@mikrojs/native 0.18.0 → 0.18.1

package/scripts/bundle-runtime.js

@@ -89,6 +89,10 @@ async function minifyWithSwc(code) {
 
 mkdirSync(outDir, {recursive: true})
 
+// Every source file each bundle inlined, for the duplication check below.
+// name -> [{module, bytes}]
+const inlinedBy = new Map()
+
 for (const name of moduleNames) {
   // Resolve entry point: {name}/{name}.ts (core modules) or {name}.ts (board/driver)
   const nested = join(runtimeDir, name, `${name}.ts`)
@@ -105,8 +109,18 @@ for (const name of moduleNames) {
     platform: 'neutral',
     format: 'esm',
     external: ['mikro', 'mikro/*', '@mikrojs/*', 'native:*'],
+    metafile: true,
   })
 
+  for (const output of Object.values(result.metafile.outputs)) {
+    for (const [input, {bytesInOutput}] of Object.entries(output.inputs)) {
+      // Zero bytes = type-only import, erased from the output.
+      if (bytesInOutput === 0) continue
+      if (!inlinedBy.has(input)) inlinedBy.set(input, [])
+      inlinedBy.get(input).push({module: name, bytes: bytesInOutput})
+    }
+  }
+
   const output = result.outputFiles?.[0]
   if (!output) {
     // eslint-disable-next-line no-console
@@ -147,3 +161,22 @@ for (const name of moduleNames) {
   // eslint-disable-next-line no-console
   console.log(`Bundled ${name} (${Buffer.byteLength(source)} bytes, ${externals.length} externals)`)
 }
+
+// A source file inlined into more than one bundle ships (and loads) twice:
+// duplicate flash bytes and a second live module instance in RAM. It happens
+// when sibling builtins share a file via a RELATIVE import — cross-builtin
+// `mikro/*` imports stay external and link at runtime, so the fix is to give
+// the shared file its own builtin and import it as `mikro/<mod>/shared`
+// (see kv/shared and ota/shared for the pattern).
+const duplicated = [...inlinedBy.entries()].filter(([, users]) => users.length > 1)
+if (duplicated.length > 0) {
+  for (const [input, users] of duplicated) {
+    // eslint-disable-next-line no-console
+    console.error(
+      `Duplicated across bundles: ${input} — ${users
+        .map((u) => `${u.module} (${u.bytes}B)`)
+        .join(', ')}`,
+    )
+  }
+  process.exit(1)
+}

package/scripts/gen-checkin-fixtures.js

@@ -0,0 +1,323 @@
+/**
+ * Check-in wire fixtures: response bodies captured from the real reference
+ * registry, replayed by test/ota_wire_fixtures_test.cpp.
+ *
+ * The reference registry (packages/@mikrojs/registry) and the device check-in
+ * client (src/mik_ota_client.cpp) implement one wire contract with two
+ * independent test suites, and they drifted: the registry answers a
+ * nothing-new check-in with CBOR null, the C client required a map, and every
+ * quiet round on real devices failed to the 60s retry cadence while both
+ * suites stayed green (fixed in c41feb3). The C++ suite's fakes only ever
+ * produced the shapes the test author imagined — CheckinResponse{}.Encode() is
+ * always a map. These fixtures make the client's round logic consume bytes the
+ * real registry produced, so a response-shape change on either side breaks a
+ * test instead of a fleet.
+ *
+ * Deterministic and offline: fixed device id, app, versions and build bytes,
+ * and nothing clock-derived reaches a response body.
+ *
+ * Requires the registry's built dist, so run `pnpm build:ts` first.
+ *
+ * Usage: node gen-checkin-fixtures.js <outdir>
+ */
+
+import {createHash} from 'node:crypto'
+import {mkdirSync, rmSync, writeFileSync} from 'node:fs'
+import {join} from 'node:path'
+
+import {createRegistry, memoryStorage} from '@mikrojs/registry'
+
+// The registry picks its response format from the request's content-type, so a
+// fixture that captures what a device receives has to POST CBOR. The codec is
+// not part of the package's public exports; take it from beside the entry point
+// rather than growing a second encoder here.
+const {decodeCbor, encodeCbor} = await import(
+  new URL('./cbor.js', import.meta.resolve('@mikrojs/registry')).href
+)
+
+const outDir = process.argv[2]
+if (!outDir) {
+  // eslint-disable-next-line no-console
+  console.error('Usage: node gen-checkin-fixtures.js <outdir>')
+  process.exit(1)
+}
+
+const TOKEN = 'tok_fixture'
+const BASE = 'https://reg.example'
+const DEVICE_ID = 'dev-1'
+const APP = 'sensor'
+const FIRMWARE = '0.16.0'
+const BYTECODE = 42
+
+/** One defaulted leaf: valid with no operator input at all. */
+const SCHEMA = JSON.stringify({kind: 'object', shape: {interval: {kind: 'number', default: 60}}})
+
+function fresh() {
+  const storage = memoryStorage()
+  return {storage, registry: createRegistry({storage, token: TOKEN})}
+}
+
+async function publish(registry, {version, content, configSchema}) {
+  const bytes = new TextEncoder().encode(content)
+  const checksum = createHash('sha256').update(bytes).digest('hex')
+  const form = new FormData()
+  form.set('app', APP)
+  form.set('version', version)
+  form.set('checksum', checksum)
+  form.set('size', String(bytes.byteLength))
+  form.set('firmwareVersion', FIRMWARE)
+  form.set('bytecodeVersion', String(BYTECODE))
+  // A stored build is served to no device until a channel points at it.
+  form.set('channel', 'main')
+  if (configSchema !== undefined) form.set('configSchema', configSchema)
+  form.set('build', new Blob([bytes], {type: 'application/gzip'}), 'app.tgz')
+  const response = await registry.fetch(
+    new Request(`${BASE}/api/v1/builds`, {
+      method: 'POST',
+      headers: {authorization: `Bearer ${TOKEN}`},
+      body: form,
+    }),
+  )
+  if (response.status !== 201) throw new Error(`publish ${version}: ${await response.text()}`)
+  return {checksum, size: bytes.byteLength}
+}
+
+async function enroll(registry) {
+  const response = await registry.fetch(
+    new Request(`${BASE}/api/v1/devices`, {
+      method: 'POST',
+      headers: {authorization: `Bearer ${TOKEN}`, 'content-type': 'application/json'},
+      body: JSON.stringify({deviceId: DEVICE_ID, app: APP}),
+    }),
+  )
+  if (response.status !== 201) throw new Error(`enroll: ${await response.text()}`)
+  return (await response.json()).credential
+}
+
+async function putConfig(registry, body) {
+  const response = await registry.fetch(
+    new Request(`${BASE}/api/v1/devices/${DEVICE_ID}/config`, {
+      method: 'PUT',
+      headers: {authorization: `Bearer ${TOKEN}`, 'content-type': 'application/json'},
+      body: JSON.stringify(body),
+    }),
+  )
+  if (response.status !== 200) throw new Error(`putConfig: ${await response.text()}`)
+}
+
+/** A check-in body exactly as encode_report() in mik_ota_client.cpp sends it. */
+function checkin(registry, credential, extra = {}) {
+  return registry.fetch(
+    new Request(`${BASE}/api/v1/checkin`, {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${credential}`,
+        'content-type': 'application/cbor',
+        accept: 'application/cbor',
+      },
+      body: encodeCbor({
+        deviceId: DEVICE_ID,
+        firmware: FIRMWARE,
+        firmwareHash: 'fwhash',
+        bytecode: BYTECODE,
+        running: {trial: false},
+        name: [1, 'shed'],
+        free: 900000,
+        ...extra,
+      }),
+    }),
+  )
+}
+
+/** The rev the registry hands down for the running release's overlay. */
+async function revFrom(response) {
+  const body = decodeCbor(new Uint8Array(await response.arrayBuffer()))
+  return body.config.rev
+}
+
+/** What the device must conclude, with every field always present so the C++
+ *  reader stays a flat lookup. `nameRev` -1 means "no rename expected". */
+function expect({
+  result,
+  configUpdated = false,
+  offer,
+  configStaged = false,
+  nameRev = -1,
+  name = '',
+}) {
+  return {
+    result,
+    configUpdated,
+    offerUrl: offer?.url ?? '',
+    offerChecksum: offer?.checksum ?? '',
+    offerSize: offer?.size ?? 0,
+    configStaged,
+    nameRev,
+    name,
+  }
+}
+
+const scenarios = [
+  {
+    scenario: 'quiet-round',
+    note: 'nothing to offer, nothing to configure: the registry answers CBOR null',
+    expect: expect({result: 'up-to-date'}),
+    async capture() {
+      const {registry} = fresh()
+      return checkin(registry, await enroll(registry))
+    },
+  },
+  {
+    scenario: 'config-delivered',
+    note: 'an operator overlay for the running release, not yet held by the device',
+    expect: expect({result: 'up-to-date', configUpdated: true}),
+    async capture() {
+      const {registry} = fresh()
+      const build = await publish(registry, {
+        version: '1.0.0',
+        content: 'build-1.0.0',
+        configSchema: SCHEMA,
+      })
+      const credential = await enroll(registry)
+      await putConfig(registry, {values: {interval: 30}, version: '1.0.0'})
+      return checkin(registry, credential, {
+        running: {checksum: build.checksum, version: '1.0.0', trial: false},
+      })
+    },
+  },
+  {
+    scenario: 'config-rev-echoed',
+    note: 'the device echoes the rev it holds: the registry sends nothing back',
+    expect: expect({result: 'up-to-date'}),
+    async capture() {
+      const {registry} = fresh()
+      const build = await publish(registry, {
+        version: '1.0.0',
+        content: 'build-1.0.0',
+        configSchema: SCHEMA,
+      })
+      const credential = await enroll(registry)
+      await putConfig(registry, {values: {interval: 30}, version: '1.0.0'})
+      const running = {checksum: build.checksum, version: '1.0.0', trial: false}
+      const rev = await revFrom(await checkin(registry, credential, {running}))
+      return checkin(registry, credential, {running, configRev: rev})
+    },
+  },
+  {
+    scenario: 'config-cleared',
+    note: 'the overlay was removed: a config field with a version and no doc',
+    expect: expect({result: 'up-to-date', configUpdated: true}),
+    async capture() {
+      const {registry} = fresh()
+      const build = await publish(registry, {
+        version: '1.0.0',
+        content: 'build-1.0.0',
+        configSchema: SCHEMA,
+      })
+      const credential = await enroll(registry)
+      await putConfig(registry, {values: {interval: 30}, version: '1.0.0'})
+      const running = {checksum: build.checksum, version: '1.0.0', trial: false}
+      const rev = await revFrom(await checkin(registry, credential, {running}))
+      await putConfig(registry, {values: {}, version: '1.0.0'})
+      // The device still holds the delivered document, so the test seeds it.
+      this.seedConfigRev = rev
+      return checkin(registry, credential, {running, configRev: rev})
+    },
+  },
+  {
+    scenario: 'name-changed',
+    note: 'renamed registry-side at a higher revision: the pair comes back alone',
+    expect: expect({result: 'up-to-date', nameRev: 3, name: 'kitchen'}),
+    async capture() {
+      const {registry, storage} = fresh()
+      const credential = await enroll(registry)
+      const device = await storage.getDevice(DEVICE_ID)
+      await storage.putDevice({...device, name: 'kitchen', nameRev: 3})
+      return checkin(registry, credential)
+    },
+  },
+  {
+    scenario: 'offer',
+    note: 'a newer build for this firmware range',
+    async capture() {
+      const {registry} = fresh()
+      const first = await publish(registry, {version: '1.0.0', content: 'build-1.0.0'})
+      const next = await publish(registry, {version: '2.0.0', content: 'build-2.0.0'})
+      const credential = await enroll(registry)
+      this.expect = expect({
+        result: 'staged',
+        offer: {
+          url: `${BASE}/api/v1/builds/${next.checksum}.tgz`,
+          checksum: next.checksum,
+          size: next.size,
+        },
+      })
+      return checkin(registry, credential, {
+        running: {checksum: first.checksum, version: '1.0.0', trial: false},
+      })
+    },
+  },
+  {
+    scenario: 'offer-with-config',
+    note: "the offer and the offered release's config travel together (offer rule 5)",
+    async capture() {
+      const {registry} = fresh()
+      const first = await publish(registry, {
+        version: '1.0.0',
+        content: 'build-1.0.0',
+        configSchema: SCHEMA,
+      })
+      const next = await publish(registry, {
+        version: '2.0.0',
+        content: 'build-2.0.0',
+        configSchema: SCHEMA,
+      })
+      const credential = await enroll(registry)
+      await putConfig(registry, {values: {interval: 30}, version: '2.0.0'})
+      this.expect = expect({
+        result: 'staged',
+        configStaged: true,
+        offer: {
+          url: `${BASE}/api/v1/builds/${next.checksum}.tgz`,
+          checksum: next.checksum,
+          size: next.size,
+        },
+      })
+      return checkin(registry, credential, {
+        running: {checksum: first.checksum, version: '1.0.0', trial: false},
+      })
+    },
+  },
+  {
+    scenario: 'unauthorized',
+    note: 'a credential the registry does not know: 401 with a JSON error body',
+    expect: expect({result: 'unauthorized'}),
+    async capture() {
+      const {registry} = fresh()
+      await enroll(registry)
+      return checkin(registry, 'duk_wrong')
+    },
+  },
+]
+
+rmSync(outDir, {recursive: true, force: true})
+mkdirSync(outDir, {recursive: true})
+
+const manifest = []
+for (const [index, entry] of scenarios.entries()) {
+  entry.seedConfigRev = ''
+  const response = await entry.capture()
+  const body = new Uint8Array(await response.arrayBuffer())
+  const file = `${String(index + 1).padStart(2, '0')}-${entry.scenario}.cbor`
+  writeFileSync(join(outDir, file), body)
+  manifest.push({
+    file,
+    scenario: entry.scenario,
+    note: entry.note,
+    status: response.status,
+    seedConfigRev: entry.seedConfigRev,
+    expect: entry.expect,
+  })
+}
+
+writeFileSync(join(outDir, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`)

package/src/builtins.cpp

@@ -52,16 +52,15 @@ static JSModuleDef* mik__deserialize_builtin(JSContext* ctx, const char* name,
         return NULL;
     }
 
-    /* Initialize import.meta (url, env, etc.) for the builtin module */
+    /* Initialize import.meta (url, env, etc.) for the builtin module.
+     * Binding resolution is deliberately NOT done here: this runs inside
+     * the module loader, and a failing JS_ResolveModule frees every
+     * not-yet-resolved module in the context — including whatever
+     * partially-read module an outer JS_ReadModule frame still holds.
+     * The root resolve covers loader-returned modules; direct consumers
+     * (the abort lazy-loader) resolve before evaluating. */
     js_module_set_import_meta(ctx, obj, false, false);
 
-    /* Resolve imports so the module loader is called for dependencies */
-    if (JS_ResolveModule(ctx, obj) < 0) {
-        platform->log(MIK_LOG_ERROR, "mikrojs", "Failed to resolve imports for builtin '%s'", name);
-        JS_FreeValue(ctx, obj);
-        return NULL;
-    }
-
     JSModuleDef* m = static_cast<JSModuleDef*>(JS_VALUE_GET_PTR(obj));
     JS_FreeValue(ctx, obj);
 

package/src/fs.cpp

@@ -383,6 +383,9 @@ static JSValue mik__file_stat(JSContext* ctx, JSValue this_val, int argc, JSValu
         return mik__fs_err_result(ctx, EBADF, nullptr);
     }
 
+    /* Push buffered writes to the OS so fstat sees the true size */
+    fflush(fh->file);
+
     struct stat st;
     if (fstat(fileno(fh->file), &st) != 0) {
         return mik__fs_err_result(ctx, errno, nullptr);

package/src/mem.cpp

@@ -18,6 +18,34 @@
 
 #define HDR_SIZE sizeof(size_t)
 
+/* Fault injection for the host OOM tests: fail the JS-heap allocators after
+ * a countdown, and keep a net live-allocation counter across every allocator
+ * here (all of them free through mik__free, so one counter balances). */
+#ifdef MIK_OOM_INJECT
+static int64_t g_oom_countdown = -1; /* -1 = disabled */
+static int64_t g_live_allocs = 0;
+
+void mik__oom_inject_fail_after(int64_t n) {
+    g_oom_countdown = n;
+}
+
+int64_t mik__oom_inject_live_allocs(void) {
+    return g_live_allocs;
+}
+
+static bool oom_inject_should_fail(void) {
+    if (g_oom_countdown < 0) return false;
+    if (g_oom_countdown == 0) return true;
+    g_oom_countdown--;
+    return false;
+}
+#define OOM_INJECT_FAIL() oom_inject_should_fail()
+#define LIVE_ALLOCS_ADD(d) (g_live_allocs += (d))
+#else
+#define OOM_INJECT_FAIL() false
+#define LIVE_ALLOCS_ADD(d) ((void)0)
+#endif
+
 static inline size_t hdr_read(void* user) {
     size_t sz;
     memcpy(&sz, static_cast<char*>(user) - HDR_SIZE, sizeof(sz));
@@ -37,6 +65,7 @@ void* mik__malloc(size_t size) {
     void* raw = malloc(size + HDR_SIZE);
     if (!raw) return nullptr;
     hdr_write(raw, size);
+    LIVE_ALLOCS_ADD(1);
     return static_cast<char*>(raw) + HDR_SIZE;
 }
 
@@ -48,11 +77,13 @@ void* mik__calloc(size_t count, size_t size) {
     void* raw = calloc(1, total + HDR_SIZE);
     if (!raw) return nullptr;
     hdr_write(raw, total);
+    LIVE_ALLOCS_ADD(1);
     return static_cast<char*>(raw) + HDR_SIZE;
 }
 
 void mik__free(void* ptr) {
     if (!ptr) return;
+    LIVE_ALLOCS_ADD(-1);
     free(static_cast<char*>(ptr) - HDR_SIZE);
 }
 
@@ -61,6 +92,7 @@ void* mik__realloc(void* ptr, size_t size) {
     raw = realloc(raw, size + HDR_SIZE);
     if (!raw) return nullptr;
     hdr_write(raw, size);
+    if (!ptr) LIVE_ALLOCS_ADD(1);
     return static_cast<char*>(raw) + HDR_SIZE;
 }
 
@@ -82,6 +114,7 @@ bool mik__is_quickjs_heap_psram(void) {
 }
 
 void* mik__js_malloc(size_t size) {
+    if (OOM_INJECT_FAIL()) return nullptr;
     void* raw = nullptr;
     if (g_quickjs_heap_psram) {
         const MIKPlatform* p = MIK_GetPlatform();
@@ -92,10 +125,12 @@ void* mik__js_malloc(size_t size) {
     if (!raw) raw = malloc(size + HDR_SIZE);
     if (!raw) return nullptr;
     hdr_write(raw, size);
+    LIVE_ALLOCS_ADD(1);
     return static_cast<char*>(raw) + HDR_SIZE;
 }
 
 void* mik__js_calloc(size_t count, size_t size) {
+    if (OOM_INJECT_FAIL()) return nullptr;
     if (size && count > SIZE_MAX / size) return nullptr;
     size_t total = count * size;
     void* raw = nullptr;
@@ -108,10 +143,12 @@ void* mik__js_calloc(size_t count, size_t size) {
     if (!raw) raw = calloc(1, total + HDR_SIZE);
     if (!raw) return nullptr;
     hdr_write(raw, total);
+    LIVE_ALLOCS_ADD(1);
     return static_cast<char*>(raw) + HDR_SIZE;
 }
 
 void* mik__js_realloc(void* ptr, size_t size) {
+    if (OOM_INJECT_FAIL()) return nullptr;
     void* raw = ptr ? static_cast<char*>(ptr) - HDR_SIZE : nullptr;
     void* new_raw = nullptr;
     if (g_quickjs_heap_psram) {
@@ -123,5 +160,6 @@ void* mik__js_realloc(void* ptr, size_t size) {
     if (!new_raw) new_raw = realloc(raw, size + HDR_SIZE);
     if (!new_raw) return nullptr;
     hdr_write(new_raw, size);
+    if (!ptr) LIVE_ALLOCS_ADD(1);
     return static_cast<char*>(new_raw) + HDR_SIZE;
 }

package/src/mik_abort.cpp

@@ -58,7 +58,14 @@ static JSValue mik__abort_lazy_get(JSContext* ctx, JSValue this_val, int magic)
         JS_FreeValue(ctx, global_obj);
         return JS_EXCEPTION;
     }
-    JSValue ret = JS_EvalFunction(ctx, JS_DupValue(ctx, JS_MKPTR(JS_TAG_MODULE, m)));
+    /* The loader no longer resolves bindings (unsafe when nested); this is
+     * a direct evaluation, so resolve here before running the module. */
+    JSValue mod_val = JS_MKPTR(JS_TAG_MODULE, m);
+    if (JS_ResolveModule(ctx, mod_val) < 0) {
+        JS_FreeValue(ctx, global_obj);
+        return JS_EXCEPTION;
+    }
+    JSValue ret = JS_EvalFunction(ctx, JS_DupValue(ctx, mod_val));
     if (JS_IsException(ret)) {
         JS_FreeValue(ctx, global_obj);
         return JS_EXCEPTION;

package/src/mik_cbor.cpp

@@ -136,9 +136,12 @@ static JSValue mik__cbor_encode(JSContext* ctx, JSValue this_val, int argc, JSVa
 
     JSValue val = argv[0];
 
-    /* Pass 1: compute size with NULL buffer */
+    /* Pass 1: compute size with a zero-capacity buffer. The base pointer
+     * must be non-null: zero-length appends (empty strings) still reach
+     * memcpy, and memcpy(NULL, ..., 0) is undefined behavior. */
+    static uint8_t measure_base;
     nanocbor_encoder_t enc;
-    nanocbor_encoder_init(&enc, nullptr, 0);
+    nanocbor_encoder_init(&enc, &measure_base, 0);
     if (mik__cbor_encode_value(ctx, &enc, val, 0) < 0) {
         return mik__result_err_named(
             ctx, "EncodeFailed",
@@ -166,6 +169,26 @@ static JSValue mik__cbor_encode(JSContext* ctx, JSValue this_val, int argc, JSVa
 
 /* ── Decoder ────────────────────────────────────────────────────────── */
 
+/* nanocbor_at_end also reports true when the buffer runs out mid-container,
+ * so a truncated container must be caught explicitly: a definite-length
+ * container with items still remaining, or an indefinite-length one whose
+ * buffer ended before the break byte (`remaining` stays 0 for indefinite). */
+static bool mik__cbor_container_truncated(const nanocbor_value_t* container) {
+    if (nanocbor_container_indefinite(container)) {
+        return container->cur >= container->end;
+    }
+    return nanocbor_container_remaining(container) != 0;
+}
+
+/* Vendored nanocbor's _get_str checks the declared length against the bytes
+ * remaining before the length-prefix header, but returns a span starting after
+ * it, so a string truncated at the buffer tail passes the check with a span
+ * that overruns `end` by up to the header size. Reject such spans before
+ * handing them to QuickJS. */
+static bool mik__cbor_str_in_bounds(const nanocbor_value_t* val, const uint8_t* buf, size_t len) {
+    return buf != nullptr && buf <= val->end && static_cast<size_t>(val->end - buf) >= len;
+}
+
 JSValue mik__cbor_decode_value(JSContext* ctx, nanocbor_value_t* val, int depth) {
     if (depth > MIK_CBOR_MAX_DEPTH) {
         return JS_EXCEPTION;
@@ -193,14 +216,20 @@ JSValue mik__cbor_decode_value(JSContext* ctx, nanocbor_value_t* val, int depth)
         case NANOCBOR_TYPE_BSTR: {
             const uint8_t* buf = nullptr;
             size_t len = 0;
-            if (nanocbor_get_bstr(val, &buf, &len) < 0) return JS_EXCEPTION;
+            if (nanocbor_get_bstr(val, &buf, &len) < 0 ||
+                !mik__cbor_str_in_bounds(val, buf, len)) {
+                return JS_EXCEPTION;
+            }
             return JS_NewUint8ArrayCopy(ctx, buf, len);
         }
 
         case NANOCBOR_TYPE_TSTR: {
             const uint8_t* buf = nullptr;
             size_t len = 0;
-            if (nanocbor_get_tstr(val, &buf, &len) < 0) return JS_EXCEPTION;
+            if (nanocbor_get_tstr(val, &buf, &len) < 0 ||
+                !mik__cbor_str_in_bounds(val, buf, len)) {
+                return JS_EXCEPTION;
+            }
             return JS_NewStringLen(ctx, reinterpret_cast<const char*>(buf), len);
         }
 
@@ -218,6 +247,10 @@ JSValue mik__cbor_decode_value(JSContext* ctx, nanocbor_value_t* val, int depth)
                 }
                 JS_SetPropertyUint32(ctx, result, idx++, elem);
             }
+            if (mik__cbor_container_truncated(&arr)) {
+                JS_FreeValue(ctx, result);
+                return JS_EXCEPTION;
+            }
             nanocbor_leave_container(val, &arr);
             return result;
         }
@@ -235,7 +268,8 @@ JSValue mik__cbor_decode_value(JSContext* ctx, nanocbor_value_t* val, int depth)
                 }
                 const uint8_t* key_buf = nullptr;
                 size_t key_len = 0;
-                if (nanocbor_get_tstr(&map, &key_buf, &key_len) < 0) {
+                if (nanocbor_get_tstr(&map, &key_buf, &key_len) < 0 ||
+                    !mik__cbor_str_in_bounds(&map, key_buf, key_len)) {
                     JS_FreeValue(ctx, result);
                     return JS_EXCEPTION;
                 }
@@ -251,6 +285,10 @@ JSValue mik__cbor_decode_value(JSContext* ctx, nanocbor_value_t* val, int depth)
                 JS_SetProperty(ctx, result, atom, prop_val);
                 JS_FreeAtom(ctx, atom);
             }
+            if (mik__cbor_container_truncated(&map)) {
+                JS_FreeValue(ctx, result);
+                return JS_EXCEPTION;
+            }
             nanocbor_leave_container(val, &map);
             return result;
         }