Crash-Isolated Codec Workers

HotPDF can move high-risk DCTDecode, JPXDecode, and JBIG2Decode image decoding out of the host process

Isolation modes

cimAutomatic is the default and uses HotPDFCodecWorker.exe when it is available beside the host executable, otherwise it preserves the compatible in-process path
cimRequired fails closed when the worker is missing, cannot start, crashes, times out, rejects the input, or exceeds an output limit
cimDisabled always uses the existing in-process decoders

Once an available worker accepts a request, cimAutomatic does not retry failed or malicious input in the host process

Process boundary

Each decode request runs in a fresh hidden process assigned to a single-process Windows Job Object

The Job Object terminates the worker and any attempted descendants when its handle closes
CodecWorkerMemoryLimitBytes applies a per-process committed-memory ceiling and defaults to 512 MiB
CodecWorkerTimeoutMilliseconds defaults to 10,000 ms and terminates a hung worker
Encoded input, optional JBIG2 globals, and BGR24 output use one randomly named shared-memory mapping with a versioned fixed-width protocol
The decoded output capacity is bounded by declared image geometry and DecodeBudgetBytes
Low-resolution JPEG requests carry exact target dimensions and return reduced-DCT geometry without constructing a full-resolution worker raster

Configuration

PDF.CodecIsolationMode := cimRequired;
PDF.CodecWorkerExecutable :=
  'C:\Program Files\MyApp\HotPDFCodecWorker.exe';
PDF.CodecWorkerTimeoutMilliseconds := 5000;
PDF.CodecWorkerMemoryLimitBytes := 256 * 1024 * 1024;

Bitmap := PDF.ExtractLoadedImage(0);
if Bitmap = nil then
begin
  PDF.GetLastCodecWorkerInfo(Info);
  Writeln(Ord(Info.Status), ': ', Info.ErrorMessage);
end;

An empty CodecWorkerExecutable resolves to HotPDFCodecWorker.exe beside the current application

Telemetry

GetLastCodecWorkerInfo reports the status, process identifier, exit code, elapsed milliseconds, and a bounded host-side diagnostic

GetLastJPEGReducedDecodeInfo reports source, scaled, output, and scanline geometry after an isolated reduced JPEG request

Distinct statuses cover unavailable or unlaunchable workers, timeout, crash, decode rejection, protocol mismatch, and decoded-output limits

Build and deployment

build-HotPDF-Codec-Worker.cmd