fix(egfx)!: make DecodedFrame fields private with getters to enforce size invariant (#1331)

Author: glamberson

crates/ironrdp-egfx/src/client.rs

@@ -751,18 +751,18 @@ impl GraphicsPipelineClient {
         // Decoded frame must be at least as large as the destination rectangle.
         // Larger is expected (macroblock alignment) and handled by cropping.
         // Smaller means the server sent mismatched dimensions.
-        if frame.width < u32::from(dest_width) || frame.height < u32::from(dest_height) {
+        if frame.width() < u32::from(dest_width) || frame.height() < u32::from(dest_height) {
             warn!(
-                frame_width = frame.width,
-                frame_height = frame.height,
+                frame_width = frame.width(),
+                frame_height = frame.height(),
                 dest_width,
                 dest_height,
                 "decoded frame smaller than destination rectangle"
             );
             return Err(pdu_other_err!("decoded frame smaller than destination rectangle"));
         }
 
-        let cropped_data = crop_decoded_frame(&frame.data, frame.width, frame.height, dest_width, dest_height);
+        let cropped_data = crop_decoded_frame(frame.data(), frame.width(), frame.height(), dest_width, dest_height);
 
         let update = BitmapUpdate {
             surface_id,

crates/ironrdp-egfx/src/decode.rs

@@ -29,12 +29,9 @@ use core::fmt;
 #[derive(Clone)]
 #[non_exhaustive]
 pub struct DecodedFrame {
-    /// RGBA pixel data (4 bytes per pixel)
-    pub data: Vec<u8>,
-    /// Frame width in pixels
-    pub width: u32,
-    /// Frame height in pixels
-    pub height: u32,
+    data: Vec<u8>,
+    width: u32,
+    height: u32,
 }
 
 impl DecodedFrame {
@@ -50,6 +47,26 @@ impl DecodedFrame {
         );
         Self { data, width, height }
     }
+
+    /// RGBA pixel data (4 bytes per pixel).
+    pub fn data(&self) -> &[u8] {
+        &self.data
+    }
+
+    /// Frame width in pixels.
+    pub fn width(&self) -> u32 {
+        self.width
+    }
+
+    /// Frame height in pixels.
+    pub fn height(&self) -> u32 {
+        self.height
+    }
+
+    /// Consume the frame and return the owned RGBA buffer.
+    pub fn into_data(self) -> Vec<u8> {
+        self.data
+    }
 }
 
 impl fmt::Debug for DecodedFrame {
@@ -286,11 +303,7 @@ mod openh264_impl {
             let mut rgba = vec![0u8; rgba_size];
             yuv.write_rgba8(&mut rgba);
 
-            Ok(DecodedFrame {
-                data: rgba,
-                width: w32,
-                height: h32,
-            })
+            Ok(DecodedFrame::new(rgba, w32, h32))
         }
 
         fn reset(&mut self) {
@@ -309,3 +322,24 @@ mod openh264_impl {
 
 #[cfg(feature = "openh264")]
 pub use openh264_impl::OpenH264Decoder;
+
+#[cfg(test)]
+mod tests {
+    use super::DecodedFrame;
+
+    #[test]
+    fn getters_return_constructor_inputs() {
+        let data = vec![0u8; 2 * 3 * 4];
+        let frame = DecodedFrame::new(data.clone(), 2, 3);
+        assert_eq!(frame.data(), data.as_slice());
+        assert_eq!(frame.width(), 2);
+        assert_eq!(frame.height(), 3);
+    }
+
+    #[test]
+    fn into_data_yields_owned_buffer() {
+        let data = vec![0xAAu8; 4 * 4 * 4];
+        let frame = DecodedFrame::new(data.clone(), 4, 4);
+        assert_eq!(frame.into_data(), data);
+    }
+}

crates/ironrdp-testsuite-core/tests/egfx/decode.rs

@@ -86,8 +86,8 @@ fn test_openh264_decode_sps_pps() {
 
     let mut decoder = OpenH264Decoder::new().expect("decoder should initialize");
     let frame = decoder.decode(&avc_data).expect("decode should succeed");
-    assert!(frame.width >= 16, "decoded width should be at least 16");
-    assert!(frame.height >= 16, "decoded height should be at least 16");
+    assert!(frame.width() >= 16, "decoded width should be at least 16");
+    assert!(frame.height() >= 16, "decoded height should be at least 16");
 }
 
 #[test]
@@ -98,9 +98,9 @@ fn test_openh264_decode_iframe() {
     let frame = decoder.decode(&avc_data).expect("decode should succeed");
 
     // Verify RGBA output dimensions and data
-    assert_eq!(frame.width, 16);
-    assert_eq!(frame.height, 16);
-    assert_eq!(frame.data.len(), 16 * 16 * 4, "RGBA data should be 16x16x4 bytes");
+    assert_eq!(frame.width(), 16);
+    assert_eq!(frame.height(), 16);
+    assert_eq!(frame.data().len(), 16 * 16 * 4, "RGBA data should be 16x16x4 bytes");
 }
 
 #[test]
@@ -116,8 +116,8 @@ fn test_openh264_decoder_reset() {
 
     // Decoder should still be usable after reset
     let frame = decoder.decode(&avc_data).expect("decode after reset should succeed");
-    assert_eq!(frame.width, 16);
-    assert_eq!(frame.height, 16);
+    assert_eq!(frame.width(), 16);
+    assert_eq!(frame.height(), 16);
 }
 
 // ============================================================================