Fix pixel change record bounds check

From cursor review: Insufficient bounds checking
for pixel change records (type 2) in renderTileToPixels,
extractAvailableTicks, and parseTileData. The code
checks for 6 bytes of header data but reads 10 bytes
(tick, pixelCount, newColor, oldColor), potentially
leading to reading out of bounds. The check should
be offset + 10 > tileData.length.

plugins/minimap/tile-utils.ts

@@ -243,7 +243,7 @@ function processPixelData(
 	currentPixels: Uint16Array,
 	maxTick?: number
 ): { success: boolean; newOffset: number } {
-	if (offset + 6 > tileData.length) {
+	if (offset + 10 > tileData.length) {
 		return { success: false, newOffset: offset };
 	}
 
@@ -370,7 +370,7 @@ export function extractAvailableTicks(tileData: BinaryData): number[] {
 			offset += 2;
 			offset += length; // Skip chunk data
 		} else if (type === 2) { // Pixels
-			if (offset + 6 > tileData.length) {
+			if (offset + 10 > tileData.length) {
 				break;
 			}
 
@@ -533,7 +533,7 @@ function parsePixelChangeRecord(
 	pixelChanges: PixelChangeRecord[],
 	ticks: Set<number>
 ): { success: boolean; newOffset: number } {
-	if (offset + 6 > tileData.length) {
+	if (offset + 10 > tileData.length) {
 		return { success: false, newOffset: offset };
 	}
 

plugins/minimap/webpack.config.js

@@ -3,6 +3,7 @@ const path = require("path");
 const webpack = require("webpack");
 const { merge } = require("webpack-merge");
 
+// eslint-disable-next-line node/no-unpublished-require
 const common = require("@clusterio/web_ui/webpack.common");
 
 module.exports = (env = {}) => merge(common(env), {
@@ -32,4 +33,4 @@ module.exports = (env = {}) => merge(common(env), {
 	optimization: {
 		chunkIds: "named",
 	},
-}); 
+});