From: Patrick Steinhardt Date: Tue, 07 Oct 2025 12:36:31 GMT Subject: [PATCH 3/6] rust/varint: add safety comments Message-ID: <20251007-b4-pks-ci-rust-v1-3-394502abe7ea@pks.im> In-Reply-To: <20251007-b4-pks-ci-rust-v1-0-394502abe7ea@pks.im> The `decode_varint()` and `encode_varint()` functions in our Rust crate are reimplementations of the respective C functions. As such, we are naturally forced to use the same interface in both Rust and C, which makes use of raw pointers. The consequence is that the code needs to be marked as unsafe in Rust. It is common practice in Rust to provide safety documentation for every block that is marked as unsafe. This common practice is also enforced by Clippy, Rust's static analyser. We don't have Clippy wired up yet, and we could of course just disable this check. But we're about to wire it up, and it is reasonable to always enforce documentation for unsafe blocks. Add such safety comments to already squelch those warnings now. Signed-off-by: Patrick Steinhardt --- src/varint.rs | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/varint.rs b/src/varint.rs index 6e610bdd8e..43b48debb5 100644 --- a/src/varint.rs +++ b/src/varint.rs @@ -1,3 +1,6 @@ +/// # Safety +/// +/// Callers must provide a NUL-terminated array to ensure safety. #[no_mangle] pub unsafe extern "C" fn decode_varint(bufp: *mut *const u8) -> u64 { let mut buf = *bufp; @@ -22,6 +25,11 @@ pub unsafe extern "C" fn decode_varint(bufp: *mut *const u8) -> u64 { val } +/// # Safety +/// +/// The provided buffer must be large enough to store the encoded varint. Callers may either provide +/// a `[u8; 16]` here, which is guaranteed to satisfy all encodable numbers. Or they can call this +/// function with a `NULL` pointer first to figure out array size. #[no_mangle] pub unsafe extern "C" fn encode_varint(value: u64, buf: *mut u8) -> u8 { let mut varint: [u8; 16] = [0; 16]; -- 2.51.0.764.g787ff6f08a.dirty