@sythos/js_barcode_universal 1.5.10 → 1.5.12

package/README.md

@@ -112,8 +112,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.10"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.10"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.12"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.12"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -670,6 +670,29 @@ zero-dependency at runtime.
 These security workflows report findings and propose maintenance updates. They do not replace
 review of barcode conformance, licensing, patent status or release attestations.
 
+Security reports follow the [security policy](SECURITY.md). Please use GitHub's private reporting
+channel for every suspected vulnerability; public Issues are for non-security bugs after security
+impact has been ruled out. Reports involving code execution, data or secret exposure, CI/release/npm
+integrity or host/runner compromise should also be sent to `devsec@sythos.net`. Exploit details are
+better kept private than turned into an accidental community fireworks show.
+
+The image I/O boundary treats camera and file rasters as untrusted input. It validates finite
+positive dimensions, bounds allocations to 16,777,216 pixels — still a high limit, roughly twice
+the pixel count of a standard 4K image — and accepts only byte-valued channels,
+and snapshots greyscale buffers before decoding. Malformed or oversized rasters are rejected
+before detector work begins.
+
+Rendering applies the same allocation discipline before creating an SVG, PNG, `ImageData`, canvas,
+WebGL or WebGPU output. Matrix dimensions, `scale`, `margin` and `barHeight` must be safe integers
+within documented bounds, and the final image must be no larger than 16,384 pixels on either side
+or 16,777,216 pixels in total. Invalid, fractional or oversized values are rejected with
+`RangeError`; callers that expose rendering controls should handle that result rather than silently
+coercing it.
+
+The browser examples treat decoded payloads and browser error messages as text. They create DOM
+nodes and set `textContent` instead of interpolating those values into HTML, so scanned content is
+not interpreted as markup.
+
 ---
 
 ## Build provenance and artifact attestations
@@ -683,6 +706,15 @@ Attestations are related but separate records:
 - **GitHub Artifact Attestations** bind a build artifact, its digest and its build context to the
   GitHub Actions workflow that produced it. They can be verified independently of the npm registry.
 
+Every third-party GitHub Action referenced by the repository workflows is pinned to its immutable
+commit SHA. Dependabot tracks the action references, but an update is still reviewed and then
+records a new explicit SHA rather than relying on a movable tag.
+
+The development toolchain is also reproducible: `package-lock.json` records the resolved packages,
+TypeScript is declared at an exact version, and the pull-request and release validation workflows
+install the lockfile with `npm ci --ignore-scripts`. The published SDK remains free of runtime
+dependencies.
+
 The release-specific attestation workflow is expected at
 [`.github/workflows/release.yml`](.github/workflows/release.yml). Release assets must be verified
 against this repository and their exact local file contents:
@@ -696,7 +728,7 @@ attestation confirms build provenance; it is not an ISO barcode-conformance cert
 clearance, or a guarantee that the implementation is vulnerability-free.
 
 Release automation validates the package version against the selected Git tag; it does not invent
-or increment versions by itself. The current release is `1.5.10`.
+or increment versions by itself. The current release is `1.5.12`.
 
 ---
 

package/bundle/sythos-barcode.esm.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.10
+ * Sythos Barcode Suite v1.5.12
  *
  * MIT License
  *
@@ -312,6 +312,41 @@ __modules["js/image/luminance.js"] = function (__require, __exports) {
  * @module image/luminance
  */
 const { NotFoundError } = __require("js/core/errors.js");
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -325,6 +360,10 @@ class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -340,15 +379,14 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
-        }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -373,10 +411,11 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -391,6 +430,9 @@ class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;
@@ -17554,7 +17596,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.10';
+const VERSION = '1.5.12';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/bundle/sythos-barcode.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.10
+ * Sythos Barcode Suite v1.5.12
  *
  * MIT License
  *
@@ -313,6 +313,41 @@ __modules["js/image/luminance.js"] = function (__require, __exports) {
  * @module image/luminance
  */
 const { NotFoundError } = __require("js/core/errors.js");
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -326,6 +361,10 @@ class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -341,15 +380,14 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
-        }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -374,10 +412,11 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -392,6 +431,9 @@ class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;
@@ -17555,7 +17597,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.10';
+const VERSION = '1.5.12';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/examples/read.html

@@ -149,7 +149,7 @@
 
   function show(hits, source) {
     if (!hits.length) return false;
-    results.innerHTML = '';
+    results.textContent = '';
     hits.forEach(function (h) {
       var div = document.createElement('div');
       div.className = 'hit';
@@ -243,7 +243,11 @@
       el('fileStatus').textContent =
         w + '×' + h + ' · ' + ms.toFixed(0) + ' ms · ' + hits.length + ' found';
       if (!show(hits, 'image')) {
-        results.innerHTML = '<div class="status">No barcode found in that image.</div>';
+        results.textContent = '';
+        var status = document.createElement('div');
+        status.className = 'status';
+        status.textContent = 'No barcode found in that image.';
+        results.appendChild(status);
       }
     };
     img.onerror = function () {
@@ -259,20 +263,44 @@
   var stream = null;
   var raf = null;
 
+  function setCameraNoteNode(note) {
+    var container = el('camNote');
+    container.textContent = '';
+    container.appendChild(note);
+  }
+
+  function setCameraNote(text) {
+    var note = document.createElement('div');
+    note.className = 'note';
+    note.textContent = text;
+    setCameraNoteNode(note);
+  }
+
+  function appendNoteCode(note, text) {
+    var code = document.createElement('code');
+    code.textContent = text;
+    note.appendChild(code);
+  }
+
   var secure = window.isSecureContext ||
     location.protocol === 'https:' ||
     location.hostname === 'localhost';
 
   if (!secure) {
-    el('camNote').innerHTML =
-      '<div class="note">The camera needs a secure context, so it is unavailable ' +
-      'when this page is opened from <code>file://</code>. Serve the folder over ' +
-      'http and reload &mdash; for example <code>npx serve</code> &mdash; or use ' +
-      'the image input above, which works anywhere.</div>';
+    var secureNote = document.createElement('div');
+    secureNote.className = 'note';
+    secureNote.appendChild(document.createTextNode(
+      'The camera needs a secure context, so it is unavailable when this page is opened from '));
+    appendNoteCode(secureNote, 'file://');
+    secureNote.appendChild(document.createTextNode(
+      '. Serve the folder over http and reload — for example '));
+    appendNoteCode(secureNote, 'npx serve');
+    secureNote.appendChild(document.createTextNode(
+      ' — or use the image input above, which works anywhere.'));
+    setCameraNoteNode(secureNote);
     el('camStart').disabled = true;
   } else if (!navigator.mediaDevices || !navigator.mediaDevices.getUserMedia) {
-    el('camNote').innerHTML =
-      '<div class="note">This browser does not expose a camera API.</div>';
+    setCameraNote('This browser does not expose a camera API.');
     el('camStart').disabled = true;
   }
 
@@ -292,8 +320,7 @@
     }).then(function () {
       loop();
     }).catch(function (e) {
-      el('camNote').innerHTML =
-        '<div class="note">Camera unavailable: ' + String(e.message || e) + '</div>';
+      setCameraNote('Camera unavailable: ' + String(e.message || e));
     });
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sythos/js_barcode_universal",
-  "version": "1.5.10",
+  "version": "1.5.12",
   "description": "Read and write barcodes in JavaScript and TypeScript with zero runtime dependencies. TypeScript sources compile to the JavaScript runtime and bundles. QR Code, Micro QR, rMQR, FrameQR Code, Aztec Code and Rune, PDF417 variants, GS1 DataBar Omnidirectional/Truncated, EAN supplements and one-dimensional formats.",
   "author": {
     "name": "Sythos",
@@ -191,6 +191,6 @@
     "types:api": "node tools/check-public-types.mjs"
   },
   "devDependencies": {
-    "typescript": "^7.0.2"
+    "typescript": "7.0.2"
   }
 }

package/src/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.10";
+export declare const VERSION = "1.5.12";

package/src/index.js

@@ -779,4 +779,4 @@ export function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-export const VERSION = '1.5.10';
+export const VERSION = '1.5.12';

package/src/js/image/luminance.js

@@ -39,6 +39,41 @@
  * @module image/luminance
  */
 import { NotFoundError } from '../core/errors.js';
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -52,6 +87,10 @@ export class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -67,15 +106,14 @@ export class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
-        }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -100,10 +138,11 @@ export class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -118,6 +157,9 @@ export class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;

package/src/js/render/options.js

@@ -41,6 +41,40 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @property {string} [light] Colour of clear modules, or 'none' for transparent.
  * @property {number} [barHeight] For 1D symbols: total bar height in pixels.
  */
+// Keep renderer allocations aligned with the image decoder's resource limits.
+const MAX_RENDER_DIMENSION = 16384;
+const MAX_RENDER_PIXELS = 16777216;
+const MAX_RENDER_SCALE = MAX_RENDER_DIMENSION;
+const MAX_RENDER_MARGIN = Math.floor((MAX_RENDER_DIMENSION - 1) / 2);
+const MAX_RENDER_BAR_HEIGHT = MAX_RENDER_DIMENSION;
+function boundedInteger(value, name, defaultValue, minimum, maximum) {
+    const resolved = value ?? defaultValue;
+    if (!Number.isSafeInteger(resolved)) {
+        throw new RangeError(`Render option "${name}" must be a finite safe integer between ${minimum} and ${maximum}, got ${resolved}`);
+    }
+    if (resolved < minimum || resolved > maximum) {
+        throw new RangeError(`Render option "${name}" must be between ${minimum} and ${maximum}, got ${resolved}`);
+    }
+    return resolved;
+}
+function validateMatrixDimensions(matrix) {
+    if (!matrix || !Number.isSafeInteger(matrix.width) || !Number.isSafeInteger(matrix.height)
+        || matrix.width < 1 || matrix.height < 1
+        || matrix.width > MAX_RENDER_DIMENSION || matrix.height > MAX_RENDER_DIMENSION) {
+        throw new RangeError(`Render matrix dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`);
+    }
+}
+function validatePixelDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_RENDER_DIMENSION || height > MAX_RENDER_DIMENSION) {
+        throw new RangeError(`Render dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (!Number.isSafeInteger(pixels) || pixels > MAX_RENDER_PIXELS) {
+        throw new RangeError(`Render image contains too many pixels: ${pixels} (maximum ${MAX_RENDER_PIXELS})`);
+    }
+}
 /**
  * Expand and pad the matrix, and resolve every dimension.
  *
@@ -53,18 +87,26 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @param {RenderOptions} options
  */
 export function normalizeOptions(matrix, options = {}) {
-    const scale = Math.max(1, Math.floor(options.scale ?? 8));
-    const margin = Math.max(0, Math.floor(options.margin ?? 4));
+    validateMatrixDimensions(matrix);
+    const scale = boundedInteger(options.scale, 'scale', 8, 1, MAX_RENDER_SCALE);
+    const margin = boundedInteger(options.margin, 'margin', 4, 0, MAX_RENDER_MARGIN);
     const dark = options.dark ?? '#000000';
     const light = options.light ?? '#ffffff';
-    const barHeight = options.barHeight ?? null;
-    let base = matrix;
+    const barHeight = options.barHeight == null
+        ? null
+        : boundedInteger(options.barHeight, 'barHeight', 1, 1, MAX_RENDER_BAR_HEIGHT);
     const is1D = matrix.height === 1;
+    const targetPixels = is1D
+        ? barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15))
+        : null;
+    const rows = is1D ? Math.max(1, Math.round(targetPixels / scale)) : matrix.height;
+    const sourceWidth = matrix.width + margin * 2;
+    const sourceHeight = rows + margin * 2;
+    validatePixelDimensions(sourceWidth * scale, sourceHeight * scale);
+    let base = matrix;
     if (is1D) {
         // Default to a bar height that stays scannable: tall enough that a laser
         // crossing at a slight angle still passes through the whole symbol.
-        const targetPixels = barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15));
-        const rows = Math.max(1, Math.round(targetPixels / scale));
         base = new BitMatrix(matrix.width, rows);
         for (let x = 0; x < matrix.width; x++) {
             if (!matrix.get(x, 0))

package/src/ts/image/luminance.ts

@@ -42,6 +42,49 @@
 
 import { NotFoundError } from '../core/errors.js';
 
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16_384;
+const MAX_IMAGE_PIXELS = 16_777_216;
+
+function validateDimensions(width, height) {
+  if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+    || width < 1 || height < 1
+    || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+    throw new NotFoundError(
+      `Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`
+    );
+  }
+  const pixels = width * height;
+  if (pixels > MAX_IMAGE_PIXELS) {
+    throw new NotFoundError(
+      `Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`
+    );
+  }
+  return pixels;
+}
+
+function isByteArray(data) {
+  return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+
+function validateByteData(data, expected, label) {
+  if (!isByteArray(data) && !Array.isArray(data)) {
+    throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+  }
+  if (!Number.isSafeInteger(data.length) || data.length < expected) {
+    throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+  }
+  if (Array.isArray(data)) {
+    for (let i = 0; i < expected; i++) {
+      const value = data[i];
+      if (!Number.isInteger(value) || value < 0 || value > 255) {
+        throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+      }
+    }
+  }
+}
+
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -56,6 +99,10 @@ export class LuminanceSource {
    * @param {number} height
    */
   constructor(grey, width, height) {
+    const pixels = validateDimensions(width, height);
+    if (!isByteArray(grey) || grey.length < pixels) {
+      throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+    }
     this.grey = grey;
     this.width = width;
     this.height = height;
@@ -72,18 +119,15 @@ export class LuminanceSource {
    * @returns {LuminanceSource}
    */
   static fromImageData(image) {
-    const { data, width, height } = image;
-    if (!data || !width || !height) {
-      throw new NotFoundError('Image must be { data, width, height } with RGBA data');
-    }
-    if (data.length < width * height * 4) {
-      throw new NotFoundError(
-        `Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-        `(expected ${width * height * 4})`
-      );
+    if (!image || typeof image !== 'object') {
+      throw new NotFoundError('Image must be an object with RGBA data');
     }
+    const { data, width, height } = image;
+    const pixels = validateDimensions(width, height);
+    const expected = pixels * 4;
+    validateByteData(data, expected, 'Image data');
 
-    const grey = new Uint8Array(width * height);
+    const grey = new Uint8Array(pixels);
     for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
       const a = data[p + 3];
       let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -109,10 +153,11 @@ export class LuminanceSource {
    * @returns {LuminanceSource}
    */
   static fromGrey(grey, width, height) {
-    if (grey.length < width * height) {
-      throw new NotFoundError('Greyscale buffer shorter than width * height');
-    }
-    return new LuminanceSource(grey, width, height);
+    const pixels = validateDimensions(width, height);
+    validateByteData(grey, pixels, 'Greyscale buffer');
+    // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+    const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+    return new LuminanceSource(copy, width, height);
   }
 
   /**
@@ -129,6 +174,9 @@ export class LuminanceSource {
    * @returns {Uint8Array}
    */
   getRow(y, out) {
+    if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+      throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+    }
     const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
     row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
     return row;

package/src/ts/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.10";
+export declare const VERSION = "1.5.12";

package/src/ts/index.ts

@@ -787,4 +787,4 @@ export function decodeStrict(image, options) {
 }
 
 /** Library version, matching package.json. */
-export const VERSION = '1.5.10';
+export const VERSION = '1.5.12';

package/src/ts/render/options.ts

@@ -45,6 +45,54 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @property {number} [barHeight] For 1D symbols: total bar height in pixels.
  */
 
+// Keep renderer allocations aligned with the image decoder's resource limits.
+const MAX_RENDER_DIMENSION = 16_384;
+const MAX_RENDER_PIXELS = 16_777_216;
+const MAX_RENDER_SCALE = MAX_RENDER_DIMENSION;
+const MAX_RENDER_MARGIN = Math.floor((MAX_RENDER_DIMENSION - 1) / 2);
+const MAX_RENDER_BAR_HEIGHT = MAX_RENDER_DIMENSION;
+
+function boundedInteger(value, name, defaultValue, minimum, maximum) {
+  const resolved = value ?? defaultValue;
+  if (!Number.isSafeInteger(resolved)) {
+    throw new RangeError(
+      `Render option "${name}" must be a finite safe integer between ${minimum} and ${maximum}, got ${resolved}`
+    );
+  }
+  if (resolved < minimum || resolved > maximum) {
+    throw new RangeError(
+      `Render option "${name}" must be between ${minimum} and ${maximum}, got ${resolved}`
+    );
+  }
+  return resolved;
+}
+
+function validateMatrixDimensions(matrix) {
+  if (!matrix || !Number.isSafeInteger(matrix.width) || !Number.isSafeInteger(matrix.height)
+    || matrix.width < 1 || matrix.height < 1
+    || matrix.width > MAX_RENDER_DIMENSION || matrix.height > MAX_RENDER_DIMENSION) {
+    throw new RangeError(
+      `Render matrix dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`
+    );
+  }
+}
+
+function validatePixelDimensions(width, height) {
+  if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+    || width < 1 || height < 1
+    || width > MAX_RENDER_DIMENSION || height > MAX_RENDER_DIMENSION) {
+    throw new RangeError(
+      `Render dimensions must be positive safe integers no larger than ${MAX_RENDER_DIMENSION}`
+    );
+  }
+  const pixels = width * height;
+  if (!Number.isSafeInteger(pixels) || pixels > MAX_RENDER_PIXELS) {
+    throw new RangeError(
+      `Render image contains too many pixels: ${pixels} (maximum ${MAX_RENDER_PIXELS})`
+    );
+  }
+}
+
 /**
  * Expand and pad the matrix, and resolve every dimension.
  *
@@ -57,20 +105,29 @@ import { BitMatrix } from '../core/bit-matrix.js';
  * @param {RenderOptions} options
  */
 export function normalizeOptions(matrix, options = {}) {
-  const scale = Math.max(1, Math.floor(options.scale ?? 8));
-  const margin = Math.max(0, Math.floor(options.margin ?? 4));
+  validateMatrixDimensions(matrix);
+  const scale = boundedInteger(options.scale, 'scale', 8, 1, MAX_RENDER_SCALE);
+  const margin = boundedInteger(options.margin, 'margin', 4, 0, MAX_RENDER_MARGIN);
   const dark = options.dark ?? '#000000';
   const light = options.light ?? '#ffffff';
-  const barHeight = options.barHeight ?? null;
+  const barHeight = options.barHeight == null
+    ? null
+    : boundedInteger(options.barHeight, 'barHeight', 1, 1, MAX_RENDER_BAR_HEIGHT);
 
-  let base = matrix;
   const is1D = matrix.height === 1;
+  const targetPixels = is1D
+    ? barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15))
+    : null;
+  const rows = is1D ? Math.max(1, Math.round(targetPixels / scale)) : matrix.height;
+  const sourceWidth = matrix.width + margin * 2;
+  const sourceHeight = rows + margin * 2;
+  validatePixelDimensions(sourceWidth * scale, sourceHeight * scale);
+
+  let base = matrix;
 
   if (is1D) {
     // Default to a bar height that stays scannable: tall enough that a laser
     // crossing at a slight angle still passes through the whole symbol.
-    const targetPixels = barHeight ?? Math.max(40, Math.round(matrix.width * scale * 0.15));
-    const rows = Math.max(1, Math.round(targetPixels / scale));
     base = new BitMatrix(matrix.width, rows);
     for (let x = 0; x < matrix.width; x++) {
       if (!matrix.get(x, 0)) continue;