fix: PNG/APNG CRC verification, GIF bounds check, adjustBrightness LUT hoisting, PAM docs

[Copilot]

• Explore codebase and identify low-hanging fruit from TODO.md
• L3: Move adjustBrightness clamp LUT to module-level constant (performance)
• L4: Replace GIF background color || 0 with explicit bounds check (robustness)
• L2: Improve PAM decoder JSDoc to document DEPTH/MAXVAL constraints (docs)
• L1: Add PNG/APNG CRC verification during decode (correctness)
• Fix security test to use valid IHDR CRC for crafted oversized PNG
• Update CHANGELOG.md and TODO.md
• Fix CI failure: reformat TODO.md to pass deno fmt --check
• Address review: use subarray instead of slice for CRC verification in png.ts and apng.ts
• Address review: add overflow-safe bounds checks in all PNG/APNG chunk parsing loops
• Address review: use Math.round for negative-safe rounding in adjustBrightness
• Precommit validation (626 tests pass)

[Hexagon]

@copilot have a look at the ci failure

[Copilot]

Pull request overview

This PR addresses several low-severity TODO findings by improving image decoding correctness/robustness, reducing a small recurring allocation in image processing, and clarifying PAM decoder limitations.

Changes:

• Added CRC32 verification for PNG/APNG chunk parsing during decode and metadata extraction, and updated the existing security test PNG to include a correct IHDR CRC.
• Hardened GIF background color selection by replacing || 0 fallbacks with an explicit palette-bounds check.
• Hoisted adjustBrightness() clamp LUT to module scope to avoid per-call reconstruction, and documented PAM decoder’s supported subset.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/utils/security.test.ts	Updates crafted PNG test bytes to include a correct IHDR CRC so the oversized-dimension check remains exercised.
src/utils/image_processing.ts	Hoists brightness clamp LUT to module scope and updates adjustBrightness() to use it.
src/utils/gif_decoder.ts	Adds explicit bounds checking for background palette index lookups.
src/formats/png.ts	Verifies CRC for each parsed chunk in decode() and extractMetadata().
src/formats/apng.ts	Verifies CRC for each parsed chunk in APNG first-pass decode and extractMetadata().
src/formats/pam.ts	Adds JSDoc describing the supported PAM subset and expected errors for unsupported variants.
TODO.md	Marks the addressed TODO items as fixed and summarizes the implemented fixes.
CHANGELOG.md	Documents the new CRC verification, GIF bounds check, and LUT hoisting behavior changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

CRC verification uses data.slice(...), which copies the chunk bytes for every chunk during metadata extraction. Prefer data.subarray(typePos, typePos + 4 + length) (with an upfront bounds check) to avoid extra allocations and reduce overhead.

Suggested change

	if (storedCrc !== this.crc32(data.slice(typePos, typePos + 4 + length))) {
	if (
	storedCrc !== this.crc32(data.subarray(typePos, typePos + 4 + length))
	) {

[Copilot]

adjustInt is computed with (adjust + 0.5) | 0, which only matches Math.round for positive values. Since amount can be negative, this yields incorrect rounding for negative brightness adjustments (e.g., -10.2 rounds to -9), which slightly skews results. Use Math.round(adjust) (or a sign-aware bitwise rounding) to keep brightness adjustment symmetric for negative/positive amounts.

Suggested change

	// Use bitwise OR for fast rounding (equivalent to Math.round for positive numbers)
	const adjustInt = (adjust + 0.5) | 0;
	// Use symmetric rounding so negative and positive brightness adjustments behave consistently
	const adjustInt = Math.round(adjust);

[Copilot]

In PNGFormat.decode's chunk loop there is no bounds check that pos + length + 4 is within data.length before slicing chunk data and reading the stored CRC. Because readUint32 treats out-of-range reads as zero, a truncated chunk can be misclassified as a CRC failure (and can even be bypassed if the computed CRC happens to be 0), and chunkData can be shorter than the declared length. Add an explicit bounds check (similar to extractMetadata's if (pos + length + 4 > data.length) ...) and throw a clear truncation/invalid chunk error before CRC verification.

[Copilot]

CRC verification currently computes this.crc32(data.slice(typePos, typePos + 4 + length)), which allocates a new Uint8Array for every chunk. Since crc32 only reads, prefer data.subarray(typePos, typePos + 4 + length) (after bounds validation) to avoid per-chunk copies during metadata extraction.

Suggested change

	if (storedCrc !== this.crc32(data.slice(typePos, typePos + 4 + length))) {
	if (
	storedCrc !== this.crc32(data.subarray(typePos, typePos + 4 + length))
	) {

[Copilot]

APNGFormat.decodeFrames first-pass chunk parsing does not validate that there are at least 8 bytes for length+type, nor that pos + length + 4 is within data.length before slicing chunk data and reading the stored CRC. With readUint32's out-of-range behavior, truncated/corrupt inputs can be mis-parsed and can produce misleading CRC errors (or be bypassed if CRC reads as 0). Add the same bounds checks used in extractMetadata before reading type/data/CRC, and throw a clear truncation/invalid chunk error.

[Copilot]

@copilot have a look at the ci failure

Fixed in 8341271. The CI was failing because deno fmt --check found overly-long lines in TODO.md introduced by the previous commit. Ran deno fmt on the file to reformat it.

[Hexagon]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied all 5 review comments in commits 54bf326 and e583259:

• png.ts decode loop: Added if (pos + 8 > data.length) break and overflow-safe length > data.length - pos - 4 bounds check before CRC verification
• png.ts extractMetadata: Switched data.slice() → data.subarray() for CRC, and overflow-safe bounds check
• apng.ts decodeFrames first-pass: Added both pos + 8 and overflow-safe length > data.length - pos - 4 bounds checks before CRC
• apng.ts extractMetadata: Switched data.slice() → data.subarray() for CRC, and overflow-safe bounds check
• image_processing.ts: Changed (adjust + 0.5) | 0 → Math.round(adjust) for correct negative brightness rounding

All 626 tests pass.