From 2314a6868dbeee5010df41c1e77b3d31259501e3 Mon Sep 17 00:00:00 2001
From: Leander <mail@leander.sh>
Date: Fri, 31 Oct 2025 19:49:35 +0100
Subject: [PATCH 1/2] chore: bump ai-callgrind 0.16.1

---
 Cargo.lock | 12 ++++++------
 Cargo.toml |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2af6680..86507eb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -68,9 +68,9 @@ dependencies = [
 
 [[package]]
 name = "iai-callgrind"
-version = "0.15.2"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd56318753b26f1f33ccf7385041fd31fdb3f8966aa1c62d46cf2efba9835504"
+checksum = "0b1e4910d3a9137442723dfb772c32dc10674c4181ca078d2fd227cd5dce9db0"
 dependencies = [
  "bincode",
  "derive_more",
@@ -80,9 +80,9 @@ dependencies = [
 
 [[package]]
 name = "iai-callgrind-macros"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "763d0d9b10ba3177236eda380afb78bafa150556dc4536969f91f938fee1b83a"
+checksum = "4d03775318d3f9f01b39ac6612b01464006dc397a654a89dd57df2fd34fb68c3"
 dependencies = [
  "derive_more",
  "proc-macro-error2",
@@ -95,9 +95,9 @@ dependencies = [
 
 [[package]]
 name = "iai-callgrind-runner"
-version = "0.15.2"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "100409442ecf8137ec5c0ad83548be9f1d22f072b646e6ed16177558e037a0dd"
+checksum = "b74c9743c00c3bca4aaffc69c87cae56837796cd362438daf354a3f785788c68"
 dependencies = [
  "serde",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 9533be9..de9377f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,7 +22,7 @@ categories = ["development-tools::profiling", "algorithms", "no-std"]
 comtains_macros = { path = "comtains_macros", version = "0.1.0" }
 
 [dev-dependencies]
-iai-callgrind = "0.15"
+iai-callgrind = "0.16"
 rand = { version = "0.8", default-features = false, features = ["std", "std_rng"] }
 
 [[bench]]

From bba9a216e355885e89d1e74511d976e7b5b5dca4 Mon Sep 17 00:00:00 2001
From: Leander <mail@leander.sh>
Date: Fri, 31 Oct 2025 19:51:06 +0100
Subject: [PATCH 2/2] feat: add early bounds check

---
 .github/workflows/ci.yml   |  2 +-
 comtains_macros/src/lib.rs | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 07b1f81..c35643b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
           sudo apt-get install -y valgrind
 
       - name: Install iai-callgrind-runner
-        run: cargo install --locked --version 0.15.2 iai-callgrind-runner
+        run: cargo install --locked --version 0.16.1 iai-callgrind-runner
 
       - name: Export runner path
         run: echo "IAI_CALLGRIND_RUNNER=$(which iai-callgrind-runner)" >> "$GITHUB_ENV"
diff --git a/comtains_macros/src/lib.rs b/comtains_macros/src/lib.rs
index 54dfdba..3b5eef6 100644
--- a/comtains_macros/src/lib.rs
+++ b/comtains_macros/src/lib.rs
@@ -131,6 +131,26 @@ fn expand_byte_set(mut sequences: Vec<Vec<u8>>) -> Result<TokenStream2> {
     let mut unique = BTreeSet::new();
     sequences.retain(|seq| unique.insert(seq.clone()));
 
+    let min_len = sequences.iter().map(|seq| seq.len()).min().unwrap();
+    let max_len = sequences.iter().map(|seq| seq.len()).max().unwrap();
+    let min_len_lit = syn::LitInt::new(&format!("{min_len}usize"), Span::call_site());
+    let max_len_lit = syn::LitInt::new(&format!("{max_len}usize"), Span::call_site());
+
+    let mut bounds_checks = Vec::new();
+    if min_len > 0 {
+        let min_len_lit = min_len_lit.clone();
+        bounds_checks.push(quote! {
+            if len < #min_len_lit {
+                return false;
+            }
+        });
+    }
+    bounds_checks.push(quote! {
+        if len > #max_len_lit {
+            return false;
+        }
+    });
+
     let trie = build_trie(&sequences);
     let root_expr = generate_node_expr(&trie, 0, 0);
 
@@ -178,6 +198,7 @@ fn expand_byte_set(mut sequences: Vec<Vec<u8>>) -> Result<TokenStream2> {
             #[inline(always)]
             pub fn contains(candidate: &[u8]) -> bool {
                 let len = candidate.len();
+                #( #bounds_checks )*
                 #root_expr
             }