Crop the centre first for fit=cover (closes #282)

libvips' thumbnail with a centre crop scales the whole source to cover
the requested size and copies that into memory before it crops: 8192x64
at 8192x8192 made it allocate about 24 GiB, and 8192x1 failed with 500.
resize now cuts the centre of the source to the requested size's
proportions first and resizes that, so no image larger than the source
or the output is made. The crop is the same centre as before. TODO.md
says so.

Model: opus-5-5

TODO.md

@@ -30,6 +30,16 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 a thin source requested with `fit=cover` no longer makes libvips
+  build a huge image (closes #282): libvips scaled the whole source to cover the
+  requested size and copied that into memory before it cut out the centre, so an
+  8192x64 source at 8192x8192 made it allocate about 24 GiB, and an 8192x1
+  source answered 500. The image processor now cuts the centre of the source to
+  the requested size's proportions first and resizes that, so no image larger
+  than the source or the output is made; the crop is the same centre as before.
+  With the runtime image's libvips and JPEG output at 8192x8192, resident memory
+  peaked at about 44 MiB for the 8192x64 source, 40 MiB for the 8192x1 one, and
+  117 MiB for a 4000x3000 one, which took 373 MiB before.
 - 2026-10-15 `max_concurrent_processing` defaults to half the CPUs pixa sees,
   rounded down, and at least 1 (closes #242): it defaulted to one image per CPU,
   and a container with no CPU limit sees every CPU of the host, so on a 48-CPU

internal/imageprocessor/fit_cover_internal_test.go

@@ -0,0 +1,148 @@
+package imageprocessor
+
+import (
+	"bytes"
+	"image"
+	"image/color"
+	"image/png"
+	"testing"
+)
+
+// TestImageProcessor_FitCoverServesThinSource verifies that FitCover serves
+// a source of 8192x64 or 8192x1, or one of those turned on its side, at
+// 8192x8192. Scaling such a source to cover that size makes it 128 or 8192
+// times as long as the output on its long side.
+func TestImageProcessor_FitCoverServesThinSource(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		inputWidth, inputHeight int
+	}{
+		{"8192x64", 8192, 64},
+		{"8192x1", 8192, 1},
+		{"64x8192", 64, 8192},
+		{"1x8192", 1, 8192},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			input := createTestJPEG(t, tt.inputWidth, tt.inputHeight)
+
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{
+					Size: Size{
+						Width:  MaxOutputDimension,
+						Height: MaxOutputDimension,
+					},
+					Format:  FormatJPEG,
+					FitMode: FitCover,
+				})
+			if err != nil {
+				t.Fatalf("Process() error = %v", err)
+			}
+
+			defer func() { _ = result.Content.Close() }()
+
+			t.Logf("Process() made %dx%d", result.Width, result.Height)
+
+			if result.Width != MaxOutputDimension ||
+				result.Height != MaxOutputDimension {
+				t.Errorf("Process() made %dx%d, want %dx%d",
+					result.Width, result.Height,
+					MaxOutputDimension, MaxOutputDimension)
+			}
+		})
+	}
+}
+
+// createBandsPNG creates a PNG of three equal bands, red, green and blue,
+// side by side when it is wider than tall and top to bottom otherwise.
+func createBandsPNG(t *testing.T, width, height int) []byte {
+	t.Helper()
+
+	bands := []color.RGBA{
+		{R: 255, A: 255},
+		{G: 255, A: 255},
+		{B: 255, A: 255},
+	}
+
+	img := image.NewRGBA(image.Rect(0, 0, width, height))
+	for y := range height {
+		for x := range width {
+			band := 3 * y / height
+			if width > height {
+				band = 3 * x / width
+			}
+
+			img.Set(x, y, bands[band])
+		}
+	}
+
+	return encodePNG(t, img)
+}
+
+// TestImageProcessor_FitCoverCropsTheCentre verifies that FitCover keeps the
+// centre of the source: a 300x100 source of red, green and blue bands side
+// by side, or a 100x300 one with them top to bottom, comes out at 50x50 as
+// its green band.
+func TestImageProcessor_FitCoverCropsTheCentre(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		inputWidth, inputHeight int
+	}{
+		{"bands side by side", 300, 100},
+		{"bands top to bottom", 100, 300},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			input := createBandsPNG(t, tt.inputWidth, tt.inputHeight)
+
+			result, err := New(Params{}).Process(t.Context(),
+				bytes.NewReader(input),
+				&Request{
+					Size:    Size{Width: 50, Height: 50},
+					Format:  FormatPNG,
+					FitMode: FitCover,
+				})
+			if err != nil {
+				t.Fatalf("Process() error = %v", err)
+			}
+
+			defer func() { _ = result.Content.Close() }()
+
+			output, err := png.Decode(result.Content)
+			if err != nil {
+				t.Fatalf("failed to decode output: %v", err)
+			}
+
+			bounds := output.Bounds()
+			t.Logf("Process() made %dx%d", bounds.Dx(), bounds.Dy())
+
+			if bounds.Dx() != 50 || bounds.Dy() != 50 {
+				t.Fatalf("Process() made %dx%d, want 50x50",
+					bounds.Dx(), bounds.Dy())
+			}
+
+			// Resampling may blend a little of the bands beside the
+			// green one into the output's edges.
+			for y := bounds.Min.Y; y < bounds.Max.Y; y++ {
+				for x := bounds.Min.X; x < bounds.Max.X; x++ {
+					r, g, b, _ := output.At(x, y).RGBA()
+					if r>>8 > 64 || g>>8 < 192 || b>>8 > 64 {
+						t.Fatalf("output pixel %d,%d is %d,%d,%d, want green",
+							x, y, r>>8, g>>8, b>>8)
+					}
+				}
+			}
+		})
+	}
+}

internal/imageprocessor/imageprocessor.go

@@ -475,8 +475,8 @@ func (p *ImageProcessor) resize(
 ) error {
 	switch fit {
 	case FitCover, "":
-		// Resize and crop to fill exact dimensions (default)
+		// Crop the centre and resize to fill exact dimensions (default)
-		return img.Thumbnail(width, height, vips.InterestingCentre)
+		return cropCentreAndResize(img, width, height)
 
 	case FitContain:
 		// Resize to fit within dimensions, maintaining aspect ratio
@@ -530,6 +530,37 @@ func (p *ImageProcessor) resize(
 	}
 }
 
+// cropCentreAndResize cuts img to its centre, the largest area it holds with
+// the proportions of width x height, and resizes that to width x height.
+// This is the crop libvips' thumbnail makes with InterestingCentre, but
+// libvips scales the whole image to cover the size and copies the result
+// into memory before it crops, and for a thin image that is far larger than
+// the image or the output: 8192x64 at 8192x8192 is 1048576x8192, about 24
+// GiB. Cropping first makes no image larger than img or the output.
+func cropCentreAndResize(img *vips.ImageRef, width, height int) error {
+	imgW, imgH := img.Width(), img.Height()
+
+	// An image wider than the requested proportions keeps its height and
+	// loses width, any other keeps its width and loses height; the side
+	// shortened is rounded to the nearest pixel and is at least 1
+	cropW, cropH := imgW, imgH
+	if imgW*height > imgH*width {
+		cropW = max(1, (imgH*width+height/2)/height)
+	} else {
+		cropH = max(1, (imgW*height+width/2)/width)
+	}
+
+	// Half of what is cut comes off each side
+	left, top := (imgW-cropW)/2, (imgH-cropH)/2 //nolint:mnd // half the cut
+
+	err := img.ExtractArea(left, top, cropW, cropH)
+	if err != nil {
+		return err
+	}
+
+	return img.ThumbnailWithSize(width, height, vips.InterestingNone, vips.SizeForce)
+}
+
 const defaultQuality = 85
 
 // encode encodes an image to the specified format. govips gives pixa no way