fix: update itk-wasm to resolve WASM and JSON parse errors

Bump itk-wasm to ^1.0.0-b.197 and @itk-wasm/image-io to 1.6.1. The
upstream update fixes a signed-pointer overflow in Emscripten ccall
that triggered a RangeError when reading an embedded .nii.gz labelmap
from a session zip whose base image had already grown the shared
worker's WASM heap past 2GB.

Also drop the control-character sanitize patch for itk-wasm's JSON
output. The upstream fix in InsightSoftwareConsortium/ITK-Wasm#1457
sanitizes invalid UTF-8 and control characters in metadata at the C++
source, so the JS-side workaround is no longer needed. Verified with
the corrupt_dates.dcm fixture from ITK-Wasm#1454 — loads without
JSON.parse errors using the plain b.197 build.

closes #852

Author: PaulHax

package-lock.json

@@ -34,7 +34,7 @@
     "@aws-sdk/client-s3": "^3.940.0",
     "@eslint/js": "^9.39.1",
     "@itk-wasm/dicom": "^7.6.4",
-    "@itk-wasm/image-io": "1.6.0",
+    "@itk-wasm/image-io": "1.6.1",
     "@itk-wasm/morphological-contour-interpolation": "2.0.0",
     "@kitware/vtk.js": "^32.12.1",
     "@netlify/edge-functions": "^3.0.2",
@@ -74,7 +74,7 @@
     "gl-matrix": "3.4.3",
     "globals": "^16.2.0",
     "happy-dom": "^20.0.11",
-    "itk-wasm": "^1.0.0-b.196",
+    "itk-wasm": "^1.0.0-b.197",
     "jszip": "3.10.1",
     "lint-staged": "16.2.7",
     "mitt": "^3.0.1",

package.json

@@ -0,0 +1,195 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as zlib from 'node:zlib';
+import JSZip from 'jszip';
+import { cleanuptotal } from 'wdio-cleanuptotal-service';
+import { volViewPage } from '../pageobjects/volview.page';
+import { DOWNLOAD_TIMEOUT, TEMP_DIR } from '../../wdio.shared.conf';
+
+const writeBufferToFile = async (data: Buffer, fileName: string) => {
+  const filePath = path.join(TEMP_DIR, fileName);
+  await fs.promises.writeFile(filePath, data);
+  cleanuptotal.addCleanup(async () => {
+    if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+  });
+  return filePath;
+};
+
+const createNiftiGz = (
+  dimX: number,
+  dimY: number,
+  dimZ: number,
+  datatype: number,
+  bitpix: number
+) => {
+  const bytesPerVoxel = bitpix / 8;
+  const header = Buffer.alloc(352);
+
+  header.writeInt32LE(348, 0);
+  header.writeInt16LE(3, 40);
+  header.writeInt16LE(dimX, 42);
+  header.writeInt16LE(dimY, 44);
+  header.writeInt16LE(dimZ, 46);
+  header.writeInt16LE(1, 48);
+  header.writeInt16LE(1, 50);
+  header.writeInt16LE(1, 52);
+  header.writeInt16LE(datatype, 70);
+  header.writeInt16LE(bitpix, 72);
+  header.writeFloatLE(1, 76);
+  header.writeFloatLE(1, 80);
+  header.writeFloatLE(1, 84);
+  header.writeFloatLE(1, 88);
+  header.writeFloatLE(352, 108);
+  header.writeFloatLE(1, 112);
+  header.writeInt16LE(1, 254);
+  header.writeFloatLE(1, 280);
+  header.writeFloatLE(0, 284);
+  header.writeFloatLE(0, 288);
+  header.writeFloatLE(0, 292);
+  header.writeFloatLE(0, 296);
+  header.writeFloatLE(1, 300);
+  header.writeFloatLE(0, 304);
+  header.writeFloatLE(0, 308);
+  header.writeFloatLE(0, 312);
+  header.writeFloatLE(0, 316);
+  header.writeFloatLE(1, 320);
+  header.writeFloatLE(0, 324);
+  header.write('n+1\0', 344, 'binary');
+
+  const imageData = Buffer.alloc(dimX * dimY * dimZ * bytesPerVoxel);
+  return zlib.gzipSync(Buffer.concat([header, imageData]), { level: 1 });
+};
+
+const createSessionZip = async (
+  baseFileName: string,
+  labelmapNiftiGz: Buffer
+) => {
+  const manifest = {
+    version: '6.2.0',
+    dataSources: [
+      {
+        id: 0,
+        type: 'uri',
+        uri: `/tmp/${baseFileName}`,
+        name: baseFileName,
+      },
+    ],
+    datasets: [{ id: '0', dataSourceId: 0 }],
+    segmentGroups: [
+      {
+        id: 'seg-1',
+        path: 'labels/seg-1.nii.gz',
+        metadata: {
+          name: 'Annotation',
+          parentImage: '0',
+          segments: {
+            order: [1],
+            byValue: {
+              '1': {
+                value: 1,
+                name: 'Label 1',
+                color: [255, 0, 0, 255],
+                visible: true,
+              },
+            },
+          },
+        },
+      },
+    ],
+  };
+
+  const zip = new JSZip();
+  zip.file('manifest.json', JSON.stringify(manifest, null, 2));
+  zip.file('labels/seg-1.nii.gz', labelmapNiftiGz);
+  return zip.generateAsync({ type: 'nodebuffer', compression: 'STORE' });
+};
+
+/**
+ * Regression test for WASM signed pointer overflow during session restore.
+ *
+ * A .volview.zip session with a large Float32 URI-based base image and an
+ * embedded .nii.gz labelmap. The import pipeline loads the base image
+ * through the shared ITK-wasm worker, growing the WASM heap past 2GB.
+ * Then segmentGroupStore.deserialize() calls readImage() for the embedded
+ * .nii.gz labelmap on the same worker.
+ *
+ * The .nii.gz format is critical: .vti labelmaps use a separate JS
+ * reader and never touch the ITK-wasm worker.
+ *
+ * Without resetting the worker, Emscripten's ccall returns output pointers
+ * as signed i32. When pointers exceed 2^31 they wrap negative, causing:
+ *   RangeError: Start offset -N is outside the bounds of the buffer
+ *
+ * Fix: resetWorker() before deserializing labelmaps clears the heap.
+ */
+describe('Session with large URI base and nii.gz labelmap', function () {
+  this.timeout(180_000);
+
+  it('loads session with large Float32 base and embedded nii.gz labelmap', async () => {
+    const prefix = `session-large-${Date.now()}`;
+    const baseFileName = `${prefix}-base-f32.nii.gz`;
+    const sessionFileName = `${prefix}-session.volview.zip`;
+
+    // Float32 1024×1024×256 = 1GB raw — pushes WASM heap past 2GB
+    await writeBufferToFile(
+      createNiftiGz(1024, 1024, 256, 16, 32),
+      baseFileName
+    );
+
+    // UInt8 labelmap same dimensions = 256MB raw, embedded in session ZIP
+    const labelmapNiftiGz = createNiftiGz(1024, 1024, 256, 2, 8);
+    const sessionZip = await createSessionZip(baseFileName, labelmapNiftiGz);
+    await writeBufferToFile(sessionZip, sessionFileName);
+
+    const rangeErrors: string[] = [];
+    const onLogEntry = (logEntry: { text: string | null }) => {
+      const text = logEntry.text ?? '';
+      if (text.includes('RangeError')) {
+        rangeErrors.push(text);
+      }
+    };
+    browser.on('log.entryAdded', onLogEntry);
+
+    try {
+      await volViewPage.open(`?urls=[tmp/${sessionFileName}]`);
+      await volViewPage.waitForViews(DOWNLOAD_TIMEOUT * 6);
+
+      // Open the segment groups panel so the list renders in the DOM
+      const annotationsTab = await $(
+        'button[data-testid="module-tab-Annotations"]'
+      );
+      await annotationsTab.click();
+
+      const segmentGroupsTab = await $('button.v-tab*=Segment Groups');
+      await segmentGroupsTab.waitForClickable();
+      await segmentGroupsTab.click();
+
+      // Wait for the labelmap readImage to either succeed (segment group
+      // appears) or fail (RangeError in console OR error notification).
+      // The deserialization is async and finishes after views render.
+      const notifsBefore = await volViewPage.getNotificationsCount();
+
+      await browser.waitUntil(
+        async () => {
+          if (rangeErrors.length > 0) return true;
+          try {
+            const notifs = await volViewPage.getNotificationsCount();
+            if (notifs > notifsBefore) return true;
+          } catch {
+            // badge may not exist yet
+          }
+          const segmentGroups = await $$('.segment-group-list .v-list-item');
+          return (await segmentGroups.length) >= 1;
+        },
+        {
+          timeout: DOWNLOAD_TIMEOUT * 3,
+          timeoutMsg: 'Labelmap load never completed or errored',
+        }
+      );
+
+      expect(rangeErrors).toEqual([]);
+    } finally {
+      browser.off('log.entryAdded', onLogEntry);
+    }
+  });
+});