From 9c7bf99a610fee2f13ceff807b6429d0f5bb5ccf Mon Sep 17 00:00:00 2001
From: ddidderr <ddidderr@paul.network>
Date: Tue, 21 Jul 2026 09:47:29 +0200
Subject: [PATCH] refactor(decompress): move default window policy to Rust

Route the configured default maximum window size through the Rust policy layer while keeping the build-time C configuration value and decoder layout in C. The explicit projection preserves overridden builds exactly and gives the scalar policy a focused null-input contract and tests.

Test Plan:

- git diff --check -- lib/decompress/zstd_decompress.c rust/src/zstd_decompress.rs

- capped serial cargo check, clippy, nightly fmt, C syntax checks, and focused default-window tests (passed in the worker)
---
 lib/decompress/zstd_decompress.c | 19 ++++++++--
 rust/src/zstd_decompress.rs      | 63 ++++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+), 3 deletions(-)

diff --git a/lib/decompress/zstd_decompress.c b/lib/decompress/zstd_decompress.c
index 546c27b7e..6e1bb0c63 100644
--- a/lib/decompress/zstd_decompress.c
+++ b/lib/decompress/zstd_decompress.c
@@ -18,8 +18,8 @@
 #include "zstd_ddict.h"
 
 /* Keep the three public build-time tuning knobs in the C configuration domain.
- * Rust queries them through the small leaves below rather than baking a second
- * set of defaults into its source. */
+ * Rust receives them through the small scalar-policy leaves below rather than
+ * baking a second set of defaults into its source. */
 #ifndef ZSTD_HEAPMODE
 #  define ZSTD_HEAPMODE 1
 #endif
@@ -187,6 +187,16 @@ typedef char ZSTD_rust_decompress_stack_callbacks_layout[
 size_t ZSTD_rust_decompress_stack_action(
         const ZSTD_rustDecompressStackProjection* projection,
         const ZSTD_rustDecompressStackCallbacks* callbacks);
+typedef struct {
+    size_t configured_max_window_size;
+} ZSTD_rustDefaultMaxWindowProjection;
+typedef char ZSTD_rust_default_max_window_projection_layout[
+        (offsetof(ZSTD_rustDefaultMaxWindowProjection,
+                  configured_max_window_size) == 0
+         && sizeof(ZSTD_rustDefaultMaxWindowProjection) == sizeof(size_t))
+        ? 1 : -1];
+size_t ZSTD_rust_default_max_window_policy(
+        const ZSTD_rustDefaultMaxWindowProjection* projection);
 typedef struct {
     int configured_max;
 } ZSTD_rustNoForwardProgressProjection;
@@ -328,7 +338,10 @@ void ZSTD_dctx_init_platform(ZSTD_DCtx* dctx)
 
 size_t ZSTD_rust_dctx_default_max_window_size(void)
 {
-    return ZSTD_MAXWINDOWSIZE_DEFAULT;
+    ZSTD_rustDefaultMaxWindowProjection const projection = {
+        ZSTD_MAXWINDOWSIZE_DEFAULT
+    };
+    return ZSTD_rust_default_max_window_policy(&projection);
 }
 
 int ZSTD_rust_no_forward_progress_max(void)
diff --git a/rust/src/zstd_decompress.rs b/rust/src/zstd_decompress.rs
index a87ac47d8..ed39ceac7 100644
--- a/rust/src/zstd_decompress.rs
+++ b/rust/src/zstd_decompress.rs
@@ -310,6 +310,22 @@ const _: () = {
     assert!(size_of::<ZSTD_rustLegacySupportProjection>() == size_of::<c_uint>());
 };
 
+#[repr(C)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct ZSTD_rustDefaultMaxWindowProjection {
+    pub configured_max_window_size: usize,
+}
+
+const _: () = {
+    assert!(
+        offset_of!(
+            ZSTD_rustDefaultMaxWindowProjection,
+            configured_max_window_size
+        ) == 0
+    );
+    assert!(size_of::<ZSTD_rustDefaultMaxWindowProjection>() == size_of::<usize>());
+};
+
 #[repr(C)]
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 pub struct ZSTD_rustNoForwardProgressProjection {
@@ -678,6 +694,21 @@ unsafe fn configured_legacy_support() -> u32 {
     }
 }
 
+/// Preserve the active C build's default maximum window size.
+///
+/// C supplies the compile-time value because it may be overridden by the
+/// build. Rust owns this scalar policy boundary without clamping or replacing
+/// the configured value, so custom decoder limits keep their existing meaning.
+#[no_mangle]
+pub unsafe extern "C" fn ZSTD_rust_default_max_window_policy(
+    projection: *const ZSTD_rustDefaultMaxWindowProjection,
+) -> usize {
+    let Some(projection) = (unsafe { projection.as_ref() }) else {
+        return 0;
+    };
+    projection.configured_max_window_size
+}
+
 /// Preserve the active C build's no-forward-progress threshold.
 ///
 /// C supplies the compile-time value because it may be overridden by the
@@ -708,6 +739,38 @@ pub unsafe extern "C" fn ZSTD_rust_heapmode_policy(
     c_int::from(projection.configured_mode >= 1)
 }
 
+#[cfg(test)]
+mod default_max_window_policy_tests {
+    use super::*;
+
+    #[test]
+    fn preserves_configured_default_window_sizes() {
+        for configured_max_window_size in [
+            0,
+            1,
+            1usize << ZSTD_WINDOWLOG_ABSOLUTEMIN,
+            (1usize << ZSTD_WINDOWLOG_LIMIT_DEFAULT) + 1,
+            usize::MAX,
+        ] {
+            let projection = ZSTD_rustDefaultMaxWindowProjection {
+                configured_max_window_size,
+            };
+            assert_eq!(
+                unsafe { ZSTD_rust_default_max_window_policy(&projection) },
+                configured_max_window_size
+            );
+        }
+    }
+
+    #[test]
+    fn rejects_missing_default_window_configuration() {
+        assert_eq!(
+            unsafe { ZSTD_rust_default_max_window_policy(ptr::null()) },
+            0
+        );
+    }
+}
+
 #[cfg(test)]
 mod no_forward_progress_policy_tests {
     use super::*;