@emasoft/svg-matrix 1.0.30 → 1.0.31

package/src/svg-flatten.js

@@ -69,16 +69,38 @@ Decimal.set({ precision: 80 });
  * // Shows region from (-50,-50) to (150,150) in user space
  */
 export function parseViewBox(viewBoxStr) {
-  if (!viewBoxStr || viewBoxStr.trim() === "") {
+  // Validate input type and content
+  if (!viewBoxStr || typeof viewBoxStr !== "string" || viewBoxStr.trim() === "") {
+    return null;
+  }
+
+  let parts;
+  try {
+    parts = viewBoxStr
+      .trim()
+      .split(/[\s,]+/)
+      .map((s) => new Decimal(s));
+  } catch (_err) {
+    console.warn(`Invalid viewBox (parse error): ${viewBoxStr}`);
     return null;
   }
 
-  const parts = viewBoxStr
-    .trim()
-    .split(/[\s,]+/)
-    .map((s) => new Decimal(s));
   if (parts.length !== 4) {
-    console.warn(`Invalid viewBox: ${viewBoxStr}`);
+    console.warn(`Invalid viewBox (expected 4 values): ${viewBoxStr}`);
+    return null;
+  }
+
+  const width = parts[2];
+  const height = parts[3];
+
+  // Validate dimensions are positive and finite
+  if (width.lte(0) || height.lte(0)) {
+    console.warn(`Invalid viewBox (non-positive dimensions): ${viewBoxStr}`);
+    return null;
+  }
+
+  if (!width.isFinite() || !height.isFinite() || !parts[0].isFinite() || !parts[1].isFinite()) {
+    console.warn(`Invalid viewBox (non-finite values): ${viewBoxStr}`);
     return null;
   }
 
@@ -228,6 +250,20 @@ export function computeViewBoxTransform(
   const vpW = D(viewportWidth);
   const vpH = D(viewportHeight);
 
+  // Validate dimensions are positive and finite to prevent division by zero
+  if (vbW.lte(0) || vbH.lte(0)) {
+    console.warn("Invalid viewBox dimensions (must be positive)");
+    return Matrix.identity(3);
+  }
+  if (vpW.lte(0) || vpH.lte(0)) {
+    console.warn("Invalid viewport dimensions (must be positive)");
+    return Matrix.identity(3);
+  }
+  if (!vbW.isFinite() || !vbH.isFinite() || !vpW.isFinite() || !vpH.isFinite()) {
+    console.warn("Invalid dimensions (must be finite)");
+    return Matrix.identity(3);
+  }
+
   // Default preserveAspectRatio
   const parValue = par || { align: "xMidYMid", meetOrSlice: "meet" };
 
@@ -340,8 +376,19 @@ export class SVGViewport {
     preserveAspectRatio = null,
     transform = null,
   ) {
-    this.width = new Decimal(width);
-    this.height = new Decimal(height);
+    // Validate width and height
+    const w = new Decimal(width);
+    const h = new Decimal(height);
+
+    if (w.lte(0) || h.lte(0)) {
+      throw new Error("SVGViewport dimensions must be positive");
+    }
+    if (!w.isFinite() || !h.isFinite()) {
+      throw new Error("SVGViewport dimensions must be finite");
+    }
+
+    this.width = w;
+    this.height = h;
     this.viewBox = viewBox ? parseViewBox(viewBox) : null;
     this.preserveAspectRatio = parsePreserveAspectRatio(preserveAspectRatio);
     this.transform = transform;
@@ -438,9 +485,19 @@ export class SVGViewport {
  * // Combines two viewBox transforms and a rotation
  */
 export function buildFullCTM(hierarchy) {
+  // Validate input is an array
+  if (!hierarchy || !Array.isArray(hierarchy)) {
+    console.warn("buildFullCTM: hierarchy must be an array");
+    return Matrix.identity(3);
+  }
+
   let ctm = Matrix.identity(3);
 
   for (const item of hierarchy) {
+    if (!item) {
+      continue; // Skip null/undefined items
+    }
+
     if (typeof item === "string") {
       // Backwards compatibility: treat string as transform attribute
       if (item) {
@@ -448,15 +505,24 @@ export function buildFullCTM(hierarchy) {
         ctm = ctm.mul(matrix);
       }
     } else if (item.type === "svg") {
-      // SVG viewport with potential viewBox
-      const viewport = new SVGViewport(
-        item.width,
-        item.height,
-        item.viewBox || null,
-        item.preserveAspectRatio || null,
-        item.transform || null,
-      );
-      ctm = ctm.mul(viewport.getTransformMatrix());
+      // SVG viewport with potential viewBox - validate required properties
+      if (item.width === undefined || item.height === undefined) {
+        console.warn("buildFullCTM: SVG viewport missing width or height");
+        continue;
+      }
+      try {
+        const viewport = new SVGViewport(
+          item.width,
+          item.height,
+          item.viewBox || null,
+          item.preserveAspectRatio || null,
+          item.transform || null,
+        );
+        ctm = ctm.mul(viewport.getTransformMatrix());
+      } catch (err) {
+        console.warn(`buildFullCTM: Failed to create viewport: ${err.message}`);
+        continue;
+      }
     } else if (item.type === "g" || item.type === "element") {
       // Group or element with optional transform
       if (item.transform) {
@@ -520,6 +586,13 @@ export function buildFullCTM(hierarchy) {
 export function resolveLength(value, referenceSize, dpi = 96) {
   const D = (x) => new Decimal(x);
 
+  // Validate dpi parameter
+  let validDpi = dpi;
+  if (typeof validDpi !== "number" || validDpi <= 0 || !isFinite(validDpi)) {
+    console.warn("resolveLength: invalid dpi (must be positive finite number), using default 96");
+    validDpi = 96;
+  }
+
   if (typeof value === "number") {
     return D(value);
   }
@@ -535,6 +608,7 @@ export function resolveLength(value, referenceSize, dpi = 96) {
   // Extract numeric value and unit
   const match = str.match(/^([+-]?[\d.]+(?:e[+-]?\d+)?)(.*)?$/i);
   if (!match) {
+    console.warn(`resolveLength: invalid length value "${value}"`);
     return D(0);
   }
 
@@ -551,15 +625,15 @@ export function resolveLength(value, referenceSize, dpi = 96) {
     case "rem":
       return num.mul(16);
     case "pt":
-      return num.mul(dpi).div(72);
+      return num.mul(validDpi).div(72);
     case "pc":
-      return num.mul(dpi).div(6);
+      return num.mul(validDpi).div(6);
     case "in":
-      return num.mul(dpi);
+      return num.mul(validDpi);
     case "cm":
-      return num.mul(dpi).div(2.54);
+      return num.mul(validDpi).div(2.54);
     case "mm":
-      return num.mul(dpi).div(25.4);
+      return num.mul(validDpi).div(25.4);
     default:
       return num; // Unknown unit, treat as px
   }
@@ -664,10 +738,28 @@ export function objectBoundingBoxTransform(
   bboxWidth,
   bboxHeight,
 ) {
-  const _D = (x) => new Decimal(x);
+  const D = (x) => new Decimal(x);
+
+  const xD = D(bboxX);
+  const yD = D(bboxY);
+  const wD = D(bboxWidth);
+  const hD = D(bboxHeight);
+
+  // Validate all parameters are finite
+  if (!xD.isFinite() || !yD.isFinite() || !wD.isFinite() || !hD.isFinite()) {
+    throw new Error("objectBoundingBoxTransform: all parameters must be finite");
+  }
+
+  // Validate dimensions are positive (zero is technically valid for degenerate case, but warn)
+  if (wD.lte(0) || hD.lte(0)) {
+    console.warn("objectBoundingBoxTransform: zero or negative dimensions create degenerate transform");
+    // Return identity for degenerate case to avoid division by zero
+    return Matrix.identity(3);
+  }
+
   // Transform: scale(bboxWidth, bboxHeight) then translate(bboxX, bboxY)
-  const scaleM = Transforms2D.scale(bboxWidth, bboxHeight);
-  const translateM = Transforms2D.translation(bboxX, bboxY);
+  const scaleM = Transforms2D.scale(wD, hD);
+  const translateM = Transforms2D.translation(xD, yD);
   return translateM.mul(scaleM);
 }
 
@@ -736,6 +828,14 @@ export function ellipseToPath(cx, cy, rx, ry) {
     rxD = D(rx),
     ryD = D(ry);
 
+  // Validate radii are positive
+  if (rxD.lte(0) || ryD.lte(0)) {
+    throw new Error("Ellipse radii must be positive");
+  }
+  if (!rxD.isFinite() || !ryD.isFinite() || !cxD.isFinite() || !cyD.isFinite()) {
+    throw new Error("Ellipse parameters must be finite");
+  }
+
   // Kappa for bezier approximation of circle/ellipse: 4 * (sqrt(2) - 1) / 3
   const kappa = D("0.5522847498307936");
   const kx = rxD.mul(kappa);
@@ -810,9 +910,23 @@ export function rectToPath(x, y, width, height, rx = 0, ry = null) {
     yD = D(y),
     wD = D(width),
     hD = D(height);
+
+  // Validate dimensions are positive
+  if (wD.lte(0) || hD.lte(0)) {
+    throw new Error("Rectangle dimensions must be positive");
+  }
+  if (!wD.isFinite() || !hD.isFinite() || !xD.isFinite() || !yD.isFinite()) {
+    throw new Error("Rectangle parameters must be finite");
+  }
+
   let rxD = D(rx);
   let ryD = ry !== null ? D(ry) : rxD;
 
+  // Validate radii are non-negative
+  if (rxD.lt(0) || ryD.lt(0)) {
+    throw new Error("Rectangle corner radii must be non-negative");
+  }
+
   // Clamp radii to half dimensions
   const halfW = wD.div(2);
   const halfH = hD.div(2);
@@ -857,7 +971,17 @@ export function rectToPath(x, y, width, height, rx = 0, ry = null) {
  */
 export function lineToPath(x1, y1, x2, y2) {
   const D = (n) => new Decimal(n);
-  return `M ${D(x1).toFixed(6)} ${D(y1).toFixed(6)} L ${D(x2).toFixed(6)} ${D(y2).toFixed(6)}`;
+  const x1D = D(x1);
+  const y1D = D(y1);
+  const x2D = D(x2);
+  const y2D = D(y2);
+
+  // Validate all parameters are finite
+  if (!x1D.isFinite() || !y1D.isFinite() || !x2D.isFinite() || !y2D.isFinite()) {
+    throw new Error("lineToPath: all parameters must be finite");
+  }
+
+  return `M ${x1D.toFixed(6)} ${y1D.toFixed(6)} L ${x2D.toFixed(6)} ${y2D.toFixed(6)}`;
 }
 
 /**
@@ -946,17 +1070,39 @@ export function polylineToPath(points) {
  * @returns {Array<[string, string]>} Array of [x, y] coordinate pairs as strings
  */
 function parsePointPairs(points) {
+  // Validate input
+  if (!points) {
+    return [];
+  }
+
   let coords;
-  if (Array.isArray(points)) {
-    coords = points.flat().map((n) => new Decimal(n).toFixed(6));
-  } else {
-    coords = points
-      .trim()
-      .split(/[\s,]+/)
-      .map((s) => new Decimal(s).toFixed(6));
+  try {
+    if (Array.isArray(points)) {
+      coords = points.flat().map((n) => new Decimal(n).toFixed(6));
+    } else if (typeof points === "string") {
+      coords = points
+        .trim()
+        .split(/[\s,]+/)
+        .filter((s) => s.length > 0)
+        .map((s) => new Decimal(s).toFixed(6));
+    } else {
+      console.warn("parsePointPairs: invalid input type");
+      return [];
+    }
+  } catch (err) {
+    console.warn(`parsePointPairs: parse error - ${err.message}`);
+    return [];
+  }
+
+  // Validate even number of coordinates
+  if (coords.length % 2 !== 0) {
+    console.warn("parsePointPairs: odd number of coordinates, ignoring last value");
+    coords = coords.slice(0, -1); // Remove last element to ensure even length
   }
+
   const pairs = [];
-  for (let i = 0; i < coords.length - 1; i += 2) {
+  // Bounds check: i + 1 must be within array
+  for (let i = 0; i + 1 < coords.length; i += 2) {
     pairs.push([coords[i], coords[i + 1]]);
   }
   return pairs;
@@ -1047,6 +1193,40 @@ export function transformArc(
   const D = (n) => new Decimal(n);
   const NEAR_ZERO = D("1e-16");
 
+  // Validate inputs
+  if (!matrix || !matrix.data || !Array.isArray(matrix.data) || matrix.data.length < 3) {
+    throw new Error("transformArc: invalid matrix");
+  }
+
+  const rxD = D(rx);
+  const ryD = D(ry);
+
+  // Validate radii are positive
+  if (rxD.lte(0) || ryD.lte(0)) {
+    console.warn("transformArc: radii must be positive, returning degenerate arc");
+    return {
+      rx: 0,
+      ry: 0,
+      xAxisRotation: 0,
+      largeArcFlag: largeArcFlag,
+      sweepFlag: sweepFlag,
+      x: D(x).toNumber(),
+      y: D(y).toNumber(),
+    };
+  }
+
+  // Validate and normalize flags to 0 or 1
+  let validLargeArcFlag = largeArcFlag;
+  if (typeof validLargeArcFlag !== "number" || (validLargeArcFlag !== 0 && validLargeArcFlag !== 1)) {
+    console.warn(`transformArc: largeArcFlag must be 0 or 1, got ${largeArcFlag}`);
+    validLargeArcFlag = validLargeArcFlag ? 1 : 0;
+  }
+  let validSweepFlag = sweepFlag;
+  if (typeof validSweepFlag !== "number" || (validSweepFlag !== 0 && validSweepFlag !== 1)) {
+    console.warn(`transformArc: sweepFlag must be 0 or 1, got ${sweepFlag}`);
+    validSweepFlag = validSweepFlag ? 1 : 0;
+  }
+
   // Get matrix components
   const a = matrix.data[0][0];
   const b = matrix.data[1][0];
@@ -1066,8 +1246,7 @@ export function transformArc(
   const sinRot = Decimal.sin(rotRad);
   const cosRot = Decimal.cos(rotRad);
 
-  const rxD = D(rx),
-    ryD = D(ry);
+  // rxD and ryD already declared in validation section above
 
   // Transform the ellipse axes using the algorithm from lean-svg
   // m0, m1 represent the transformed X-axis direction of the ellipse
@@ -1132,10 +1311,10 @@ export function transformArc(
 
   // Check if matrix flips orientation (negative determinant)
   const det = a.mul(d).minus(b.mul(c));
-  let newSweepFlag = sweepFlag;
+  let newSweepFlag = validSweepFlag;
   if (det.lt(0)) {
     // Flip sweep direction
-    newSweepFlag = sweepFlag ? 0 : 1;
+    newSweepFlag = validSweepFlag ? 0 : 1;
   }
 
   // Convert rotation back to degrees and normalize to [0, 180)
@@ -1147,7 +1326,7 @@ export function transformArc(
     rx: newRx.toNumber(),
     ry: newRy.toNumber(),
     xAxisRotation: newRotDeg.toNumber(),
-    largeArcFlag: largeArcFlag,
+    largeArcFlag: validLargeArcFlag,
     sweepFlag: newSweepFlag,
     x: newX.toNumber(),
     y: newY.toNumber(),
@@ -1210,28 +1389,42 @@ export function transformArc(
  * // Translation by (50, 50) specified in matrix form
  */
 export function parseTransformFunction(func, args) {
+  // Validate inputs
+  if (!func || typeof func !== "string") {
+    console.warn("parseTransformFunction: invalid function name");
+    return Matrix.identity(3);
+  }
+  if (!args || !Array.isArray(args)) {
+    console.warn("parseTransformFunction: invalid arguments array");
+    return Matrix.identity(3);
+  }
+
   const D = (x) => new Decimal(x);
 
   switch (func.toLowerCase()) {
     case "translate": {
-      const tx = args[0] || 0;
-      const ty = args[1] || 0;
+      const tx = args[0] !== undefined ? args[0] : 0;
+      const ty = args[1] !== undefined ? args[1] : 0;
       return Transforms2D.translation(tx, ty);
     }
 
     case "scale": {
-      const sx = args[0] || 1;
+      const sx = args[0] !== undefined ? args[0] : 1;
       const sy = args[1] !== undefined ? args[1] : sx;
       return Transforms2D.scale(sx, sy);
     }
 
     case "rotate": {
       // SVG rotate is in degrees, can have optional cx, cy
-      const angleDeg = args[0] || 0;
+      const angleDeg = args[0] !== undefined ? args[0] : 0;
       const angleRad = D(angleDeg).mul(D(Math.PI)).div(180);
 
       if (args.length >= 3) {
         // rotate(angle, cx, cy) - rotation around point
+        if (args[1] === undefined || args[2] === undefined) {
+          console.warn("parseTransformFunction: rotate(angle, cx, cy) missing cx or cy");
+          return Transforms2D.rotate(angleRad);
+        }
         const cx = args[1];
         const cy = args[2];
         return Transforms2D.rotateAroundPoint(angleRad, cx, cy);
@@ -1240,14 +1433,14 @@ export function parseTransformFunction(func, args) {
     }
 
     case "skewx": {
-      const angleDeg = args[0] || 0;
+      const angleDeg = args[0] !== undefined ? args[0] : 0;
       const angleRad = D(angleDeg).mul(D(Math.PI)).div(180);
       const tanVal = Decimal.tan(angleRad);
       return Transforms2D.skew(tanVal, 0);
     }
 
     case "skewy": {
-      const angleDeg = args[0] || 0;
+      const angleDeg = args[0] !== undefined ? args[0] : 0;
       const angleRad = D(angleDeg).mul(D(Math.PI)).div(180);
       const tanVal = Decimal.tan(angleRad);
       return Transforms2D.skew(0, tanVal);
@@ -1257,7 +1450,11 @@ export function parseTransformFunction(func, args) {
       // matrix(a, b, c, d, e, f) -> | a c e |
       //                             | b d f |
       //                             | 0 0 1 |
-      const [a, b, c, d, e, f] = args.map((x) => D(x || 0));
+      if (args.length < 6) {
+        console.warn(`parseTransformFunction: matrix() requires 6 arguments, got ${args.length}`);
+        return Matrix.identity(3);
+      }
+      const [a, b, c, d, e, f] = args.slice(0, 6).map((x) => D(x !== undefined ? x : 0));
       return Matrix.from([
         [a, c, e],
         [b, d, f],
@@ -1371,6 +1568,12 @@ export function parseTransformAttribute(transformStr) {
  * // Returns: Identity matrix
  */
 export function buildCTM(transformStack) {
+  // Validate input is an array
+  if (!transformStack || !Array.isArray(transformStack)) {
+    console.warn("buildCTM: transformStack must be an array");
+    return Matrix.identity(3);
+  }
+
   let ctm = Matrix.identity(3);
 
   for (const transformStr of transformStack) {
@@ -1420,6 +1623,23 @@ export function buildCTM(transformStack) {
  * // Point transformed through all operations
  */
 export function applyToPoint(ctm, x, y) {
+  // Validate CTM
+  if (!ctm || !ctm.data || !Array.isArray(ctm.data)) {
+    throw new Error("applyToPoint: invalid CTM matrix");
+  }
+
+  // Validate coordinates are valid numbers
+  const D = (val) => new Decimal(val);
+  try {
+    const xD = D(x);
+    const yD = D(y);
+    if (!xD.isFinite() || !yD.isFinite()) {
+      throw new Error("applyToPoint: coordinates must be finite");
+    }
+  } catch (err) {
+    throw new Error(`applyToPoint: invalid coordinates - ${err.message}`);
+  }
+
   const [tx, ty] = Transforms2D.applyTransform(ctm, x, y);
   return { x: tx, y: ty };
 }
@@ -1466,14 +1686,40 @@ export function applyToPoint(ctm, x, y) {
  * // Returns single matrix() function representing all transforms
  */
 export function toSVGMatrix(ctm, precision = 6) {
-  const a = ctm.data[0][0].toFixed(precision);
-  const b = ctm.data[1][0].toFixed(precision);
-  const c = ctm.data[0][1].toFixed(precision);
-  const d = ctm.data[1][1].toFixed(precision);
-  const e = ctm.data[0][2].toFixed(precision);
-  const f = ctm.data[1][2].toFixed(precision);
-
-  return `matrix(${a}, ${b}, ${c}, ${d}, ${e}, ${f})`;
+  // Validate CTM structure
+  if (
+    !ctm ||
+    !ctm.data ||
+    !Array.isArray(ctm.data) ||
+    ctm.data.length < 3 ||
+    !Array.isArray(ctm.data[0]) ||
+    !Array.isArray(ctm.data[1]) ||
+    ctm.data[0].length < 3 ||
+    ctm.data[1].length < 3
+  ) {
+    throw new Error("toSVGMatrix: invalid CTM matrix structure");
+  }
+
+  // Validate precision
+  let validPrecision = precision;
+  if (typeof validPrecision !== "number" || validPrecision < 0 || validPrecision > 20) {
+    console.warn("toSVGMatrix: invalid precision, using default 6");
+    validPrecision = 6;
+  }
+
+  // Validate matrix elements have toFixed method
+  try {
+    const a = ctm.data[0][0].toFixed(validPrecision);
+    const b = ctm.data[1][0].toFixed(validPrecision);
+    const c = ctm.data[0][1].toFixed(validPrecision);
+    const d = ctm.data[1][1].toFixed(validPrecision);
+    const e = ctm.data[0][2].toFixed(validPrecision);
+    const f = ctm.data[1][2].toFixed(validPrecision);
+
+    return `matrix(${a}, ${b}, ${c}, ${d}, ${e}, ${f})`;
+  } catch (err) {
+    throw new Error(`toSVGMatrix: invalid matrix elements - ${err.message}`);
+  }
 }
 
 /**
@@ -1519,6 +1765,16 @@ export function toSVGMatrix(ctm, precision = 6) {
  * // Returns: false
  */
 export function isIdentity(m, tolerance = "1e-10") {
+  // Validate matrix parameter
+  if (!m || !m.data || !Array.isArray(m.data)) {
+    throw new Error("isIdentity: invalid matrix parameter");
+  }
+
+  // Validate matrix has equals method
+  if (typeof m.equals !== "function") {
+    throw new Error("isIdentity: matrix must have equals method");
+  }
+
   const identity = Matrix.identity(3);
   return m.equals(identity, tolerance);
 }
@@ -1585,11 +1841,31 @@ export function isIdentity(m, tolerance = "1e-10") {
  * // Relative commands preserved in output
  */
 export function transformPathData(pathData, ctm, options = {}) {
+  // Validate inputs
+  if (!pathData || typeof pathData !== "string") {
+    console.warn("transformPathData: invalid pathData (must be string)");
+    return "";
+  }
+  if (!ctm || !ctm.data) {
+    console.warn("transformPathData: invalid CTM matrix");
+    return pathData; // Return unchanged if matrix is invalid
+  }
+
   const { toAbsolute = true, precision = 6 } = options;
+
+  // Validate precision
+  if (typeof precision !== "number" || precision < 0 || precision > 20) {
+    console.warn("transformPathData: invalid precision, using default 6");
+  }
+
   const D = (x) => new Decimal(x);
 
   // Parse path into commands
   const commands = parsePathCommands(pathData);
+  if (commands.length === 0) {
+    return "";
+  }
+
   const result = [];
 
   // Track current position for relative commands
@@ -1605,7 +1881,11 @@ export function transformPathData(pathData, ctm, options = {}) {
     switch (cmdUpper) {
       case "M": {
         const transformed = [];
-        for (let i = 0; i < args.length; i += 2) {
+        // Validate args length is multiple of 2
+        if (args.length % 2 !== 0) {
+          console.warn(`transformPathData: M command has ${args.length} args, expected multiple of 2`);
+        }
+        for (let i = 0; i + 1 < args.length; i += 2) {
           let x = D(args[i]),
             y = D(args[i + 1]);
           if (isRelative) {
@@ -1629,7 +1909,11 @@ export function transformPathData(pathData, ctm, options = {}) {
 
       case "L": {
         const transformed = [];
-        for (let i = 0; i < args.length; i += 2) {
+        // Validate args length is multiple of 2
+        if (args.length % 2 !== 0) {
+          console.warn(`transformPathData: L command has ${args.length} args, expected multiple of 2`);
+        }
+        for (let i = 0; i + 1 < args.length; i += 2) {
           let x = D(args[i]),
             y = D(args[i + 1]);
           if (isRelative) {
@@ -1649,6 +1933,10 @@ export function transformPathData(pathData, ctm, options = {}) {
 
       case "H": {
         // Horizontal line becomes L after transform (may have Y component)
+        if (args.length < 1) {
+          console.warn("transformPathData: H command requires at least 1 argument");
+          break;
+        }
         let x = D(args[0]);
         if (isRelative) {
           x = x.plus(curX);
@@ -1666,6 +1954,10 @@ export function transformPathData(pathData, ctm, options = {}) {
 
       case "V": {
         // Vertical line becomes L after transform (may have X component)
+        if (args.length < 1) {
+          console.warn("transformPathData: V command requires at least 1 argument");
+          break;
+        }
         const x = curX;
         let y = D(args[0]);
         if (isRelative) {
@@ -1683,7 +1975,11 @@ export function transformPathData(pathData, ctm, options = {}) {
 
       case "C": {
         const transformed = [];
-        for (let i = 0; i < args.length; i += 6) {
+        // Validate args length is multiple of 6
+        if (args.length % 6 !== 0) {
+          console.warn(`transformPathData: C command has ${args.length} args, expected multiple of 6`);
+        }
+        for (let i = 0; i + 5 < args.length; i += 6) {
           let x1 = D(args[i]),
             y1 = D(args[i + 1]);
           let x2 = D(args[i + 2]),
@@ -1722,7 +2018,11 @@ export function transformPathData(pathData, ctm, options = {}) {
 
       case "S": {
         const transformed = [];
-        for (let i = 0; i < args.length; i += 4) {
+        // Validate args length is multiple of 4
+        if (args.length % 4 !== 0) {
+          console.warn(`transformPathData: S command has ${args.length} args, expected multiple of 4`);
+        }
+        for (let i = 0; i + 3 < args.length; i += 4) {
           let x2 = D(args[i]),
             y2 = D(args[i + 1]);
           let x = D(args[i + 2]),
@@ -1754,7 +2054,11 @@ export function transformPathData(pathData, ctm, options = {}) {
 
       case "Q": {
         const transformed = [];
-        for (let i = 0; i < args.length; i += 4) {
+        // Validate args length is multiple of 4
+        if (args.length % 4 !== 0) {
+          console.warn(`transformPathData: Q command has ${args.length} args, expected multiple of 4`);
+        }
+        for (let i = 0; i + 3 < args.length; i += 4) {
           let x1 = D(args[i]),
             y1 = D(args[i + 1]);
           let x = D(args[i + 2]),
@@ -1786,7 +2090,11 @@ export function transformPathData(pathData, ctm, options = {}) {
 
       case "T": {
         const transformed = [];
-        for (let i = 0; i < args.length; i += 2) {
+        // Validate args length is multiple of 2
+        if (args.length % 2 !== 0) {
+          console.warn(`transformPathData: T command has ${args.length} args, expected multiple of 2`);
+        }
+        for (let i = 0; i + 1 < args.length; i += 2) {
           let x = D(args[i]),
             y = D(args[i + 1]);
           if (isRelative) {
@@ -1807,7 +2115,11 @@ export function transformPathData(pathData, ctm, options = {}) {
       case "A": {
         // Use proper arc transformation
         const transformed = [];
-        for (let i = 0; i < args.length; i += 7) {
+        // Validate args length is multiple of 7
+        if (args.length % 7 !== 0) {
+          console.warn(`transformPathData: Arc command has ${args.length} args, expected multiple of 7`);
+        }
+        for (let i = 0; i + 6 < args.length; i += 7) {
           const rx = args[i];
           const ry = args[i + 1];
           const rotation = args[i + 2];
@@ -1899,6 +2211,11 @@ export function transformPathData(pathData, ctm, options = {}) {
  * // ]
  */
 function parsePathCommands(pathData) {
+  // Validate input
+  if (!pathData || typeof pathData !== "string") {
+    return [];
+  }
+
   const commands = [];
   const commandRegex = /([MmLlHhVvCcSsQqTtAaZz])([^MmLlHhVvCcSsQqTtAaZz]*)/g;
   let match;
@@ -1911,7 +2228,14 @@ function parsePathCommands(pathData) {
         ? argsStr
             .split(/[\s,]+/)
             .filter((s) => s.length > 0)
-            .map((s) => parseFloat(s))
+            .map((s) => {
+              const val = parseFloat(s);
+              if (isNaN(val)) {
+                console.warn(`parsePathCommands: invalid number '${s}'`);
+                return 0;
+              }
+              return val;
+            })
         : [];
     commands.push({ cmd, args });
   }