fail_on is ignored by thumbnail_buffer and thumbnail_source

/* gcc -O2 -o thumb-failon thumb-failon.c $(pkg-config --cflags --libs vips) */
#include <stdio.h>
#include <unistd.h>
#include <vips/vips.h>

static const char *path = "/tmp/truncated.jpg";
static char *jpeg;
static size_t jpeg_len;

/* A JPEG cut off part way through its scan data: the header survives, so every
 * case below builds a pipeline, and the damage is only found when the pixels
 * are read.
 */
static void
make_truncated(void)
{
	VipsImage *im;
	char *whole;
	size_t whole_len;

	if (vips_gaussnoise(&im, 400, 300, NULL) ||
		vips_jpegsave_buffer(im, (void **) &whole, &whole_len, NULL))
		vips_error_exit(NULL);
	g_object_unref(im);

	jpeg_len = whole_len * 2 / 3;
	jpeg = g_memdup2(whole, jpeg_len);
	g_free(whole);

	if (!g_file_set_contents(path, jpeg, jpeg_len, NULL))
		vips_error_exit("cannot write %s", path);

	printf("%zu byte JPEG truncated to %zu bytes\n\n", whole_len, jpeg_len);
}

/* Read the thumbnail's pixels: fail_on is a loader setting, so it can only show
 * up when the loader is asked to decode.
 */
static void
try(const char *what, VipsImage *out, int result)
{
	double avg;

	if (!result)
		result = vips_avg(out, &avg, NULL);

	if (result) {
		char *msg = vips_error_buffer_copy();
		char *nl = strchr(msg, '\n');

		if (nl)
			*nl = '\0';
		printf("%-42s REFUSED   %s\n", what, msg);
		g_free(msg);
	}
	else
		printf("%-42s ACCEPTED  %d x %d thumbnail of a broken file\n",
			what, vips_image_get_width(out), vips_image_get_height(out));

	vips_error_clear();
	VIPS_UNREF(out);
}

int
main(int argc, char **argv)
{
	VipsImage *out;
	VipsSource *source;

	if (VIPS_INIT(argv[0]))
		vips_error_exit(NULL);

	make_truncated();

	out = NULL;
	try("thumbnail, no fail_on",
		out, vips_thumbnail(path, &out, 100, NULL));

	out = NULL;
	try("thumbnail, fail_on=error",
		out, vips_thumbnail(path, &out, 100,
			"fail_on", VIPS_FAIL_ON_ERROR, NULL));

	out = NULL;
	try("thumbnail_buffer, fail_on=error",
		out, vips_thumbnail_buffer(jpeg, jpeg_len, &out, 100,
			"fail_on", VIPS_FAIL_ON_ERROR, NULL));

	out = NULL;
	try("thumbnail_buffer, option_string",
		out, vips_thumbnail_buffer(jpeg, jpeg_len, &out, 100,
			"option_string", "fail_on=error", NULL));

	out = NULL;
	source = vips_source_new_from_memory(jpeg, jpeg_len);
	try("thumbnail_source, fail_on=error",
		out, vips_thumbnail_source(source, &out, 100,
			"fail_on", VIPS_FAIL_ON_ERROR, NULL));
	VIPS_UNREF(source);

	out = NULL;
	source = vips_source_new_from_memory(jpeg, jpeg_len);
	try("thumbnail_source, option_string",
		out, vips_thumbnail_source(source, &out, 100,
			"option_string", "fail_on=error", NULL));
	VIPS_UNREF(source);

	g_free(jpeg);
	unlink(path);
	vips_shutdown();
	return 0;
}

47365 byte JPEG truncated to 31576 bytes

thumbnail, no fail_on                      ACCEPTED  100 x 75 thumbnail of a broken file
thumbnail, fail_on=error                   REFUSED   VipsJpeg: premature end of JPEG image
thumbnail_buffer, fail_on=error            ACCEPTED  100 x 75 thumbnail of a broken file
thumbnail_buffer, option_string            REFUSED   VipsJpeg: premature end of JPEG image
thumbnail_source, fail_on=error            ACCEPTED  100 x 75 thumbnail of a broken file
thumbnail_source, option_string            REFUSED   VipsJpeg: premature end of JPEG image