@sythos/js_barcode_universal 1.5.10 → 1.5.11

package/README.md

@@ -112,8 +112,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.10"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.10"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.11"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.11"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -670,6 +670,11 @@ zero-dependency at runtime.
 These security workflows report findings and propose maintenance updates. They do not replace
 review of barcode conformance, licensing, patent status or release attestations.
 
+The image I/O boundary treats camera and file rasters as untrusted input. It validates finite
+positive dimensions, bounds allocations to 16,777,216 pixels, accepts only byte-valued channels,
+and snapshots greyscale buffers before decoding. Malformed or oversized rasters are rejected
+before detector work begins.
+
 ---
 
 ## Build provenance and artifact attestations
@@ -696,7 +701,7 @@ attestation confirms build provenance; it is not an ISO barcode-conformance cert
 clearance, or a guarantee that the implementation is vulnerability-free.
 
 Release automation validates the package version against the selected Git tag; it does not invent
-or increment versions by itself. The current release is `1.5.10`.
+or increment versions by itself. The current release is `1.5.11`.
 
 ---
 

package/bundle/sythos-barcode.esm.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.10
+ * Sythos Barcode Suite v1.5.11
  *
  * MIT License
  *
@@ -312,6 +312,41 @@ __modules["js/image/luminance.js"] = function (__require, __exports) {
  * @module image/luminance
  */
 const { NotFoundError } = __require("js/core/errors.js");
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -325,6 +360,10 @@ class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -340,15 +379,14 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
-        }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -373,10 +411,11 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -391,6 +430,9 @@ class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;
@@ -17554,7 +17596,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.10';
+const VERSION = '1.5.11';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/bundle/sythos-barcode.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.10
+ * Sythos Barcode Suite v1.5.11
  *
  * MIT License
  *
@@ -313,6 +313,41 @@ __modules["js/image/luminance.js"] = function (__require, __exports) {
  * @module image/luminance
  */
 const { NotFoundError } = __require("js/core/errors.js");
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -326,6 +361,10 @@ class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -341,15 +380,14 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
-        }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -374,10 +412,11 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -392,6 +431,9 @@ class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;
@@ -17555,7 +17597,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.10';
+const VERSION = '1.5.11';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sythos/js_barcode_universal",
-  "version": "1.5.10",
+  "version": "1.5.11",
   "description": "Read and write barcodes in JavaScript and TypeScript with zero runtime dependencies. TypeScript sources compile to the JavaScript runtime and bundles. QR Code, Micro QR, rMQR, FrameQR Code, Aztec Code and Rune, PDF417 variants, GS1 DataBar Omnidirectional/Truncated, EAN supplements and one-dimensional formats.",
   "author": {
     "name": "Sythos",

package/src/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.10";
+export declare const VERSION = "1.5.11";

package/src/index.js

@@ -779,4 +779,4 @@ export function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-export const VERSION = '1.5.10';
+export const VERSION = '1.5.11';

package/src/js/image/luminance.js

@@ -39,6 +39,41 @@
  * @module image/luminance
  */
 import { NotFoundError } from '../core/errors.js';
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -52,6 +87,10 @@ export class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -67,15 +106,14 @@ export class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
-        }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -100,10 +138,11 @@ export class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -118,6 +157,9 @@ export class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;

package/src/ts/image/luminance.ts

@@ -42,6 +42,49 @@
 
 import { NotFoundError } from '../core/errors.js';
 
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16_384;
+const MAX_IMAGE_PIXELS = 16_777_216;
+
+function validateDimensions(width, height) {
+  if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+    || width < 1 || height < 1
+    || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+    throw new NotFoundError(
+      `Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`
+    );
+  }
+  const pixels = width * height;
+  if (pixels > MAX_IMAGE_PIXELS) {
+    throw new NotFoundError(
+      `Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`
+    );
+  }
+  return pixels;
+}
+
+function isByteArray(data) {
+  return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+
+function validateByteData(data, expected, label) {
+  if (!isByteArray(data) && !Array.isArray(data)) {
+    throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+  }
+  if (!Number.isSafeInteger(data.length) || data.length < expected) {
+    throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+  }
+  if (Array.isArray(data)) {
+    for (let i = 0; i < expected; i++) {
+      const value = data[i];
+      if (!Number.isInteger(value) || value < 0 || value > 255) {
+        throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+      }
+    }
+  }
+}
+
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -56,6 +99,10 @@ export class LuminanceSource {
    * @param {number} height
    */
   constructor(grey, width, height) {
+    const pixels = validateDimensions(width, height);
+    if (!isByteArray(grey) || grey.length < pixels) {
+      throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+    }
     this.grey = grey;
     this.width = width;
     this.height = height;
@@ -72,18 +119,15 @@ export class LuminanceSource {
    * @returns {LuminanceSource}
    */
   static fromImageData(image) {
-    const { data, width, height } = image;
-    if (!data || !width || !height) {
-      throw new NotFoundError('Image must be { data, width, height } with RGBA data');
-    }
-    if (data.length < width * height * 4) {
-      throw new NotFoundError(
-        `Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-        `(expected ${width * height * 4})`
-      );
+    if (!image || typeof image !== 'object') {
+      throw new NotFoundError('Image must be an object with RGBA data');
     }
+    const { data, width, height } = image;
+    const pixels = validateDimensions(width, height);
+    const expected = pixels * 4;
+    validateByteData(data, expected, 'Image data');
 
-    const grey = new Uint8Array(width * height);
+    const grey = new Uint8Array(pixels);
     for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
       const a = data[p + 3];
       let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -109,10 +153,11 @@ export class LuminanceSource {
    * @returns {LuminanceSource}
    */
   static fromGrey(grey, width, height) {
-    if (grey.length < width * height) {
-      throw new NotFoundError('Greyscale buffer shorter than width * height');
-    }
-    return new LuminanceSource(grey, width, height);
+    const pixels = validateDimensions(width, height);
+    validateByteData(grey, pixels, 'Greyscale buffer');
+    // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+    const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+    return new LuminanceSource(copy, width, height);
   }
 
   /**
@@ -129,6 +174,9 @@ export class LuminanceSource {
    * @returns {Uint8Array}
    */
   getRow(y, out) {
+    if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+      throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+    }
     const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
     row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
     return row;

package/src/ts/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.10";
+export declare const VERSION = "1.5.11";

package/src/ts/index.ts

@@ -787,4 +787,4 @@ export function decodeStrict(image, options) {
 }
 
 /** Library version, matching package.json. */
-export const VERSION = '1.5.10';
+export const VERSION = '1.5.11';