huiali/rust-skills/rust-unsafe

// SAFETY: ptr must be non-null and properly aligned.
// This function is only called after a null check.
unsafe { *ptr = value; }
 
/// # Safety
///
/// * `ptr` must be properly aligned and not null
/// * `ptr` must point to initialized memory of type T
/// * The memory must not be accessed after this function returns
pub unsafe fn write(ptr: *mut T, value: &T) { ... }

use std::ffi::{CStr, CString};
use std::os::raw::c_char;
 
extern "C" {
    fn c_function(s: *const c_char) -> i32;
}
 
// ✅ Safe wrapper
pub fn safe_c_function(s: &str) -> Result<i32, Box<dyn Error>> {
    let c_str = CString::new(s)?;
    // SAFETY: c_str is a valid null-terminated string created from Rust data.
    // The pointer is valid for the duration of this call.
    let result = unsafe { c_function(c_str.as_ptr()) };
    Ok(result)
}

use std::ptr::NonNull;
 
struct Buffer {
    ptr: NonNull<u8>,
    len: usize,
}
 
impl Buffer {
    pub fn write(&mut self, index: usize, value: u8) -> Result<(), String> {
        if index >= self.len {
            return Err("index out of bounds".to_string());
        }
 
        // SAFETY: We've checked index is within bounds.
        // ptr is NonNull and points to valid memory.
        unsafe {
            self.ptr.as_ptr().add(index).write(value);
        }
        Ok(())
    }
}

use std::mem::MaybeUninit;
 
// ✅ Safe uninitialized memory handling
fn create_buffer(size: usize) -> Vec<u8> {
    let mut buffer: Vec<MaybeUninit<u8>> = Vec::with_capacity(size);
 
    for i in 0..size {
        buffer.push(MaybeUninit::new(0));
    }
 
    // SAFETY: All elements have been initialized to 0.
    unsafe { std::mem::transmute(buffer) }
}
 
// ❌ Avoid: deprecated pattern
fn bad_buffer(size: usize) -> Vec<u8> {
    let mut v = Vec::with_capacity(size);
    unsafe { v.set_len(size); }  // UB if not initialized!
    v
}

#[repr(C)]
pub struct Point {
    pub x: f64,
    pub y: f64,
}
 
#[repr(C)]
pub enum Status {
    Success = 0,
    Error = 1,
}
 
// SAFETY: Layout matches C struct exactly
extern "C" {
    fn process_point(p: *const Point) -> Status;
}

Do I really need unsafe?
  → Can I use safe abstractions?
  → Is this for FFI? (justified)
  → Is this for measured performance? (profile first)
  → Am I fighting the borrow checker? (redesign instead)

For every unsafe block:
1. Document preconditions
2. Explain why they hold
3. Reference invariants maintained
 
For public unsafe functions:
1. Add /// # Safety section
2. List all requirements
3. Document consequences of violations

# Detect undefined behavior
cargo +nightly miri test
 
# Memory leak detection
valgrind ./target/release/program
 
# Data race detection
RUST_BACKTRACE=1 cargo test --features tsan

Raw unsafe code
  ↓
Safe private functions (validate inputs)
  ↓
Safe public API (no unsafe visible)

# Check for undefined behavior
cargo +nightly miri test
 
# Run with address sanitizer
RUSTFLAGS="-Z sanitizer=address" cargo +nightly test
 
# Check FFI bindings
cargo check --features ffi
 
# Verify memory safety
valgrind --leak-check=full ./target/release/program
 
# Documentation check
cargo doc --no-deps --open

// ❌ Bad: pointer outlives data
fn bad() -> *const i32 {
    let x = 42;
    &x as *const i32  // Dangling!
}
 
// ✅ Good: proper lifetime management
fn good(x: &i32) -> *const i32 {
    x as *const i32  // Lifetime tied to input
}

// ❌ Bad: reading uninitialized memory
let x: i32;
unsafe { println!("{}", x); }  // UB!
 
// ✅ Good: use MaybeUninit
let mut x = MaybeUninit::<i32>::uninit();
x.write(42);
let x = unsafe { x.assume_init() };  // Safe

// ❌ Bad: default repr with FFI
struct Point { x: f64, y: f64 }
extern "C" { fn use_point(p: Point); }
 
// ✅ Good: explicit C layout
#[repr(C)]
struct Point { x: f64, y: f64 }
extern "C" { fn use_point(p: Point); }