-
Notifications
You must be signed in to change notification settings - Fork 13.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Doc fix #137714
base: master
Are you sure you want to change the base?
Doc fix #137714
Conversation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
library/alloc/src/ffi/c_str.rs
Outdated
/// obtained by calling [`CString::into_raw`]. Other usage (e.g., trying to take | ||
/// ownership of a string that was allocated by foreign code) is likely to lead | ||
/// to undefined behavior or allocator corruption. | ||
/// obtained by calling [`CString::into_raw`] and this pointer must not be accessed |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
not the pointer, but the memory it points too
library/alloc/src/str.rs
Outdated
/// | ||
/// * The provided bytes must contain a valid UTF-8 sequence. | ||
/// | ||
/// * The `Box<[u8]>` must have been allocated via the global allocator. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is not a safety requirement. Box<[u8]>
is really Box<[u8], Global>
, so passing a box with a custom allocator to this function is prevented by type check.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, you are right. I will fix these.
PR Description
This PR addresses missing safety documentation for two APIs:
1. alloc::ffi::CStr::from_raw
Alias
: The pointer must not be aliased (accessed via other pointers) during the reconstructed CString's lifetime.Owning
: Calling this function twice on the same pointer and creating two objects with overlapping lifetimes, introduces two alive owners of the same memory. This may result in a double-free.Dangling
: The prior documentation required the pointer to originate from CString::into_raw, but this constraint is incomplete. A validly sourced pointer can also cause undefined behavior (UB) if it becomes dangling. A simple Poc for this situation:2. alloc::str::from_boxed_utf8_unchecked
ValidStr
: Bytes must contain a valid UTF-8 sequence.