pptx-react-viewer 1.1.3 → 1.1.5

package/node_modules/mtx-decompressor/dist/index.mjs

@@ -591,14 +591,8 @@ function decodeSimpleGlyph(numContours, streams, out, calcBBox, minX, minY, maxX
     const flag = flagBytes[i];
     onCurve[i] = flag & 128 ? 0 : 1;
     const enc = TRIPLET_ENCODINGS[flag & 127];
-    const extraBytes = enc.byteCount - 1;
-    const subBuf = new Uint8Array(extraBytes);
-    for (let b = 0; b < extraBytes; b++) {
-      subBuf[b] = sGlyph.readU8();
-    }
-    const sub = new Stream(subBuf, extraBytes);
-    let dx = sub.readNBits(enc.xBits) + enc.deltaX;
-    let dy = sub.readNBits(enc.yBits) + enc.deltaY;
+    let dx = sGlyph.readNBits(enc.xBits) + enc.deltaX;
+    let dy = sGlyph.readNBits(enc.yBits) + enc.deltaY;
     if (enc.xSign !== 0) {
       dx *= enc.xSign;
     }
@@ -1156,6 +1150,8 @@ var MAX_2BYTE_DIST = 512;
 var PRELOAD_SIZE = 2 * 32 * 96 + 4 * 256;
 var LEN_MIN = 2;
 var DIST_MIN = 1;
+var MAX_OUT_LEN = 4 * 1024 * 1024;
+var MAX_OUT = 16 * 1024 * 1024;
 var RLE_INITIAL = 0;
 var RLE_NORMAL = 1;
 var RLE_SEEN_ESCAPE = 2;
@@ -1165,6 +1161,9 @@ function setDistRange(length) {
   let distMax = DIST_MIN + ((1 << DIST_WIDTH * numDistRanges) - 1);
   while (distMax < length) {
     numDistRanges++;
+    if (numDistRanges > 8) {
+      throw new Error("LZCOMP setDistRange: numDistRanges exceeds bound (8)");
+    }
     distMax = DIST_MIN + ((1 << DIST_WIDTH * numDistRanges) - 1);
   }
   const DUP2 = 256 + (1 << LEN_WIDTH) * numDistRanges;
@@ -1195,7 +1194,11 @@ function decodeLength(lenEcoder, symbol, numDistRangesOut) {
   let firstTime = true;
   let value = 0;
   let done;
+  let iters = 0;
   do {
+    if (++iters > 16) {
+      throw new Error("LZCOMP decodeLength: iteration cap exceeded");
+    }
     let bits;
     if (firstTime) {
       bits = symbol - 256;
@@ -1234,6 +1237,9 @@ function lzcompDecompress(data, size, version) {
   const distEcoder = new AHuff(bio, 1 << DIST_WIDTH);
   const lenEcoder = new AHuff(bio, 1 << LEN_WIDTH);
   const outLen = bio.readValue(24);
+  if (outLen > MAX_OUT_LEN) {
+    throw new Error(`LZCOMP outLen ${outLen} exceeds maximum (${MAX_OUT_LEN})`);
+  }
   const { DUP2, DUP4, DUP6, NUM_SYMS } = setDistRange(outLen);
   const symEcoder = new AHuff(bio, NUM_SYMS);
   const windowSize = PRELOAD_SIZE + outLen;
@@ -1250,6 +1256,9 @@ function lzcompDecompress(data, size, version) {
     if (!usingRunLength) {
       if (outIdx >= outBufSize) {
         outBufSize += outBufSize >>> 1;
+        if (outBufSize > MAX_OUT) {
+          throw new Error("LZCOMP output exceeds maximum size budget");
+        }
         const tmp = new Uint8Array(outBufSize);
         tmp.set(outBuf);
         outBuf = tmp;
@@ -1268,6 +1277,9 @@ function lzcompDecompress(data, size, version) {
         } else {
           if (outIdx >= outBufSize) {
             outBufSize += outBufSize >>> 1;
+            if (outBufSize > MAX_OUT) {
+              throw new Error("LZCOMP output exceeds maximum size budget");
+            }
             const tmp = new Uint8Array(outBufSize);
             tmp.set(outBuf);
             outBuf = tmp;
@@ -1280,6 +1292,9 @@ function lzcompDecompress(data, size, version) {
         if (rleCount === 0) {
           if (outIdx >= outBufSize) {
             outBufSize += outBufSize >>> 1;
+            if (outBufSize > MAX_OUT) {
+              throw new Error("LZCOMP output exceeds maximum size budget");
+            }
             const tmp = new Uint8Array(outBufSize);
             tmp.set(outBuf);
             outBuf = tmp;
@@ -1293,6 +1308,9 @@ function lzcompDecompress(data, size, version) {
       case RLE_NEED_BYTE: {
         if (outIdx + rleCount > outBufSize) {
           outBufSize = outIdx + rleCount + (outBufSize >>> 1);
+          if (outBufSize > MAX_OUT) {
+            throw new Error("LZCOMP output exceeds maximum size budget");
+          }
           const tmp = new Uint8Array(outBufSize);
           tmp.set(outBuf);
           outBuf = tmp;
@@ -1456,11 +1474,23 @@ function dumpContainer(ctr) {
 // src/mtx-decompress.ts
 var ENCRYPTION_KEY = 80;
 function unpackMtx(data, size) {
+  if (size < 10 || data.length < 10) {
+    throw new Error("MTX data too small: header requires at least 10 bytes");
+  }
   const versionMagic = data[0];
   const offset2 = data[4] << 16 | data[5] << 8 | data[6];
   const offset3 = data[7] << 16 | data[8] << 8 | data[9];
+  if (offset2 < 10 || offset3 < offset2 || offset3 > size) {
+    throw new Error(
+      `MTX header offsets out of bounds: offset2=${offset2}, offset3=${offset3}, size=${size}`
+    );
+  }
   const offsets = [10, offset2, offset3];
-  const blockSizes = [offset2 - 10, offset3 - offset2, size - offset3];
+  const blockSizes = [
+    Math.max(0, offset2 - 10),
+    Math.max(0, offset3 - offset2),
+    Math.max(0, size - offset3)
+  ];
   const streams = [];
   const decompressedSizes = [];
   for (let i = 0; i < 3; i++) {

package/node_modules/mtx-decompressor/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "mtx-decompressor",
-	"version": "1.1.3",
+	"version": "1.1.5",
 	"description": "MicroType Express (MTX) font decompressor — extracts TTF/OTF from compressed EOT containers.",
 	"homepage": "https://github.com/ChristopherVR/pptx-viewer",
 	"bugs": {
@@ -39,6 +39,6 @@
 	"devDependencies": {
 		"tsup": "^8.5.1",
 		"typescript": "^5.9.3",
-		"vitest": "^4.1.0"
+		"vitest": "^4.1.5"
 	}
 }

package/node_modules/pptx-viewer-core/dist/{SvgExporter-BMjoxMDV.d.ts → SvgExporter-0TxiiorD.d.ts}

@@ -1,4 +1,4 @@
-import { m as PptxData, P as PptxElement, K as TextSegment, l as PptxSlide } from './presentation-CchuDGfU.js';
+import { m as PptxData, P as PptxElement, K as TextSegment, l as PptxSlide } from './presentation-ArhfImJ5.js';
 
 /**
  * Platform adapter for file system operations.

package/node_modules/pptx-viewer-core/dist/{SvgExporter-z6AbXRQg.d.mts → SvgExporter-BQ4KbRO9.d.mts}

@@ -1,4 +1,4 @@
-import { m as PptxData, P as PptxElement, K as TextSegment, l as PptxSlide } from './presentation-CchuDGfU.mjs';
+import { m as PptxData, P as PptxElement, K as TextSegment, l as PptxSlide } from './presentation-ArhfImJ5.mjs';
 
 /**
  * Platform adapter for file system operations.

package/node_modules/pptx-viewer-core/dist/cli/index.d.mts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { F as FindResult, M as MergeOptions } from '../text-operations-CeukUztU.mjs';
-import '../presentation-CchuDGfU.mjs';
+import { F as FindResult, M as MergeOptions } from '../text-operations-CLj-sJyk.mjs';
+import '../presentation-ArhfImJ5.mjs';
 
 /**
  * CLI command handlers for pptx-cli.

package/node_modules/pptx-viewer-core/dist/cli/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { F as FindResult, M as MergeOptions } from '../text-operations-e7JxgI5l.js';
-import '../presentation-CchuDGfU.js';
+import { F as FindResult, M as MergeOptions } from '../text-operations-rhJV-A_W.js';
+import '../presentation-ArhfImJ5.js';
 
 /**
  * CLI command handlers for pptx-cli.

package/node_modules/pptx-viewer-core/dist/converter/index.d.mts

@@ -1,6 +1,6 @@
-import { T as TextSegmentRenderer } from '../SvgExporter-z6AbXRQg.mjs';
-export { C as ConversionOptions, a as ConversionResult, D as DocumentConverter, F as FileSystemAdapter, M as MediaContext, P as PptxConverterOptions, b as PptxMarkdownConverter, S as SlideProcessor, c as SlideProcessorOptions, d as SvgExportOptions, e as SvgExporter, f as dataUrlToMediaBytes, g as deriveOutputPath, h as generateMediaFilename, i as getDirectory, n as normalizePath } from '../SvgExporter-z6AbXRQg.mjs';
-import { l as PptxSlide } from '../presentation-CchuDGfU.mjs';
+import { T as TextSegmentRenderer } from '../SvgExporter-BQ4KbRO9.mjs';
+export { C as ConversionOptions, a as ConversionResult, D as DocumentConverter, F as FileSystemAdapter, M as MediaContext, P as PptxConverterOptions, b as PptxMarkdownConverter, S as SlideProcessor, c as SlideProcessorOptions, d as SvgExportOptions, e as SvgExporter, f as dataUrlToMediaBytes, g as deriveOutputPath, h as generateMediaFilename, i as getDirectory, n as normalizePath } from '../SvgExporter-BQ4KbRO9.mjs';
+import { l as PptxSlide } from '../presentation-ArhfImJ5.mjs';
 
 /**
  * Renders slide-level metadata sections (transition, animations,

package/node_modules/pptx-viewer-core/dist/converter/index.d.ts

@@ -1,6 +1,6 @@
-import { T as TextSegmentRenderer } from '../SvgExporter-BMjoxMDV.js';
-export { C as ConversionOptions, a as ConversionResult, D as DocumentConverter, F as FileSystemAdapter, M as MediaContext, P as PptxConverterOptions, b as PptxMarkdownConverter, S as SlideProcessor, c as SlideProcessorOptions, d as SvgExportOptions, e as SvgExporter, f as dataUrlToMediaBytes, g as deriveOutputPath, h as generateMediaFilename, i as getDirectory, n as normalizePath } from '../SvgExporter-BMjoxMDV.js';
-import { l as PptxSlide } from '../presentation-CchuDGfU.js';
+import { T as TextSegmentRenderer } from '../SvgExporter-0TxiiorD.js';
+export { C as ConversionOptions, a as ConversionResult, D as DocumentConverter, F as FileSystemAdapter, M as MediaContext, P as PptxConverterOptions, b as PptxMarkdownConverter, S as SlideProcessor, c as SlideProcessorOptions, d as SvgExportOptions, e as SvgExporter, f as dataUrlToMediaBytes, g as deriveOutputPath, h as generateMediaFilename, i as getDirectory, n as normalizePath } from '../SvgExporter-0TxiiorD.js';
+import { l as PptxSlide } from '../presentation-ArhfImJ5.js';
 
 /**
  * Renders slide-level metadata sections (transition, animations,