Rust soundness fixes (#7518)

* Rust soundness fixes

* Second pass

* Make init_from_table unsafe

* Remove SafeSliceAccess

* Clippy

* Remove create_vector_of_strings

* More clippy

* Remove deprecated root type accessors

* More soundness fixes

* Fix EndianScalar for bool

* Add TriviallyTransmutable

* Add debug assertions

* Review comments

* Review feedback
This commit is contained in:
Raphael Taylor-Davies
2022-09-29 14:58:49 +01:00
committed by GitHub
parent dadbff5714
commit 374f8fb5fb
102 changed files with 2673 additions and 2035 deletions

View File

@@ -25,32 +25,38 @@ pub use self::bitflags_long_enum::LongEnum;
impl<'a> flatbuffers::Follow<'a> for LongEnum {
type Inner = Self;
#[inline]
fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
let b = unsafe {
flatbuffers::read_scalar_at::<u64>(buf, loc)
};
unsafe { Self::from_bits_unchecked(b) }
unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
let b = flatbuffers::read_scalar_at::<u64>(buf, loc);
// Safety:
// This is safe because we know bitflags is implemented with a repr transparent uint of the correct size.
// from_bits_unchecked will be replaced by an equivalent but safe from_bits_retain in bitflags 2.0
// https://github.com/bitflags/bitflags/issues/262
Self::from_bits_unchecked(b)
}
}
impl flatbuffers::Push for LongEnum {
type Output = LongEnum;
#[inline]
fn push(&self, dst: &mut [u8], _rest: &[u8]) {
unsafe { flatbuffers::emplace_scalar::<u64>(dst, self.bits()); }
unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
flatbuffers::emplace_scalar::<u64>(dst, self.bits());
}
}
impl flatbuffers::EndianScalar for LongEnum {
type Scalar = u64;
#[inline]
fn to_little_endian(self) -> Self {
let b = u64::to_le(self.bits());
unsafe { Self::from_bits_unchecked(b) }
fn to_little_endian(self) -> u64 {
self.bits().to_le()
}
#[inline]
#[allow(clippy::wrong_self_convention)]
fn from_little_endian(self) -> Self {
let b = u64::from_le(self.bits());
fn from_little_endian(v: u64) -> Self {
let b = u64::from_le(v);
// Safety:
// This is safe because we know bitflags is implemented with a repr transparent uint of the correct size.
// from_bits_unchecked will be replaced by an equivalent but safe from_bits_retain in bitflags 2.0
// https://github.com/bitflags/bitflags/issues/262
unsafe { Self::from_bits_unchecked(b) }
}
}