decode

The bitmap a portable-format stream holds.

source names the origin of the bytes in any failure, the way a file name does everywhere else in this module; it is not a path and nothing opens it.

Three things about the checking are decisions rather than defaults:

• Every container is validated as it is built — an array's values strictly ascend, a bitset's population count is the cardinality its header declared, a run list's runs ascend, are separated by at least one absent value and sum to that cardinality. BitmapView.open deliberately defers all of this to BitmapView.verify because it reads in place and a walk would defeat the point. Here the values are being copied onto the heap regardless, so the walk is already paid for and refusing to look would be a choice to trust bytes this engine did not write.

• Containers are bounds-checked, not required to tile the stream. BitmapView.open requires its blocks to tile its slice exactly, which catches truncation, a gap, an overlap and trailing bytes in one check — sound because the slice is ours and its writer is this file. A foreign writer's offset header may legitimately point anywhere inside its payload, so each container is required to fit and nothing is claimed about the space between them.

• A value this engine cannot hold is unsupported, not damage. The portable format is over unsigned 32-bit values and a rabosh ordinal is 0..BitmapFormat.MAX_ORDINAL, so a stream from another system may hold values that are intact and unrepresentable here. That is the distinction UnsupportedBitmapFormatException exists for; calling it corruption would send somebody looking for a disk fault.

Throws