--- CBOR-XS/XS.xs	2013/11/30 17:19:34	1.35
+++ CBOR-XS/XS.xs	2013/11/30 17:37:45	1.36
@@ -230,18 +230,18 @@
 
    if (ecb_expect_true (len < LENGTH_EXT1))
       *enc->cur++ = major | len;
-   else if (ecb_expect_true (len <= 0xff))
+   else if (ecb_expect_true (len <= 0xffU))
      {
        *enc->cur++ = major | LENGTH_EXT1;
        *enc->cur++ = len;
      }
-   else if (len <= 0xffff)
+   else if (len <= 0xffffU)
      {
        *enc->cur++ = major | LENGTH_EXT2;
        *enc->cur++ = len >> 8;
        *enc->cur++ = len;
      }
-   else if (len <= 0xffffffff)
+   else if (len <= 0xffffffffU)
      {
        *enc->cur++ = major | LENGTH_EXT4;
        *enc->cur++ = len >> 24;
@@ -629,49 +629,49 @@
 
   if (ecb_expect_true (m < LENGTH_EXT1))
     return m;
-
-  switch (m)
+  else if (ecb_expect_true (m == LENGTH_EXT1))
+    {
+      WANT (1);
+      dec->cur += 1;
+      return dec->cur[-1];
+    }
+  else if (ecb_expect_true (m == LENGTH_EXT2))
     {
-      case LENGTH_EXT1:
-        WANT (1);
-        dec->cur += 1;
-        return dec->cur[-1];
-
-      case LENGTH_EXT2:
-        WANT (2);
-        dec->cur += 2;
-        return (((UV)dec->cur[-2]) <<  8)
-             |  ((UV)dec->cur[-1]);
-
-      case LENGTH_EXT4:
-        WANT (4);
-        dec->cur += 4;
-        return (((UV)dec->cur[-4]) << 24)
-             | (((UV)dec->cur[-3]) << 16)
-             | (((UV)dec->cur[-2]) <<  8)
-             |  ((UV)dec->cur[-1]);
-
-      case LENGTH_EXT8:
-        WANT (8);
-        dec->cur += 8;
+      WANT (2);
+      dec->cur += 2;
+      return (((UV)dec->cur[-2]) <<  8)
+           |  ((UV)dec->cur[-1]);
+    }
+  else if (ecb_expect_true (m == LENGTH_EXT4))
+    {
+      WANT (4);
+      dec->cur += 4;
+      return (((UV)dec->cur[-4]) << 24)
+           | (((UV)dec->cur[-3]) << 16)
+           | (((UV)dec->cur[-2]) <<  8)
+           |  ((UV)dec->cur[-1]);
+    }
+  else if (ecb_expect_true (m == LENGTH_EXT8))
+    {
+      WANT (8);
+      dec->cur += 8;
 
-        return
+      return
 #if UVSIZE < 8
-               0
+             0
 #else
-               (((UV)dec->cur[-8]) << 56)
-             | (((UV)dec->cur[-7]) << 48)
-             | (((UV)dec->cur[-6]) << 40)
-             | (((UV)dec->cur[-5]) << 32)
+             (((UV)dec->cur[-8]) << 56)
+           | (((UV)dec->cur[-7]) << 48)
+           | (((UV)dec->cur[-6]) << 40)
+           | (((UV)dec->cur[-5]) << 32)
 #endif
-             | (((UV)dec->cur[-4]) << 24)
-             | (((UV)dec->cur[-3]) << 16)
-             | (((UV)dec->cur[-2]) <<  8)
-             |  ((UV)dec->cur[-1]);
-
-      default:
-        ERR ("corrupted CBOR data (unsupported integer minor encoding)");
+           | (((UV)dec->cur[-4]) << 24)
+           | (((UV)dec->cur[-3]) << 16)
+           | (((UV)dec->cur[-2]) <<  8)
+           |  ((UV)dec->cur[-1]);
     }
+  else
+    ERR ("corrupted CBOR data (unsupported integer minor encoding)");
 
 fail:
   return 0;
@@ -707,6 +707,7 @@
     {
       int i, len = decode_uint (dec);
 
+      WANT (len); // complexity check for av_fill - need at least one byte per value, do not allow supersize arrays
       av_fill (av, len - 1);
 
       for (i = 0; i < len; ++i)
@@ -729,7 +730,7 @@
   // byte or utf-8 strings as keys, but only when !stringref
 
   if (ecb_expect_true (!dec->stringref))
-    if ((*dec->cur - MAJOR_BYTES) <= 27)
+    if (ecb_expect_true ((*dec->cur - MAJOR_BYTES) <= LENGTH_EXT8))
       {
         I32 len = decode_uint (dec);
         char *key = (char *)dec->cur;
@@ -743,7 +744,7 @@
 
         return;
       }
-    else if ((*dec->cur - MAJOR_TEXT) <= 27)
+    else if (ecb_expect_true ((*dec->cur - MAJOR_TEXT) <= LENGTH_EXT8))
       {
         I32 len = decode_uint (dec);
         char *key = (char *)dec->cur;
@@ -1290,10 +1291,14 @@
 PROTOTYPES: ENABLE
 
 void encode_cbor (SV *scalar)
+	ALIAS:
+        encode_cbor         = 0
+        encode_cbor_sharing = F_ALLOW_SHARING
 	PPCODE:
 {
         CBOR cbor;
         cbor_init (&cbor);
+        cbor.flags |= ix;
         PUTBACK; scalar = encode_cbor (scalar, &cbor); SPAGAIN;
         XPUSHs (scalar);
 }