@trkyshorty/node-lzf 1.3.0 → 2.0.0

package/CHANGELOG.md

@@ -0,0 +1,100 @@
+# Changelog
+
+All notable changes to `@trkyshorty/node-lzf` are listed here. Versions follow
+[Semantic Versioning](https://semver.org/).
+
+## 2.0.0
+
+### Breaking
+
+- Requires Node.js 20 or later (Node.js 18 is end-of-life).
+- Empty input no longer throws: `compress` returns an empty Buffer and an empty
+  stream decompresses to an empty Buffer. Code that relied on the
+  `Input buffer must not be empty` `TypeError` to reject empty data has to
+  check the length itself.
+- Input larger than 1 GiB throws `RangeError` (`ERR_OUT_OF_RANGE`) instead of
+  `TypeError`.
+- Argument error messages were reworded; match on the new `code` property
+  instead of the message. The decompression messages still contain
+  `corrupted input` and `expected length too small`.
+
+### Fixed
+
+- `compressAsync`/`decompressAsync` no longer read the caller's memory from the
+  worker thread. Detaching the input's `ArrayBuffer` during the call
+  (`transfer()`, `postMessage`) returned wrong data or crashed the process with
+  a use-after-free, and changing the input before the promise settled leaked
+  into the result. The input is now copied before the call returns.
+- A `DataView` input threw an uncatchable error and aborted the process; it is
+  now rejected with a `TypeError`.
+- `decompress` with `expectedLength` set to `Infinity` or a huge number relied
+  on undefined behavior in C++; it is now range-checked before conversion.
+- The compressor could read out of bounds on Windows ARM64 (32-bit offset
+  type), and its unaligned 16-bit load was undefined behavior on x86 with
+  gcc/clang.
+- Compressing a 1-byte input read one byte past the end of the input (an
+  upstream liblzf bug found by AddressSanitizer).
+
+### Added
+
+- Every error has a stable `code` property (`ERR_INVALID_ARG_TYPE`,
+  `ERR_OUT_OF_RANGE`, `ERR_LZF_OUTPUT_TOO_SMALL`, `ERR_LZF_CORRUPTED_INPUT`,
+  `ERR_LZF_ALLOCATION_FAILED`, `ERR_LZF_COMPRESSION_FAILED`). The type
+  definitions export `ErrorCode` and `LzfError`.
+- `expectedLength` may be `0`, for an empty stream.
+- Any TypedArray (`Float64Array`, `Int16Array`, `Float16Array`, ...) is
+  accepted and read as its raw bytes; the type definitions accept
+  `NodeJS.TypedArray`.
+- Prebuilt binaries for Windows arm64, macOS x64 and Alpine Linux (musl) x64.
+  Linux prebuilds are tagged with their libc.
+
+### Changed
+
+- `decompress` allocates at most 88× the input size, the largest expansion an
+  LZF stream can encode, so an untrusted `expectedLength` cannot make a small
+  input allocate up to 1 GiB. A corrupted stream that would exceed this cap
+  now reports `ERR_LZF_CORRUPTED_INPUT` rather than `ERR_LZF_OUTPUT_TOO_SMALL`.
+- `compressAsync`/`decompressAsync` copy their input (see Fixed), so each call
+  in flight holds an extra copy of the input until it settles.
+
+## 1.3.1 - 2026-09-11
+
+### Changed
+
+- A local `npm publish` is refused; releases are published by the CI workflow
+  only, so stale local prebuilds cannot reach the registry.
+
+## 1.3.0 - 2026-09-11
+
+### Changed
+
+- Releases are published to npm automatically by CI when the package version
+  changes, using npm trusted publishing with provenance.
+
+## 1.2.0 - 2026-09-11
+
+### Added
+
+- TypeScript usage example in the README.
+
+### Changed
+
+- Vendored liblzf builds without compiler warnings.
+
+## 1.1.0 - 2026-07-22
+
+First release as `@trkyshorty/node-lzf`.
+
+### Added
+
+- N-API addon with prebuilt binaries for linux-x64, linux-arm64, win32-x64 and
+  darwin-arm64.
+- `compressAsync` and `decompressAsync`, running on the libuv thread pool.
+- Type definitions, a complete test suite and a benchmark against zlib.
+
+### Changed
+
+- **Breaking:** `decompress` requires `expectedLength` (1 byte to 1 GiB).
+  Omitting it used to allocate a 999 MB buffer on every call. This should have
+  been a major version.
+- Arguments are validated strictly; corrupted input throws instead of crashing.

package/LICENSE

@@ -27,6 +27,31 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ----------------------------------------------------------------------------
 
-This package bundles liblzf by Marc Alexander Lehmann (src/lzf/), which is
-distributed under the BSD 2-Clause license (or alternatively the GPL v2 or
-later). See the license headers in src/lzf/*.h and src/lzf/*.cc for details.
+This package bundles a modified copy of liblzf (src/lzf/), which is compiled
+into the native addon and the prebuilt binaries. node-lzf uses liblzf under
+the BSD 2-Clause terms below; the original files also offer the GPL v2 or
+later as an alternative. Changes made by node-lzf are marked with
+"node-lzf:" comments in the source files.
+
+Copyright (c) 2000-2010 Marc Alexander Lehmann <schmorp@schmorp.de>
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
+EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -1,38 +1,41 @@
-## node-lzf
+# node-lzf
 
-[LZF](http://oldhome.schmorp.de/marc/liblzf.html) compression library for nodejs.
+[![npm version](https://img.shields.io/npm/v/@trkyshorty/node-lzf.svg)](https://www.npmjs.com/package/@trkyshorty/node-lzf)
+[![prebuild](https://github.com/trkyshorty/node-lzf/actions/workflows/prebuild.yml/badge.svg?branch=master)](https://github.com/trkyshorty/node-lzf/actions/workflows/prebuild.yml)
+[![node](https://img.shields.io/node/v/@trkyshorty/node-lzf.svg)](https://nodejs.org)
+[![license](https://img.shields.io/npm/l/@trkyshorty/node-lzf.svg)](LICENSE)
+
+[LZF](https://software.schmorp.de/pkg/liblzf.html) compression library for Node.js.
 
 LZF advantages:
 
-- Small code size (less then 500 lines including header files and docs).
-- Very fast compression speeds, rivaling a straight copy loop, especially for decompression which is basically at (unoptimized) memcpy-speed. Compression speed can be increased by 20% by sacrificing a few percent of compression ratio.
-- Mediocre compression ratios - you can usually expect about 40-50% compression for typical binary data
-- Easy to use (just two functions, no state attached)
-- Highly portable (written in C)
-- Tunable, see the file lzfP.h in the distribution, to tailor liblzf to your needs. The generated compressed blocks can be decompressed by any liblzf version regardless of the options used to compress.
-- Freely usable (BSD-type-license)
+- Very fast compression speeds, rivaling a straight copy loop, especially for decompression which is basically at (unoptimized) memcpy-speed.
+- Mediocre compression ratios - you can usually expect about 40-50% compression for typical binary data.
+- Easy to use (just compress and decompress, no state attached).
+- Any liblzf build decodes the output, whatever options it was compressed with.
+- Freely usable (BSD-type license).
 
-### Install
+## Install
 
 ```bash
 npm install @trkyshorty/node-lzf
 ```
 
-The module is N-API based and ships prebuilt binaries (`prebuilds/`) for
-linux-x64, linux-arm64, win32-x64 and darwin-arm64 — no compiler toolchain
-is needed on those platforms. On other platforms it falls back to compiling
-from source via `node-gyp-build` (requires a C++ toolchain).
+Requires Node.js 20 or later. The module is N-API based and ships prebuilt
+binaries (`prebuilds/`) for these platforms, so no compiler toolchain is
+needed on them:
+
+| OS      | Architectures                         |
+| ------- | ------------------------------------- |
+| Linux   | x64, arm64 (glibc); x64 (musl/Alpine) |
+| Windows | x64, arm64                            |
+| macOS   | arm64, x64                            |
 
-Prebuilds are produced by the `prebuild` GitHub Actions workflow
-(`npm run prebuild` runs `prebuildify --napi --strip` for the current
-platform). Releases are fully automatic: bump `version` in `package.json`
-and push to `master`. If that version is not on npm yet, the workflow builds
-and tests every platform, publishes the package with the merged `prebuilds/`
-via npm trusted publishing (with provenance) and tags the commit
-`v<version>`. Pushes that keep the version publish nothing; a manual run
-always builds and tests.
+On any other platform (Alpine on arm64, for example) it falls back to
+compiling from source via `node-gyp-build`, which requires a C++ toolchain
+and Python.
 
-### Usage
+## Usage
 
 ```javascript
 const lzf = require('@trkyshorty/node-lzf');
@@ -48,7 +51,11 @@ const compressed2 = await lzf.compressAsync(data);
 const restored2 = await lzf.decompressAsync(compressed2, data.length);
 ```
 
-#### TypeScript
+LZF streams do not store the original size, so store `data.length` next to
+the compressed bytes (a length prefix in your framing, for example) and pass
+it back to `decompress`.
+
+### TypeScript
 
 Type definitions are bundled, no `@types` package is needed. The module is
 CommonJS (`export =`), so import it as a namespace — or as a default import
@@ -70,46 +77,77 @@ async function roundtrip(input: Buffer): Promise<Buffer> {
     const packed = await lzf.compressAsync(input);
     return lzf.decompressAsync(packed, input.length);
 }
+
+// errors carry a typed code
+try {
+    lzf.decompress(compressed, 1);
+} catch (err) {
+    if ((err as lzf.LzfError).code === 'ERR_LZF_OUTPUT_TOO_SMALL') {
+        // ...
+    }
+}
 ```
 
-### API
+## API
+
+Every function accepts a `Buffer` or any other TypedArray (`Uint8Array`,
+`Float64Array`, ...), read as its raw bytes, and always returns a `Buffer`.
+`DataView` and `ArrayBuffer` are rejected; wrap an `ArrayBuffer` in a
+`Uint8Array` first. Inputs are limited to 1 GiB.
 
-TypeScript definitions are bundled (`index.d.ts`).
+### `compress(data): Buffer`
 
-#### `compress(data: Buffer): Buffer`
+Returns an LZF-compressed Buffer sized exactly to the result. An empty input
+returns an empty Buffer. Incompressible input can grow slightly (up to
+~104%).
 
-Returns an LZF-compressed Buffer sized exactly to the result. Throws
-`TypeError` if `data` is not a Buffer, is empty, or exceeds 1 GiB.
-Note: incompressible input can grow slightly (up to ~104%).
+### `decompress(data, expectedLength): Buffer`
 
-#### `decompress(data: Buffer, expectedLength: number): Buffer`
+Returns the decompressed Buffer. `expectedLength` is **required**: pass the
+exact decompressed size, or an upper bound — the result is shrunk to the
+actual size. It must be an integer between 0 and 1 GiB. An empty input
+returns an empty Buffer.
 
-Returns the decompressed Buffer. `expectedLength` is **required** — pass the
-exact decompressed size (or an upper bound); the result is shrunk to the
-actual size. Throws `TypeError`/`RangeError` for invalid arguments
-(`expectedLength` must be an integer between 1 and 1 GiB) and `Error` with
-a descriptive message when the input is corrupted (`corrupted input`) or
-`expectedLength` is too small (`expected length too small`). The
-decompressor is safe on untrusted input: corrupt streams throw instead of
-reading or writing out of bounds.
+The decompressor is safe on untrusted input: a corrupted stream throws
+instead of reading or writing out of bounds. The output allocation never
+exceeds 88× the input size (the largest expansion an LZF stream can encode),
+however large `expectedLength` is. Still check `expectedLength` against a
+limit that fits your application when it comes from an untrusted source.
 
 > **v1.1.0 note:** older versions allowed omitting `expectedLength` and
 > silently allocated a 999 MB scratch buffer per call — that default has
 > been removed.
 
-#### `compressAsync(data: Buffer): Promise<Buffer>` / `decompressAsync(data: Buffer, expectedLength: number): Promise<Buffer>`
+### `compressAsync(data): Promise<Buffer>` / `decompressAsync(data, expectedLength): Promise<Buffer>`
 
 Same semantics as the sync variants, but the (de)compression runs on the
 libuv thread pool and the returned promise rejects with the errors the sync
-variants would throw. Prefer these for payloads larger than a few hundred
-KB on latency-sensitive servers.
+variants would throw. The input is copied before the call returns, so it may
+be modified, reused or transferred right away. Prefer these for payloads
+larger than a few hundred KB on latency-sensitive servers.
 
-Compressed output is a valid LZF stream decodable by any liblzf build.
-The exact compressed bytes are not guaranteed to be identical across calls
+### Errors
+
+Every error has a stable `code` property; match on it rather than on the
+message.
+
+| `code`                       | Class        | Cause                                                                   |
+| ---------------------------- | ------------ | ----------------------------------------------------------------------- |
+| `ERR_INVALID_ARG_TYPE`       | `TypeError`  | `data` is not a TypedArray, or `expectedLength` is not a number         |
+| `ERR_OUT_OF_RANGE`           | `RangeError` | `data` exceeds 1 GiB, or `expectedLength` is not an integer in 0..1 GiB |
+| `ERR_LZF_OUTPUT_TOO_SMALL`   | `Error`      | the decompressed data does not fit in `expectedLength` bytes            |
+| `ERR_LZF_CORRUPTED_INPUT`    | `Error`      | the input is not a valid LZF stream                                     |
+| `ERR_LZF_ALLOCATION_FAILED`  | `Error`      | the output, or the async input copy, could not be allocated             |
+| `ERR_LZF_COMPRESSION_FAILED` | `Error`      | liblzf reported a compression failure (not expected in practice)        |
+
+### Output stability
+
+Compressed output is a valid LZF stream decodable by any liblzf build. The
+exact compressed bytes are not guaranteed to be identical across calls
 (liblzf's hash table is intentionally left uninitialized for speed) — only
 the roundtrip contract holds.
 
-### Benchmarks
+## Benchmarks
 
 `npm run bench` compares against node's built-in zlib (`deflateRaw`,
 levels 1 and 6) on deterministic datasets. Numbers below from a Windows
@@ -140,14 +178,42 @@ In short: LZF compresses 2–10× faster than zlib at its fastest level, at
 the cost of a worse ratio. Pick LZF when compression latency matters more
 than size (hot network paths); pick zlib/brotli for cold storage.
 
+## Development
+
+`npm test` runs the suite against whichever binary `node-gyp-build` resolves:
+`build/Release` when it exists, otherwise the local `prebuilds/` — which are
+git-ignored and may predate your latest `src/` change. After changing the C++
+sources (`src/`, `binding.gyp`) run `npm run test:local` instead: it rebuilds
+`build/Release` (a C++ toolchain is required) and runs the tests against that
+fresh build. Delete `build/` to test the prebuilds again. Builds use the
+`node-gyp` devDependency rather than the copy bundled with npm, which is too
+old to find Visual Studio 2026 on Node 20.
+
+The `test` GitHub Actions workflow runs on every push and pull request: it
+builds from source and runs the suite on Linux, Windows and macOS with
+Node 20, 22 and 24, and once more on Linux under AddressSanitizer and
+UndefinedBehaviorSanitizer.
+
+### Releasing
+
+Releases are fully automatic: add the changes to `CHANGELOG.md`, bump
+`version` in `package.json` and push to `master`. If that version is not on
+npm yet, the `prebuild` workflow builds and tests every platform
+(`npm run build:prebuilds` runs `prebuildify --napi --strip` for the current
+platform), publishes the package with the merged `prebuilds/` via npm trusted
+publishing (with provenance) and tags the commit `v<version>`. Pushes that
+keep the version publish nothing; a manual run always builds and tests. A
+local `npm publish` is refused (`prepublishOnly`), so stale local
+`prebuilds/` can never reach the registry.
+
 ---
 
-### Authors
+## Authors
 
 - Ian Babrou (`ibobrik@gmail.com`) — original author
 - Türkay Tanrikulu (`trky.shorty@gmail.com`) — fork maintainer
 
-### License
+## License
 
-BSD-2-Clause, see [LICENSE](LICENSE). Bundles [liblzf](http://oldhome.schmorp.de/marc/liblzf.html)
+BSD-2-Clause, see [LICENSE](LICENSE). Bundles [liblzf](https://software.schmorp.de/pkg/liblzf.html)
 by Marc Alexander Lehmann (BSD-2-Clause / GPL dual-licensed).

package/index.d.ts

@@ -2,32 +2,60 @@
 
 declare namespace lzf {
     /**
-     * Compresses a Buffer with LZF. Throws TypeError on invalid input
-     * (non-Buffer, empty, or larger than 1 GiB). Runs synchronously on
-     * the calling thread.
+     * Input accepted by every function: a Buffer or any other TypedArray,
+     * read as its raw bytes. DataView and ArrayBuffer are rejected.
      */
-    function compress(data: Buffer): Buffer;
+    type Input = NodeJS.TypedArray;
+
+    /** Value of the `code` property on every error the module throws. */
+    type ErrorCode =
+        /** TypeError: `data` is not a TypedArray or `expectedLength` is not a number. */
+        | 'ERR_INVALID_ARG_TYPE'
+        /** RangeError: `data` exceeds 1 GiB or `expectedLength` is not an integer in 0..1 GiB. */
+        | 'ERR_OUT_OF_RANGE'
+        /** Error: the decompressed data does not fit in `expectedLength` bytes. */
+        | 'ERR_LZF_OUTPUT_TOO_SMALL'
+        /** Error: the input is not a valid LZF stream. */
+        | 'ERR_LZF_CORRUPTED_INPUT'
+        /** Error: the output (or the async input copy) could not be allocated. */
+        | 'ERR_LZF_ALLOCATION_FAILED'
+        /** Error: liblzf reported a compression failure (not expected in practice). */
+        | 'ERR_LZF_COMPRESSION_FAILED';
+
+    /** Shape of the errors thrown (sync) or rejected (async) by this module. */
+    interface LzfError extends Error {
+        code: ErrorCode;
+    }
+
+    /**
+     * Compresses the input with LZF and returns a new Buffer. An empty input
+     * returns an empty Buffer. Throws TypeError for input that is not a
+     * TypedArray and RangeError for input larger than 1 GiB. Runs
+     * synchronously on the calling thread.
+     */
+    function compress(data: Input): Buffer;
 
     /**
-     * Compresses a Buffer with LZF on the libuv thread pool without
-     * blocking the event loop. Rejects with the same errors compress()
-     * throws.
+     * Compresses on the libuv thread pool without blocking the event loop.
+     * The input is copied before the call returns, so it may be reused right
+     * away. Rejects with the same errors compress() throws.
      */
-    function compressAsync(data: Buffer): Promise<Buffer>;
+    function compressAsync(data: Input): Promise<Buffer>;
 
     /**
-     * Decompresses an LZF-compressed Buffer. expectedLength is the exact
-     * (or an upper bound of the) decompressed size, between 1 and 1 GiB.
-     * Throws TypeError/RangeError on invalid arguments and Error when the
-     * input is corrupted or expectedLength is too small.
+     * Decompresses LZF-compressed data into a new Buffer. expectedLength is
+     * the exact (or an upper bound of the) decompressed size, an integer
+     * between 0 and 1 GiB. Throws TypeError/RangeError on invalid arguments
+     * and Error when the input is corrupted or expectedLength is too small.
      */
-    function decompress(data: Buffer, expectedLength: number): Buffer;
+    function decompress(data: Input, expectedLength: number): Buffer;
 
     /**
-     * Decompresses on the libuv thread pool without blocking the event
-     * loop. Rejects with the same errors decompress() throws.
+     * Decompresses on the libuv thread pool without blocking the event loop.
+     * The input is copied before the call returns, so it may be reused right
+     * away. Rejects with the same errors decompress() throws.
      */
-    function decompressAsync(data: Buffer, expectedLength: number): Promise<Buffer>;
+    function decompressAsync(data: Input, expectedLength: number): Promise<Buffer>;
 }
 
 export = lzf;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trkyshorty/node-lzf",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "description": "lzf compression module for nodejs (Topface/node-lzf fork)",
   "keywords": [
     "lzf",
@@ -14,7 +14,7 @@
     "Ian Babrou <ibobrik@gmail.com>"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "repository": {
     "type": "git",
@@ -25,6 +25,7 @@
     "node-gyp-build": "^4.8.4"
   },
   "devDependencies": {
+    "node-gyp": "^12.4.0",
     "prebuildify": "^6.0.1"
   },
   "main": "./index.js",
@@ -36,12 +37,16 @@
     "binding.gyp",
     "src/",
     "prebuilds/",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "install": "node-gyp-build",
-    "prebuild": "prebuildify --napi --strip",
+    "prepublishOnly": "node -e \"if (!process.env.GITHUB_ACTIONS) { console.error('Refusing to publish locally: the prebuild workflow publishes releases. Bump the version and push to master.'); process.exit(1); }\"",
+    "build:prebuilds": "prebuildify --napi --strip",
+    "build:source": "node-gyp rebuild",
     "test": "node --test test/test.js",
+    "test:local": "node-gyp rebuild && node --test test/test.js",
     "bench": "node benchmark/benchmark.js"
   },
   "license": "BSD-2-Clause"

package/src/lzf/lzfP.h

@@ -82,6 +82,9 @@
  * node-lzf: upstream used `# define STRICT_ALIGN !(defined(__i386) || defined (__amd64))`;
  * a `defined` operator produced by macro expansion is undefined behavior in the standard
  * (gcc/clang -Wexpansion-to-defined). We select the same value directly with #if.
+ * MSVC x64 is deliberately left on the aligned path: enabling the unaligned one there
+ * was measured (npm run bench) at a few percent faster on most data but ~70% slower
+ * on highly repetitive input.
  */
 #ifndef STRICT_ALIGN
 # if defined(__i386) || defined (__amd64)
@@ -151,8 +154,9 @@ using namespace std;
 
 #ifndef LZF_USE_OFFSETS
 # if defined (WIN32)
-   /* node-lzf: replaces upstream's macro-expanded `defined(_M_X64)`; same rationale as STRICT_ALIGN. */
-#  if defined(_M_X64)
+   /* node-lzf: replaces upstream's macro-expanded `defined(_M_X64)`; same rationale as STRICT_ALIGN.
+    * _WIN64 covers both x64 and ARM64 Windows. */
+#  if defined(_WIN64)
 #   define LZF_USE_OFFSETS 1
 #  else
 #   define LZF_USE_OFFSETS 0
@@ -191,6 +195,18 @@ typedef LZF_HSLOT LZF_STATE[1 << (HLOG)];
 # endif
 #endif
 
+#if !STRICT_ALIGN
+/* node-lzf: upstream dereferenced `*(u16 *)p`, an unaligned load that is undefined
+ * behavior (UBSan -fsanitize=alignment). memcpy is well-defined and compiles to the
+ * same single load on the targets that enable this path. */
+static inline u16 lzf_load16 (const u8 *p)
+{
+  u16 v;
+  memcpy (&v, p, sizeof (v));
+  return v;
+}
+#endif
+
 #if ULTRA_FAST
 # undef VERY_FAST
 #endif

package/src/lzf/lzf_c.cc

@@ -118,8 +118,12 @@ lzf_compress (const void *const in_data, unsigned int in_len,
    * no bit pattern traps. Since the only platform that is both non-POSIX
    * and fails to support both assumptions is windows 64 bit, we make a
    * special workaround for it.
+   * node-lzf: upstream only checked _M_X64, leaving a 32-bit `unsigned long` on
+   * Windows ARM64. With the uninitialized hash table a garbage `ref` could then
+   * truncate to a small offset and be dereferenced out of bounds. _WIN64 covers
+   * every 64-bit Windows target.
    */
-#if defined (WIN32) && defined (_M_X64)
+#if defined (_WIN64)
   unsigned _int64 off; /* workaround for missing POSIX compliance */
 #else
   unsigned long off;
@@ -136,8 +140,12 @@ lzf_compress (const void *const in_data, unsigned int in_len,
 
   lit = 0; op++; /* start run */
 
-  hval = FRST (ip);
-  while (ip < in_end - 2)
+  /* node-lzf: upstream read FRST (ip) unconditionally, i.e. ip[1] one byte past
+   * a 1-byte input (AddressSanitizer heap-buffer-overflow), and formed in_end - 2
+   * before the start of the buffer. Inputs shorter than 3 bytes never enter the
+   * match loop and are emitted as literals below. */
+  hval = in_len > 1 ? FRST (ip) : 0;
+  while (in_len > 2 && ip < in_end - 2)
     {
       LZF_HSLOT *hslot;
 
@@ -155,7 +163,8 @@ lzf_compress (const void *const in_data, unsigned int in_len,
 #if STRICT_ALIGN
           && ((ref[1] << 8) | ref[0]) == ((ip[1] << 8) | ip[0])
 #else
-          && *(u16 *)ref == *(u16 *)ip
+          /* node-lzf: upstream compared `*(u16 *)ref == *(u16 *)ip`; see lzf_load16 in lzfP.h. */
+          && lzf_load16 (ref) == lzf_load16 (ip)
 #endif
         )
         {

package/src/lzf.cc

@@ -3,10 +3,12 @@
 
 #include <napi.h>
 
+#include <algorithm>
 #include <cerrno>
-#include <climits>
+#include <cmath>
+#include <cstdint>
 #include <cstdlib>
-#include <string>
+#include <cstring>
 
 #include "lzf/lzf.h"
 
@@ -23,18 +25,91 @@ inline size_t CompressBound(size_t n) {
     return n + (n / 16) + 64 + 3;
 }
 
+/* Largest output any LZF stream of n bytes can decode to. The densest token
+ * is a long back reference: 3 input bytes (control, length, offset) that
+ * expand to 7 + 255 + 2 = 264 output bytes, i.e. 88x. Literal runs and short
+ * back references expand less, so no valid or corrupted stream can outgrow
+ * this. Capping the allocation with it means an untrusted expectedLength
+ * cannot make a tiny input allocate up to 1 GiB. */
+constexpr size_t kMaxExpansion = 88;
+
+inline size_t DecompressBound(size_t n) {
+    return n > SIZE_MAX / kMaxExpansion ? SIZE_MAX : n * kMaxExpansion;
+}
+
+/* ---- errors ------------------------------------------------------------- */
+
+enum class ErrorKind { kError, kTypeError, kRangeError };
+
+/* Every error carries a stable `code` so callers never have to match on the
+ * message. The strings are static, so a Failure can be filled on a worker
+ * thread and turned into a JS error later on the main thread. */
+struct Failure {
+    ErrorKind kind = ErrorKind::kError;
+    const char* code = nullptr;
+    const char* message = nullptr;
+};
+
+constexpr Failure kInvalidData{ErrorKind::kTypeError, "ERR_INVALID_ARG_TYPE",
+                               "The \"data\" argument must be a Buffer or TypedArray"};
+constexpr Failure kDataTooLarge{ErrorKind::kRangeError, "ERR_OUT_OF_RANGE",
+                                "The \"data\" argument exceeds the 1 GiB limit"};
+constexpr Failure kInvalidLengthType{ErrorKind::kTypeError, "ERR_INVALID_ARG_TYPE",
+                                     "The \"expectedLength\" argument must be a number"};
+constexpr Failure kLengthNotInteger{ErrorKind::kRangeError, "ERR_OUT_OF_RANGE",
+                                    "The \"expectedLength\" argument must be an integer"};
+constexpr Failure kLengthOutOfRange{ErrorKind::kRangeError, "ERR_OUT_OF_RANGE",
+                                    "The \"expectedLength\" argument must be between 0 and 1 GiB"};
+constexpr Failure kAllocationFailed{ErrorKind::kError, "ERR_LZF_ALLOCATION_FAILED",
+                                    "Failed to allocate memory"};
+constexpr Failure kCompressionFailed{ErrorKind::kError, "ERR_LZF_COMPRESSION_FAILED",
+                                     "Compression failed"};
+constexpr Failure kOutputTooSmall{ErrorKind::kError, "ERR_LZF_OUTPUT_TOO_SMALL",
+                                  "Decompression failed: expected length too small"};
+constexpr Failure kCorruptedInput{ErrorKind::kError, "ERR_LZF_CORRUPTED_INPUT",
+                                  "Decompression failed: corrupted input"};
+
+Napi::Value MakeError(Napi::Env env, const Failure& failure) {
+    napi_value code;
+    napi_value message;
+    napi_value error = nullptr;
+    napi_create_string_utf8(env, failure.code, NAPI_AUTO_LENGTH, &code);
+    napi_create_string_utf8(env, failure.message, NAPI_AUTO_LENGTH, &message);
+    switch (failure.kind) {
+        case ErrorKind::kTypeError: napi_create_type_error(env, code, message, &error); break;
+        case ErrorKind::kRangeError: napi_create_range_error(env, code, message, &error); break;
+        case ErrorKind::kError: napi_create_error(env, code, message, &error); break;
+    }
+    return Napi::Value(env, error);
+}
+
+Napi::Value Throw(Napi::Env env, const Failure& failure) {
+    napi_throw(env, MakeError(env, failure));
+    return env.Undefined();
+}
+
+Napi::Value RejectedPromise(Napi::Env env, const Failure& failure) {
+    auto deferred = Napi::Promise::Deferred::New(env);
+    deferred.Reject(MakeError(env, failure));
+    return deferred.Promise();
+}
+
+/* ---- codec -------------------------------------------------------------- */
+
 struct RawResult {
     char* data = nullptr;
     size_t length = 0;
 };
 
-/* Compresses into a malloc'd buffer shrunk to the exact result size.
- * Returns false and fills `error` on failure (buffer already freed). */
-bool DoCompress(const char* input, size_t inputLength, RawResult* out, std::string* error) {
+/* Compresses into a malloc'd buffer shrunk to the exact result size. An
+ * empty input yields an empty result (lzf_compress itself rejects it). */
+bool DoCompress(const char* input, size_t inputLength, RawResult* out, Failure* failure) {
+    if (inputLength == 0) return true;
+
     size_t bound = CompressBound(inputLength);
     char* buffer = static_cast<char*>(malloc(bound));
     if (buffer == nullptr) {
-        *error = "Failed to allocate output buffer";
+        *failure = kAllocationFailed;
         return false;
     }
 
@@ -44,7 +119,7 @@ bool DoCompress(const char* input, size_t inputLength, RawResult* out, std::stri
 
     if (compressedLength == 0) {
         free(buffer);
-        *error = "Compression failed";
+        *failure = kCompressionFailed;
         return false;
     }
 
@@ -54,31 +129,41 @@ bool DoCompress(const char* input, size_t inputLength, RawResult* out, std::stri
     return true;
 }
 
-/* Decompresses into a malloc'd buffer of expectedLength, shrunk to the
- * actual result size. Distinguishes "expected length too small" (E2BIG)
- * from corrupted input via errno set by lzf_decompress. */
+/* Decompresses into a malloc'd buffer of at most expectedLength bytes, shrunk
+ * to the actual result size. Distinguishes "expected length too small"
+ * (E2BIG) from corrupted input via errno set by lzf_decompress. An empty
+ * input decodes to an empty result, the inverse of DoCompress. */
 bool DoDecompress(const char* input, size_t inputLength, size_t expectedLength, RawResult* out,
-                  std::string* error) {
-    char* buffer = static_cast<char*>(malloc(expectedLength));
+                  Failure* failure) {
+    if (inputLength == 0) return true;
+    if (expectedLength == 0) {
+        /* every LZF token produces at least one byte */
+        *failure = kOutputTooSmall;
+        return false;
+    }
+
+    size_t capacity = std::min(expectedLength, DecompressBound(inputLength));
+    char* buffer = static_cast<char*>(malloc(capacity));
     if (buffer == nullptr) {
-        *error = "Failed to allocate output buffer";
+        *failure = kAllocationFailed;
         return false;
     }
 
     errno = 0;
     unsigned int decompressedLength = lzf_decompress(
         input, static_cast<unsigned int>(inputLength),
-        buffer, static_cast<unsigned int>(expectedLength));
+        buffer, static_cast<unsigned int>(capacity));
 
     if (decompressedLength == 0) {
         int cause = errno;
         free(buffer);
-        *error = cause == E2BIG ? "Decompression failed: expected length too small"
-                                : "Decompression failed: corrupted input";
+        /* E2BIG below the expansion bound cannot come from a real stream, but
+         * report it as corruption rather than blaming expectedLength. */
+        *failure = cause == E2BIG && capacity == expectedLength ? kOutputTooSmall : kCorruptedInput;
         return false;
     }
 
-    if (decompressedLength < expectedLength) {
+    if (decompressedLength < capacity) {
         char* shrunk = static_cast<char*>(realloc(buffer, decompressedLength));
         if (shrunk != nullptr) buffer = shrunk;
     }
@@ -90,6 +175,10 @@ bool DoDecompress(const char* input, size_t inputLength, size_t expectedLength,
 /* Wraps a malloc'd result as a Buffer without copying when the runtime
  * supports external buffers (plain Node does); falls back to copy+free. */
 Napi::Value WrapResult(Napi::Env env, RawResult* result) {
+    if (result->length == 0) {
+        free(result->data);
+        return Napi::Buffer<char>::New(env, 0);
+    }
     return Napi::Buffer<char>::NewOrCopy(
         env, result->data, result->length,
         [](Napi::Env, char* data) { free(data); });
@@ -97,195 +186,202 @@ Napi::Value WrapResult(Napi::Env env, RawResult* result) {
 
 /* ---- argument validation ------------------------------------------------ */
 
-bool ValidateInputBuffer(const Napi::CallbackInfo& info, std::string* error) {
-    if (info.Length() < 1 || !info[0].IsBuffer()) {
-        *error = "First argument must be a Buffer";
+struct Input {
+    const char* data = nullptr;
+    size_t length = 0;
+};
+
+/* Accepts any TypedArray (Buffer, Uint8Array, Float64Array, ...) and reads its
+ * bytes. DataView and ArrayBuffer are rejected. napi_get_buffer_info reports
+ * the view's byte length straight from V8, so element types node-addon-api
+ * does not know (Float16Array) are measured correctly too. */
+bool GetInput(const Napi::CallbackInfo& info, Input* input, Failure* failure) {
+    if (info.Length() < 1 || !info[0].IsTypedArray()) {
+        *failure = kInvalidData;
         return false;
     }
-    size_t length = info[0].As<Napi::Buffer<char>>().Length();
-    if (length == 0) {
-        *error = "Input buffer must not be empty";
+    void* data = nullptr;
+    size_t length = 0;
+    if (napi_get_buffer_info(info.Env(), info[0], &data, &length) != napi_ok) {
+        *failure = kInvalidData;
         return false;
     }
     if (length > kMaxInputLength) {
-        *error = "Input buffer exceeds 1 GiB limit";
+        *failure = kDataTooLarge;
         return false;
     }
+    input->data = static_cast<const char*>(data);
+    input->length = length;
     return true;
 }
 
 /* expectedLength is required: the legacy default silently allocated a
- * 999 MB buffer per call, which is a footgun rather than a feature. */
-bool ValidateExpectedLength(const Napi::CallbackInfo& info, size_t* expectedLength,
-                            std::string* error, bool* rangeError) {
-    *rangeError = false;
+ * 999 MB buffer per call, which is a footgun rather than a feature. The
+ * range is checked on the double before any integer conversion, because
+ * converting an out-of-range double (Infinity, 1e300) is undefined. */
+bool GetExpectedLength(const Napi::CallbackInfo& info, size_t* expectedLength, Failure* failure) {
     if (info.Length() < 2 || !info[1].IsNumber()) {
-        *error = "Second argument (expectedLength) must be a number";
+        *failure = kInvalidLengthType;
         return false;
     }
     double raw = info[1].As<Napi::Number>().DoubleValue();
-    if (raw != raw /* NaN */ || raw != static_cast<double>(static_cast<int64_t>(raw))) {
-        *rangeError = true;
-        *error = "expectedLength must be an integer";
+    if (!std::isfinite(raw) || std::trunc(raw) != raw) {
+        *failure = kLengthNotInteger;
         return false;
     }
-    int64_t value = static_cast<int64_t>(raw);
-    if (value <= 0 || static_cast<uint64_t>(value) > kMaxOutputLength) {
-        *rangeError = true;
-        *error = "expectedLength must be between 1 and 1 GiB";
+    if (raw < 0 || raw > static_cast<double>(kMaxOutputLength)) {
+        *failure = kLengthOutOfRange;
         return false;
     }
-    *expectedLength = static_cast<size_t>(value);
+    *expectedLength = static_cast<size_t>(raw);
     return true;
 }
 
 /* ---- async workers ------------------------------------------------------ */
 
-class CompressWorker : public Napi::AsyncWorker {
+/* The async API copies the input on the calling thread before queueing. A
+ * pointer into the caller's memory is not safe to keep: the ArrayBuffer can
+ * be detached or shrunk (transfer(), postMessage, resize()) while the worker
+ * runs, which freed the memory under it. The copy also means the caller may
+ * reuse or mutate the input as soon as the call returns. */
+class OwnedInput {
   public:
-    CompressWorker(Napi::Env env, Napi::Buffer<char> input)
-        : Napi::AsyncWorker(env),
-          deferred_(Napi::Promise::Deferred::New(env)),
-          inputRef_(Napi::Persistent(input.As<Napi::Object>())),
-          data_(input.Data()),
-          length_(input.Length()) {}
+    OwnedInput() = default;
+    OwnedInput(const OwnedInput&) = delete;
+    OwnedInput& operator=(const OwnedInput&) = delete;
+    ~OwnedInput() { free(data_); }
+
+    bool CopyFrom(const Input& input) {
+        if (input.length == 0) return true;
+        data_ = static_cast<char*>(malloc(input.length));
+        if (data_ == nullptr) return false;
+        memcpy(data_, input.data, input.length);
+        length_ = input.length;
+        return true;
+    }
 
+    const char* data() const { return data_; }
+    size_t length() const { return length_; }
+
+  private:
+    char* data_ = nullptr;
+    size_t length_ = 0;
+};
+
+class CodecWorker : public Napi::AsyncWorker {
+  public:
+    explicit CodecWorker(Napi::Env env)
+        : Napi::AsyncWorker(env), deferred_(Napi::Promise::Deferred::New(env)) {}
+
+    OwnedInput& input() { return input_; }
     Napi::Promise Promise() { return deferred_.Promise(); }
 
   protected:
-    void Execute() override {
-        std::string error;
-        if (!DoCompress(data_, length_, &result_, &error)) SetError(error);
+    /* Failures are reported through failure_ rather than SetError so the
+     * rejection keeps its error class and code. */
+    void OnOK() override {
+        if (failed_) deferred_.Reject(MakeError(Env(), failure_));
+        else deferred_.Resolve(WrapResult(Env(), &result_));
     }
 
-    void OnOK() override { deferred_.Resolve(WrapResult(Env(), &result_)); }
-
-    void OnError(const Napi::Error& e) override { deferred_.Reject(e.Value()); }
+    OwnedInput input_;
+    RawResult result_;
+    Failure failure_;
+    bool failed_ = false;
 
   private:
     Napi::Promise::Deferred deferred_;
-    Napi::ObjectReference inputRef_;  // keeps the input buffer alive while the worker runs
-    const char* data_;
-    size_t length_;
-    RawResult result_;
 };
 
-class DecompressWorker : public Napi::AsyncWorker {
+class CompressWorker : public CodecWorker {
   public:
-    DecompressWorker(Napi::Env env, Napi::Buffer<char> input, size_t expectedLength)
-        : Napi::AsyncWorker(env),
-          deferred_(Napi::Promise::Deferred::New(env)),
-          inputRef_(Napi::Persistent(input.As<Napi::Object>())),
-          data_(input.Data()),
-          length_(input.Length()),
-          expectedLength_(expectedLength) {}
-
-    Napi::Promise Promise() { return deferred_.Promise(); }
+    using CodecWorker::CodecWorker;
 
   protected:
     void Execute() override {
-        std::string error;
-        if (!DoDecompress(data_, length_, expectedLength_, &result_, &error)) SetError(error);
+        failed_ = !DoCompress(input_.data(), input_.length(), &result_, &failure_);
     }
+};
 
-    void OnOK() override { deferred_.Resolve(WrapResult(Env(), &result_)); }
+class DecompressWorker : public CodecWorker {
+  public:
+    DecompressWorker(Napi::Env env, size_t expectedLength)
+        : CodecWorker(env), expectedLength_(expectedLength) {}
 
-    void OnError(const Napi::Error& e) override { deferred_.Reject(e.Value()); }
+  protected:
+    void Execute() override {
+        failed_ = !DoDecompress(input_.data(), input_.length(), expectedLength_, &result_,
+                                &failure_);
+    }
 
   private:
-    Napi::Promise::Deferred deferred_;
-    Napi::ObjectReference inputRef_;
-    const char* data_;
-    size_t length_;
     size_t expectedLength_;
-    RawResult result_;
 };
 
+/* Copies the input into the worker and queues it, or deletes the worker and
+ * returns a rejected promise when the copy cannot be allocated. */
+Napi::Value QueueWorker(Napi::Env env, CodecWorker* worker, const Input& input) {
+    if (!worker->input().CopyFrom(input)) {
+        delete worker;
+        return RejectedPromise(env, kAllocationFailed);
+    }
+    Napi::Promise promise = worker->Promise();
+    worker->Queue();
+    return promise;
+}
+
 /* ---- sync API ----------------------------------------------------------- */
 
 Napi::Value Compress(const Napi::CallbackInfo& info) {
     Napi::Env env = info.Env();
 
-    std::string error;
-    if (!ValidateInputBuffer(info, &error)) {
-        Napi::TypeError::New(env, error).ThrowAsJavaScriptException();
-        return env.Undefined();
-    }
+    Input input;
+    Failure failure;
+    if (!GetInput(info, &input, &failure)) return Throw(env, failure);
 
-    Napi::Buffer<char> input = info[0].As<Napi::Buffer<char>>();
     RawResult result;
-    if (!DoCompress(input.Data(), input.Length(), &result, &error)) {
-        Napi::Error::New(env, error).ThrowAsJavaScriptException();
-        return env.Undefined();
-    }
+    if (!DoCompress(input.data, input.length, &result, &failure)) return Throw(env, failure);
     return WrapResult(env, &result);
 }
 
 Napi::Value Decompress(const Napi::CallbackInfo& info) {
     Napi::Env env = info.Env();
 
-    std::string error;
-    bool rangeError = false;
+    Input input;
     size_t expectedLength = 0;
-    if (!ValidateInputBuffer(info, &error)) {
-        Napi::TypeError::New(env, error).ThrowAsJavaScriptException();
-        return env.Undefined();
-    }
-    if (!ValidateExpectedLength(info, &expectedLength, &error, &rangeError)) {
-        if (rangeError) Napi::RangeError::New(env, error).ThrowAsJavaScriptException();
-        else Napi::TypeError::New(env, error).ThrowAsJavaScriptException();
-        return env.Undefined();
-    }
+    Failure failure;
+    if (!GetInput(info, &input, &failure)) return Throw(env, failure);
+    if (!GetExpectedLength(info, &expectedLength, &failure)) return Throw(env, failure);
 
-    Napi::Buffer<char> input = info[0].As<Napi::Buffer<char>>();
     RawResult result;
-    if (!DoDecompress(input.Data(), input.Length(), expectedLength, &result, &error)) {
-        Napi::Error::New(env, error).ThrowAsJavaScriptException();
-        return env.Undefined();
+    if (!DoDecompress(input.data, input.length, expectedLength, &result, &failure)) {
+        return Throw(env, failure);
     }
     return WrapResult(env, &result);
 }
 
 /* ---- async API (libuv thread pool; never blocks the event loop) --------- */
 
-Napi::Value RejectedPromise(Napi::Env env, const Napi::Error& error) {
-    auto deferred = Napi::Promise::Deferred::New(env);
-    deferred.Reject(error.Value());
-    return deferred.Promise();
-}
-
 Napi::Value CompressAsync(const Napi::CallbackInfo& info) {
     Napi::Env env = info.Env();
 
-    std::string error;
-    if (!ValidateInputBuffer(info, &error)) {
-        return RejectedPromise(env, Napi::TypeError::New(env, error));
-    }
+    Input input;
+    Failure failure;
+    if (!GetInput(info, &input, &failure)) return RejectedPromise(env, failure);
 
-    auto* worker = new CompressWorker(env, info[0].As<Napi::Buffer<char>>());
-    Napi::Promise promise = worker->Promise();
-    worker->Queue();
-    return promise;
+    return QueueWorker(env, new CompressWorker(env), input);
 }
 
 Napi::Value DecompressAsync(const Napi::CallbackInfo& info) {
     Napi::Env env = info.Env();
 
-    std::string error;
-    bool rangeError = false;
+    Input input;
     size_t expectedLength = 0;
-    if (!ValidateInputBuffer(info, &error)) {
-        return RejectedPromise(env, Napi::TypeError::New(env, error));
-    }
-    if (!ValidateExpectedLength(info, &expectedLength, &error, &rangeError)) {
-        if (rangeError) return RejectedPromise(env, Napi::RangeError::New(env, error));
-        return RejectedPromise(env, Napi::TypeError::New(env, error));
-    }
+    Failure failure;
+    if (!GetInput(info, &input, &failure)) return RejectedPromise(env, failure);
+    if (!GetExpectedLength(info, &expectedLength, &failure)) return RejectedPromise(env, failure);
 
-    auto* worker = new DecompressWorker(env, info[0].As<Napi::Buffer<char>>(), expectedLength);
-    Napi::Promise promise = worker->Promise();
-    worker->Queue();
-    return promise;
+    return QueueWorker(env, new DecompressWorker(env, expectedLength), input);
 }
 
 Napi::Object Init(Napi::Env env, Napi::Object exports) {