wasm: range answers are read with a hard limit, not buffered whole

remote.js read every 206 body (the probe and each range) with
resp.arrayBuffer() and checked its length afterwards, so a hostile
server could make the page buffer gigabytes before the check failed.

Every body is now piped through a TransformStream that errors as soon as
the count passes the limit, which cancels the body (and the request):
the requested range length for a 206, maxDownload for the 200 fallback.
A declared Content-Length past the limit is refused before reading. The
200 path now always streams (it read a declared length at once, because
a reader loop stalls on small bodies in headless Chromium under
--virtual-time-budget; a pipe does not).

Test (test.mjs): a probe and a range answered with a 64 MiB body read at
most the range + one 64 KiB piece; before, all 64 MiB were read ("asked
for the first 1048576 bytes of 2000000, got 67108864").

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

examples/wasm-viewer/test/test.mjs

@@ -322,6 +322,7 @@ async function remoteTests() {
   }, /unusable Content-Range/, "unusable Content-Range");
 
   await limitTests();
+  await floodTests();
 
   // Corpus files: what the viewer can show of each is the same read by
   // ranges as in memory (an error wherever it gives one).
@@ -411,6 +412,57 @@ async function limitTests() {
   }
 }
 
+// A body of `total` bytes in 64 KiB pieces, made as they are read; `pulled()`
+// tells how many were.
+function flood(total) {
+  let pulled = 0;
+  const body = new ReadableStream({
+    pull(c) {
+      if (pulled >= total) return c.close();
+      const n = Math.min(65536, total - pulled);
+      pulled += n;
+      c.enqueue(new Uint8Array(n));
+    },
+  }, { highWaterMark: 0 });
+  return { body, pulled: () => pulled };
+}
+
+// A 206 whose body runs past the range asked for is cut off as it arrives:
+// the page never reads (or holds) more than it asked for, whatever the
+// server sends. 64 MiB stands for "gigabytes".
+async function floodTests() {
+  const FLOOD = 64 << 20;
+  // The probe: asked for the first 1 MiB.
+  let f = flood(FLOOD);
+  await fails(() => pkg.openUrl("http://flood.invalid/x.h5", {
+    fetch: async () => new Response(f.body, { status: 206, headers: { "Content-Range": "bytes 0-1048575/2000000" } }),
+  }), /the server sent more/, "flooded probe");
+  assert.ok(f.pulled() <= (1 << 20) + 65536, `probe: read ${f.pulled()} bytes`);
+  // A range request after a correct probe.
+  f = flood(FLOOD);
+  const file = await pkg.openUrl(`${base}/fix/fixture.h5`, {
+    blockSize: 512,
+    fetch: async (url, init) => {
+      const range = new Headers(init.headers).get("Range");
+      if (range === "bytes=0-511") return fetch(url, init);
+      const m = /^bytes=(\d+)-(\d+)$/.exec(range);
+      return new Response(f.body, { status: 206, headers: { "Content-Range": `bytes ${m[1]}-${m[2]}/25752` } });
+    },
+  }).catch((e) => e);
+  // The open itself may need a second range: flooded either way.
+  const read = file instanceof Error ? Promise.reject(file) : file.read("/grid");
+  await fails(() => read, /the server sent more/, "flooded range");
+  assert.ok(f.pulled() <= 8 * 512 + 65536, `range: read ${f.pulled()} bytes`);
+  // A declared Content-Length past the range is refused before reading.
+  f = flood(FLOOD);
+  await fails(() => pkg.openUrl("http://flood.invalid/x.h5", {
+    fetch: async () => new Response(f.body, {
+      status: 206, headers: { "Content-Range": "bytes 0-1048575/2000000", "Content-Length": String(FLOOD) },
+    }),
+  }), /the server sent more/, "declared too long");
+  assert.ok(f.pulled() <= 65536, `declared: read ${f.pulled()} bytes`);
+}
+
 function hdf5Files(dir, out) {
   for (const e of readdirSync(dir, { withFileTypes: true })) {
     const p = join(dir, e.name);