refuse input larger than this many bytes; 16 MiB
emulated instructions allowed per second of sound produced; 4 million
refuse to inflate past this many bytes of output, the bound on a zip bomb; 64 MiB
a read that takes longer than this multiple of the audio it produced counts as starved; 1
stop a stream after this many seconds of output, whatever the file says; 3600
consecutive starved reads before the stream is cut; 8
Guards for decoders of formats that carry machine code or compressed payloads (NSF, SID, SPC, a tracker with a packed sample bank, an LHA or DEFLATE archive): all of them are untrusted input, and "it ran a long time" or "it grew enormous" is a failure the format itself cannot be asked to prevent. Every limit is named, defaulted and raised by the caller, and every breach is one
DecodeBudgetErrorthat says which limit and why, never a hang or a crash.