pdf-codec 3.7.0 → 4.0.1

package/dist/image/jpeg2000.cjs

@@ -260,6 +260,7 @@ function decodeJpeg2000(data, options = {}) {
 	const siz = codestream.siz;
 	const width = siz.xsiz - siz.xosiz;
 	const height = siz.ysiz - siz.yosiz;
+	if (options.maxWidth !== void 0 && width > options.maxWidth || options.maxHeight !== void 0 && height > options.maxHeight || options.maxPixels !== void 0 && width * height > options.maxPixels) throw new Error(`cannot decode a ${String(width)}x${String(height)} JPEG 2000 canvas; this exceeds the caller's configured size bound`);
 	const componentCount = siz.components.length;
 	const first = siz.components[0];
 	if (first === void 0) throw new require_image_jpeg2000_errors.Jpeg2000ParseError("the codestream declares no components");

package/dist/image/jpeg2000.d.cts

@@ -38,6 +38,9 @@ interface Jpeg2000Metadata {
 }
 interface Jpeg2000DecodeOptions {
   readonly onWarning?: (message: string) => void;
+  readonly maxWidth?: number;
+  readonly maxHeight?: number;
+  readonly maxPixels?: number;
 }
 interface Jpeg2000Image {
   readonly width: number;

package/dist/image/jpeg2000.d.ts

@@ -38,6 +38,9 @@ interface Jpeg2000Metadata {
 }
 interface Jpeg2000DecodeOptions {
   readonly onWarning?: (message: string) => void;
+  readonly maxWidth?: number;
+  readonly maxHeight?: number;
+  readonly maxPixels?: number;
 }
 interface Jpeg2000Image {
   readonly width: number;

package/dist/image/jpeg2000.js

@@ -259,6 +259,7 @@ function decodeJpeg2000(data, options = {}) {
 	const siz = codestream.siz;
 	const width = siz.xsiz - siz.xosiz;
 	const height = siz.ysiz - siz.yosiz;
+	if (options.maxWidth !== void 0 && width > options.maxWidth || options.maxHeight !== void 0 && height > options.maxHeight || options.maxPixels !== void 0 && width * height > options.maxPixels) throw new Error(`cannot decode a ${String(width)}x${String(height)} JPEG 2000 canvas; this exceeds the caller's configured size bound`);
 	const componentCount = siz.components.length;
 	const first = siz.components[0];
 	if (first === void 0) throw new Jpeg2000ParseError("the codestream declares no components");

package/dist/images-read.cjs

@@ -1,9 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_objects = require("./objects.cjs");
 const require_filters = require("./filters.cjs");
-const require_image_png_encode = require("./image/png-encode.cjs");
-const require_image_jpeg_info = require("./image/jpeg-info.cjs");
 const require_image_jpeg2000 = require("./image/jpeg2000.cjs");
+let byte_codec = require("byte-codec");
 //#region src/images-read.ts
 function componentsOf(cs) {
 	if (cs.kind === "gray") return 1;
@@ -185,13 +184,18 @@ function jpeg2000ChannelKind(image, dict, resolver, sink) {
 function readJpeg2000Image(dict, raw, resolver, sink) {
 	let image;
 	try {
-		image = require_image_jpeg2000.decodeJpeg2000(raw, { onWarning: (message) => {
-			sink({
-				code: "image/jpx-degraded",
-				severity: "warning",
-				message
-			});
-		} });
+		image = require_image_jpeg2000.decodeJpeg2000(raw, {
+			onWarning: (message) => {
+				sink({
+					code: "image/jpx-degraded",
+					severity: "warning",
+					message
+				});
+			},
+			maxWidth: byte_codec.PNG_MAX_DIMENSION,
+			maxHeight: byte_codec.PNG_MAX_DIMENSION,
+			maxPixels: byte_codec.PNG_MAX_PIXELS
+		});
 	} catch (error) {
 		sink({
 			code: "image/jpx-undecodable",
@@ -243,7 +247,7 @@ function readJpeg2000Image(dict, raw, resolver, sink) {
 	} : rawImage;
 	return {
 		format: "png",
-		bytes: require_image_png_encode.encodePng(withAlpha),
+		bytes: (0, byte_codec.encodePng)(withAlpha),
 		widthPx: image.width,
 		heightPx: image.height
 	};
@@ -261,7 +265,7 @@ function readImageXObject(dict, raw, resolver, sink) {
 	if (decoded.remainingFilter === "DCTDecode") {
 		let info;
 		try {
-			info = require_image_jpeg_info.readJpegInfo(decoded.bytes);
+			info = (0, byte_codec.readJpegInfo)(decoded.bytes);
 		} catch {
 			sink({
 				code: "image/undecodable",
@@ -281,11 +285,11 @@ function readImageXObject(dict, raw, resolver, sink) {
 	if (decoded.remainingFilter !== void 0) return;
 	const width = require_objects.asNumber(require_objects.dictGet(dict, "Width") ?? require_objects.dictGet(dict, "W"));
 	const height = require_objects.asNumber(require_objects.dictGet(dict, "Height") ?? require_objects.dictGet(dict, "H"));
-	if (width === void 0 || height === void 0 || width <= 0 || height <= 0) {
+	if (width === void 0 || height === void 0 || !Number.isInteger(width) || !Number.isInteger(height) || width <= 0 || height <= 0 || width > byte_codec.PNG_MAX_DIMENSION || height > byte_codec.PNG_MAX_DIMENSION || width * height > byte_codec.PNG_MAX_PIXELS) {
 		sink({
 			code: "image/undecodable",
 			severity: "warning",
-			message: "image XObject is missing a valid /Width or /Height; skipping"
+			message: "image XObject has an invalid, out-of-range, or unusably large /Width or /Height; skipping"
 		});
 		return;
 	}
@@ -317,7 +321,7 @@ function readImageXObject(dict, raw, resolver, sink) {
 	} : rawImage;
 	return {
 		format: "png",
-		bytes: require_image_png_encode.encodePng(withAlpha),
+		bytes: (0, byte_codec.encodePng)(withAlpha),
 		widthPx: width,
 		heightPx: height
 	};

package/dist/images-read.js

@@ -1,8 +1,7 @@
 import { asArray, asBool, asName, asNumber, dictGet } from "./objects.js";
 import { decodeStream } from "./filters.js";
-import { encodePng } from "./image/png-encode.js";
-import { readJpegInfo } from "./image/jpeg-info.js";
 import { decodeJpeg2000 } from "./image/jpeg2000.js";
+import { PNG_MAX_DIMENSION, PNG_MAX_PIXELS, encodePng, readJpegInfo } from "byte-codec";
 //#region src/images-read.ts
 function componentsOf(cs) {
 	if (cs.kind === "gray") return 1;
@@ -184,13 +183,18 @@ function jpeg2000ChannelKind(image, dict, resolver, sink) {
 function readJpeg2000Image(dict, raw, resolver, sink) {
 	let image;
 	try {
-		image = decodeJpeg2000(raw, { onWarning: (message) => {
-			sink({
-				code: "image/jpx-degraded",
-				severity: "warning",
-				message
-			});
-		} });
+		image = decodeJpeg2000(raw, {
+			onWarning: (message) => {
+				sink({
+					code: "image/jpx-degraded",
+					severity: "warning",
+					message
+				});
+			},
+			maxWidth: PNG_MAX_DIMENSION,
+			maxHeight: PNG_MAX_DIMENSION,
+			maxPixels: PNG_MAX_PIXELS
+		});
 	} catch (error) {
 		sink({
 			code: "image/jpx-undecodable",
@@ -280,11 +284,11 @@ function readImageXObject(dict, raw, resolver, sink) {
 	if (decoded.remainingFilter !== void 0) return;
 	const width = asNumber(dictGet(dict, "Width") ?? dictGet(dict, "W"));
 	const height = asNumber(dictGet(dict, "Height") ?? dictGet(dict, "H"));
-	if (width === void 0 || height === void 0 || width <= 0 || height <= 0) {
+	if (width === void 0 || height === void 0 || !Number.isInteger(width) || !Number.isInteger(height) || width <= 0 || height <= 0 || width > PNG_MAX_DIMENSION || height > PNG_MAX_DIMENSION || width * height > PNG_MAX_PIXELS) {
 		sink({
 			code: "image/undecodable",
 			severity: "warning",
-			message: "image XObject is missing a valid /Width or /Height; skipping"
+			message: "image XObject has an invalid, out-of-range, or unusably large /Width or /Height; skipping"
 		});
 		return;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pdf-codec",
-  "version": "3.7.0",
+  "version": "4.0.1",
   "description": "Hand-written, dependency-minimal PDF codec: parses arbitrary real-world PDFs and generates new ones, built on its own codec-owned LayoutDocument item model and Zod 4 codecs.",
   "type": "module",
   "repository": {
@@ -99,8 +99,8 @@
   "license": "MIT",
   "packageManager": "pnpm@11.6.0",
   "dependencies": {
-    "byte-codec": "^1.3.0",
-    "document-schema.js": "^6.1.0",
+    "byte-codec": "^1.4.0",
+    "document-schema.js": "^6.2.0",
     "fflate": "^0.8.3",
     "zod": "^4.4.3"
   },

package/dist/image/png-encode.cjs

@@ -1,64 +0,0 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_bytes_writer = require("../bytes/writer.cjs");
-const require_bytes_flate = require("../bytes/flate.cjs");
-const require_image_png_filter = require("./png-filter.cjs");
-const require_bytes_crc32 = require("../bytes/crc32.cjs");
-//#region src/image/png-encode.ts
-const PNG_SIGNATURE = new Uint8Array([
-	137,
-	80,
-	78,
-	71,
-	13,
-	10,
-	26,
-	10
-]);
-function u32be(value) {
-	const bytes = /* @__PURE__ */ new Uint8Array(4);
-	new DataView(bytes.buffer).setUint32(0, value);
-	return bytes;
-}
-function writeChunk(writer, type, data) {
-	const typeBytes = new TextEncoder().encode(type);
-	writer.writeBytes(u32be(data.length));
-	writer.writeBytes(typeBytes);
-	writer.writeBytes(data);
-	writer.writeBytes(u32be(require_bytes_crc32.crc32(require_bytes_writer.concatBytes([typeBytes, data]))));
-}
-function colorTypeFor(image) {
-	if (image.channels === 1) return image.alpha === void 0 ? 0 : 4;
-	return image.alpha === void 0 ? 2 : 6;
-}
-function encodePng(image, options = {}) {
-	const { width, height, channels, data, alpha } = image;
-	const outChannels = alpha === void 0 ? channels : channels + 1;
-	const bytesPerRow = width * outChannels;
-	const pixelCount = width * height;
-	const interleaved = new Uint8Array(pixelCount * outChannels);
-	for (let i = 0; i < pixelCount; i++) {
-		const srcBase = i * channels;
-		const dstBase = i * outChannels;
-		for (let c = 0; c < channels; c++) interleaved[dstBase + c] = data[srcBase + c];
-		if (alpha !== void 0) interleaved[dstBase + channels] = alpha[i];
-	}
-	const filtered = require_image_png_filter.filterScanlines(interleaved, height, bytesPerRow, outChannels, options.filter ?? "adaptive");
-	const compressed = require_bytes_flate.deflate(filtered);
-	const ihdr = /* @__PURE__ */ new Uint8Array(13);
-	const ihdrView = new DataView(ihdr.buffer);
-	ihdrView.setUint32(0, width);
-	ihdrView.setUint32(4, height);
-	ihdr[8] = 8;
-	ihdr[9] = colorTypeFor(image);
-	ihdr[10] = 0;
-	ihdr[11] = 0;
-	ihdr[12] = 0;
-	const writer = new require_bytes_writer.ByteWriter();
-	writer.writeBytes(PNG_SIGNATURE);
-	writeChunk(writer, "IHDR", ihdr);
-	writeChunk(writer, "IDAT", compressed);
-	writeChunk(writer, "IEND", /* @__PURE__ */ new Uint8Array(0));
-	return writer.toBytes();
-}
-//#endregion
-exports.encodePng = encodePng;

package/dist/image/png-encode.d.cts

@@ -1,8 +0,0 @@
-import { RawImage } from "./png-decode.cjs";
-//#region src/image/png-encode.d.ts
-interface PngEncodeOptions {
-  readonly filter?: "none" | "adaptive";
-}
-declare function encodePng(image: RawImage, options?: PngEncodeOptions): Uint8Array<ArrayBuffer>;
-//#endregion
-export { PngEncodeOptions, encodePng };

package/dist/image/png-encode.d.ts

@@ -1,8 +0,0 @@
-import { RawImage } from "./png-decode.js";
-//#region src/image/png-encode.d.ts
-interface PngEncodeOptions {
-  readonly filter?: "none" | "adaptive";
-}
-declare function encodePng(image: RawImage, options?: PngEncodeOptions): Uint8Array<ArrayBuffer>;
-//#endregion
-export { PngEncodeOptions, encodePng };

package/dist/image/png-encode.js

@@ -1,63 +0,0 @@
-import { ByteWriter, concatBytes } from "../bytes/writer.js";
-import { deflate } from "../bytes/flate.js";
-import { filterScanlines } from "./png-filter.js";
-import { crc32 } from "../bytes/crc32.js";
-//#region src/image/png-encode.ts
-const PNG_SIGNATURE = new Uint8Array([
-	137,
-	80,
-	78,
-	71,
-	13,
-	10,
-	26,
-	10
-]);
-function u32be(value) {
-	const bytes = /* @__PURE__ */ new Uint8Array(4);
-	new DataView(bytes.buffer).setUint32(0, value);
-	return bytes;
-}
-function writeChunk(writer, type, data) {
-	const typeBytes = new TextEncoder().encode(type);
-	writer.writeBytes(u32be(data.length));
-	writer.writeBytes(typeBytes);
-	writer.writeBytes(data);
-	writer.writeBytes(u32be(crc32(concatBytes([typeBytes, data]))));
-}
-function colorTypeFor(image) {
-	if (image.channels === 1) return image.alpha === void 0 ? 0 : 4;
-	return image.alpha === void 0 ? 2 : 6;
-}
-function encodePng(image, options = {}) {
-	const { width, height, channels, data, alpha } = image;
-	const outChannels = alpha === void 0 ? channels : channels + 1;
-	const bytesPerRow = width * outChannels;
-	const pixelCount = width * height;
-	const interleaved = new Uint8Array(pixelCount * outChannels);
-	for (let i = 0; i < pixelCount; i++) {
-		const srcBase = i * channels;
-		const dstBase = i * outChannels;
-		for (let c = 0; c < channels; c++) interleaved[dstBase + c] = data[srcBase + c];
-		if (alpha !== void 0) interleaved[dstBase + channels] = alpha[i];
-	}
-	const filtered = filterScanlines(interleaved, height, bytesPerRow, outChannels, options.filter ?? "adaptive");
-	const compressed = deflate(filtered);
-	const ihdr = /* @__PURE__ */ new Uint8Array(13);
-	const ihdrView = new DataView(ihdr.buffer);
-	ihdrView.setUint32(0, width);
-	ihdrView.setUint32(4, height);
-	ihdr[8] = 8;
-	ihdr[9] = colorTypeFor(image);
-	ihdr[10] = 0;
-	ihdr[11] = 0;
-	ihdr[12] = 0;
-	const writer = new ByteWriter();
-	writer.writeBytes(PNG_SIGNATURE);
-	writeChunk(writer, "IHDR", ihdr);
-	writeChunk(writer, "IDAT", compressed);
-	writeChunk(writer, "IEND", /* @__PURE__ */ new Uint8Array(0));
-	return writer.toBytes();
-}
-//#endregion
-export { encodePng };