[Security] Out-of-bounds heap read via raw buffer size mismatch

## Summary `VImage::new_from_memory()` at `src/common.cc:459` is called with user-declared raw dimensions (`width * height * channels`), but neither the JS layer (`lib/input.js:178-184`) nor the C++ layer validates that the buffer is large enough for the declared dimensions. A small buffer paired with large declared dimensions causes an **out-of-bounds heap read**. ## Reproduction ```js const sharp = require('sharp'); // 10-byte buffer declared as 100x100x3 = 30000 bytes const small = Buffer.alloc(10); await sharp(small, { raw: { width: 100, height: 100, channels: 3 } }).toBuffer(); // Reads 29990 bytes past the buffer boundary ``` ## Impact - Heap data leakage into output image pixels (information disclosure) - Process crash via segfault (DoS) - Affects any application accepting user-controlled raw image dimensions ## Suggested Fix Add a byte-size check before calling `new_from_memory`: ```cpp if (bufferLength < static_cast<size_t>(width) * height * channels * sizeof_depth) { return Error("Raw buffer too small for declared dimensions"); } ``` --- Found during automated security audit.