More review changes

Co-authored-by: Copilot <copilot@github.com>

lib/EpdFont/scripts/build-sd-fonts.py

@@ -126,6 +126,8 @@ def build_family(family: dict, output_base: Path) -> tuple[str, bool, str]:
     """Build a single font family. Returns (name, success, message)."""
     name = family["name"]
     output_dir = output_base / name
+    if output_dir.exists():
+        shutil.rmtree(output_dir)
     output_dir.mkdir(parents=True, exist_ok=True)
 
     styles = family.get("styles", {})
@@ -258,7 +260,7 @@ def main():
 
     # Filter if --only specified
     if args.only:
-        only_names = set(args.only.split(","))
+        only_names = {token.strip() for token in args.only.split(",") if token.strip()}
         families = [f for f in families if f["name"] in only_names]
         missing = only_names - {f["name"] for f in families}
         if missing:

lib/Epub/Epub/converters/JpegToFramebufferConverter.cpp

@@ -8,6 +8,7 @@
 #include <Logging.h>
 
 #include <cstdlib>
+#include <limits>
 #include <memory>
 #include <new>
 
@@ -234,6 +235,17 @@ bool readJpegDimensionsFromHeader(const std::string& imagePath, ImageDimensions&
         LOG_ERR("JPG", "Invalid JPEG dimensions %ux%u: %s", width, height, imagePath.c_str());
         return false;
       }
+
+      constexpr int MAX_SOURCE_PIXELS = 3145728;  // Keep in sync with ImageToFramebufferDecoder contract.
+      const int widthInt = static_cast<int>(width);
+      const int heightInt = static_cast<int>(height);
+      if (width > static_cast<uint16_t>(std::numeric_limits<int16_t>::max()) ||
+          height > static_cast<uint16_t>(std::numeric_limits<int16_t>::max()) ||
+          widthInt * heightInt > MAX_SOURCE_PIXELS) {
+        LOG_ERR("JPG", "JPEG dimensions out of supported range %ux%u: %s", width, height, imagePath.c_str());
+        return false;
+      }
+
       out.width = static_cast<int16_t>(width);
       out.height = static_cast<int16_t>(height);
       return true;

lib/GfxRenderer/FontCacheManager.cpp

@@ -109,8 +109,16 @@ void FontCacheManager::PrewarmScope::endScanAndPrewarm() {
 
   manager_->prewarmCache(manager_->scanFontId_, manager_->scanText_.c_str(), styleMask);
 
-  // Keep reserved capacity to avoid repeated alloc/free churn between pages.
+  constexpr size_t BASE_SCAN_TEXT_CAP = 2048;
+  constexpr size_t MAX_SCAN_TEXT_CAP = 16384;
+
+  // Keep reserved capacity for typical pages, but trim pathological outliers.
   manager_->scanText_.clear();
+  if (manager_->scanText_.capacity() > MAX_SCAN_TEXT_CAP) {
+    std::string trimmed;
+    trimmed.reserve(BASE_SCAN_TEXT_CAP);
+    manager_->scanText_.swap(trimmed);
+  }
 }
 
 FontCacheManager::PrewarmScope::~PrewarmScope() {