# Corresponding sources for the browser HEIC decoder

The exact heic-to 1.6.6 npm source archive includes src/index.js, src/worker.js,
src/lib/libheif-without-unsafe-eval.js, esbuild.mjs, LICENSE and the upstream
README build instructions. Its libheif header identifies libheif 1.23.6 built
with libde265 1.0.16. Both corresponding native source trees are included here
as unmodified archives with their licenses and build scripts.

Follow the heic-to README and libheif build-emscripten.sh with
LIBDE265_VERSION=1.0.16 USE_UNSAFE_EVAL=0 USE_WASM=0. Build heic-to with its
esbuild.mjs to obtain the CSP bundle. The original generated decoder JS is
also present in the heic-to source archive, so modifications to the JavaScript
wrapper can be rebuilt without rebuilding the native decoder.

ClairPDF modification, 2026-10-11: guard decoded pixel dimensions immediately
before ImageData allocation. Build the upstream CSP bundle, then run
`python guard-patch.py path/to/heic-to-csp.min.js` using the adjacent LGPL patch.
All upstream copyrights and licenses remain.
You may replace and modify the LGPL decoder using browser development tools;
ClairPDF imposes no additional restriction on those permissions.