From ae1f3943ef21337dc490ee139e9db6a8f1d18480 Mon Sep 17 00:00:00 2001
From: Hayleigh Thompson <me@hayleigh.dev>
Date: Sat, 18 Jul 2026 13:08:13 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Make=20sure=20cids=20are=20treat?=
 =?UTF-8?q?ed=20as=20bit=20arrays.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/at/cbor.gleam | 55 +++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 49 insertions(+), 6 deletions(-)

diff --git a/src/at/cbor.gleam b/src/at/cbor.gleam
index 092e561..74575ac 100644
--- a/src/at/cbor.gleam
+++ b/src/at/cbor.gleam
@@ -130,13 +130,56 @@ fn parse_dynamic(bits: BitArray) -> Result(#(Dynamic, BitArray), DecodeError) {
     // CIDS
     <<6:3, 24:5, 42:8, 2:3, size:5, bits:bytes-size(size), remaining:bits>>
       if size <= 23
-    -> Ok(#(dynamic.bit_array(bits), remaining))
+    ->
+      case bits {
+        <<0:8, _:bits>> -> Ok(#(dynamic.bit_array(bits), remaining))
+        _ -> Error(MalformedInput)
+      }
 
-    <<6:3, 24:5, 42:8, 2:3, size:8, bits:bytes-size(size), remaining:bits>>
-    | <<6:3, 24:5, 42:8, 2:3, size:16, bits:bytes-size(size), remaining:bits>>
-    | <<6:3, 24:5, 42:8, 2:3, size:32, bits:bytes-size(size), remaining:bits>>
-    | <<6:3, 24:5, 42:8, 2:3, size:64, bits:bytes-size(size), remaining:bits>> ->
-      Ok(#(dynamic.bit_array(bits), remaining))
+    <<
+      6:3,
+      24:5,
+      42:8,
+      2:3,
+      24:5,
+      size:8,
+      bits:bytes-size(size),
+      remaining:bits,
+    >>
+    | <<
+        6:3,
+        24:5,
+        42:8,
+        2:3,
+        25:5,
+        size:16,
+        bits:bytes-size(size),
+        remaining:bits,
+      >>
+    | <<
+        6:3,
+        24:5,
+        42:8,
+        2:3,
+        26:5,
+        size:32,
+        bits:bytes-size(size),
+        remaining:bits,
+      >>
+    | <<
+        6:3,
+        24:5,
+        42:8,
+        2:3,
+        27:5,
+        size:64,
+        bits:bytes-size(size),
+        remaining:bits,
+      >> ->
+      case bits {
+        <<0:8, _:bits>> -> Ok(#(dynamic.bit_array(bits), remaining))
+        _ -> Error(MalformedInput)
+      }
 
     // BOOLS
     <<7:3, 20:5, remaining:bits>> -> Ok(#(dynamic.bool(False), remaining))
-- 
2.51.2