Merge pull request #99 from ipfs/fix/minimal-encoding

fix: enforce minimal encoding

.gx/lastpubver

@@ -1 +1 @@
-0.9.0: QmPSQnBKM9g7BaUcZCvswUJVscQ1ipjmwxN5PXCjkp9EQ7
+0.9.3: QmTbxNB1NwDesLmKTscr4udL2tVP7MaxvXnD1D9yX7g3PN

.travis.yml

@@ -1,24 +1,31 @@
-sudo: false
-
+os:
+  - linux
 
 language: go
+
 go:
-  - 'tip'
+  - 1.11.x
 
+env:
+  global:
+    - GOTFLAGS="-race"
+  matrix:
+    - BUILD_DEPTYPE=gomod
+
+
+# disable travis install
 install:
-  - go get github.com/whyrusleeping/gx
-  - go get github.com/whyrusleeping/gx-go
-  - gx install --global
-script:
-  - gx test -v -race -coverprofile=coverage.txt -covermode=atomic .
+  - true
+
+script:
+  - bash <(curl -s https://raw.githubusercontent.com/ipfs/ci-helpers/master/travis-ci/run-standard-tests.sh)
 
-after_success:
-  - bash <(curl -s https://codecov.io/bash)
 
 cache:
   directories:
     - $GOPATH/src/gx
+    - $GOPATH/pkg/mod
+    - $HOME/.cache/go-build
 
 notifications:
-email: false
-  
+  email: false

README.md

@@ -14,6 +14,9 @@ go-cid
 This is an implementation in Go of the [CID spec](https://github.com/ipld/cid).
 It is used in `go-ipfs` and related packages to refer to a typed hunk of data.
 
+## Lead Maintainer
+
+[Eric Myhre](https://github.com/warpfork)
 
 ## Table of Contents
 
@@ -31,43 +34,23 @@ It is used in `go-ipfs` and related packages to refer to a typed hunk of data.
 go get github.com/ipfs/go-cid
 ```
 
-Note that `go-cid` is packaged with Gx, so it is recommended to use Gx to install and use it (see Usage section).
-
 ## Usage
 
-### Using Gx and Gx-go
-
-This module is packaged with [Gx](https://github.com/whyrusleeping/gx). In order to use it in your own project it is recommended that you:
-
-```sh
-go get -u github.com/whyrusleeping/gx
-go get -u github.com/whyrusleeping/gx-go
-cd <your-project-repository>
-gx init
-gx import github.com/ipfs/go-cid
-gx install --global
-gx-go --rewrite
-```
-
-Please check [Gx](https://github.com/whyrusleeping/gx) and [Gx-go](https://github.com/whyrusleeping/gx-go) documentation for more information.
-
 ### Running tests
 
-Before running tests, please run:
+Run tests with `go test` from the directory root
 
 ```sh
-make deps
+go test
 ```
 
-This will make sure that dependencies are rewritten to known working versions.
-
 ### Examples
 
 #### Parsing string input from users
 
 ```go
 // Create a cid from a marshaled string
-c, err := cid.Decode("zdvgqEMYmNeH5fKciougvQcfzMcNjF3Z1tPouJ8C7pc3pe63k")
+c, err := cid.Decode("bafzbeigai3eoy2ccc7ybwjfz5r3rdxqrinwi4rwytly24tdbh6yk7zslrm")
 if err != nil {...}
 
 fmt.Println("Got CID: ", c)

_rsrch/cidiface/enums.go

@@ -8,6 +8,7 @@ const (
 
 	DagProtobuf = 0x70
 	DagCBOR     = 0x71
+	Libp2pKey   = 0x72
 
 	GitRaw = 0x78
 
@@ -34,6 +35,7 @@ var Codecs = map[string]uint64{
 	"raw":                  Raw,
 	"protobuf":             DagProtobuf,
 	"cbor":                 DagCBOR,
+	"libp2p-key":           Libp2pKey,
 	"git-raw":              GitRaw,
 	"eth-block":            EthBlock,
 	"eth-block-list":       EthBlockList,
@@ -57,6 +59,7 @@ var CodecToStr = map[uint64]string{
 	Raw:                "raw",
 	DagProtobuf:        "protobuf",
 	DagCBOR:            "cbor",
+	Libp2pKey:          "libp2p-key",
 	GitRaw:             "git-raw",
 	EthBlock:           "eth-block",
 	EthBlockList:       "eth-block-list",

builder.go

@@ -38,7 +38,7 @@ func (p V0Builder) Sum(data []byte) (Cid, error) {
 	if err != nil {
 		return Undef, err
 	}
-	return NewCidV0(hash), nil
+	return Cid{string(hash)}, nil
 }
 
 func (p V0Builder) GetCodec() uint64 {

cid.go

@@ -21,7 +21,7 @@ package cid
 
 import (
 	"bytes"
-	"encoding/binary"
+	"encoding"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -29,21 +29,13 @@ import (
 
 	mbase "github.com/multiformats/go-multibase"
 	mh "github.com/multiformats/go-multihash"
+	varint "github.com/multiformats/go-varint"
 )
 
 // UnsupportedVersionString just holds an error message
 const UnsupportedVersionString = "<unsupported cid version>"
 
 var (
-	// ErrVarintBuffSmall means that a buffer passed to the cid parser was not
-	// long enough, or did not contain an invalid cid
-	ErrVarintBuffSmall = errors.New("reading varint: buffer too small")
-
-	// ErrVarintTooBig means that the varint in the given cid was above the
-	// limit of 2^64
-	ErrVarintTooBig = errors.New("reading varint: varint bigger than 64bits" +
-		" and not supported")
-
 	// ErrCidTooShort means that the cid passed to decode was not long
 	// enough to be a valid Cid
 	ErrCidTooShort = errors.New("cid too short")
@@ -61,6 +53,7 @@ const (
 
 	DagProtobuf = 0x70
 	DagCBOR     = 0x71
+	Libp2pKey   = 0x72
 
 	GitRaw = 0x78
 
@@ -79,6 +72,8 @@ const (
 	ZcashTx            = 0xc1
 	DecredBlock        = 0xe0
 	DecredTx           = 0xe1
+	DashBlock          = 0xf0
+	DashTx             = 0xf1
 )
 
 // Codecs maps the name of a codec to its type
@@ -87,6 +82,7 @@ var Codecs = map[string]uint64{
 	"raw":                  Raw,
 	"protobuf":             DagProtobuf,
 	"cbor":                 DagCBOR,
+	"libp2p-key":           Libp2pKey,
 	"git-raw":              GitRaw,
 	"eth-block":            EthBlock,
 	"eth-block-list":       EthBlockList,
@@ -103,6 +99,8 @@ var Codecs = map[string]uint64{
 	"zcash-tx":             ZcashTx,
 	"decred-block":         DecredBlock,
 	"decred-tx":            DecredTx,
+	"dash-block":           DashBlock,
+	"dash-tx":              DashTx,
 }
 
 // CodecToStr maps the numeric codec to its name
@@ -126,33 +124,49 @@ var CodecToStr = map[uint64]string{
 	ZcashTx:            "zcash-tx",
 	DecredBlock:        "decred-block",
 	DecredTx:           "decred-tx",
+	DashBlock:          "dash-block",
+	DashTx:             "dash-tx",
+}
+
+// tryNewCidV0 tries to convert a multihash into a CIDv0 CID and returns an
+// error on failure.
+func tryNewCidV0(mhash mh.Multihash) (Cid, error) {
+	// Need to make sure hash is valid for CidV0 otherwise we will
+	// incorrectly detect it as CidV1 in the Version() method
+	dec, err := mh.Decode(mhash)
+	if err != nil {
+		return Undef, err
+	}
+	if dec.Code != mh.SHA2_256 || dec.Length != 32 {
+		return Undef, fmt.Errorf("invalid hash for cidv0 %d-%d", dec.Code, dec.Length)
+	}
+	return Cid{string(mhash)}, nil
 }
 
 // NewCidV0 returns a Cid-wrapped multihash.
 // They exist to allow IPFS to work with Cids while keeping
 // compatibility with the plain-multihash format used used in IPFS.
 // NewCidV1 should be used preferentially.
+//
+// Panics if the multihash isn't sha2-256.
 func NewCidV0(mhash mh.Multihash) Cid {
-	// Need to make sure hash is valid for CidV0 otherwise we will
-	// incorrectly detect it as CidV1 in the Version() method
-	dec, err := mh.Decode(mhash)
+	c, err := tryNewCidV0(mhash)
 	if err != nil {
 		panic(err)
 	}
-	if dec.Code != mh.SHA2_256 || dec.Length != 32 {
-		panic("invalid hash for cidv0")
-	}
-	return Cid{string(mhash)}
+	return c
 }
 
 // NewCidV1 returns a new Cid using the given multicodec-packed
 // content type.
+//
+// Panics if the multihash is invalid.
 func NewCidV1(codecType uint64, mhash mh.Multihash) Cid {
 	hashlen := len(mhash)
 	// two 8 bytes (max) numbers plus hash
-	buf := make([]byte, 2*binary.MaxVarintLen64+hashlen)
-	n := binary.PutUvarint(buf, 1)
-	n += binary.PutUvarint(buf[n:], codecType)
+	buf := make([]byte, 1+varint.UvarintSize(codecType)+hashlen)
+	n := varint.PutUvarint(buf, 1)
+	n += varint.PutUvarint(buf[n:], codecType)
 	cn := copy(buf[n:], mhash)
 	if cn != hashlen {
 		panic("copy hash length is inconsistent")
@@ -161,7 +175,12 @@ func NewCidV1(codecType uint64, mhash mh.Multihash) Cid {
 	return Cid{string(buf[:n+hashlen])}
 }
 
-// Cid represents a self-describing content adressed
+var _ encoding.BinaryMarshaler = Cid{}
+var _ encoding.BinaryUnmarshaler = (*Cid)(nil)
+var _ encoding.TextMarshaler = Cid{}
+var _ encoding.TextUnmarshaler = (*Cid)(nil)
+
+// Cid represents a self-describing content addressed
 // identifier. It is formed by a Version, a Codec (which indicates
 // a multicodec-packed content type) and a Multihash.
 type Cid struct{ str string }
@@ -189,7 +208,7 @@ func Parse(v interface{}) (Cid, error) {
 	case []byte:
 		return Cast(v2)
 	case mh.Multihash:
-		return NewCidV0(v2), nil
+		return tryNewCidV0(v2)
 	case Cid:
 		return v2, nil
 	default:
@@ -220,7 +239,7 @@ func Decode(v string) (Cid, error) {
 			return Undef, err
 		}
 
-		return NewCidV0(hash), nil
+		return tryNewCidV0(hash)
 	}
 
 	_, data, err := mbase.Decode(v)
@@ -253,17 +272,6 @@ func ExtractEncoding(v string) (mbase.Encoding, error) {
 	return encoding, nil
 }
 
-func uvError(read int) error {
-	switch {
-	case read == 0:
-		return ErrVarintBuffSmall
-	case read < 0:
-		return ErrVarintTooBig
-	default:
-		return nil
-	}
-}
-
 // Cast takes a Cid data slice, parses it and returns a Cid.
 // For CidV1, the data buffer is in the form:
 //
@@ -276,36 +284,38 @@ func uvError(read int) error {
 // Please use decode when parsing a regular Cid string, as Cast does not
 // expect multibase-encoded data. Cast accepts the output of Cid.Bytes().
 func Cast(data []byte) (Cid, error) {
-	if len(data) == 34 && data[0] == 18 && data[1] == 32 {
-		h, err := mh.Cast(data)
+	nr, c, err := CidFromBytes(data)
 	if err != nil {
 		return Undef, err
 	}
 
-		return NewCidV0(h), nil
+	if nr != len(data) {
+		return Undef, fmt.Errorf("trailing bytes in data buffer passed to cid Cast")
 	}
 
-	vers, n := binary.Uvarint(data)
-	if err := uvError(n); err != nil {
-		return Undef, err
-	}
+	return c, nil
+}
 
-	if vers != 1 {
-		return Undef, fmt.Errorf("expected 1 as the cid version number, got: %d", vers)
-	}
-
-	_, cn := binary.Uvarint(data[n:])
-	if err := uvError(cn); err != nil {
-		return Undef, err
-	}
-
-	rest := data[n+cn:]
-	h, err := mh.Cast(rest)
+// UnmarshalBinary is equivalent to Cast(). It implements the
+// encoding.BinaryUnmarshaler interface.
+func (c *Cid) UnmarshalBinary(data []byte) error {
+	casted, err := Cast(data)
 	if err != nil {
-		return Undef, err
+		return err
 	}
+	c.str = casted.str
+	return nil
+}
 
-	return Cid{string(data[0 : n+cn+len(h)])}, nil
+// UnmarshalText is equivalent to Decode(). It implements the
+// encoding.TextUnmarshaler interface.
+func (c *Cid) UnmarshalText(text []byte) error {
+	decodedCid, err := Decode(string(text))
+	if err != nil {
+		return err
+	}
+	c.str = decodedCid.str
+	return nil
 }
 
 // Version returns the Cid version.
@@ -321,8 +331,8 @@ func (c Cid) Type() uint64 {
 	if c.Version() == 0 {
 		return DagProtobuf
 	}
-	_, n := uvarint(c.str)
-	codec, _ := uvarint(c.str[n:])
+	_, n, _ := uvarint(c.str)
+	codec, _, _ := uvarint(c.str[n:])
 	return codec
 }
 
@@ -334,7 +344,7 @@ func (c Cid) String() string {
 	case 0:
 		return c.Hash().B58String()
 	case 1:
-		mbstr, err := mbase.Encode(mbase.Base58BTC, c.Bytes())
+		mbstr, err := mbase.Encode(mbase.Base32, c.Bytes())
 		if err != nil {
 			panic("should not error with hardcoded mbase: " + err.Error())
 		}
@@ -384,9 +394,9 @@ func (c Cid) Hash() mh.Multihash {
 	}
 
 	// skip version length
-	_, n1 := binary.Uvarint(bytes)
+	_, n1, _ := varint.FromUvarint(bytes)
 	// skip codec length
-	_, n2 := binary.Uvarint(bytes[n1:])
+	_, n2, _ := varint.FromUvarint(bytes[n1:])
 
 	return mh.Multihash(bytes[n1+n2:])
 }
@@ -398,6 +408,18 @@ func (c Cid) Bytes() []byte {
 	return []byte(c.str)
 }
 
+// MarshalBinary is equivalent to Bytes(). It implements the
+// encoding.BinaryMarshaler interface.
+func (c Cid) MarshalBinary() ([]byte, error) {
+	return c.Bytes(), nil
+}
+
+// MarshalText is equivalent to String(). It implements the
+// encoding.TextMarshaler interface.
+func (c Cid) MarshalText() ([]byte, error) {
+	return []byte(c.String()), nil
+}
+
 // Equals checks that two Cids are the same.
 // In order for two Cids to be considered equal, the
 // Version, the Codec and the Multihash must match.
@@ -490,7 +512,18 @@ type Prefix struct {
 // Sum uses the information in a prefix to perform a multihash.Sum()
 // and return a newly constructed Cid with the resulting multihash.
 func (p Prefix) Sum(data []byte) (Cid, error) {
-	hash, err := mh.Sum(data, p.MhType, p.MhLength)
+	length := p.MhLength
+	if p.MhType == mh.ID {
+		length = -1
+	}
+
+	if p.Version == 0 && (p.MhType != mh.SHA2_256 ||
+		(p.MhLength != 32 && p.MhLength != -1)) {
+
+		return Undef, fmt.Errorf("invalid v0 prefix")
+	}
+
+	hash, err := mh.Sum(data, p.MhType, length)
 	if err != nil {
 		return Undef, err
 	}
@@ -509,34 +542,42 @@ func (p Prefix) Sum(data []byte) (Cid, error) {
 //
 //     <version><codec><mh-type><mh-length>
 func (p Prefix) Bytes() []byte {
-	buf := make([]byte, 4*binary.MaxVarintLen64)
-	n := binary.PutUvarint(buf, p.Version)
-	n += binary.PutUvarint(buf[n:], p.Codec)
-	n += binary.PutUvarint(buf[n:], uint64(p.MhType))
-	n += binary.PutUvarint(buf[n:], uint64(p.MhLength))
-	return buf[:n]
+	size := varint.UvarintSize(p.Version)
+	size += varint.UvarintSize(p.Codec)
+	size += varint.UvarintSize(p.MhType)
+	size += varint.UvarintSize(uint64(p.MhLength))
+
+	buf := make([]byte, size)
+	n := varint.PutUvarint(buf, p.Version)
+	n += varint.PutUvarint(buf[n:], p.Codec)
+	n += varint.PutUvarint(buf[n:], p.MhType)
+	n += varint.PutUvarint(buf[n:], uint64(p.MhLength))
+	if n != size {
+		panic("size mismatch")
+	}
+	return buf
 }
 
 // PrefixFromBytes parses a Prefix-byte representation onto a
 // Prefix.
 func PrefixFromBytes(buf []byte) (Prefix, error) {
 	r := bytes.NewReader(buf)
-	vers, err := binary.ReadUvarint(r)
+	vers, err := varint.ReadUvarint(r)
 	if err != nil {
 		return Prefix{}, err
 	}
 
-	codec, err := binary.ReadUvarint(r)
+	codec, err := varint.ReadUvarint(r)
 	if err != nil {
 		return Prefix{}, err
 	}
 
-	mhtype, err := binary.ReadUvarint(r)
+	mhtype, err := varint.ReadUvarint(r)
 	if err != nil {
 		return Prefix{}, err
 	}
 
-	mhlen, err := binary.ReadUvarint(r)
+	mhlen, err := varint.ReadUvarint(r)
 	if err != nil {
 		return Prefix{}, err
 	}
@@ -548,3 +589,41 @@ func PrefixFromBytes(buf []byte) (Prefix, error) {
 		MhLength: int(mhlen),
 	}, nil
 }
+
+func CidFromBytes(data []byte) (int, Cid, error) {
+	if len(data) > 2 && data[0] == mh.SHA2_256 && data[1] == 32 {
+		if len(data) < 34 {
+			return 0, Undef, fmt.Errorf("not enough bytes for cid v0")
+		}
+
+		h, err := mh.Cast(data[:34])
+		if err != nil {
+			return 0, Undef, err
+		}
+
+		return 34, Cid{string(h)}, nil
+	}
+
+	vers, n, err := varint.FromUvarint(data)
+	if err != nil {
+		return 0, Undef, err
+	}
+
+	if vers != 1 {
+		return 0, Undef, fmt.Errorf("expected 1 as the cid version number, got: %d", vers)
+	}
+
+	_, cn, err := varint.FromUvarint(data[n:])
+	if err != nil {
+		return 0, Undef, err
+	}
+
+	mhnr, _, err := mh.MHFromBytes(data[n+cn:])
+	if err != nil {
+		return 0, Undef, err
+	}
+
+	l := n + cn + mhnr
+
+	return l, Cid{string(data[0:l])}, nil
+}

cid_test.go

@@ -19,6 +19,7 @@ var tCodecs = map[uint64]string{
 	Raw:                "raw",
 	DagProtobuf:        "protobuf",
 	DagCBOR:            "cbor",
+	Libp2pKey:          "libp2p-key",
 	GitRaw:             "git-raw",
 	EthBlock:           "eth-block",
 	EthBlockList:       "eth-block-list",
@@ -35,6 +36,8 @@ var tCodecs = map[uint64]string{
 	ZcashTx:            "zcash-tx",
 	DecredBlock:        "decred-block",
 	DecredTx:           "decred-tx",
+	DashBlock:          "dash-block",
+	DashTx:             "dash-tx",
 }
 
 func assertEqual(t *testing.T, a, b Cid) {
@@ -71,6 +74,34 @@ func TestTableForV0(t *testing.T) {
 	}
 }
 
+func TestPrefixSum(t *testing.T) {
+	// Test creating CIDs both manually and with Prefix.
+	// Tests: https://github.com/ipfs/go-cid/issues/83
+	for _, hashfun := range []uint64{
+		mh.ID, mh.SHA3, mh.SHA2_256,
+	} {
+		h1, err := mh.Sum([]byte("TEST"), hashfun, -1)
+		if err != nil {
+			t.Fatal(err)
+		}
+		c1 := NewCidV1(Raw, h1)
+
+		h2, err := mh.Sum([]byte("foobar"), hashfun, -1)
+		if err != nil {
+			t.Fatal(err)
+		}
+		c2 := NewCidV1(Raw, h2)
+
+		c3, err := c1.Prefix().Sum([]byte("foobar"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !c2.Equals(c3) {
+			t.Fatal("expected CIDs to be equal")
+		}
+	}
+}
+
 func TestBasicMarshaling(t *testing.T) {
 	h, err := mh.Sum([]byte("TEST"), mh.SHA3, 4)
 	if err != nil {
@@ -156,6 +187,44 @@ func TestBasesMarshaling(t *testing.T) {
 	}
 }
 
+func TestBinaryMarshaling(t *testing.T) {
+	data := []byte("this is some test content")
+	hash, _ := mh.Sum(data, mh.SHA2_256, -1)
+	c := NewCidV1(DagCBOR, hash)
+	var c2 Cid
+
+	data, err := c.MarshalBinary()
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = c2.UnmarshalBinary(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !c.Equals(c2) {
+		t.Errorf("cids should be the same: %s %s", c, c2)
+	}
+}
+
+func TestTextMarshaling(t *testing.T) {
+	data := []byte("this is some test content")
+	hash, _ := mh.Sum(data, mh.SHA2_256, -1)
+	c := NewCidV1(DagCBOR, hash)
+	var c2 Cid
+
+	data, err := c.MarshalText()
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = c2.UnmarshalText(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !c.Equals(c2) {
+		t.Errorf("cids should be the same: %s %s", c, c2)
+	}
+}
+
 func TestEmptyString(t *testing.T) {
 	_, err := Decode("")
 	if err == nil {
@@ -264,6 +333,41 @@ func TestNewPrefixV0(t *testing.T) {
 	if c1.Prefix() != c2.Prefix() {
 		t.Fatal("prefixes mismatch")
 	}
+
+}
+
+func TestInvalidV0Prefix(t *testing.T) {
+	tests := []Prefix{
+		{
+			MhType:   mh.SHA2_256,
+			MhLength: 31,
+		},
+		{
+			MhType:   mh.SHA2_256,
+			MhLength: 33,
+		},
+		{
+			MhType:   mh.SHA2_256,
+			MhLength: -2,
+		},
+		{
+			MhType:   mh.SHA2_512,
+			MhLength: 32,
+		},
+		{
+			MhType:   mh.SHA2_512,
+			MhLength: -1,
+		},
+	}
+
+	for i, p := range tests {
+		t.Log(i)
+		_, err := p.Sum([]byte("testdata"))
+		if err == nil {
+			t.Fatalf("should error (index %d)", i)
+		}
+	}
+
 }
 
 func TestPrefixRoundtrip(t *testing.T) {
@@ -370,13 +474,13 @@ func TestHexDecode(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if c.String() != "zb2rhhFAEMepUBbGyP1k8tGfz7BSciKXP6GHuUeUsJBaK6cqG" {
+	if c.String() != "bafkreie5qrjvaw64n4tjm6hbnm7fnqvcssfed4whsjqxzslbd3jwhsk3mm" {
 		t.Fatal("hash value failed to round trip decoding from hex")
 	}
 }
 
 func ExampleDecode() {
-	encoded := "zb2rhhFAEMepUBbGyP1k8tGfz7BSciKXP6GHuUeUsJBaK6cqG"
+	encoded := "bafkreie5qrjvaw64n4tjm6hbnm7fnqvcssfed4whsjqxzslbd3jwhsk3mm"
 	c, err := Decode(encoded)
 	if err != nil {
 		fmt.Printf("Error: %s", err)
@@ -384,11 +488,11 @@ func ExampleDecode() {
 	}
 
 	fmt.Println(c)
-	// Output: zb2rhhFAEMepUBbGyP1k8tGfz7BSciKXP6GHuUeUsJBaK6cqG
+	// Output: bafkreie5qrjvaw64n4tjm6hbnm7fnqvcssfed4whsjqxzslbd3jwhsk3mm
 }
 
 func TestFromJson(t *testing.T) {
-	cval := "zb2rhhFAEMepUBbGyP1k8tGfz7BSciKXP6GHuUeUsJBaK6cqG"
+	cval := "bafkreie5qrjvaw64n4tjm6hbnm7fnqvcssfed4whsjqxzslbd3jwhsk3mm"
 	jsoncid := []byte(`{"/":"` + cval + `"}`)
 	var c Cid
 	err := json.Unmarshal(jsoncid, &c)
@@ -402,7 +506,7 @@ func TestFromJson(t *testing.T) {
 }
 
 func TestJsonRoundTrip(t *testing.T) {
-	exp, err := Decode("zb2rhhFAEMepUBbGyP1k8tGfz7BSciKXP6GHuUeUsJBaK6cqG")
+	exp, err := Decode("bafkreie5qrjvaw64n4tjm6hbnm7fnqvcssfed4whsjqxzslbd3jwhsk3mm")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -446,3 +550,48 @@ func BenchmarkStringV1(b *testing.B) {
 		b.FailNow()
 	}
 }
+
+func TestReadCidsFromBuffer(t *testing.T) {
+	cidstr := []string{
+		"bafkreie5qrjvaw64n4tjm6hbnm7fnqvcssfed4whsjqxzslbd3jwhsk3mm",
+		"Qmf5Qzp6nGBku7CEn2UQx4mgN8TW69YUok36DrGa6NN893",
+		"zb2rhZi1JR4eNc2jBGaRYJKYM8JEB4ovenym8L1CmFsRAytkz",
+	}
+
+	var cids []Cid
+	var buf []byte
+	for _, cs := range cidstr {
+		c, err := Decode(cs)
+		if err != nil {
+			t.Fatal(err)
+		}
+		cids = append(cids, c)
+		buf = append(buf, c.Bytes()...)
+	}
+
+	var cur int
+	for _, expc := range cids {
+		n, c, err := CidFromBytes(buf[cur:])
+		if err != nil {
+			t.Fatal(err)
+		}
+		if c != expc {
+			t.Fatal("cids mismatched")
+		}
+		cur += n
+	}
+	if cur != len(buf) {
+		t.Fatal("had trailing bytes")
+	}
+}
+
+func TestBadParse(t *testing.T) {
+	hash, err := mh.Sum([]byte("foobar"), mh.SHA3_256, -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = Parse(hash)
+	if err == nil {
+		t.Fatal("expected to fail to parse an invalid CIDv1 CID")
+	}
+}

go.mod

@@ -0,0 +1,9 @@
+module github.com/ipfs/go-cid
+
+require (
+	github.com/multiformats/go-multibase v0.0.1
+	github.com/multiformats/go-multihash v0.0.13
+	github.com/multiformats/go-varint v0.0.5
+)
+
+go 1.13

go.sum

@@ -0,0 +1,30 @@
+github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1 h1:lYpkrQH5ajf0OXOcUbGjvZxxijuBwbbmlSxLiuofa+g=
+github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1/go.mod h1:pD8RvIylQ358TN4wwqatJ8rNavkEINozVn9DtGI3dfQ=
+github.com/minio/sha256-simd v0.1.1-0.20190913151208-6de447530771 h1:MHkK1uRtFbVqvAgvWxafZe54+5uBxLluGylDiKgdhwo=
+github.com/minio/sha256-simd v0.1.1-0.20190913151208-6de447530771/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
+github.com/mr-tron/base58 v1.1.0 h1:Y51FGVJ91WBqCEabAi5OPUz38eAx8DakuAm5svLcsfQ=
+github.com/mr-tron/base58 v1.1.0/go.mod h1:xcD2VGqlgYjBdcBLw+TuYLr8afG+Hj8g2eTVqeSzSU8=
+github.com/mr-tron/base58 v1.1.3 h1:v+sk57XuaCKGXpWtVBX8YJzO7hMGx4Aajh4TQbdEFdc=
+github.com/mr-tron/base58 v1.1.3/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
+github.com/multiformats/go-base32 v0.0.3 h1:tw5+NhuwaOjJCC5Pp82QuXbrmLzWg7uxlMFp8Nq/kkI=
+github.com/multiformats/go-base32 v0.0.3/go.mod h1:pLiuGC8y0QR3Ue4Zug5UzK9LjgbkL8NSQj0zQ5Nz/AA=
+github.com/multiformats/go-multibase v0.0.1 h1:PN9/v21eLywrFWdFNsFKaU04kLJzuYzmrJR+ubhT9qA=
+github.com/multiformats/go-multibase v0.0.1/go.mod h1:bja2MqRZ3ggyXtZSEDKpl0uO/gviWFaSteVbWT51qgs=
+github.com/multiformats/go-multihash v0.0.12 h1:i2PQZWlsq8asUZwPS5w7VMCoUKEz/k/XG6WH30gsTU8=
+github.com/multiformats/go-multihash v0.0.12/go.mod h1:2+oRiLVLqXx+yxM/RIdhLstp1q2WMJAlQ4kdLkS3un0=
+github.com/multiformats/go-multihash v0.0.13 h1:06x+mk/zj1FoMsgNejLpy6QTvJqlSt/BhLEy87zidlc=
+github.com/multiformats/go-multihash v0.0.13/go.mod h1:VdAWLKTwram9oKAatUcLxBNUjdtcVwxObEQBtRfuyjc=
+github.com/multiformats/go-varint v0.0.4 h1:CplQWhUouUgTZ53vNFE8VoWr2VjaKXci+xyrKyyFuSw=
+github.com/multiformats/go-varint v0.0.4/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
+github.com/multiformats/go-varint v0.0.5 h1:XVZwSo04Cs3j/jS0uAEPpT3JY6DzMcVLLoWOSnCxOjg=
+github.com/multiformats/go-varint v0.0.5/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
+github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
+github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8 h1:1wopBVtVdWnn03fZelqdXTqk7U7zPQCb+T4rbU9ZEoU=
+golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

package.json

@@ -9,9 +9,9 @@
   "gxDependencies": [
     {
       "author": "whyrusleeping",
-      "hash": "QmPnFwZ2JXKnXgMw8CdBPxn7FWh6LLdjUjxV1fKHuJnkr8",
+      "hash": "QmerPMzPk1mJVowm8KgmoknWa4yCYvvugMPsgWmDNUvDLW",
       "name": "go-multihash",
-      "version": "1.0.8"
+      "version": "1.0.9"
     },
     {
       "author": "whyrusleeping",
@@ -25,6 +25,6 @@
   "license": "MIT",
   "name": "go-cid",
   "releaseCmd": "git commit -a -m \"gx publish $VERSION\"",
-  "version": "0.9.0"
+  "version": "0.9.3"
 }
 

varint.go

@@ -1,5 +1,9 @@
 package cid
 
+import (
+	"github.com/multiformats/go-varint"
+)
+
 // Version of varint function that work with a string rather than
 // []byte to avoid unnecessary allocation
 
@@ -15,7 +19,7 @@ package cid
 // 	n  < 0: value larger than 64 bits (overflow)
 // 	        and -n is the number of bytes read
 //
-func uvarint(buf string) (uint64, int) {
+func uvarint(buf string) (uint64, int, error) {
 	var x uint64
 	var s uint
 	// we have a binary string so we can't use a range loope
@@ -23,12 +27,14 @@ func uvarint(buf string) (uint64, int) {
 		b := buf[i]
 		if b < 0x80 {
 			if i > 9 || i == 9 && b > 1 {
-				return 0, -(i + 1) // overflow
+				return 0, 0, varint.ErrOverflow
+			} else if b == 0 && i > 0 {
+				return 0, 0, varint.ErrNotMinimal
 			}
-			return x | uint64(b)<<s, i + 1
+			return x | uint64(b)<<s, i + 1, nil
 		}
 		x |= uint64(b&0x7f) << s
 		s += 7
 	}
-	return 0, 0
+	return 0, 0, varint.ErrUnderflow
 }

varint_test.go

@@ -1,17 +1,25 @@
 package cid
 
 import (
-	"encoding/binary"
 	"testing"
+
+	"github.com/multiformats/go-varint"
 )
 
 func TestUvarintRoundTrip(t *testing.T) {
 	testCases := []uint64{0, 1, 2, 127, 128, 129, 255, 256, 257, 1<<63 - 1}
 	for _, tc := range testCases {
+		t.Log("testing", tc)
 		buf := make([]byte, 16)
-		binary.PutUvarint(buf, tc)
-		v, l1 := uvarint(string(buf))
-		_, l2 := binary.Uvarint(buf)
+		varint.PutUvarint(buf, tc)
+		v, l1, err := uvarint(string(buf))
+		if err != nil {
+			t.Fatalf("%v: %s", buf, err)
+		}
+		_, l2, err := varint.FromUvarint(buf)
+		if err != nil {
+			t.Fatal(err)
+		}
 		if tc != v {
 			t.Errorf("roundtrip failed expected %d but got %d", tc, v)
 		}