html-to-markdown 2.24.6 → 2.25.1

data/rust-vendor/png/src/decoder/unfiltering_buffer.rs

@@ -8,12 +8,7 @@ use crate::Info;
 pub(crate) struct UnfilteringBuffer {
     /// Vec containing the uncompressed image data currently being processed.
     data_stream: Vec<u8>,
-    /// Index in `data_stream` where the previous row starts.
-    /// This excludes the filter type byte - it points at the first byte of actual pixel data.
-    /// The pixel data is already-`unfilter`-ed.
-    ///
-    /// If `prev_start == current_start` then it means that there is no previous row.
-    prev_start: usize,
+    prev_row: PrevRow,
     /// Index in `data_stream` where the current row starts.
     /// This points at the filter type byte of the current row (i.e. the actual pixel data starts at `current_start + 1`)
     /// The pixel data is not-yet-`unfilter`-ed.
@@ -26,6 +21,10 @@ pub(crate) struct UnfilteringBuffer {
     available: usize,
     /// The number of bytes before we shift the buffer back.
     shift_back_limit: usize,
+    /// How many bytes are left to decompress into this buffer for the current frame.
+    remaining_bytes: u64,
+    /// To avoid always allocating a new vector in `fn unfilter_curr_row_using_scratch_buffer`.
+    scratch_buffer: Vec<u8>,
 }
 
 impl UnfilteringBuffer {
@@ -34,9 +33,14 @@ impl UnfilteringBuffer {
     /// Asserts in debug builds that all the invariants hold.  No-op in release
     /// builds.  Intended to be called after creating or mutating `self` to
     /// ensure that the final state preserves the invariants.
+    #[cfg(not(debug_assertions))]
+    fn debug_assert_invariants(&self) {}
+    #[cfg(debug_assertions)]
     fn debug_assert_invariants(&self) {
-        debug_assert!(self.prev_start <= self.current_start);
-        debug_assert!(self.current_start <= self.available);
+        if let PrevRow::InPlace(prev_start) = &self.prev_row {
+            debug_assert!(*prev_start <= self.current_start);
+        }
+        debug_assert!(self.current_start <= self.filled);
         debug_assert!(self.available <= self.filled);
         debug_assert!(self.filled <= self.data_stream.len());
     }
@@ -87,11 +91,13 @@ impl UnfilteringBuffer {
 
         let result = Self {
             data_stream: Vec::with_capacity(data_stream_capacity),
-            prev_start: 0,
+            prev_row: PrevRow::None,
             current_start: 0,
             filled: 0,
             available: 0,
             shift_back_limit,
+            remaining_bytes: u64::MAX,
+            scratch_buffer: Vec::new(),
         };
 
         result.debug_assert_invariants();
@@ -101,38 +107,72 @@ impl UnfilteringBuffer {
     /// Called to indicate that there is no previous row (e.g. when the current
     /// row is the first scanline of a given Adam7 pass).
     pub fn reset_prev_row(&mut self) {
-        self.prev_start = self.current_start;
+        // Stash a previously allocated buffer (for potential reuse later)
+        // rather than throwing it away when resetting `self.prev_row`.
+        if let PrevRow::Scratch(buf) = &mut self.prev_row {
+            self.scratch_buffer = std::mem::take(buf);
+        }
+
+        self.prev_row = PrevRow::None;
         self.debug_assert_invariants();
     }
 
-    pub fn reset_all(&mut self) {
+    pub fn start_frame(&mut self, frame_bytes: u64) {
         self.data_stream.clear();
-        self.prev_start = 0;
+        self.prev_row = PrevRow::None;
         self.current_start = 0;
         self.filled = 0;
         self.available = 0;
+        self.remaining_bytes = frame_bytes;
+    }
+
+    pub fn remaining_bytes(&self) -> u64 {
+        self.remaining_bytes
     }
 
     /// Returns the previous (already `unfilter`-ed) row.
     pub fn prev_row(&self) -> &[u8] {
-        &self.data_stream[self.prev_start..self.current_start]
+        self.prev_row
+            .as_slice(&self.data_stream[..self.current_start])
+    }
+
+    /// Returns how many bytes of the current row are present in the mutable
+    /// part of the buffer (32kB most recently decompressed bytes are read-only
+    /// to retain the "lookback" window as needed for inflate algorithm).  If a
+    /// full row is mutable, then it may be unfiltered using
+    /// `unfilter_curr_row_in_place`.
+    ///
+    /// See also `readable_len_of_curr_row`.
+    pub fn mutable_len_of_curr_row(&self) -> usize {
+        self.available.saturating_sub(self.current_start)
     }
 
-    /// Returns how many bytes of the current row are present in the buffer.
-    pub fn curr_row_len(&self) -> usize {
-        self.available - self.current_start
+    /// Returns how many bytes of the current row have been already
+    /// decompressed.  If a full row is available, then it may be unfiltered
+    /// using `unfilter_curr_row_using_scratch_buffer`.
+    ///
+    /// See also `mutable_len_of_curr_row`.
+    pub fn readable_len_of_curr_row(&self) -> usize {
+        self.filled - self.current_start
     }
 
-    /// Returns a `&mut Vec<u8>` suitable for passing to
-    /// `ReadDecoder.decode_image_data` or `StreamingDecoder.update`.
+    /// Runs `f` on the underlying buffer.
     ///
     /// Invariants of `self` depend on the assumption that the caller will only
     /// append new bytes to the returned vector (which is indeed the behavior of
     /// `ReadDecoder` and `StreamingDecoder`).  TODO: Consider protecting the
     /// invariants by returning an append-only view of the vector
     /// (`FnMut(&[u8])`??? or maybe `std::io::Write`???).
-    pub fn as_unfilled_buffer(&mut self) -> UnfilterBuf<'_> {
-        if self.prev_start >= self.shift_back_limit
+    pub fn with_unfilled_buffer<F, T>(&mut self, f: F) -> T
+    where
+        F: FnOnce(&mut UnfilterBuf<'_>) -> T,
+    {
+        // Potentially shift the buffer left to avoid unbounded growth.
+        let discard_size = self.available.min(match &self.prev_row {
+            PrevRow::None | PrevRow::Scratch(_) => self.current_start,
+            PrevRow::InPlace(prev_start) => *prev_start,
+        });
+        if discard_size >= self.shift_back_limit
             // Avoid the shift back if the buffer is still very empty. Consider how we got here: a
             // previous decompression filled the buffer, then we unfiltered, we're now refilling
             // the buffer again. The condition implies, the previous decompression filled at most
@@ -140,62 +180,140 @@ impl UnfilteringBuffer {
             // attempt will not yet be limited by the buffer length.
             && self.filled >= self.data_stream.len() / 2
         {
-            // We have to relocate the data to the start of the buffer. Benchmarking suggests that
-            // the codegen for an unbounded range is better / different than the one for a bounded
-            // range. We prefer the former if the data overhead is not too high. `16` was
-            // determined experimentally and might be system (memory) dependent. There's also the
-            // question if we could be a little smarter and avoid crossing page boundaries when
-            // that is not required. Alas, microbenchmarking TBD.
-            if let Some(16..) = self.data_stream.len().checked_sub(self.filled) {
-                self.data_stream
-                    .copy_within(self.prev_start..self.filled, 0);
-            } else {
-                self.data_stream.copy_within(self.prev_start.., 0);
-            }
-
-            // The data kept its relative position to `filled` which now lands exactly at
-            // the distance between prev_start and filled.
-            self.current_start -= self.prev_start;
-            self.available -= self.prev_start;
-            self.filled -= self.prev_start;
-            self.prev_start = 0;
+            self.shift_buffer_left(discard_size);
         }
 
         if self.filled + Self::GROWTH_BYTES > self.data_stream.len() {
             self.data_stream.resize(self.filled + Self::GROWTH_BYTES, 0);
         }
 
-        UnfilterBuf {
+        if self.remaining_bytes < usize::MAX as u64
+            && self.filled.saturating_add(self.remaining_bytes as usize) < self.data_stream.len()
+        {
+            self.data_stream
+                .resize(self.filled + self.remaining_bytes as usize, 0);
+        }
+
+        let old_filled = self.filled;
+        let ret = f(&mut UnfilterBuf {
             buffer: &mut self.data_stream,
             filled: &mut self.filled,
             available: &mut self.available,
+        });
+        assert!(self.filled >= old_filled);
+        self.remaining_bytes -= (self.filled - old_filled) as u64;
+
+        if self.remaining_bytes == 0 {
+            self.available = self.filled;
         }
+
+        self.debug_assert_invariants();
+        ret
+    }
+
+    /// Shifts the contents of `self.data_stream` left,
+    /// discarding the first `discard_size` bytes.
+    fn shift_buffer_left(&mut self, discard_size: usize) {
+        // Violating this assertion will clobber the immutable "lookback"
+        // window that needs to be maintained for decompressor.
+        assert!(discard_size <= self.available);
+
+        // We have to relocate the data to the start of the buffer. Benchmarking suggests that
+        // the codegen for an unbounded range is better / different than the one for a bounded
+        // range. We prefer the former if the data overhead is not too high. `16` was
+        // determined experimentally and might be system (memory) dependent. There's also the
+        // question if we could be a little smarter and avoid crossing page boundaries when
+        // that is not required. Alas, microbenchmarking TBD.
+        if let Some(16..) = self.data_stream.len().checked_sub(self.filled) {
+            self.data_stream.copy_within(discard_size..self.filled, 0);
+        } else {
+            self.data_stream.copy_within(discard_size.., 0);
+        }
+
+        // The data kept its relative position to `filled` which now lands exactly at
+        // the distance between prev_start and filled.
+        self.current_start -= discard_size;
+        self.available -= discard_size;
+        self.filled -= discard_size;
+        match &mut self.prev_row {
+            PrevRow::None | PrevRow::Scratch(_) => (),
+            PrevRow::InPlace(prev_start) => *prev_start -= discard_size,
+        }
+    }
+
+    fn curr_row_filter(&self) -> Result<RowFilter, DecodingError> {
+        let filter = self.data_stream[self.current_start];
+        RowFilter::from_u8(filter).ok_or(DecodingError::Format(
+            FormatErrorInner::UnknownFilterMethod(filter).into(),
+        ))
     }
 
-    /// Runs `unfilter` on the current row, and then shifts rows so that the current row becomes the previous row.
+    /// Runs `unfilter` on the current row, and then shifts rows so that the
+    /// current row becomes the previous row.
     ///
-    /// Will panic if `self.curr_row_len() < rowlen`.
-    pub fn unfilter_curr_row(
+    /// `unfilter` will mutate the current row in-place, and therefore the
+    /// caller should first consult `mutable_len_of_curr_row` to check if all
+    /// bytes of the current row are indeed mutable.
+    pub fn unfilter_curr_row_in_place(
         &mut self,
         rowlen: usize,
         bpp: BytesPerPixel,
     ) -> Result<(), DecodingError> {
-        debug_assert!(rowlen >= 2); // 1 byte for `FilterType` and at least 1 byte of pixel data.
+        debug_assert!(rowlen >= 2); // 1 byte for `RowFilter` and at least 1 byte of pixel data.
+
+        // Violating the assertion below would clobber the bytes in the
+        // "lookback" window.
+        debug_assert!(self.mutable_len_of_curr_row() >= rowlen);
 
+        let filter = self.curr_row_filter()?;
         let (prev, row) = self.data_stream.split_at_mut(self.current_start);
-        let prev: &[u8] = &prev[self.prev_start..];
+        let prev: &[u8] = self.prev_row.as_slice(prev);
+        let row = &mut row[1..rowlen]; // Skip the `RowFilter` byte.
+        debug_assert!(prev.is_empty() || prev.len() == row.len());
 
-        debug_assert!(prev.is_empty() || prev.len() == (rowlen - 1));
+        unfilter(filter, bpp, prev, row);
+
+        self.reset_prev_row();
+        self.prev_row = PrevRow::InPlace(self.current_start + 1);
+        self.current_start += rowlen;
+        self.debug_assert_invariants();
 
-        // Get the filter type.
-        let filter = RowFilter::from_u8(row[0]).ok_or(DecodingError::Format(
-            FormatErrorInner::UnknownFilterMethod(row[0]).into(),
-        ))?;
-        let row = &mut row[1..rowlen];
+        Ok(())
+    }
 
-        unfilter(filter, bpp, prev, row);
+    /// Runs `unfilter` on the current row, and then shifts rows so that the
+    /// current row becomes the previous row.
+    ///
+    /// Before running `unfilter`, the contents of the current row will be
+    /// copied into a scratch buffer.  This allows unfiltering to happen even
+    /// if `mutable_len_of_curr_row < rowlen` (e.g. when handling partial
+    /// or not-yet-complete input streams).
+    pub fn unfilter_curr_row_using_scratch_buffer(
+        &mut self,
+        rowlen: usize,
+        bpp: BytesPerPixel,
+    ) -> Result<(), DecodingError> {
+        debug_assert!(rowlen >= 2); // 1 byte for `RowFilter` and at least 1 byte of pixel data.
+        debug_assert!(self.readable_len_of_curr_row() >= rowlen);
+
+        // If `mutable_len_of_curr_row >= rowlen`, then `unfilter_curr_row_in_place`
+        // should have been called instead (to avoid the cost of `copy_from_slice` below).
+        debug_assert!(self.mutable_len_of_curr_row() < rowlen);
+
+        let filter = self.curr_row_filter()?;
+
+        let mut row = std::mem::take(&mut self.scratch_buffer);
+        row.resize(rowlen - 1, 0);
+        row.as_mut_slice()
+            .copy_from_slice(&self.data_stream[self.current_start + 1..][..rowlen - 1]);
+
+        let prev = self.prev_row();
+        debug_assert!(prev.is_empty() || prev.len() == (rowlen - 1));
+
+        unfilter(filter, bpp, prev, &mut row);
 
-        self.prev_start = self.current_start + 1;
+        self.reset_prev_row();
+        self.prev_row = PrevRow::Scratch(row);
         self.current_start += rowlen;
 
         self.debug_assert_invariants();
@@ -204,6 +322,45 @@ impl UnfilteringBuffer {
     }
 }
 
+/// An already `unfilter`-ed, previous row.
+///
+/// The data excludes the `RowFilter` byte - it only includes the actual pixel data.
+enum PrevRow {
+    /// No unfiltered row.
+    ///
+    /// `None` is the value of `UnfilteringBuffer::prev_row` before any row has
+    /// been unfiltered (or at the start of a new interlace pass).
+    None,
+
+    /// Offset of `UnfilteringBuffer::data_stream` where the unfiltered row
+    /// starts.
+    ///
+    /// `UnfilteringBuffer::InPlace(_)` is used by `unfilter_curr_row_in_place`
+    /// when setting `UnfilteringBuffer::prev_row`.
+    InPlace(usize),
+
+    /// Separate scratch buffer containing the unfiltered row data.
+    ///
+    /// `UnfilteringBuffer::Scratch(_)` is used by
+    /// `unfilter_curr_row_using_scratch_buffer`
+    /// when setting `UnfilteringBuffer::prev_row`.
+    Scratch(Vec<u8>),
+}
+
+impl PrevRow {
+    /// Returns the previous unfiltered row as a slice of bytes.
+    ///
+    /// `buf` should refer to the `..current_start` portion of
+    /// `UnfilteringBuffer::data_stream`.
+    fn as_slice<'a>(&'a self, buf: &'a [u8]) -> &'a [u8] {
+        match self {
+            PrevRow::None => &[],
+            PrevRow::InPlace(prev_start) => &buf[*prev_start..],
+            PrevRow::Scratch(scratch) => scratch.as_slice(),
+        }
+    }
+}
+
 fn checked_next_multiple_of(val: usize, factor: usize) -> Option<usize> {
     if factor == 0 {
         return None;

data/rust-vendor/png/src/decoder/zlib.rs

@@ -2,38 +2,56 @@ use super::{stream::FormatErrorInner, unfiltering_buffer::UnfilteringBuffer, Dec
 
 use fdeflate::Decompressor;
 
-/// An inplace buffer for decompression and filtering of PNG rowlines.
+/// [PNG spec](https://www.w3.org/TR/2003/REC-PNG-20031110/#10Compression) says that
+/// "deflate/inflate compression with a sliding window (which is an upper bound on the
+/// distances appearing in the deflate stream) of at most 32768 bytes".
 ///
-/// The underlying data structure is a vector, with additional markers denoting a region of bytes
-/// that are utilized by the decompression but not yet available to arbitrary modifications. The
-/// caller can still shift around data between calls to the stream decompressor as long as the data
-/// in the marked region is not modified and the indices adjusted accordingly. See
-/// [`UnfilterRegion`] that contains these markers.
+/// `fdeflate` requires that we keep this many most recently decompressed bytes in the
+/// `out_buffer` - this allows referring back to them when handling "length and distance
+/// codes" in the deflate stream).
+const LOOKBACK_SIZE: usize = 32768;
+
+/// A buffer for decompression and in-place filtering of PNG rowlines.
 ///
-/// Violating the invariants, i.e. modifying bytes in the marked region, results in absurdly wacky
-/// decompression output or panics but not undefined behavior.
+/// The underlying data structure is a vector, with additional markers dividing
+/// the vector into specific regions of bytes - see [`UnfilterRegion`] for more
+/// details.
 pub struct UnfilterBuf<'data> {
-    /// The data container. Starts with arbitrary data unrelated to the decoder, a slice of decoder
-    /// private data followed by free space for further decoder output. The regions are delimited
-    /// by `filled` and `available` which must be updated accordingly.
-    pub(crate) buffer: &'data mut Vec<u8>,
-    /// Where we record changes to the out position.
-    pub(crate) filled: &'data mut usize,
-    /// Where we record changes to the available byte.
+    /// The data container.
+    pub(crate) buffer: &'data mut [u8],
+    /// The past-the-end index of the region that is allowed to be modified.
     pub(crate) available: &'data mut usize,
+    /// The past-the-end index of the region with decompressed bytes.
+    pub(crate) filled: &'data mut usize,
 }
 
-/// A region into a buffer utilized as a [`UnfilterBuf`].
+/// `UnfilterRegion` divides a `Vec<u8>` buffer into three consecutive regions:
+///
+/// * `vector[0..available]` - bytes that may be mutated (this typically means
+///   bytes that were decompressed earlier, but user of the buffer may also use
+///   this region for storing other data)
+/// * `vector[available..filled]` - already decompressed bytes that need to be
+///   preserved. (Future decompressor calls may reference and copy bytes from
+///   this region.  The maximum `filled - available` "look back" distance for
+///   [PNG compression method 0](https://www.w3.org/TR/png-3/#10CompressionCM0)
+///   is 32768 bytes)
+/// * `vector[filled..]` - buffer where future decompressor calls can write
+///   additional decompressed bytes
+///
+/// Even though only `vector[0..available]` bytes can be mutated, it is allowed
+/// to "shift" or "move" the contents of vector, as long as the:
+///
+/// * `vector[available..filled]` bytes are preserved
+/// * `available` and `filled` offsets are updated
 ///
-/// The span of data denoted by `filled..available` is the region of bytes that must be preserved
-/// for use by the decompression algorithm. It may be moved, e.g. by subtracting the same amount
-/// from both of these fields. Always ensure that `filled <= available`, the library does not
-/// violate this invariant when modifying this struct as an [`UnfilterBuf`].
+/// Violating the invariants described above (e.g. mutating the bytes in the
+/// `vector[available..filled]` region) may result in absurdly wacky
+/// decompression output or panics, but not undefined behavior.
 #[derive(Default, Clone, Copy)]
 pub struct UnfilterRegion {
-    /// The past-the-end index of byte that are allowed to be modified.
+    /// The past-the-end index of the region that is allowed to be modified.
     pub available: usize,
-    /// The past-the-end of bytes that have been written to.
+    /// The past-the-end index of the region with decompressed bytes.
     pub filled: usize,
 }
 
@@ -52,15 +70,6 @@ pub(super) struct ZlibStream {
 }
 
 impl ZlibStream {
-    // [PNG spec](https://www.w3.org/TR/2003/REC-PNG-20031110/#10Compression) says that
-    // "deflate/inflate compression with a sliding window (which is an upper bound on the
-    // distances appearing in the deflate stream) of at most 32768 bytes".
-    //
-    // `fdeflate` requires that we keep this many most recently decompressed bytes in the
-    // `out_buffer` - this allows referring back to them when handling "length and distance
-    // codes" in the deflate stream).
-    const LOOKBACK_SIZE: usize = 32768;
-
     pub(crate) fn new() -> Self {
         ZlibStream {
             state: Box::new(Decompressor::new()),
@@ -113,68 +122,72 @@ impl ZlibStream {
             self.state.ignore_adler32();
         }
 
-        let (buffer, filled) = image_data.borrow_mut();
-        let output_limit = (filled + UnfilteringBuffer::GROWTH_BYTES).min(buffer.len());
-        let (in_consumed, out_consumed) = self
-            .state
-            .read(data, &mut buffer[..output_limit], filled, false)
-            .map_err(|err| {
-                DecodingError::Format(FormatErrorInner::CorruptFlateStream { err }.into())
-            })?;
-
+        let in_consumed = image_data.decompress(&mut self.state, data)?;
         self.started = true;
-        let filled = filled + out_consumed;
-        image_data.filled(filled);
-
-        if self.state.is_done() {
-            image_data.commit(filled);
-        } else {
-            // See [`Self::LOOKBACK_SIZE`].
-            image_data.commit(filled.saturating_sub(Self::LOOKBACK_SIZE));
-        }
 
         Ok(in_consumed)
     }
 
-    /// Called after all consecutive IDAT chunks were handled.
+    /// Output any remaining buffered data within the decompressor.
     ///
-    /// The compressed stream can be split on arbitrary byte boundaries. This enables some cleanup
-    /// within the decompressor and flushing additional data which may have been kept back in case
-    /// more data were passed to it.
-    pub(crate) fn finish_compressed_chunks(
+    /// Returns `Ok(true)` if all data has been decompressed and there is no
+    /// more data that will be produced, or `Ok(false)` if there's potentially
+    /// more output.
+    ///
+    /// Returns `Err` if the zlib stream is corrupt or truncated too early.
+    pub(crate) fn finish(
         &mut self,
         image_data: &mut UnfilterBuf<'_>,
-    ) -> Result<(), DecodingError> {
-        if !self.started {
-            return Ok(());
+    ) -> Result<bool, DecodingError> {
+        if !self.started || self.state.is_done() {
+            return Ok(true);
         }
 
-        if self.state.is_done() {
-            // We can end up here only after the [`decompress`] call above has detected the state
-            // to be done, too. In this case the filled and committed amount of data are already
-            // equal to each other. So neither of them needs to be touched in any way.
-            return Ok(());
+        // If the zlib stream isn't done but we've already output all the pixel
+        // data needed, then either there's too much compressed data or the
+        // checksum is missing. Those aren't allowed by the spec, but libpng
+        // generally doesn't treat them as fatal.
+        if *image_data.filled == image_data.buffer.len() {
+            return Ok(true);
         }
 
-        let (_, mut filled) = image_data.borrow_mut();
-        while !self.state.is_done() {
-            let (buffer, _) = image_data.borrow_mut();
-            let (_in_consumed, out_consumed) =
-                self.state.read(&[], buffer, filled, true).map_err(|err| {
-                    DecodingError::Format(FormatErrorInner::CorruptFlateStream { err }.into())
-                })?;
-
-            filled += out_consumed;
+        let (_, out_consumed) = self
+            .state
+            .read(
+                &[],
+                &mut image_data.buffer[*image_data.available..],
+                *image_data.filled - *image_data.available,
+                false,
+            )
+            .map_err(|err| {
+                DecodingError::Format(FormatErrorInner::CorruptFlateStream { err }.into())
+            })?;
+        *image_data.filled += out_consumed;
 
-            if !self.state.is_done() {
-                image_data.flush_allocate();
-            }
+        if self.state.is_done() {
+            *image_data.available = *image_data.filled;
+            return Ok(true);
         }
 
-        image_data.filled(filled);
-        image_data.commit(filled);
+        // More output is only possible if zlib stream hasn't finished and the
+        // output buffer *is* full. (Empty space in the output buffer tells us
+        // there wasn't more data to write into it.)
+        if *image_data.filled == image_data.buffer.len() {
+            *image_data.available =
+                (*image_data.available).max(image_data.filled.saturating_sub(LOOKBACK_SIZE));
+            return Ok(false);
+        }
 
-        Ok(())
+        // The zlib stream was truncated before the end of the pixel data. This
+        // would ordinarily be caught within fdeflate if we'd passed
+        // end_of_input=true. But we intentionally don't pass that flag so that
+        // we're able to drain all available pixel data first.
+        Err(DecodingError::Format(
+            FormatErrorInner::CorruptFlateStream {
+                err: fdeflate::DecompressionError::InsufficientInput,
+            }
+            .into(),
+        ))
     }
 }
 
@@ -184,7 +197,11 @@ impl UnfilterRegion {
     /// Pass the wrapped buffer to
     /// [`StreamingDecoder::update`][`super::stream::StreamingDecoder::update`] to fill it with
     /// data and update the region indices.
+    ///
+    /// May panic if invariants of [`UnfilterRegion`] are violated.
     pub fn as_buf<'data>(&'data mut self, buffer: &'data mut Vec<u8>) -> UnfilterBuf<'data> {
+        assert!(self.available <= self.filled);
+        assert!(self.filled <= buffer.len());
         UnfilterBuf {
             buffer,
             filled: &mut self.filled,
@@ -194,20 +211,43 @@ impl UnfilterRegion {
 }
 
 impl UnfilterBuf<'_> {
-    pub(crate) fn borrow_mut(&mut self) -> (&mut [u8], usize) {
-        (self.buffer, *self.filled)
-    }
-
-    pub(crate) fn filled(&mut self, filled: usize) {
-        *self.filled = filled;
-    }
+    /// Pushes `input` into `fdeflate` crate and appends decompressed bytes to `self.buffer`
+    /// (adjusting `self.filled` and `self.available` depending on how many bytes have been
+    /// decompressed).
+    ///
+    /// Returns how many bytes of `input` have been consumed.
+    #[inline]
+    fn decompress(
+        &mut self,
+        decompressor: &mut fdeflate::Decompressor,
+        input: &[u8],
+    ) -> Result<usize, DecodingError> {
+        let output_limit = (*self.filled + UnfilteringBuffer::GROWTH_BYTES).min(self.buffer.len());
+        let (in_consumed, out_consumed) = decompressor
+            .read(
+                input,
+                &mut self.buffer[*self.available..output_limit],
+                *self.filled - *self.available,
+                false,
+            )
+            .map_err(|err| {
+                DecodingError::Format(FormatErrorInner::CorruptFlateStream { err }.into())
+            })?;
 
-    pub(crate) fn commit(&mut self, howmany: usize) {
-        *self.available = howmany;
-    }
+        *self.filled += out_consumed;
+        if decompressor.is_done() {
+            *self.available = *self.filled;
+        } else if let Some(new_available) = self.filled.checked_sub(LOOKBACK_SIZE) {
+            // The decompressed data may have started in the middle of the buffer,
+            // so ensure that `self.available` never goes backward.  This is needed
+            // to avoid miscommunicating the size of the "look-back" window when calling
+            // `fdeflate::Decompressor::read` a bit earlier and passing
+            // `&mut self.buffer[*self.available..output_limit]`.
+            if new_available > *self.available {
+                *self.available = new_available;
+            }
+        }
 
-    pub(crate) fn flush_allocate(&mut self) {
-        let len = self.buffer.len() + 32 * 1024;
-        self.buffer.resize(len, 0);
+        Ok(in_consumed)
     }
 }