Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` #137714

DiuDiu777 · 2025-02-27T08:43:41Z

PR Description

This PR addresses missing safety documentation for two APIs:

1. alloc::ffi::CStr::from_raw

Alias: The pointer must not be aliased (accessed via other pointers) during the reconstructed CString's lifetime.
Owning: Calling this function twice on the same pointer and creating two objects with overlapping lifetimes, introduces two alive owners of the same memory. This may result in a double-free.
Dangling: The prior documentation required the pointer to originate from CString::into_raw, but this constraint is incomplete. A validly sourced pointer can also cause undefined behavior (UB) if it becomes dangling. A simple Poc for this situation:

use std::ffi::CString;
use std::os::raw::c_char;

fn create_dangling() -> *mut c_char {
    let local_ptr: *mut c_char = {
        let valid_data = CString::new("valid").unwrap();
        valid_data.into_raw() 
    }; 

    unsafe { 
        let _x = CString::from_raw(local_ptr); 
    } 
    local_ptr
}

fn main() {
    let dangling = create_dangling();
    unsafe {let _y = CString::from_raw(dangling);} // Cause UB!
}

2. alloc::str::from_boxed_utf8_unchecked

ValidStr: Bytes must contain a valid UTF-8 sequence.

rustbot · 2025-02-27T08:43:45Z

r? @thomcc

rustbot has assigned @thomcc.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Sky9x · 2025-03-03T06:56:06Z

library/alloc/src/ffi/c_str.rs

-    /// obtained by calling [`CString::into_raw`]. Other usage (e.g., trying to take
-    /// ownership of a string that was allocated by foreign code) is likely to lead
-    /// to undefined behavior or allocator corruption.
+    /// obtained by calling [`CString::into_raw`] and this pointer must not be accessed


not the pointer, but the memory it points too

Sky9x · 2025-03-03T06:56:08Z

library/alloc/src/str.rs

+///
+/// * The provided bytes must contain a valid UTF-8 sequence.
+///
+/// * The `Box<[u8]>` must have been allocated via the global allocator.


This is not a safety requirement. Box<[u8]> is really Box<[u8], Global>, so passing a box with a custom allocator to this function is prevented by type check.

Yes, you are right. I will fix these.

tgross35

One nit and please squash, then lgtm

r? tgross35

library/alloc/src/ffi/c_str.rs

rustbot · 2025-04-27T04:20:54Z

Requested reviewer is already assigned to this pull request.

Please choose another assignee.

tgross35 · 2025-04-27T04:28:18Z

You should drop me as a coauthor from the commit message, suggesting a comma in review doesn't mean I had anything to do with authoring this patch :)

DiuDiu777 · 2025-04-27T05:55:42Z

Done :) @tgross35

tgross35 · 2025-04-27T05:56:38Z

Thanks!

@bors r+ rollup

bors · 2025-04-27T05:56:41Z

📌 Commit bfdd947 has been approved by tgross35

It is now in the queue for this repository.

…iaskrgr Rollup of 8 pull requests Successful merges: - rust-lang#137439 (Stabilise `std::ffi::c_str`) - rust-lang#137714 (Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked`) - rust-lang#139031 (Use char::is_whitespace directly in str::trim*) - rust-lang#139090 (fix docs for `Peekable::next_if{_eq}`) - rust-lang#140297 (Update example to use CStr::to_string_lossy) - rust-lang#140330 (Clarified bootstrap optimization "true" argument) - rust-lang#140339 (session: Cleanup `CanonicalizedPath::new`) - rust-lang#140346 (rustc_span: Some hygiene cleanups) r? `@ghost` `@rustbot` modify labels: rollup

Rollup merge of rust-lang#137714 - DiuDiu777:doc-fix, r=tgross35 Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` ## PR Description This PR addresses missing safety documentation for two APIs: **1. alloc::ffi::CStr::from_raw** - `Alias`: The pointer must not be aliased (accessed via other pointers) during the reconstructed CString's lifetime. - `Owning`: Calling this function twice on the same pointer and creating two objects with overlapping lifetimes, introduces two alive owners of the same memory. This may result in a double-free. - `Dangling`: The prior documentation required the pointer to originate from CString::into_raw, but this constraint is incomplete. A validly sourced pointer can also cause undefined behavior (UB) if it becomes dangling. A simple Poc for this situation: ``` use std::ffi::CString; use std::os::raw::c_char; fn create_dangling() -> *mut c_char { let local_ptr: *mut c_char = { let valid_data = CString::new("valid").unwrap(); valid_data.into_raw() }; unsafe { let _x = CString::from_raw(local_ptr); } local_ptr } fn main() { let dangling = create_dangling(); unsafe {let _y = CString::from_raw(dangling);} // Cause UB! } ``` **2. alloc::str::from_boxed_utf8_unchecked** - `ValidStr`: Bytes must contain a valid UTF-8 sequence.

Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` ## PR Description This PR addresses missing safety documentation for two APIs: **1. alloc::ffi::CStr::from_raw** - `Alias`: The pointer must not be aliased (accessed via other pointers) during the reconstructed CString's lifetime. - `Owning`: Calling this function twice on the same pointer and creating two objects with overlapping lifetimes, introduces two alive owners of the same memory. This may result in a double-free. - `Dangling`: The prior documentation required the pointer to originate from CString::into_raw, but this constraint is incomplete. A validly sourced pointer can also cause undefined behavior (UB) if it becomes dangling. A simple Poc for this situation: ``` use std::ffi::CString; use std::os::raw::c_char; fn create_dangling() -> *mut c_char { let local_ptr: *mut c_char = { let valid_data = CString::new("valid").unwrap(); valid_data.into_raw() }; unsafe { let _x = CString::from_raw(local_ptr); } local_ptr } fn main() { let dangling = create_dangling(); unsafe {let _y = CString::from_raw(dangling);} // Cause UB! } ``` **2. alloc::str::from_boxed_utf8_unchecked** - `ValidStr`: Bytes must contain a valid UTF-8 sequence.

rustbot assigned thomcc Feb 27, 2025

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Feb 27, 2025

This comment has been minimized.

# to view

Sky9x suggested changes Mar 3, 2025

View reviewed changes

DiuDiu777 requested a review from Sky9x March 3, 2025 12:04

Sky9x approved these changes Mar 3, 2025

View reviewed changes

tgross35 approved these changes Apr 27, 2025

View reviewed changes

library/alloc/src/ffi/c_str.rs Outdated Show resolved Hide resolved

rustbot assigned tgross35 and unassigned thomcc Apr 27, 2025

tgross35 changed the title ~~Doc fix~~ Update safety documentation for CString::from_ptr and str::from_boxed_utf8_unchecked Apr 27, 2025

DiuDiu777 force-pushed the doc-fix branch from 9be9482 to d3acd47 Compare April 27, 2025 03:10

fix missing doc in CString::from_raw and str::from_boxed_utf8_unchecked

bfdd947

DiuDiu777 force-pushed the doc-fix branch from d3acd47 to bfdd947 Compare April 27, 2025 04:50

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 27, 2025

matthiaskrgr mentioned this pull request Apr 27, 2025

Rollup of 8 pull requests #140360

Merged

bors merged commit bd3af53 into rust-lang:master Apr 27, 2025
6 checks passed

rustbot added this to the 1.88.0 milestone Apr 27, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` #137714

Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` #137714

DiuDiu777 commented Feb 27, 2025 •

edited

Loading

rustbot commented Feb 27, 2025

This comment has been minimized.

This comment has been minimized.

Sky9x Mar 3, 2025

Sky9x Mar 3, 2025

DiuDiu777 Mar 3, 2025

tgross35 left a comment •

edited

Loading

rustbot commented Apr 27, 2025

tgross35 commented Apr 27, 2025

DiuDiu777 commented Apr 27, 2025 •

edited

Loading

tgross35 commented Apr 27, 2025

bors commented Apr 27, 2025

Update safety documentation for CString::from_ptr and str::from_boxed_utf8_unchecked #137714

Update safety documentation for CString::from_ptr and str::from_boxed_utf8_unchecked #137714

Conversation

DiuDiu777 commented Feb 27, 2025 • edited Loading

PR Description​

rustbot commented Feb 27, 2025

This comment has been minimized.

This comment has been minimized.

Sky9x Mar 3, 2025

Choose a reason for hiding this comment

Sky9x Mar 3, 2025

Choose a reason for hiding this comment

DiuDiu777 Mar 3, 2025

Choose a reason for hiding this comment

tgross35 left a comment • edited Loading

Choose a reason for hiding this comment

rustbot commented Apr 27, 2025

tgross35 commented Apr 27, 2025

DiuDiu777 commented Apr 27, 2025 • edited Loading

tgross35 commented Apr 27, 2025

bors commented Apr 27, 2025

Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` #137714

Update safety documentation for `CString::from_ptr` and `str::from_boxed_utf8_unchecked` #137714

DiuDiu777 commented Feb 27, 2025 •

edited

Loading

PR Description

tgross35 left a comment •

edited

Loading

DiuDiu777 commented Apr 27, 2025 •

edited

Loading