From 14f69cda11bdde9c33c3d5b3b6a25441e0a27f74 Mon Sep 17 00:00:00 2001
From: Danielv123 <danielv@danielv.no>
Date: Mon, 21 Jul 2025 19:18:59 +0200
Subject: [PATCH] Fix pixel change record bounds check

From cursor review: Insufficient bounds checking
for pixel change records (type 2) in renderTileToPixels,
extractAvailableTicks, and parseTileData. The code
checks for 6 bytes of header data but reads 10 bytes
(tick, pixelCount, newColor, oldColor), potentially
leading to reading out of bounds. The check should
be offset + 10 > tileData.length.
---
 plugins/minimap/tile-utils.ts     | 6 +++---
 plugins/minimap/webpack.config.js | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/plugins/minimap/tile-utils.ts b/plugins/minimap/tile-utils.ts
index 68e2d809..7e6f22e5 100644
--- a/plugins/minimap/tile-utils.ts
+++ b/plugins/minimap/tile-utils.ts
@@ -243,7 +243,7 @@ function processPixelData(
 	currentPixels: Uint16Array,
 	maxTick?: number
 ): { success: boolean; newOffset: number } {
-	if (offset + 6 > tileData.length) {
+	if (offset + 10 > tileData.length) {
 		return { success: false, newOffset: offset };
 	}
 
@@ -370,7 +370,7 @@ export function extractAvailableTicks(tileData: BinaryData): number[] {
 			offset += 2;
 			offset += length; // Skip chunk data
 		} else if (type === 2) { // Pixels
-			if (offset + 6 > tileData.length) {
+			if (offset + 10 > tileData.length) {
 				break;
 			}
 
@@ -533,7 +533,7 @@ function parsePixelChangeRecord(
 	pixelChanges: PixelChangeRecord[],
 	ticks: Set<number>
 ): { success: boolean; newOffset: number } {
-	if (offset + 6 > tileData.length) {
+	if (offset + 10 > tileData.length) {
 		return { success: false, newOffset: offset };
 	}
 
diff --git a/plugins/minimap/webpack.config.js b/plugins/minimap/webpack.config.js
index 25683b47..e24e8817 100644
--- a/plugins/minimap/webpack.config.js
+++ b/plugins/minimap/webpack.config.js
@@ -3,6 +3,7 @@ const path = require("path");
 const webpack = require("webpack");
 const { merge } = require("webpack-merge");
 
+// eslint-disable-next-line node/no-unpublished-require
 const common = require("@clusterio/web_ui/webpack.common");
 
 module.exports = (env = {}) => merge(common(env), {
@@ -32,4 +33,4 @@ module.exports = (env = {}) => merge(common(env), {
 	optimization: {
 		chunkIds: "named",
 	},
-}); 
+});