From d6b5731cacee29d22eb4c6c554fc52ff5f10dea3 Mon Sep 17 00:00:00 2001
From: mbotero <mbotero@censys.com>
Date: Mon, 20 Jul 2026 15:41:26 -0500
Subject: [PATCH] Fix panics found from fuzzing

---
 internal/decoder/bytes.go   | 2 +-
 internal/decoder/decoder.go | 3 +++
 internal/decoder/int.go     | 3 +++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/internal/decoder/bytes.go b/internal/decoder/bytes.go
index 9da63a6..60b2b3d 100644
--- a/internal/decoder/bytes.go
+++ b/internal/decoder/bytes.go
@@ -20,7 +20,7 @@ func (d *Decoder) decodeBytes() ([]byte, error) {
 	}
 	index += 1
 	endIndex := index + int(stringLength)
-	if endIndex > d.length {
+	if endIndex > d.length || endIndex < 0 {
 		return nil, errors.New("bencode: not a valid bencoded string")
 	}
 	value := d.data[index:endIndex]
diff --git a/internal/decoder/decoder.go b/internal/decoder/decoder.go
index c585b8e..8b46444 100644
--- a/internal/decoder/decoder.go
+++ b/internal/decoder/decoder.go
@@ -19,6 +19,9 @@ func (d *Decoder) Decode(data []byte) (interface{}, error) {
 }
 
 func (d *Decoder) decode() (interface{}, error) {
+	if d.cursor == d.length {
+		return nil, errors.New("bencode: out of bounds")
+	}
 	switch d.data[d.cursor] {
 	case 'i':
 		return d.decodeInt()
diff --git a/internal/decoder/int.go b/internal/decoder/int.go
index 13e4734..f3e7ed7 100644
--- a/internal/decoder/int.go
+++ b/internal/decoder/int.go
@@ -15,6 +15,9 @@ var (
 )
 
 func (d *Decoder) parseInt(data []byte) (int64, error) {
+	if len(data) == 0 {
+		return 0, errors.New("bencode: tried to parse an integer from zero bytes")
+	}
 	isNegative := false
 	if data[0] == '-' {
 		data = data[1:]