Skip to content

Commit 8fc89be

Browse files
authored
Unrolled build for rust-lang#137714
Rollup merge of rust-lang#137714 - DiuDiu777:doc-fix, r=tgross35 Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` ## PR Description​ This PR addresses missing safety documentation for two APIs: ​**1. alloc::ffi::CStr::from_raw**​ - ​`Alias`: The pointer ​must not be aliased​ (accessed via other pointers) during the reconstructed CString's lifetime. - `Owning`: Calling this function twice on the same pointer and creating two objects with overlapping lifetimes, introduces two alive owners of the same memory. This may result in a double-free. - `Dangling`: The prior documentation required the pointer to originate from CString::into_raw, but this constraint is incomplete. A validly sourced pointer can also cause undefined behavior (UB) if it becomes dangling. A simple Poc for this situation: ``` use std::ffi::CString; use std::os::raw::c_char; fn create_dangling() -> *mut c_char { let local_ptr: *mut c_char = { let valid_data = CString::new("valid").unwrap(); valid_data.into_raw() }; unsafe { let _x = CString::from_raw(local_ptr); } local_ptr } fn main() { let dangling = create_dangling(); unsafe {let _y = CString::from_raw(dangling);} // Cause UB! } ``` ​**2. alloc::str::from_boxed_utf8_unchecked**​ - `ValidStr`: Bytes must contain a ​valid UTF-8 sequence.
2 parents 8947e16 + bfdd947 commit 8fc89be

File tree

2 files changed

+12
-3
lines changed

2 files changed

+12
-3
lines changed

library/alloc/src/ffi/c_str.rs

+8-3
Original file line numberDiff line numberDiff line change
@@ -351,9 +351,14 @@ impl CString {
351351
/// # Safety
352352
///
353353
/// This should only ever be called with a pointer that was earlier
354-
/// obtained by calling [`CString::into_raw`]. Other usage (e.g., trying to take
355-
/// ownership of a string that was allocated by foreign code) is likely to lead
356-
/// to undefined behavior or allocator corruption.
354+
/// obtained by calling [`CString::into_raw`], and the memory it points to must not be accessed
355+
/// through any other pointer during the lifetime of reconstructed `CString`.
356+
/// Other usage (e.g., trying to take ownership of a string that was allocated by foreign code)
357+
/// is likely to lead to undefined behavior or allocator corruption.
358+
///
359+
/// This function does not validate ownership of the raw pointer's memory.
360+
/// A double-free may occur if the function is called twice on the same raw pointer.
361+
/// Additionally, the caller must ensure the pointer is not dangling.
357362
///
358363
/// It should be noted that the length isn't just "recomputed," but that
359364
/// the recomputed length must match the original length from the

library/alloc/src/str.rs

+4
Original file line numberDiff line numberDiff line change
@@ -603,6 +603,10 @@ impl str {
603603
/// Converts a boxed slice of bytes to a boxed string slice without checking
604604
/// that the string contains valid UTF-8.
605605
///
606+
/// # Safety
607+
///
608+
/// * The provided bytes must contain a valid UTF-8 sequence.
609+
///
606610
/// # Examples
607611
///
608612
/// ```

0 commit comments

Comments
 (0)