castrum 0.9.9 → 0.9.11

package/rust/ffi/util.rs

@@ -122,6 +122,19 @@ pub(crate) fn panic_guard<T>(f: impl FnOnce() -> T, fallback: T) -> T {
     std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)).unwrap_or(fallback)
 }
 
+/// Wrap a `#[no_mangle] extern "C"` body so a panic returns `fallback`
+/// instead of unwinding into the host runtime. Every C-ABI export uses this
+/// (a source-level test in `ffi/tests.rs` enforces it).
+///
+/// `return` inside the block returns from the guarded closure, so the bodies
+/// stay readable.
+macro_rules! c_abi {
+    ($fallback:expr, $body:block) => {
+        $crate::ffi::util::panic_guard(|| $body, $fallback)
+    };
+}
+pub(crate) use c_abi;
+
 /// Write the packed `[u8 allowed][u32 remaining LE][i64 reset_ms LE]` verdict;
 /// returns bytes written or the exact required size (13) when `out_cap` is too
 /// small. Never returns 0 on a valid call.

package/rust/ffi/validators.rs

@@ -10,6 +10,7 @@
 //     in JS and an engine re-encode — measured ~100 ns/call of pure waste;
 //     guide rule "cstring args are a LOSS for BYTE inputs").
 
+use super::util::c_abi;
 /// Email / UUID / IPv4 / IPv6 validators → 1/0 (`cstring` ARG shape).
 macro_rules! validator_c_abi {
     ($name:ident, $core:path) => {
@@ -19,10 +20,12 @@ macro_rules! validator_c_abi {
         /// `data` must be a valid NUL-terminated C string.
         #[no_mangle]
         pub unsafe extern "C" fn $name(data: *const std::os::raw::c_char) -> u8 {
-            if data.is_null() {
-                return 0;
-            }
-            u8::from($core(std::ffi::CStr::from_ptr(data).to_bytes()))
+            c_abi!(0, {
+                if data.is_null() {
+                    return 0;
+                }
+                u8::from($core(std::ffi::CStr::from_ptr(data).to_bytes()))
+            })
         }
     };
 }
@@ -40,15 +43,17 @@ macro_rules! validator_bytes_c_abi {
         /// `data` must be valid for reads of `len` bytes.
         #[no_mangle]
         pub unsafe extern "C" fn $name(data: *const u8, len: usize) -> u8 {
-            if data.is_null() && len != 0 {
-                return 0;
-            }
-            let bytes = if len == 0 {
-                &[]
-            } else {
-                std::slice::from_raw_parts(data, len)
-            };
-            u8::from($core(bytes))
+            c_abi!(0, {
+                if data.is_null() && len != 0 {
+                    return 0;
+                }
+                let bytes = if len == 0 {
+                    &[]
+                } else {
+                    std::slice::from_raw_parts(data, len)
+                };
+                u8::from($core(bytes))
+            })
         }
     };
 }
@@ -103,21 +108,23 @@ pub unsafe extern "C" fn castrum_hex_validate_batch(
     out: *mut u8,
     out_cap: usize,
 ) -> usize {
-    if data.is_null() || out.is_null() {
-        return 0;
-    }
-    let input = std::slice::from_raw_parts(data, len);
-    let needed = crate::util::validation::hex_batch_count(input);
-    if needed > out_cap {
-        return needed;
-    }
-    // `needed` verdict bytes fit — one bounded scratch Vec, one copy out.
-    let mut buf = Vec::with_capacity(needed);
-    match crate::util::validation::hex_batch_valid_into(input, width as usize, &mut buf) {
-        Ok(()) if buf.len() <= out_cap => {
-            std::slice::from_raw_parts_mut(out, buf.len()).copy_from_slice(&buf);
-            buf.len()
+    c_abi!(0, {
+        if data.is_null() || out.is_null() {
+            return 0;
+        }
+        let input = std::slice::from_raw_parts(data, len);
+        let needed = crate::util::validation::hex_batch_count(input);
+        if needed > out_cap {
+            return needed;
+        }
+        // `needed` verdict bytes fit — one bounded scratch Vec, one copy out.
+        let mut buf = Vec::with_capacity(needed);
+        match crate::util::validation::hex_batch_valid_into(input, width as usize, &mut buf) {
+            Ok(()) if buf.len() <= out_cap => {
+                std::slice::from_raw_parts_mut(out, buf.len()).copy_from_slice(&buf);
+                buf.len()
+            }
+            _ => 0,
         }
-        _ => 0,
-    }
+    })
 }

package/rust/http/http_date.rs

@@ -4,6 +4,10 @@
 // fixed-width writer for hot loops. The date arithmetic uses Howard Hinnant's
 // days↔civil algorithms (epoch-correct). Extracted from `etag.rs` so the
 // HTTP cache semantics file owns only ETags + conditional requests.
+//
+// NOTE: we intentionally do NOT use the `httpdate` crate — it panics when
+// formatting pre-1970 timestamps and years >= 10000, both of which this module
+// supports (see `http_date_into_out_of_range_year_falls_back`).
 
 use napi::bindgen_prelude::*;
 use napi_derive::napi;

package/rust/panic_safety.rs

@@ -38,3 +38,194 @@ fn header_parser_do_not_panic_on_adversarial_packed_headers() {
         let _ = HeaderRefs::parse(&data, false, 200);
     }
 }
+
+// ── Hand-rolled writers: arbitrary input × undersized output buffers ──
+//
+// Every writer that takes a caller-provided output slice MUST report an error
+// (Err / None) instead of panicking or writing past the end when the buffer is
+// too small, and MUST NOT read out of bounds when the input is arbitrary bytes.
+// A panic here means a hostile request becomes a 500 (napi) or is merely
+// contained by `panic_guard` (C-ABI) — neither is acceptable.
+
+#[test]
+fn hand_rolled_writers_never_panic_on_undersized_buffers() {
+    let mut rng = Rng(0x5eed_5eed);
+    for _ in 0..3000 {
+        let len = (rng.next() % 40) as usize;
+        let data = rng.bytes(len);
+        for cap in [0usize, 1, 2, 3, 7, 15, 31, data.len(), data.len() * 2 + 1] {
+            let mut out = vec![0u8; cap];
+            let _ = crate::crypto::base64::hex_encode_into_slice(&data, &mut out);
+            let _ = crate::crypto::base64::hex_decode_into_slice(&data, &mut out);
+            let _ = crate::http::url_codec::url_encode_into_slice(&data, &mut out);
+            let _ = crate::http::url_codec::url_decode_into_slice(&data, &mut out);
+            let _ = crate::http::query_parser::query_parse_packed_into_slice(&data, &mut out);
+            let _ = crate::http::cookie_parser::cookie_parse_packed_into_slice(&data, &mut out);
+            let _ = crate::http::http_parser::http_parse_request_packed_into_slice(&data, &mut out);
+            let _ = crate::http::etag::etag_from_crc32_into(rng.next() as u32, true, &mut out);
+            let _ = crate::payload::ws_frames::encode_frame_into(
+                (rng.next() & 0x0f) as u8,
+                &data,
+                rng.next() & 1 == 0,
+                rng.next() & 1 == 0,
+                &mut out,
+            );
+            let _ = crate::payload::sse::encode_event_into_slice(
+                Some("e"),
+                &data,
+                Some("i"),
+                Some(rng.next()),
+                &mut out,
+            );
+            let _ =
+                crate::util::packed::write_bitset_batch_into(&data, &mut out, |b| b.len() % 2 == 0);
+            let _ = crate::util::packed::write_sum_batch_into(&data, &mut out, |b| b.len() as i64);
+            let _ = crate::util::packed::write_u32_batch_into(&data, &mut out, |b| b.len() as u32);
+        }
+    }
+}
+
+// ── Broad parser sweep: arbitrary bytes must never panic ──
+
+#[test]
+fn hand_rolled_parsers_never_panic_on_hostile_input() {
+    let mut rng = Rng(0xfeed_face);
+    let supported = vec!["gzip".to_string(), "br".to_string(), "*".to_string()];
+    for _ in 0..3000 {
+        let len = (rng.next() % 96) as usize;
+        let data = rng.bytes(len);
+
+        // Decoders / validators over untrusted bytes.
+        let _ = crate::crypto::base64::hex_decode_bytes(&data);
+        let _ = crate::util::bytes::decode_form_component_len(&data);
+        let mut form_out = vec![0u8; data.len()];
+        let _ = crate::util::bytes::decode_form_component_into(&data, &mut form_out);
+        let mut scratch = Vec::new();
+        let _ = crate::util::bytes::decode_form_component_scratch(&data, &mut scratch);
+        let _ = crate::util::bytes::hex_decode_32(&data);
+        let _: Vec<_> = crate::util::bytes::cookie_pairs(&data).collect();
+        let mut verdicts = Vec::new();
+        let _ = crate::util::validation::hex_batch_valid_into(
+            &data,
+            (rng.next() % 40) as usize,
+            &mut verdicts,
+        );
+
+        // HTTP-surface parsers.
+        let _ = crate::http::method::MethodKind::from_bytes_ignore_case(&data);
+        let _ = crate::http::mime_lookup::mime_from_extension_bytes(&data);
+        let _ = crate::http::http_date::parse_http_date_secs(&data);
+        let _ = crate::http::accept::parse_accept_encoding_core(&data);
+        let _ = crate::http::accept::negotiate_encoding_server_preference(&supported, &data);
+        let _ = crate::payload::ws_frames::decode_frame(&data);
+    }
+}
+
+// ── multipart: hostile body/boundary + packed-writer size contract ──
+
+#[test]
+fn multipart_parser_never_panics_on_hostile_input() {
+    let mut rng = Rng(0xb0_0b0b);
+    for _ in 0..1500 {
+        let body_len = (rng.next() % 300) as usize;
+        let body = rng.bytes(body_len);
+        let boundary_len = (rng.next() % 20) as usize;
+        let boundary = rng.bytes(boundary_len);
+        let limits = crate::http::multipart::Limits {
+            max_parts: 16,
+            max_field_count: 16,
+            max_part_bytes: 128,
+            max_total_bytes: 256,
+        };
+        let parts = crate::http::multipart::parse_multipart_limited(&body, &boundary, &limits);
+        let all = crate::http::multipart::parse_multipart(&body, &boundary);
+        for p in &all {
+            let _ = (
+                p.name.len(),
+                p.filename.is_some(),
+                p.content_type.is_some(),
+                p.data.len(),
+            );
+        }
+
+        let mut packed = Vec::new();
+        crate::http::multipart::parts_to_packed(&parts, &mut packed);
+        assert_eq!(
+            packed.len(),
+            crate::http::multipart::parts_packed_len(&parts),
+            "parts_packed_len must match the Vec writer"
+        );
+        // Undersized packed output must return None (no partial write) …
+        if !packed.is_empty() {
+            let mut small = vec![0u8; packed.len() - 1];
+            assert!(crate::http::multipart::parts_to_packed_into(&parts, &mut small).is_none());
+        }
+        // … and an exact-size buffer must reproduce the Vec bytes byte-for-byte.
+        let mut exact = vec![0u8; packed.len()];
+        let n = crate::http::multipart::parts_to_packed_into(&parts, &mut exact)
+            .expect("exact-size buffer must succeed");
+        assert_eq!(n, packed.len());
+        assert_eq!(exact, packed);
+    }
+}
+
+// ── Exact length accounting for the hand-rolled escape writers ──
+//
+// `json_escaped_len` / `regex_escape_len` are used by the C-ABI "needed size"
+// convention to allocate EXACTLY once. If the reported length ever disagreed
+// with the written length the caller's grow-and-retry loop could spin forever
+// (under-report) or the writer could run off the end (over-report). These are
+// the strongest invariants for those writers.
+
+#[test]
+fn json_escaped_len_is_exact_for_hostile_bytes() {
+    let mut rng = Rng(0x150_15015);
+    // Alphabet biased toward the escape-triggering classes: NUL, controls,
+    // the memchr3 specials, high bytes (invalid UTF-8) and valid multi-byte
+    // lead/continuation pairs.
+    let alphabet = [
+        0u8, 1, 8, 9, 10, 12, 13, 0x1f, b'"', b'\\', b'/', b'a', 0x7f, 0x80, 0xc3, 0xa9, 0xff,
+        0xf0, 0x9f,
+    ];
+    for _ in 0..5000 {
+        let len = (rng.next() % 48) as usize;
+        let data: Vec<u8> = (0..len)
+            .map(|_| alphabet[(rng.next() % alphabet.len() as u64) as usize])
+            .collect();
+
+        let need = crate::json::json_ser::json_escaped_len(&data);
+        let mut out = vec![0u8; need];
+        let mut pos = 0usize;
+        let written = crate::json::json_ser::write_json_escaped(&mut out, &mut pos, &data);
+        assert_eq!(
+            written, need,
+            "json escaped length mismatch for {data:02x?}"
+        );
+        assert_eq!(pos, need);
+        // Escaped output of a JSON string must itself be valid UTF-8.
+        assert!(std::str::from_utf8(&out).is_ok(), "non-UTF-8 escape output");
+    }
+}
+
+#[test]
+fn regex_escape_write_matches_len_and_reference() {
+    let mut rng = Rng(0x2e_9333);
+    let metas = b".*+?^${}()|[]\\";
+    for _ in 0..5000 {
+        let len = (rng.next() % 48) as usize;
+        let data = rng.bytes(len);
+        let need = crate::util::text::regex_escape_len(&data);
+        let mut out = vec![0u8; need];
+        let written = crate::util::text::regex_escape_write(&data, &mut out);
+        assert_eq!(written, need, "regex escape length mismatch");
+        // Independent reference: backslash before each metachar.
+        let mut expected = Vec::with_capacity(need);
+        for &b in &data {
+            if metas.contains(&b) {
+                expected.push(b'\\');
+            }
+            expected.push(b);
+        }
+        assert_eq!(out, expected, "regex escape output mismatch");
+    }
+}

package/rust/payload/sse.rs

@@ -40,10 +40,14 @@ pub fn encode_event_size(
     if let Some(retry) = retry {
         need += 8 + u64_digits(retry); // "retry: " + digits + "\n"
     }
-    // One `data: ` (6) + `\n` (1) per input line, the line bytes themselves,
-    // then the terminating blank `\n`.
-    let line_count = data.iter().filter(|&&b| b == b'\n').count() + 1;
-    need + line_count * 7 + data.len() + 1
+    // One `data: ` (6) + `\n` (1) per input line, the line bytes themselves
+    // (SEGMENTS EXCLUDE the `\n` separators — sum of segment lengths =
+    // `data.len() - (line_count - 1)`), then the terminating blank `\n`.
+    // Line boundaries found via SIMD memchr — a scalar `filter().count()`
+    // pass over the full payload was ~1 cycle/byte (~650ns/KB steady state),
+    // collapsing large encodes to 0.10× of JS.
+    let line_count = memchr::memchr_iter(b'\n', data).count() + 1;
+    need + line_count * 7 + data.len() - (line_count - 1) + 1
 }
 
 /// Encode one SSE event into `out`, returning bytes written. Zero-alloc (no
@@ -98,7 +102,23 @@ pub fn encode_event_into_slice(
         out[w] = b'\n';
         w += 1;
     }
-    for line in data.split(|&b| b == b'\n') {
+    // One `data: ` line per input line: SIMD memchr finds the `\n` boundaries
+    // (no scalar split() re-scan of the whole payload), copying each run.
+    // `data.split('\n')` semantics are preserved exactly: the tail after the
+    // last `\n` is emitted even when empty.
+    let mut line_start = 0usize;
+    for sep in memchr::memchr_iter(b'\n', data) {
+        let line = &data[line_start..sep];
+        out[w..w + 6].copy_from_slice(b"data: ");
+        w += 6;
+        out[w..w + line.len()].copy_from_slice(line);
+        w += line.len();
+        out[w] = b'\n';
+        w += 1;
+        line_start = sep + 1;
+    }
+    {
+        let line = &data[line_start..];
         out[w..w + 6].copy_from_slice(b"data: ");
         w += 6;
         out[w..w + line.len()].copy_from_slice(line);
@@ -211,4 +231,57 @@ mod tests {
         let mut out = [0u8; 3];
         assert!(encode_event_into_slice(Some("update"), b"payload", None, None, &mut out).is_err());
     }
+
+    #[test]
+    fn large_multiline_matches_allocating() {
+        // 4k lines x 96-byte data — spans well past any SIMD threshold.
+        let mut data = Vec::with_capacity(4 * 1024 * 96);
+        for i in 0..4 * 1024 {
+            data.extend_from_slice(format!("line-{i} ").as_bytes());
+            data.extend_from_slice(b"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"); // 55
+            data.push(b'\n');
+        }
+        let expected = encode_event(None, &data, None, None);
+        assert!(
+            expected.len() > 256 * 1024,
+            "test payload unexpectedly small: {}",
+            expected.len()
+        );
+        let mut out = vec![0u8; encode_event_size(None, &data, None, None)];
+        let w = encode_event_into_slice(None, &data, None, None, &mut out).unwrap();
+        assert_eq!(w, expected.len());
+        assert_eq!(&out[..w], &expected[..]);
+    }
+
+    #[test]
+    fn single_large_line_scales_too() {
+        // One 1MB line — the old scalar split() path cost ~300us here.
+        let mut data = vec![b'a'; 1 << 20];
+        data.push(b'\n');
+        let expected = encode_event(None, &data, None, None);
+        let mut out = vec![0u8; encode_event_size(None, &data, None, None)];
+        let w = encode_event_into_slice(None, &data, None, None, &mut out).unwrap();
+        assert_eq!(w, expected.len());
+        assert_eq!(&out[..w], &expected[..]);
+    }
+
+    #[test]
+    fn trailing_newline_emits_empty_tail_line() {
+        // split() semantics: "a\n" -> ["a", ""] -> one empty data: line.
+        assert_eq!(
+            encode_event(None, b"hello\n", None, None),
+            b"data: hello\ndata: \n\n"
+        );
+        assert_eq!(encode_event(None, b"\n", None, None), b"data: \ndata: \n\n");
+        assert_eq!(encode_event(None, b"", None, None), b"data: \n\n");
+    }
+
+    #[test]
+    fn embedded_crlf_kept_in_line() {
+        // Only \n splits lines; \r stays in the line bytes.
+        assert_eq!(
+            encode_event(None, b"a\r\nb", None, None),
+            b"data: a\r\ndata: b\n\n"
+        );
+    }
 }

package/rust/proptest_suite.rs

@@ -16,7 +16,9 @@ use crate::http::headers::HeaderRefs;
 use crate::http::media_type::parse_media_type_core;
 use crate::http::query_parser::query_parse_packed_vec;
 use crate::json::fast_schema::compile;
-use crate::util::bytes::decode_percent_at;
+use crate::util::bytes::{
+    decode_form_component_into, decode_form_component_len, decode_percent_at,
+};
 
 proptest! {
     /// HeaderRefs::parse must never panic on arbitrary (possibly truncated,
@@ -125,6 +127,134 @@ proptest! {
         }
         prop_assert_eq!(decoded, input);
     }
+
+    // ── Exact size contracts for the hand-rolled decoders/writers ──
+
+    /// The C-ABI "needed size" pass must never under-report the written length
+    /// (an under-report would make the caller's grow-and-retry loop spin
+    /// forever); an exact-size buffer must always succeed and agree.
+    #[test]
+    fn decode_form_component_size_contract(input in prop::collection::vec(any::<u8>(), 0..256)) {
+        let reported = decode_form_component_len(&input);
+        let mut out = vec![0u8; input.len() + 8];
+        let written = decode_form_component_into(&input, &mut out)
+            .expect("an input-sized buffer always suffices");
+        prop_assert!(written <= reported, "reported {} < written {}", reported, written);
+        let mut exact = vec![0u8; reported];
+        let w2 = decode_form_component_into(&input, &mut exact)
+            .expect("exact reported size must suffice");
+        prop_assert_eq!(w2, written);
+    }
+
+    /// `json_escaped_len` must be an EXACT accounting of `write_json_escaped`
+    /// for arbitrary bytes, and the escaped output must be valid UTF-8.
+    #[test]
+    fn json_escaped_len_exact_accounting(input in prop::collection::vec(any::<u8>(), 0..256)) {
+        let need = crate::json::json_ser::json_escaped_len(&input);
+        let mut out = vec![0u8; need];
+        let mut pos = 0usize;
+        let written = crate::json::json_ser::write_json_escaped(&mut out, &mut pos, &input);
+        prop_assert_eq!(written, need);
+        prop_assert_eq!(pos, need);
+        prop_assert!(std::str::from_utf8(&out).is_ok());
+    }
+
+    /// `PackedIter`'s three accessors (`next()`/`collect_vec`/
+    /// `count_and_total_bytes`) must agree on validity and totals for arbitrary
+    /// (forged-length) packed buffers.
+    #[test]
+    fn packed_iter_self_consistent(input in prop::collection::vec(any::<u8>(), 0..512)) {
+        match crate::util::packed::PackedIter::new(&input) {
+            Ok(it) => {
+                let collected = it.collect_vec();
+                let stats = it.count_and_total_bytes();
+                prop_assert_eq!(collected.is_ok(), stats.is_ok());
+                if let (Ok(items), Ok((count, total))) = (collected, stats) {
+                    prop_assert_eq!(items.len(), count);
+                    prop_assert_eq!(items.iter().map(|i| i.len()).sum::<usize>(), total);
+                    prop_assert_eq!(items.len(), it.len());
+                }
+                // The Iterator impl must never panic and never yield more items
+                // than the header claims.
+                prop_assert!(it.take(10_000).count() <= it.len());
+            }
+            Err(_) => {
+                prop_assert!(crate::util::packed::unpack(&input).is_err());
+            }
+        }
+    }
+
+    /// RFC 3986 encode → decode is the identity over arbitrary bytes, and the
+    /// encoder's own output is always accepted by the strict decoder.
+    #[test]
+    fn url_codec_roundtrip(input in prop::collection::vec(any::<u8>(), 0..256)) {
+        let mut enc = vec![0u8; input.len() * 3];
+        let n = crate::http::url_codec::url_encode_into_slice(&input, &mut enc)
+            .expect("3x buffer always suffices");
+        enc.truncate(n);
+        let mut dec = vec![0u8; enc.len()];
+        let m = crate::http::url_codec::url_decode_into_slice(&enc, &mut dec)
+            .expect("the encoder output is always well-formed");
+        prop_assert_eq!(&dec[..m], &input[..]);
+    }
+
+    /// SIMD hex encode → decode is the identity for arbitrary bytes and the
+    /// `_into` variants agree byte-for-byte with the allocating ones.
+    #[test]
+    fn hex_simd_roundtrip_arbitrary(input in prop::collection::vec(any::<u8>(), 0..256)) {
+        let enc = crate::crypto::base64::hex_encode_bytes(&input);
+        prop_assert_eq!(enc.len(), input.len() * 2);
+        let mut into_enc = vec![0u8; input.len() * 2];
+        let n = crate::crypto::base64::hex_encode_into_slice(&input, &mut into_enc).unwrap();
+        prop_assert_eq!(&into_enc[..n], enc.as_bytes());
+        let dec = crate::crypto::base64::hex_decode_bytes(enc.as_bytes())
+            .expect("own encoder output always decodes");
+        prop_assert_eq!(&dec[..], &input[..]);
+        let mut into_dec = vec![0u8; input.len()];
+        let m = crate::crypto::base64::hex_decode_into_slice(enc.as_bytes(), &mut into_dec).unwrap();
+        prop_assert_eq!(&into_dec[..m], &input[..]);
+    }
+
+    /// RFC 6455 encode → decode round-trips for any payload/opcode/flags, and
+    /// the zero-alloc writer matches the allocating one byte-for-byte.
+    #[test]
+    fn ws_frame_roundtrip(
+        payload in prop::collection::vec(any::<u8>(), 0..300),
+        opcode in 0u8..16,
+        mask in any::<bool>(),
+        fin in any::<bool>(),
+    ) {
+        let frame = crate::payload::ws_frames::encode_frame(opcode, &payload, mask, fin);
+        let decoded = crate::payload::ws_frames::decode_frame(&frame)
+            .expect("a self-produced frame always decodes");
+        prop_assert_eq!(decoded.opcode, opcode & 0x0f);
+        prop_assert_eq!(decoded.fin, fin);
+        prop_assert_eq!(&decoded.payload[..], &payload[..]);
+        let mut out = vec![0u8; frame.len()];
+        let n = crate::payload::ws_frames::encode_frame_into(opcode, &payload, mask, fin, &mut out)
+            .unwrap();
+        prop_assert_eq!(&out[..n], &frame[..]);
+    }
+
+    /// SSE `encode_event_size` must be exact and one byte short must error
+    /// (never panic / write out of bounds).
+    #[test]
+    fn sse_encode_size_contract(data in prop::collection::vec(any::<u8>(), 0..256)) {
+        let need = crate::payload::sse::encode_event_size(Some("evt"), &data, Some("id"), Some(42));
+        let mut out = vec![0u8; need];
+        let w = crate::payload::sse::encode_event_into_slice(
+            Some("evt"), &data, Some("id"), Some(42), &mut out,
+        )
+        .unwrap();
+        prop_assert_eq!(w, need);
+        if need > 0 {
+            let mut small = vec![0u8; need - 1];
+            prop_assert!(crate::payload::sse::encode_event_into_slice(
+                Some("evt"), &data, Some("id"), Some(42), &mut small,
+            )
+            .is_err());
+        }
+    }
 }
 
 /// decode_percent_at round-trips a manually percent-encoded byte (`%HH`).

package/rust/util/bytes.rs

@@ -585,6 +585,38 @@ mod tests {
             ]
         );
     }
+    #[test]
+    fn decode_form_undersized_buffer_reports_error() {
+        // A buffer smaller than the input can only ever yield BufferTooSmall —
+        // never a partial write the caller would mistake for success.
+        let mut out = [0u8; 4];
+        assert_eq!(
+            decode_form_component_into(b"plain-ascii", &mut out),
+            Err(FormDecodeError::BufferTooSmall)
+        );
+        // A decoded form that shrinks (3 input bytes -> 1) may still fit.
+        let mut out5 = [0u8; 5];
+        assert_eq!(
+            decode_form_component_into(b"%41%42%43%44%45", &mut out5),
+            Ok(5)
+        );
+        assert_eq!(&out5, b"ABCDE");
+    }
+
+    #[test]
+    fn decode_percent_at_boundaries() {
+        assert_eq!(decode_percent_at(b"%41", 0), Some((0x41, 3)));
+        // Truncated escapes (`%4`, `%`) and a non-hex digit all fail closed.
+        assert_eq!(decode_percent_at(b"%4", 0), None);
+        assert_eq!(decode_percent_at(b"%", 0), None);
+        assert_eq!(decode_percent_at(b"%4G", 0), None);
+        assert_eq!(decode_percent_at(b"%g0", 0), None);
+        // Lowercase hex is accepted; an out-of-range index must not panic.
+        assert_eq!(decode_percent_at(b"%2f", 0), Some((0x2f, 3)));
+        assert_eq!(decode_percent_at(b"abc", 10), None);
+        assert_eq!(decode_percent_at(b"", 0), None);
+    }
+
     #[test]
     #[should_panic(expected = "hex_encode: output buffer too small")]
     fn hex_encode_panics_on_undersized() {