imagescript 3.2.1 → 3.3.0

package/README.md

@@ -28,12 +28,15 @@ deno add jsr:@matmen/imagescript     # Deno (npm:imagescript works too)
   - WebPs (lossy, lossless and with alpha; bit-exact with libwebp)
   - TGAs (color mapped, truecolor and greyscale; uncompressed and run length encoded)
   - JPEGs, TIFFs, PNGs and WebPs are rotated as their Exif (or, for PNGs, XMP) orientation says
+  - images larger than 268 megapixels (`maxPixels`) are rejected before decoding, so small files declaring huge images
+    can't exhaust the memory
 - [Decoding animations](https://imagescript.matmen.dev/classes/Animation.html#decode) (GIF, APNG and WebP) with all
   frames, durations and disposal modes
 - [Rendering SVGs](https://imagescript.matmen.dev/classes/Image.html#rendersvg) (shapes, paths, gradients, strokes, clip paths,
   masks, CSS; no text, images or filters)
-- [Rendering vector fonts](https://imagescript.matmen.dev/classes/Image.html#rendertext) (TrueType and OpenType, with kerning,
-  outlines and TrueType hinting)
+- [Rendering vector fonts](https://imagescript.matmen.dev/classes/Image.html#rendertext) (TrueType and OpenType, with
+  complex text shaping in every script, right to left and bidirectional text, outlines, TrueType hinting, fallback
+  fonts and color emoji)
 - [Resizing](https://imagescript.matmen.dev/classes/Image.html#resize) (bilinear, bicubic, area averaging and nearest neighbor)
 - Image manipulation functions ([crop](https://imagescript.matmen.dev/classes/Image.html#crop)
   , [rotate](https://imagescript.matmen.dev/classes/Image.html#rotate)
@@ -101,7 +104,9 @@ The JPEG codec is based in part on the work of the Independent JPEG Group (libjp
 [pdf.js](https://github.com/mozilla/pdf.js), the glyph rasterizer is translated from
 [font-rs](https://github.com/raphlinus/font-rs). The WebP codecs follow [RFC 9649](https://www.rfc-editor.org/rfc/rfc9649) and [RFC 6386](https://www.rfc-editor.org/rfc/rfc6386)
 and reproduce [libwebp](https://chromium.googlesource.com/webm/libwebp)'s color conversion, the TrueType hinting follows
-[FreeType](https://freetype.org)'s interpreter (portions of this software are copyright © 2026 The FreeType Project).
+[FreeType](https://freetype.org)'s interpreter (portions of this software are copyright © 2026 The FreeType Project),
+the text shaping is ported from [HarfBuzz](https://github.com/harfbuzz/harfbuzz) and uses data of the
+[Unicode Character Database](https://www.unicode.org/ucd/).
 See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) for their licenses.
 
 ---

package/THIRD_PARTY_NOTICES.md

@@ -14,6 +14,10 @@ following projects, under their own licenses. Each derived file says so in its h
 | [RFC 6386](https://www.rfc-editor.org/rfc/rfc6386) (VP8 Data Format and Decoding Guide, with the libvpx reference decoder) | `src/codecs/vp8-tables.ts` (probability and quantizer tables), `src/codecs/vp8.ts` (decoding procedures) | BSD-3-Clause |
 | [libwebp](https://chromium.googlesource.com/webm/libwebp) | `src/codecs/vp8.ts` (YUV to RGB conversion, "fancy" chroma upsampling), `src/codecs/webp.ts` (animation frame blending) | BSD-3-Clause |
 | [FreeType](https://freetype.org) | `src/render/hinting.ts` (behavior and parts of the logic of the TrueType interpreter) | FreeType License |
+| [Pillow](https://github.com/python-pillow/Pillow) | `src/util/resample.ts` (filter coefficients, box, bilinear and bicubic filters) | MIT-CMU |
+| [HarfBuzz](https://github.com/harfbuzz/harfbuzz) | `src/render/buffer.ts`, `src/render/layout.ts`, `src/render/shape.ts`, `src/render/shapers/*` (OpenType shaping: buffer, GSUB/GPOS, normalization, fallback positioning, the script shapers and syllable grammars), `scripts/unicode.js` (shaping category tables) | Old MIT |
+| [Universal Shaping Engine data](https://github.com/harfbuzz/harfbuzz/tree/main/src/ms-use) by Microsoft | `scripts/ms-use` (category overrides, invalid vowel sequences), the tables generated from them in `src/render/unicode-data.ts` | MIT |
+| [Unicode Character Database](https://www.unicode.org/ucd/) | `src/render/unicode-data.ts` (character properties, generated by `scripts/unicode.js`) | Unicode License v3 |
 
 ## fflate, Fast CRC32 in JavaScript
 
@@ -154,3 +158,130 @@ Where the specification leaves details open, its behavior and parts of its logic
 interpolation of untouched points (IUP), the handling of near-perpendicular freedom and projection vectors, and the
 tolerance of invalid references. FreeType is used under the FreeType License, included as
 [licenses/FTL.txt](licenses/FTL.txt).
+
+## Pillow
+
+```
+The Python Imaging Library (PIL) is
+
+    Copyright © 1997-2011 by Secret Labs AB
+    Copyright © 1995-2011 by Fredrik Lundh and contributors
+
+Pillow is the friendly PIL fork. It is
+
+    Copyright © 2010 by Jeffrey 'Alex' Clark and contributors
+
+Like PIL, Pillow is licensed under the open source MIT-CMU License:
+
+By obtaining, using, and/or copying this software and/or its associated
+documentation, you agree that you have read, understood, and will comply
+with the following terms and conditions:
+
+Permission to use, copy, modify and distribute this software and its
+documentation for any purpose and without fee is hereby granted,
+provided that the above copyright notice appears in all copies, and that
+both that copyright notice and this permission notice appear in supporting
+documentation, and that the name of Secret Labs AB or the author not be
+used in advertising or publicity pertaining to distribution of the software
+without specific, written prior permission.
+
+SECRET LABS AB AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
+SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.
+IN NO EVENT SHALL SECRET LABS AB OR THE AUTHOR BE LIABLE FOR ANY SPECIAL,
+INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+```
+
+The resampling in `src/util/resample.ts` computes its filter coefficients as Pillow's `precompute_coeffs` does (the
+filter stretched by the downscaling factor, the source range rounded around each output pixel's center, the weights
+normalized) and uses Pillow's box, bilinear and bicubic (a = -0.5) filter functions. The integer passes, the fast
+paths and the premultiplied alpha handling are ImageScript's own.
+
+## Unicode Character Database
+
+Copyright © 1991-2026 Unicode, Inc.
+
+`src/render/unicode-data.ts` is generated by `scripts/unicode.js` from data files of the Unicode Character Database
+(character properties for the bidirectional algorithm, line breaking, text segmentation and shaping). They are used
+under the Unicode License v3, included as [licenses/Unicode-3.0.txt](licenses/Unicode-3.0.txt). The bidirectional
+algorithm (`src/render/bidi.ts`) and the line breaking (`src/render/linebreak.ts`) are written after UAX #9 and
+UAX #14.
+
+## HarfBuzz
+
+The shaping engine is ported from HarfBuzz 14.6.0; its license is included as
+[licenses/HarfBuzz.txt](licenses/HarfBuzz.txt). The copyright holders of the ported files are listed in the headers
+of the files derived from them.
+
+```
+HarfBuzz is licensed under the so-called "Old MIT" license.  Details follow.
+For parts of HarfBuzz that are licensed under different licenses see individual
+files names COPYING in subdirectories where applicable.
+
+Copyright © 2010-2022  Google, Inc.
+Copyright © 2015-2020  Ebrahim Byagowi
+Copyright © 2019,2020  Facebook, Inc.
+Copyright © 2012,2015  Mozilla Foundation
+Copyright © 2011  Codethink Limited
+Copyright © 2008,2010  Nokia Corporation and/or its subsidiary(-ies)
+Copyright © 2009  Keith Stribley
+Copyright © 2011  Martin Hosken and SIL International
+Copyright © 2007  Chris Wilson
+Copyright © 2005,2006,2020,2021,2022,2023  Behdad Esfahbod
+Copyright © 2004,2007,2008,2009,2010,2013,2021,2022,2023  Red Hat, Inc.
+Copyright © 1998-2005  David Turner and Werner Lemberg
+Copyright © 2016  Igalia S.L.
+Copyright © 2022  Matthias Clasen
+Copyright © 2018,2021  Khaled Hosny
+Copyright © 2018,2019,2020  Adobe, Inc
+Copyright © 2013-2015  Alexei Podtelezhnikov
+
+For full copyright notices consult the individual files in the package.
+
+
+Permission is hereby granted, without written agreement and without
+license or royalty fees, to use, copy, modify, and distribute this
+software and its documentation for any purpose, provided that the
+above copyright notice and the following two paragraphs appear in
+all copies of this software.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE TO ANY PARTY FOR
+DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN
+IF THE COPYRIGHT HOLDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGE.
+
+THE COPYRIGHT HOLDER SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING,
+BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
+ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO
+PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
+```
+
+## Universal Shaping Engine data
+
+```
+MIT License
+
+Copyright (c) Microsoft Corporation.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE
+```

package/dist/animation.d.ts

@@ -11,6 +11,12 @@ export interface AnimationOptions {
 export interface AnimationDecodeOptions {
     /** Whether to stop decoding after the first frame. Default: `false` */
     onlyFirstFrame?: boolean;
+    /**
+     * The most pixels to decode, of all frames together (every frame is a full canvas): larger animations throw a
+     * RangeError before anything that size is allocated, so small files declaring huge animations (decompression
+     * bombs) can't exhaust the memory. Default: `268402689` (16383², like sharp), `Infinity` for no limit
+     */
+    maxPixels?: number;
 }
 /** Options of {@link Animation.encodeWebP}, and those all animation encoders have */
 export interface AnimationEncodeOptions {
@@ -68,6 +74,7 @@ export declare class Animation extends Array<Frame> {
     get height(): number;
     /** The animation's duration (in ms) */
     get duration(): number;
+    /** A short description for debugging, e.g. `Animation<64x64x1000ms>` */
     toString(): string;
     /**
      * Returns a new animation of the same class containing a range of this one's frames

package/dist/animation.js

@@ -7,7 +7,8 @@ import { Frame } from "./frame.js";
 import { ImageType } from "./image-type.js";
 import { optimize } from "./util/optimize.js";
 import { resolveMetadata, pngText, exifData, gifComments } from "./metadata.js";
-import { isOptions } from "./util/options.js";
+import { isOptions, finite } from "./util/options.js";
+import { MAX_PIXELS, decoding } from "./util/limits.js";
 const toPlays = (loopCount) => loopCount < 0 ? 0 : loopCount + 1;
 const fromPlays = (plays) => plays === 0 ? -1 : plays - 1;
 function canvasFrames(width, height, frames) {
@@ -27,7 +28,7 @@ export class Animation extends Array {
         for (let i = 0; i < this.length; i++)
             if (!(this[i] instanceof Frame))
                 throw new TypeError(`Frame ${i} is not an instance of Frame`);
-        if (loopCount < -1 || isNaN(loopCount))
+        if (finite(loopCount, 'loop count') < -1)
             throw new RangeError('Invalid loop count');
         this.loopCount = loopCount;
     }
@@ -73,7 +74,6 @@ export class Animation extends Array {
         return new Class(Array.prototype.slice.call(this, start, end), this.loopCount);
     }
     resize(width, height, modeOrOptions) {
-        const mode = (isOptions(modeOrOptions) ? modeOrOptions.mode : modeOrOptions) ?? Image.RESIZE_BILINEAR;
         const originalWidth = this.width, originalHeight = this.height;
         if (width === Image.RESIZE_AUTO && height === Image.RESIZE_AUTO)
             throw new Error('RESIZE_AUTO can only be used for either width or height, not for both');
@@ -85,7 +85,7 @@ export class Animation extends Array {
         for (const frame of this) {
             const left = Math.round(frame.xOffset * sx), top = Math.round(frame.yOffset * sy);
             const right = Math.round((frame.xOffset + frame.width) * sx), bottom = Math.round((frame.yOffset + frame.height) * sy);
-            Image.prototype.resize.call(frame, Math.max(1, right - left), Math.max(1, bottom - top), mode);
+            Image.prototype.resize.call(frame, Math.max(1, right - left), Math.max(1, bottom - top), modeOrOptions);
             frame.xOffset = left;
             frame.yOffset = top;
         }
@@ -170,27 +170,37 @@ export class Animation extends Array {
         }));
     }
     static async decode(input, onlyFirstFrameOrOptions = false) {
-        const onlyExtractFirstFrame = isOptions(onlyFirstFrameOrOptions) ? onlyFirstFrameOrOptions.onlyFirstFrame ?? false : onlyFirstFrameOrOptions;
+        return decoding(() => Animation.__decode__(input, onlyFirstFrameOrOptions));
+    }
+    static async __decode__(input, onlyFirstFrameOrOptions) {
+        const { onlyFirstFrame: onlyExtractFirstFrame = false, maxPixels = MAX_PIXELS } = isOptions(onlyFirstFrameOrOptions) ? onlyFirstFrameOrOptions : { onlyFirstFrame: onlyFirstFrameOrOptions };
         const data = view(input);
         const type = ImageType.getType(data);
         if (type === 'gif')
-            return Animation.__fromGIF__(data, onlyExtractFirstFrame, Animation);
+            return Animation.__fromGIF__(data, onlyExtractFirstFrame, Animation, maxPixels);
         if (type === 'webp') {
-            const decoded = webp.decodeAnimation(data, onlyExtractFirstFrame);
+            const decoded = webp.decodeAnimation(data, onlyExtractFirstFrame, maxPixels);
             const frames = canvasFrames(decoded.width, decoded.height, webp.composite(decoded));
             return new Animation(frames, fromPlays(decoded.loopCount));
         }
+        if (type === 'png' && !png.isAnimated(data)) {
+            const image = await Image.decode(data, { maxPixels, applyOrientation: false });
+            return new Animation(canvasFrames(image.width, image.height, [{ pixels: image.bitmap, duration: 0 }]), -1);
+        }
         if (type === 'png') {
-            const decoded = await png.decodeAnimation(data, onlyExtractFirstFrame);
+            const decoded = await png.decodeAnimation(data, onlyExtractFirstFrame, maxPixels);
             const frames = canvasFrames(decoded.width, decoded.height, png.compositeAnimation(decoded));
             return new Animation(frames, decoded.frames.length > 1 ? fromPlays(decoded.plays) : -1);
         }
         if (type)
-            return new Animation([Frame.from(await Image.decode(data), 0)]);
+            return new Animation([Frame.from(await Image.decode(data, { maxPixels }), 0)]);
         throw new Error('Unsupported image type');
     }
-    static __fromGIF__(data, onlyExtractFirstFrame, Class) {
-        const decoded = gifCodec.decode(data, onlyExtractFirstFrame);
+    static __fromGIF__(data, onlyExtractFirstFrame, Class, maxPixels = MAX_PIXELS) {
+        return decoding(() => Animation.__gifFrames__(data, onlyExtractFirstFrame, Class, maxPixels));
+    }
+    static __gifFrames__(data, onlyExtractFirstFrame, Class, maxPixels) {
+        const decoded = gifCodec.decode(data, onlyExtractFirstFrame, maxPixels);
         const frames = gifCodec.composite(decoded).map(({ pixels, delay }) => ({ pixels, duration: 10 * delay }));
         return new Class(canvasFrames(decoded.width, decoded.height, frames), decoded.loopCount);
     }

package/dist/codecs/crc.js

@@ -2,6 +2,7 @@
  * Slice-by-16 CRC-32, derived from "Fast CRC32 in JavaScript" (https://gist.github.com/101arrowz/e58695f7ccfdf74f60ba22018093edea)
  * Copyright (c) 2021 Arjun Barrett, MIT License (see THIRD_PARTY_NOTICES.md)
  */
+import { nodeZlib } from "./zlib.js";
 const TABLE = new Int32Array(16 * 256);
 for (let n = 0; n < 256; n++) {
     let c = n;
@@ -14,7 +15,11 @@ for (let n = 0; n < 256; n++) {
     for (let k = 256; k < TABLE.length; k += 256)
         c = TABLE[k + n] = TABLE[c & 0xff] ^ c >>> 8;
 }
+const native = nodeZlib && nodeZlib.crc32 ? nodeZlib.crc32.bind(nodeZlib) : null;
+const NATIVE_MIN = 64;
 export function crc32(buffer) {
+    if (native && buffer.length >= NATIVE_MIN)
+        return native(buffer) >>> 0;
     let crc = -1, i = 0;
     for (const end = buffer.length - 16; i <= end; i += 16) {
         crc = TABLE[3840 + ((buffer[i] ^ crc) & 0xff)] ^ TABLE[3584 + ((buffer[i + 1] ^ crc >> 8) & 0xff)]

package/dist/codecs/gif.js

@@ -1,10 +1,12 @@
+import { ByteWriter } from "../util/bytes.js";
 import { quantize } from "./quantize.js";
+import { MAX_PIXELS, PixelBudget, checkPixels } from "../util/limits.js";
 const DISPOSAL_TO_GIF = [0, 1, 3, 2];
 const DISPOSAL_FROM_GIF = [0, 1, 3, 2, 0, 0, 0, 0];
 const MAX_CODE = 4095;
 const UNEXPECTED_END = new Error('GIF: unexpected end of data');
 export function encode({ width, height, loopCount = -1, frames }, quality = 95, comments = []) {
-    const out = new ByteWriter();
+    const out = new GIFWriter();
     out.bytes(0x47, 0x49, 0x46, 0x38, 0x39, 0x61);
     out.u16(width);
     out.u16(height);
@@ -47,7 +49,7 @@ export function encode({ width, height, loopCount = -1, frames }, quality = 95,
     return out.finish();
 }
 function lzwEncode(indices, minCodeSize) {
-    const out = new ByteWriter(indices.length);
+    const out = new GIFWriter(indices.length);
     const clear = 1 << minCodeSize;
     const eoi = clear + 1;
     const dictionary = new Int16Array(4096 * 256);
@@ -110,7 +112,7 @@ function writeSubBlocks(out, data) {
     }
     out.byte(0x00);
 }
-export function decode(data, onlyFirstFrame = false) {
+export function decode(data, onlyFirstFrame = false, maxPixels = MAX_PIXELS) {
     const reader = new ByteReader(data);
     const signature = reader.string(6);
     if (signature !== 'GIF87a' && signature !== 'GIF89a')
@@ -123,6 +125,7 @@ export function decode(data, onlyFirstFrame = false) {
     const frames = [];
     let loopCount = 0;
     let control = null;
+    const budget = new PixelBudget(maxPixels);
     try {
         parse();
     }
@@ -130,6 +133,7 @@ export function decode(data, onlyFirstFrame = false) {
         if (err !== UNEXPECTED_END)
             throw err;
     }
+    checkPixels(width, height, maxPixels, Math.max(1, frames.length));
     return { width, height, loopCount, frames };
     function parse() {
         while (reader.offset < data.length) {
@@ -183,6 +187,7 @@ export function decode(data, onlyFirstFrame = false) {
             const table = localTable || globalTable;
             const minCodeSize = reader.u8();
             const compressed = readSubBlocks(reader);
+            budget.take(fw, fh);
             const indices = lzwDecode(compressed, minCodeSize, fw * fh);
             const { dispose = 0, delay = 0, transparentIndex = -1 } = control || {};
             control = null;
@@ -376,42 +381,12 @@ class ByteReader {
         return String.fromCharCode(...this.slice(length));
     }
 }
-class ByteWriter {
-    buffer;
-    length;
-    constructor(capacity = 1024) {
-        this.buffer = new Uint8Array(Math.max(16, capacity));
-        this.length = 0;
-    }
-    reserve(size) {
-        if (this.length + size <= this.buffer.length)
-            return;
-        const buffer = new Uint8Array(Math.max(this.buffer.length * 2, this.length + size));
-        buffer.set(this.buffer.subarray(0, this.length));
-        this.buffer = buffer;
-    }
-    byte(value) {
-        this.reserve(1);
-        this.buffer[this.length++] = value;
-    }
-    bytes(...values) {
-        for (const value of values)
-            this.byte(value);
-    }
+class GIFWriter extends ByteWriter {
     u16(value) {
-        this.byte(value & 0xff);
-        this.byte(value >> 8 & 0xff);
+        this.bytes(value & 0xff, value >> 8 & 0xff);
     }
     string(value) {
         for (let i = 0; i < value.length; i++)
             this.byte(value.charCodeAt(i));
     }
-    array(values) {
-        this.reserve(values.length);
-        this.buffer.set(values, this.length);
-        this.length += values.length;
-    }
-    finish() {
-        return this.buffer.slice(0, this.length);
-    }
 }

package/dist/codecs/jpeg.js

@@ -4,13 +4,15 @@
  * (IJG license, see licenses/README.ijg). The scan decoder follows the structure of pdf.js' jpg.js
  * (Copyright 2014 Mozilla Foundation, Apache License 2.0). See THIRD_PARTY_NOTICES.md
  */
+import { ByteWriter } from "../util/bytes.js";
+import { MAX_PIXELS, checkPixels } from "../util/limits.js";
 import { orientation as exifOrientation } from "./exif.js";
 import { concat } from "../util/mem.js";
 const ZIGZAG = Int32Array.of(0, 1, 8, 16, 9, 2, 3, 10, 17, 24, 32, 25, 18, 11, 4, 5, 12, 19, 26, 33, 40, 48, 41, 34, 27, 20, 13, 6, 7, 14, 21, 28, 35, 42, 49, 56, 57, 50, 43, 36, 29, 22, 15, 23, 30, 37, 44, 51, 58, 59, 52, 45, 38, 31, 39, 46, 53, 60, 61, 54, 47, 55, 62, 63);
 function clamp8(v) {
     return v < 0 ? 0 : v > 255 ? 255 : v;
 }
-export function decode(data, { transform } = {}) {
+export function decode(data, { transform, maxPixels = MAX_PIXELS } = {}) {
     if (data[0] !== 0xff || data[1] !== 0xd8)
         throw new Error('JPEG: invalid signature');
     const quantizationTables = [];
@@ -84,6 +86,7 @@ export function decode(data, { transform } = {}) {
                     throw new Error('JPEG: multiple frames are not supported');
                 if (data[start] !== 8)
                     throw new Error(`JPEG: ${data[start]}-bit precision is not supported`);
+                checkPixels(u16(start + 3), u16(start + 1), maxPixels);
                 frame = createFrame(marker === 0xc2, u16(start + 1), u16(start + 3), data.subarray(start + 5, end));
                 break;
             }
@@ -158,6 +161,8 @@ function createFrame(progressive, height, width, componentData) {
     }
     if (!width || !sampling.length)
         throw new Error('JPEG: invalid dimensions');
+    if (sampling.length > 4)
+        throw new Error(`JPEG: ${sampling.length} components are not supported`);
     const hmax = Math.max(...sampling.map(c => c.h));
     const vmax = Math.max(...sampling.map(c => c.v));
     const mcusPerLine = Math.ceil(width / (8 * hmax));
@@ -946,29 +951,9 @@ function fdctPass(d, o, s) {
     d[o + s] = z11 + z4;
     d[o + 7 * s] = z11 - z4;
 }
-class BitWriter {
-    buffer;
-    length;
-    bits;
-    count;
-    constructor(capacity) {
-        this.buffer = new Uint8Array(Math.max(1024, capacity));
-        this.length = 0;
-        this.bits = 0;
-        this.count = 0;
-    }
-    reserve(size) {
-        if (this.length + size <= this.buffer.length)
-            return;
-        const buffer = new Uint8Array(Math.max(this.buffer.length * 2, this.length + size));
-        buffer.set(this.buffer.subarray(0, this.length));
-        this.buffer = buffer;
-    }
-    bytes(...values) {
-        this.reserve(values.length);
-        for (const value of values)
-            this.buffer[this.length++] = value;
-    }
+class BitWriter extends ByteWriter {
+    bits = 0;
+    count = 0;
     write(value, size) {
         this.bits = this.bits << size | value & (1 << size) - 1;
         this.count += size;
@@ -986,7 +971,4 @@ class BitWriter {
         if (this.count)
             this.write((1 << 8 - this.count) - 1, 8 - this.count);
     }
-    finish() {
-        return this.buffer.slice(0, this.length);
-    }
 }

package/dist/codecs/png.js

@@ -1,4 +1,5 @@
 import { crc32 } from "./crc.js";
+import { MAX_PIXELS, checkPixels } from "../util/limits.js";
 import { concat } from "../util/mem.js";
 import { encode as utf8, decode as utf8Decode } from "../util/utf8.js";
 import { orientation as exifOrientation, xmpOrientation } from "./exif.js";
@@ -437,15 +438,16 @@ async function decodeImageData(p, chunks, width, height) {
             continue;
         const rowBytes = Math.ceil(pw * bitsPerPixel / 8);
         const size = ph * rowBytes;
-        const pixels = unfilter(data, dataOffset, ph, rowBytes, bpp);
+        const pixels = unfilter(data, dataOffset, ph, rowBytes, bpp, !interlace);
         dataOffset += size + ph;
         toRGBA(pixels, rowBytes, pw, ph, rgba, { row: y => ((ys + y * dy) * width + xs) * 4, step: dx * 4 });
     }
     return rgba;
 }
-export async function decode(array) {
+export async function decode(array, maxPixels = MAX_PIXELS) {
     const p = parse(array);
     const { width, height } = p.header;
+    checkPixels(width, height, maxPixels);
     const pixels = await decodeImageData(p, p.idat, width, height);
     return { width, height, pixels, orientation: p.exif ? exifOrientation(p.exif) : await textOrientation(p.text) };
 }
@@ -458,9 +460,10 @@ export function isAnimated(array) {
         return false;
     }
 }
-export async function decodeAnimation(array, onlyFirstFrame = false) {
+export async function decodeAnimation(array, onlyFirstFrame = false, maxPixels = MAX_PIXELS) {
     const p = parse(array);
     const { width, height } = p.header;
+    checkPixels(width, height, maxPixels, !p.animation || p.animationError || onlyFirstFrame ? 1 : Math.max(1, p.frames.length));
     if (!p.animation || p.animationError) {
         const pixels = await decodeImageData(p, p.idat, width, height);
         return { width, height, plays: 0, frames: [{ x: 0, y: 0, width, height, duration: 0, dispose: 0, blend: 0, pixels }] };
@@ -485,13 +488,21 @@ export function compositeAnimation({ width, height, frames }) {
     const output = [];
     for (const f of frames) {
         const previous = f.dispose === 2 ? canvas.slice() : null;
-        for (let y = 0; y < f.height; y++)
+        for (let y = 0; y < f.height; y++) {
+            if (f.blend === 0) {
+                canvas.set(f.pixels.subarray(y * f.width * 4, (y + 1) * f.width * 4), ((f.y + y) * width + f.x) * 4);
+                continue;
+            }
             for (let x = 0; x < f.width; x++) {
                 const s = (y * f.width + x) * 4, d = ((f.y + y) * width + f.x + x) * 4;
                 const sa = f.pixels[s + 3], da = canvas[d + 3];
-                if (f.blend === 0 || sa === 255 || da === 0) {
-                    if (f.blend === 0 || sa !== 0)
-                        canvas.set(f.pixels.subarray(s, s + 4), d);
+                if (sa === 255 || da === 0) {
+                    if (sa !== 0) {
+                        canvas[d] = f.pixels[s];
+                        canvas[d + 1] = f.pixels[s + 1];
+                        canvas[d + 2] = f.pixels[s + 2];
+                        canvas[d + 3] = sa;
+                    }
                 }
                 else if (sa !== 0) {
                     const u = sa * 255, v = (255 - sa) * da, al = u + v;
@@ -500,6 +511,7 @@ export function compositeAnimation({ width, height, frames }) {
                     canvas[d + 3] = al / 255 | 0;
                 }
             }
+        }
         output.push({ pixels: canvas.slice(), duration: f.duration });
         if (f.dispose === 1)
             for (let y = 0; y < f.height; y++)
@@ -550,11 +562,11 @@ function hexProfile(text) {
     const digits = match[2].replace(/\s+/g, '');
     const out = new Uint8Array(Math.min(+match[1], digits.length >> 1));
     for (let i = 0; i < out.length; i++)
-        out[i] = parseInt(digits.substr(i * 2, 2), 16);
+        out[i] = parseInt(digits.slice(i * 2, i * 2 + 2), 16);
     return out;
 }
-function unfilter(data, offset, height, rowBytes, bpp) {
-    const out = new Uint8Array(height * rowBytes);
+function unfilter(data, offset, height, rowBytes, bpp, inPlace = false) {
+    const out = inPlace ? data.subarray(offset, offset + height * rowBytes) : new Uint8Array(height * rowBytes);
     const first = Math.min(bpp, rowBytes);
     for (let y = 0; y < height; y++) {
         const filter = data[offset++];

package/dist/codecs/tga.js

@@ -1,4 +1,5 @@
 import { encode as utf8 } from "../util/utf8.js";
+import { MAX_PIXELS, checkPixels } from "../util/limits.js";
 const SIGNATURE = 'TRUEVISION-XFILE.\0';
 function readHeader(d) {
     if (d.length < 18)
@@ -69,11 +70,12 @@ function readColor(d, o, bits, alphaBits, out, p) {
         out[p + 3] = bits === 32 && alphaBits ? d[o + 3] : 255;
     }
 }
-export function decode(d) {
+export function decode(d, maxPixels = MAX_PIXELS) {
     const h = readHeader(d);
     if (!h || !isTGA(d))
         throw new Error('TGA: invalid header');
     const { width, height, depth } = h;
+    checkPixels(width, height, maxPixels);
     const base = h.imageType & ~8, rle = (h.imageType & 8) !== 0;
     const bytesPerPixel = Math.ceil(depth / 8);
     let offset = 18 + h.idLength;

package/dist/codecs/tiff.js

@@ -1,5 +1,6 @@
 import { decompressAsync } from "./zlib.js";
 import * as jpeg from "./jpeg.js";
+import { MAX_PIXELS, checkPixels, checkBytes } from "../util/limits.js";
 const TYPE_SIZES = { 1: 1, 2: 1, 3: 2, 4: 4, 5: 8, 6: 1, 7: 1, 8: 2, 9: 4, 10: 8, 11: 4, 12: 8, 13: 4, 16: 8, 17: 8, 18: 8 };
 const TAGS = {
     ImageWidth: 256,
@@ -28,7 +29,7 @@ const TAGS = {
     ReferenceBlackWhite: 532
 };
 const COMPRESSION_NAMES = { 2: 'CCITT RLE', 3: 'CCITT fax 3', 4: 'CCITT fax 4', 6: 'old-style JPEG', 32809: 'ThunderScan', 34676: 'SGI LogLuv', 34677: 'SGI LogL' };
-export async function decode(data) {
+export async function decode(data, maxPixels = MAX_PIXELS) {
     const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
     let little;
     if (data[0] === 0x49 && data[1] === 0x49)
@@ -154,9 +155,13 @@ export async function decode(data) {
             throw new Error('TIFF: missing image data');
         return data.subarray(offset, Math.min(data.length, offset + count));
     };
+    checkPixels(width, height, maxPixels);
+    checkPixels(segmentWidth, segmentHeight, Math.max(4 * width * height, 1 << 20));
+    checkBytes(Math.ceil(width * samplesPerPixel * bps / 8) * height, maxPixels);
     const pixels = new Uint8Array(width * height * 4);
     if (compression === 7) {
-        const tables = tags.has(TAGS.JPEGTables) ? data.subarray(tags.get(TAGS.JPEGTables).offset, tags.get(TAGS.JPEGTables).offset + tags.get(TAGS.JPEGTables).count) : null;
+        const jpegTables = tags.get(TAGS.JPEGTables);
+        const tables = jpegTables ? data.subarray(jpegTables.offset, jpegTables.offset + jpegTables.count) : null;
         const transform = photometric === 6 ? 'ycc' : photometric === 2 ? 'rgb' : photometric === 5 ? 'cmyk' : null;
         for (let s = 0; s < segmentsPerPlane; s++) {
             let stream = segment(s);

package/dist/codecs/vp8.js

@@ -1,4 +1,5 @@
 import { KF_BMODE_PROBS, COEFF_UPDATE_PROBS, DEFAULT_COEFF_PROBS, DC_QLOOKUP, AC_QLOOKUP, PCAT } from "./vp8-tables.js";
+import { MAX_PIXELS, checkPixels } from "../util/limits.js";
 class BoolDecoder {
     data;
     pos;
@@ -161,9 +162,10 @@ function readHeader(data) {
     };
 }
 const clamp255 = (v) => v < 0 ? 0 : v > 255 ? 255 : v;
-export function decode(data) {
+export function decode(data, maxPixels = MAX_PIXELS) {
     const { header: h, first: d } = readHeader(data);
     const { width, height } = h;
+    checkPixels(width, height, maxPixels);
     const mbw = (width + 15) >> 4, mbh = (height + 15) >> 4;
     const ys = mbw * 16 + 1, cs = mbw * 8 + 1;
     const Y = new Uint8Array(ys * (mbh * 16 + 1));