[PATCH v2 3/6] rust/varint: add safety comments
- From
Patrick Steinhardt <ps@pks.im>
- Date
- Oct 8, 2025, 06:27 UTC
- Message-ID
- <20251008-b4-pks-ci-rust-v2-3-d556ee83c381@pks.im>
- In-Reply-To
- <20251008-b4-pks-ci-rust-v2-0-d556ee83c381@pks.im>
The `decode_varint()` and `encode_varint()` functions in our Rust crate are reimplementations of the respective C functions. As such, we are naturally forced to use the same interface in both Rust and C, which makes use of raw pointers. The consequence is that the code needs to be marked as unsafe in Rust.
It is common practice in Rust to provide safety documentation for every block that is marked as unsafe. This common practice is also enforced by Clippy, Rust's static analyser. We don't have Clippy wired up yet, and we could of course just disable this check. But we're about to wire it up, and it is reasonable to always enforce documentation for unsafe blocks.
Add such safety comments to already squelch those warnings now. While at it, also document the functions' behaviour.
Helped-by: "brian m. carlson" <sandals@crustytoothpaste.net> Signed-off-by: Patrick Steinhardt <ps@pks.im> --- src/varint.rs | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
diff --git a/src/varint.rs b/src/varint.rs index 6e610bdd8e..06492dfc5e 100644 --- a/src/varint.rs +++ b/src/varint.rs @@ -1,3 +1,10 @@ +/// Decode the variable-length integer stored in `bufp` and return the decoded value. +/// +/// Returns 0 in case the decoded integer would overflow u64::MAX. +/// +/// # Safety +/// +/// The buffer must be NUL-terminated to ensure safety. #[no_mangle] pub unsafe extern "C" fn decode_varint(bufp: *mut *const u8) -> u64 { let mut buf = *bufp; @@ -22,6 +29,14 @@ pub unsafe extern "C" fn decode_varint(bufp: *mut *const u8) -> u64 { val } +/// Encode `value` into `buf` as a variable-length integer unless `buf` is null. +/// +/// Returns the number of bytes written, or, if `buf` is null, the number of bytes that would be +/// written to encode the integer. +/// +/// # Safety +/// +/// `buf` must either be null or point to at least 16 bytes of memory. #[no_mangle] pub unsafe extern "C" fn encode_varint(value: u64, buf: *mut u8) -> u8 { let mut varint: [u8; 16] = [0; 16];
-- 2.51.0.764.g787ff6f08a.dirty