using the set_incoming and CallRegistry.pending symbols to
keep the behavior safe and traceable.

In `@apps/desktop/src/app/messages.rs`:
- Around line 73-124: The hard height cap at the end of calculate_message_height
is causing the virtual list to allocate too little space for long ChatMessage
entries. Remove the 500px clamp, or replace it with a much larger bound that
won’t truncate realistic message heights, so the returned value always matches
the actual bubble size. Keep the rest of the sizing logic in
calculate_message_height unchanged and ensure the final height reflects content,
media, sender name, and reactions without artificial clipping.

In `@apps/desktop/src/app/mod.rs`:
- Around line 1263-1264: The video decoding path in `StreamingVideoDecoder::new`
is using `smol::unblock` for heavy CPU work, which violates the blocking-work
guideline. Update the decode call site to use `tokio::task::spawn_blocking`
instead, keeping the `decode_result` flow intact and preserving the surrounding
async handling in `mod.rs`. If this code must remain on GPUI’s smol runtime,
bridge the work to Tokio explicitly or confirm the guideline should be relaxed
for this context.
- Around line 1156-1194: The paused-video resume path in the
VideoPlayerState::Paused branch is clearing the audio state too early, which
prevents the existing audio from being resumed. Update the logic around
self.stop_current_media() so it is skipped when self.audio_owner already matches
the current message_id, and keep the current self.audio_player.resume() path in
place for that case. Use the VideoPlayerState::Paused branch,
stop_current_media(), and audio_owner check to locate the fix.

In `@apps/desktop/src/audio/player.rs`:
- Around line 242-249: The Opus decode path in player::decode_float is
truncating stereo PCM as if the returned sample count were mono. Update the
logic in the decode result handling so that output.truncate uses the full frame
count across channels (or otherwise size the buffer/slice based on the channel
count) before extending all_samples, ensuring 2-channel audio keeps both
channels instead of dropping half the decoded data.
- Around line 238-240: The lazy decoder initialization in the player runtime
path is panicking via `OpusDecoder::new(...).expect("default decoder")`; replace
this with error propagation so `decoder.get_or_insert_with` no longer assumes
success. Update the `PlayerError::DecodeError` handling in `player.rs` so
decoder creation failures are returned to the caller the same way the header
branch already does, and keep the fix localized around the `OpusDecoder`
initialization logic.

In `@apps/desktop/src/client/whatsapp.rs`:
- Around line 147-165: Remove the redundant UI sender initialization in the
whatsapp client startup flow: the `self.runtime.spawn` block that only locks
`ui_sender_clone` and assigns `ui_tx_clone` duplicates the sender storage
already done in `run_client`. Keep the sender stored once in the async path that
calls `Self::run_client`, and delete the extra task to avoid unnecessary work
and any race between the two assignments.
- Around line 1189-1199: normalize_chat_jid is hitting client.get_lid_pn_entry
for every PN JID, creating an N+1 database lookup path for incoming messages and
receipts. Refactor normalize_chat_jid to avoid repeated queries by adding an
in-memory PN→LID cache (for example, a HashMap guarded by a Mutex or similar
shared state) and consult it before calling get_lid_pn_entry; update the cache
on successful lookups so repeated JIDs reuse the stored mapping.
- Line 180: The backend initialization in the whatsapp client uses a hardcoded
SqliteStore::new("whatsapp.db") path, which is not portable across launch
contexts. Update the code around the backend setup to derive the database
location from a proper platform data directory (for example via
dirs::data_dir()) or pass the path into the initializer as a parameter, and keep
the path handling in the same area as the SqliteStore::new call so it can be
configured per environment.
- Around line 1153-1170: The `stored_to_chat_message` helper is hardcoding
`is_read` to true for every `StoredMessage`, which conflicts with the chat-level
unread state loaded elsewhere. Update this conversion to use the stored
message’s read status if the `whatsapp_rust_chat_store::StoredMessage` provides
one, or otherwise derive a safer default that keeps messages unread when the
chat has pending unread items. Keep the fix localized to
`stored_to_chat_message` and preserve the existing mapping for other
`ChatMessage` fields.
- Around line 628-667: `send_message` is using `std::thread::spawn` with
`runtime.block_on`, and it keeps the `client_handle` lock held across the async
send. Update this method to follow the `set_call_muted`/`accept_call` pattern:
schedule work with `runtime.spawn`, clone the `Client` out of `client_handle`
and release the lock before awaiting, then perform `send_message` and
`record_outgoing` inside the spawned async task. Apply the same pattern to the
other public methods named in the comment for consistency.
- Around line 95-100: The Tokio runtime initialization in WhatsApp client setup
uses an .expect() panic path, which violates the no-panics guideline. Update the
constructor in whatsapp::new to return a Result instead of assuming runtime
creation succeeds, and propagate the error from
tokio::runtime::Builder::new_multi_thread().build() back to the caller with
proper error handling rather than unwrapping.

In `@apps/desktop/src/components/avatar.rs`:
- Around line 13-26: The avatar constructors are duplicated: from_initial and
render both build the same GpuiAvatar with identical sizing logic. Update
from_initial to delegate to render by converting the char to a string and
passing it through render, so all avatar construction stays centralized in the
render function and future changes only need to be made in one place.

In `@apps/desktop/src/components/input_area_view.rs`:
- Around line 170-172: `set_recording` in `InputAreaView` only mutates
`is_recording`, so the PTT UI never re-renders when `render()` depends on that
flag for icon, color, and variant. Update `set_recording` to accept `cx` and
call `cx.notify()` after changing the field, so callers handling
`StartRecording`/`StopRecording` can refresh the component without relying on
parent state changes.

In `@apps/desktop/src/main.rs`:
- Line 59: The `main` startup path in `apps/desktop/src/main.rs` still uses
`.unwrap()` on the window creation result, which violates the no-unwrap
guideline. Update the error handling at the call site in `main` so failures are
handled explicitly: either replace `.unwrap()` with `.expect()` using a clear,
descriptive message, or better, match on the result, log the failure, and exit
gracefully. Use the surrounding `main`/window creation code to keep the fix
localized and avoid any panic-only behavior without context.

In `@apps/desktop/src/state/chat.rs`:
- Around line 333-363: The unread-count logic in `ChatState::add_message` is too
permissive because `is_newer` is reused for both unread tracking and preview
updates, causing same-timestamp history messages to increment `unread_count`.
Split the conditions so the unread increment only happens for incoming messages
with a strictly newer timestamp than `last_message_time`, while the
`last_message` and `last_message_time` preview update can continue to use the
current inclusive behavior. Keep the fix localized in `add_message` and preserve
the existing chronological insert logic.

In `@apps/desktop/src/utils.rs`:
- Around line 7-16: The fallback in mime_to_image_format silently maps unknown
MIME types to ImageFormat::Png, which hides unsupported formats; update the
default branch to emit a warning for any unrecognized MIME before returning the
fallback. Keep the existing mapping for known image types, and make the warning
include the incoming mime value so callers can trace why decoding later failed.

In `@apps/desktop/src/video/audio.rs`:
- Line 37: The `extract_audio_from_mp4` function currently collapses all failure
cases into `Option`, which hides useful context for callers. Update
`extract_audio_from_mp4` and its internal error paths to return
`anyhow::Result<VideoAudio>` instead, and convert each `None` branch in the MP4
parse, audio track lookup, AAC frame extraction, probe, decoder creation, and
sample decoding flow into a descriptive error. Preserve the existing logging,
but make the returned errors distinguishable by attaching context at the
relevant failure points in `audio.rs`.
- Around line 168-187: The stereo-to-mono conversion in the audio decoding flow
is using the MP4 header channel count instead of the actual decoded stream
channel count. Update the logic around the decoded `SignalSpec`/`spec` and the
`mono_samples` conversion to base the `channels == 2` decision on the decoded
channel count, not `audio_track.channel_config()`. Keep the existing averaging
behavior in `all_samples` conversion, but ensure the channel count used there
reflects the real decoded audio so the `log::info!` message and output stay
correct when header and decoded channels differ.

In `@apps/desktop/src/video/player.rs`:
- Around line 185-191: The natural-completion path in `VideoPlayer::update()` is
clearing the completion sender before it can be used, so `on_complete()` never
receives its signal. Update the completion branch to take `self.completion_tx`
before calling `self.stop()`, then send on that captured sender after stopping,
using the `update()` and `stop()` methods to keep the flow correct and preserve
the public `on_complete()` behavior.

In `@apps/desktop/src/views/chat.rs`:
- Around line 112-119: Remove the unreachable fallback in chat view rendering:
`message_cache` in `selected_chat.map(|chat| app.get_message_list_cache(...))`
is guaranteed to be `Some` whenever `selected_chat` is present, so the
`unwrap_or_else` in `.when_some(selected_chat, ...)` is masking an invariant
violation. Update the logic around `when_some` and `MessageListCache` to either
use `unwrap()` with the existing guarantee or, preferably, destructure
`selected_chat` and `message_cache` together so the compiler enforces their
pairing and no empty-cache fallback can silently render zero messages.

In `@apps/desktop/src/views/pairing.rs`:
- Around line 12-31: Move the QR generation work out of the synchronous UI event
path by updating the `handle_event` flow in `AppState` to call `generate_qr_png`
inside `tokio::task::spawn_blocking` before storing the result. Keep
`generate_qr_png` as the QR/PNG encoder, but ensure the
`apps/desktop/src/app/mod.rs` event handler awaits the blocking task and only
then updates state so QR refreshes do not stall the desktop thread.
- Around line 61-66: The QR image rendering in the pairing view is recreating
the PNG buffer on every render via the `qr_code` branch in `pairing.rs`, which
needlessly clones bytes even though `cached.png_bytes` is already shared. Update
the `Image::from_bytes` / `img(ImageSource::Image(...))` path to reuse a cached
decoded `Image` or `Arc<Image>` instead of rebuilding it from `cached.png_bytes`
each time, keeping the logic localized around the `qr_code` handling in this
view.

In `@storages/chat-store/src/fts.rs`:
- Around line 18-43: ensure_fts currently creates the FTS table and triggers but
never backfills existing messages, so pre-existing rows stay unsearchable when
search is enabled later. Update ensure_fts to detect whether messages_fts was
newly created, and if so run an FTS5 rebuild after the CREATE VIRTUAL TABLE
step; keep the trigger creation logic unchanged and avoid rebuilding on later
calls.

In `@storages/chat-store/src/queries.rs`:
- Around line 36-46: The parse_jid helper in queries.rs logs the full raw JID on
parse failure, which can expose phone numbers in chat-store logs. Update the
warn! call inside parse_jid to avoid emitting the raw value and instead log a
redacted placeholder or generic message, while keeping the fallback to
Jid::default() unchanged.

In `@storages/chat-store/src/store.rs`:
- Around line 956-978: The unread count is being incremented twice for the same
logical message because both the placeholder path and the later message update
path call bump_chat with unread_delta. Update the MessageOp::Store /
insert_message flow so unread is only incremented when the row is newly
inserted, and avoid applying the unread_delta on in-place redelivery updates;
use the insert_message result (or a similar inserted/new-row signal) to decide
whether bump_chat should change unread_count.

In `@storages/chat-store/src/types.rs`:
- Around line 127-138: Add #[non_exhaustive] to the public StoreChange enum so
downstream pattern matches on StoreChange must include a fallback arm. Update
the enum definition in types.rs where StoreChange is declared, keeping its
existing variants (Chats, Messages, Contacts) unchanged and preserving its role
as the store invalidation signal.

In `@storages/sqlite-storage/src/shared.rs`:
- Around line 28-49: `SqliteStorage::run` currently maps
`spawn_blocking(...).await` `JoinError` into `StoreError::Database`, which hides
panic context from `f`. Update the `run` method to preserve debuggability by
handling the `JoinError` explicitly: either log the join failure before
converting it, or add a clear comment near the `.await` mapping in
`SqliteStorage::run` explaining that panics in `f` surface as
`StoreError::Database`. Keep the existing `acquire_owned`, `pool.get`, and
`spawn_blocking` flow unchanged.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/desktop/README.md`:
- Around line 15-47: Update the desktop README architecture tree to include the
missing modules and components currently present in the workspace, especially
the audio/, video/, responsive.rs, utils.rs, assets.rs, and call popup component
files so the layout matches the real codebase. In the Features Status section,
mark the call UI and QR code rendering items as completed since the relevant
components and CachedQrCode already exist. In Future Improvements, remove or
rewrite items that are no longer pending, especially message sending status and
WebRTC call integration, to reflect the current implemented behavior in the
desktop app.
- Line 28: The call.rs module description is outdated and references a
non-existent ActiveCall type. Update the README entry for call.rs to match the
actual exports from state/mod.rs by listing the real symbols (CallId,
IncomingCall, OutgoingCall, OutgoingCallState) and removing ActiveCall so the
module map stays accurate.

In `@apps/desktop/src/app/messages.rs`:
- Around line 44-47: The virtual list item sizing in MessageListCache::new()
still uses a fixed px(600.) width, so update the size calculation to derive the
width from ResponsiveLayout instead of hardcoding it. Locate the sizing logic in
apps/desktop/src/app/messages.rs around calculate_message_height(msg,
show_sender, max_media_size), and thread the responsive message-list width into
the virtual item dimensions so list layout stays aligned with the current
viewport.

In `@apps/desktop/src/audio/encoder.rs`:
- Around line 129-146: EncoderError currently uses manual Display and
std::error::Error impls, which should be replaced with thiserror-derived typed
errors. Add thiserror to apps/desktop/Cargo.toml, then update EncoderError in
encoder.rs to derive the appropriate error traits and annotate each variant with
the right error message/source behavior so the enum no longer needs hand-written
fmt::Display or Error impls.

In `@apps/desktop/src/audio/player.rs`:
- Around line 287-310: PlayerError is still using manual Display and Error impls
instead of the required thiserror-based typed error pattern. Update the
PlayerError enum in player.rs to derive the appropriate thiserror traits, remove
the hand-written std::fmt::Display and std::error::Error impl blocks, and make
sure the variant messages are preserved via thiserror attributes; keep the
approach consistent with the EncoderError fix and verify the thiserror
dependency is available in the desktop crate.

In `@apps/desktop/src/audio/recorder.rs`:
- Around line 27-44: The resampling logic in Recorder::resample_to_16khz is
using nearest-neighbor sampling by selecting every Nth sample, which hurts audio
quality. Update this method to perform linear interpolation between adjacent
samples when mapping from the original sample rate to TARGET_SAMPLE_RATE,
keeping the existing early return for already-16kHz input and preserving the
current output length calculation.
- Around line 96-107: The config selection in init() is too restrictive because
it only considers mono configs, which can cause NoSupportedConfig even though
the stream callback in Recorder has a multi-channel downmix path. Update the
supported-config search to first prefer mono configs for CAPTURE_SAMPLE_RATE,
but also fall back to stereo/multi-channel configs when no mono option exists,
using the existing downmix handling in the callback. Keep the logic localized
around init() and the supported config loop so the multi-channel path becomes
reachable.
- Around line 219-244: Replace the manual error boilerplate for RecorderError
with a thiserror-based derive so the enum itself defines the messages. Update
RecorderError to use the thiserror derive and move each variant’s text into its
attributes, then remove the custom std::fmt::Display implementation and the
empty std::error::Error impl. Keep the enum variants and their meanings
unchanged, and use RecorderError as the unique symbol to locate this refactor.
- Around line 147-159: The recording callback in recorder::Recorder is appending
samples to the shared buffer without any upper bound, so add a max-duration or
max-sample-count guard inside the callback before pushing to samples. Use the
existing capture path around the cpal input callback and the samples lock to
stop extending the Vec<f32> once the limit is reached, and make sure the
recording state is marked complete/ignored so input is no longer accumulated.

In `@apps/desktop/src/client/whatsapp.rs`:
- Around line 389-416: The reaction-handling block in `handle_message` still
mixes an outer `if let` with an inner let-chain, which is inconsistent with the
file’s broader let-chain style. Refactor the
`base_msg.reaction_message.as_option()` handling to use a `let Some(reaction) =
... else { ... };`-style early-exit structure, keeping the existing `return`
behavior intact while preserving the `key.id` and `key.remote_jid` checks inside
the reaction path.

In `@apps/desktop/src/video/streaming.rs`:
- Around line 411-422: The reset_decoder method currently ignores Decoder::new()
failures, leaving the old decoder and last_decoded_index state in place. Update
reset_decoder to handle the Err case explicitly: log the failure with context
from Decoder::new(), and ensure the decoder state is not left stale (including
resetting last_decoded_index as part of the reset path). Keep the SPS/PPS
reinitialization in the successful new_decoder path using self.sps_pps.

---

Duplicate comments:
In `@apps/desktop/src/components/avatar.rs`:
- Around line 21-26: The avatar constructor still duplicates the same builder
chain as render instead of delegating. Update from_initial in Avatar to call
into render (or the shared construction path) using the provided initial
converted to a string and the same size handling, so both methods stay aligned
and future changes only need to be made in one place.

In `@apps/desktop/src/video/audio.rs`:
- Around line 168-187: The mono conversion in audio processing still relies on
the container/header channel count instead of the decoded stream’s actual
channel count. Update the logic around the stereo-to-mono branch in audio.rs to
use the channel info from decoded.spec() (or a value derived from it) rather
than audio_track.channel_config(), and ensure the conversion path in the
mono_samples block only averages when the decoded audio is truly stereo.
- Line 37: `extract_audio_from_mp4` is still collapsing multiple distinct
failure paths into `Option`; update it to return `anyhow::Result<VideoAudio>`
and propagate each failure case with meaningful context instead of `None`.
Adjust the full flow inside `extract_audio_from_mp4` to use `?` for MP4 parsing,
track/frame selection, probe/decoder creation, and decoding, and then update any
callers of `extract_audio_from_mp4` to handle `Result` rather than checking for
`Option`.

In `@apps/desktop/src/views/pairing.rs`:
- Around line 12-31: The QR generation work in generate_qr_png is still running
synchronously and must be moved off the UI thread. Wrap the CPU-heavy QR code
creation and PNG encoding in tokio::task::spawn_blocking, and update the call
site that triggers it so the result is awaited asynchronously instead of calling
generate_qr_png directly. Keep the logic centered around generate_qr_png and the
app/mod.rs QR refresh path.
- Around line 61-66: The QR image creation in the pairing view is still
rebuilding from `cached.png_bytes` on every render. Update the `pairing.rs` QR
rendering path to cache the decoded `Image` or `Arc<Image>` alongside the QR
data, and have the widget use that cached image instead of calling
`Image::from_bytes` with `cached.png_bytes.as_ref().clone()` each frame. Keep
the change localized to the QR display logic so the
`img(ImageSource::Image(...))` path reuses the pre-decoded asset.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/desktop/README.md`:
- Line 46: Update the call.rs entry in the desktop README to remove the
nonexistent ActiveCall type and document only the actual call structs, including
IncomingCall and OutgoingCall.

In `@apps/desktop/src/app/mod.rs`:
- Around line 1804-1810: In both video-completion cleanup branches within the
media update flow, clear app.audio_owner alongside app.audio_player.stop().
Update both locations identified by the duplicated completion handling,
preserving the existing active_media, video_update_task, and notification
cleanup.
- Around line 1882-1908: When complete hydration in the chat-loading flow
removes store-backed chats via the retain operation, also invalidate each
removed chat’s message cache before dropping it. Update the logic around the
existing chats.retain call and invalidate by JID only for chats excluded from
retention, while preserving caches for retained and newly merged chats.

In `@apps/desktop/src/audio/call_device.rs`:
- Around line 20-45: Replace the linear interpolation in resample_into with a
stateful band-limited resampling approach, such as a low-pass FIR filter
followed by decimation, preserving filter history across calls and using the
existing fractional cursor for block continuity. Ensure the common 48→16 kHz
path attenuates frequencies above the 8 kHz Nyquist limit before downsampling.
- Around line 241-244: Update the readiness barriers in the audio setup flow,
including the nearby second recv call around the corresponding mic/speaker
startup path, to use recv_timeout with an appropriate startup timeout. Convert
timeout or channel-closure failures into a descriptive setup error while
preserving the existing handling of successful readiness signals.
- Around line 263-264: Update the CPAL error callbacks near the device stream
setup to propagate stream failures into the call shutdown path instead of only
logging them: the microphone callback must clear the shared alive state, and the
speaker callback must set teardown and close the drain channel. Preserve the
existing error logging while wiring both callbacks to the corresponding shared
state used by the call lifecycle.

In `@apps/desktop/src/audio/player.rs`:
- Around line 270-299: Update the packet handling around the OpusHead/OpusTags
checks so packets are skipped only when their payload has the corresponding
header signature, rather than based on packet_count. Preserve decoder
initialization for streams with OpusHead, and initialize the fallback decoder
before decoding the first non-header packet when headers are absent.
- Around line 139-180: Update AudioPlayer::play_samples, pause, resume, and the
stream error callback so is_playing changes only after successful CPAL
operations. Move startup activation until build_stream and stream.play succeed,
restore the prior state and resolve the completion channel on startup failure,
propagate pause/resume errors without flipping state, and have the error
callback clear playback state and complete the pending completion receiver.

In `@apps/desktop/src/audio/recorder.rs`:
- Around line 145-169: Update the scoring logic in the supported-configuration
selection loop so capture-rate support ranks ahead of sample format: a
configuration supporting CAPTURE_SAMPLE_RATE must outrank lower-rate F32
configurations, while retaining the existing mono preference and candidate
construction behavior.

In `@apps/desktop/src/audio/waveform.rs`:
- Around line 13-33: Update the waveform RMS bucket generation using
WAVEFORM_SAMPLES so samples are distributed across all waveform buckets rather
than relying on fixed-size chunks that can produce too few values; ensure a
65-sample input populates the final bucket when it has signal. Add a regression
test covering 65 samples and asserting the final waveform value is non-zero,
while preserving normalization and padding behavior for other inputs.

In `@apps/desktop/src/components/call_popup.rs`:
- Around line 119-143: The call action container in the popup currently uses a
pointer-only div; replace or augment it with a focusable keyboard-operable
control around the existing on_click behavior. Ensure Enter and Space activate
the same callback for accepting or declining calls, while preserving the current
styling and visual label.

In `@apps/desktop/src/components/message_bubble.rs`:
- Around line 390-400: The render_image_from_bytes function currently clones
image bytes and decodes the image on every render. Update this path to obtain
and reuse a cached Arc<Image>, following the existing sticker-preview caching
approach, and render the cached decoded image directly while preserving the
current format and sizing behavior.

In `@apps/desktop/src/components/message_list.rs`:
- Around line 16-23: Remove the unused _playing_message_id parameter from
render_message_list and update every call site to stop passing it, while
preserving the closure’s existing use of app.playing_message_id() for each
render.

In `@apps/desktop/src/video/streaming.rs`:
- Around line 129-131: Validate the dimensions obtained in the video streaming
path before the RGBA buffer allocation: reject zero dimensions and pixel counts
above the supported maximum, then use checked multiplication when computing the
buffer size. Update the allocation logic around the video dimension handling and
the later RGBA buffer creation so invalid or overflowing sizes return an
appropriate error instead of allocating.
- Around line 27-28: Update avcc_to_annexb to accept the track’s avcC
lengthSizeMinusOne value and derive the NAL prefix width as 1, 2, or 4 bytes
instead of using NAL_LENGTH_SIZE. Read and pass this value from the video track
metadata, validate malformed avcC records and NAL lengths, and reject
unsupported or inconsistent widths before parsing samples.