Rust soundness fixes (#7518)

* Rust soundness fixes

* Second pass

* Make init_from_table unsafe

* Remove SafeSliceAccess

* Clippy

* Remove create_vector_of_strings

* More clippy

* Remove deprecated root type accessors

* More soundness fixes

* Fix EndianScalar for bool

* Add TriviallyTransmutable

* Add debug assertions

* Review comments

* Review feedback

tests/private_annotation_test/ab_generated.rs

@@ -55,10 +55,8 @@ impl core::fmt::Debug for AB {
 impl<'a> flatbuffers::Follow<'a> for AB {
   type Inner = Self;
   #[inline]
-  fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
-    let b = unsafe {
-      flatbuffers::read_scalar_at::<i8>(buf, loc)
-    };
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    let b = flatbuffers::read_scalar_at::<i8>(buf, loc);
     Self(b)
   }
 }
@@ -66,21 +64,21 @@ impl<'a> flatbuffers::Follow<'a> for AB {
 impl flatbuffers::Push for AB {
     type Output = AB;
     #[inline]
-    fn push(&self, dst: &mut [u8], _rest: &[u8]) {
-        unsafe { flatbuffers::emplace_scalar::<i8>(dst, self.0); }
+    unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
+        flatbuffers::emplace_scalar::<i8>(dst, self.0);
     }
 }
 
 impl flatbuffers::EndianScalar for AB {
+  type Scalar = i8;
   #[inline]
-  fn to_little_endian(self) -> Self {
-    let b = i8::to_le(self.0);
-    Self(b)
+  fn to_little_endian(self) -> i8 {
+    self.0.to_le()
   }
   #[inline]
   #[allow(clippy::wrong_self_convention)]
-  fn from_little_endian(self) -> Self {
-    let b = i8::from_le(self.0);
+  fn from_little_endian(v: i8) -> Self {
+    let b = i8::from_le(v);
     Self(b)
   }
 }

tests/private_annotation_test/annotations_generated.rs

@@ -19,8 +19,8 @@ pub(crate) struct Annotations<'a> {
 impl<'a> flatbuffers::Follow<'a> for Annotations<'a> {
   type Inner = Annotations<'a>;
   #[inline]
-  fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
-    Self { _tab: flatbuffers::Table { buf, loc } }
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    Self { _tab: flatbuffers::Table::new(buf, loc) }
   }
 }
 
@@ -32,7 +32,7 @@ impl<'a> Annotations<'a> {
   }
 
   #[inline]
-  pub fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
+  pub unsafe fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
     Annotations { _tab: table }
   }
   #[allow(unused_mut)]
@@ -54,7 +54,10 @@ impl<'a> Annotations<'a> {
 
   #[inline]
   pub fn value(&self) -> i32 {
-    self._tab.get::<i32>(Annotations::VT_VALUE, Some(0)).unwrap()
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<i32>(Annotations::VT_VALUE, Some(0)).unwrap()}
   }
 }
 

tests/private_annotation_test/any_generated.rs

@@ -59,10 +59,8 @@ impl core::fmt::Debug for Any {
 impl<'a> flatbuffers::Follow<'a> for Any {
   type Inner = Self;
   #[inline]
-  fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
-    let b = unsafe {
-      flatbuffers::read_scalar_at::<u8>(buf, loc)
-    };
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    let b = flatbuffers::read_scalar_at::<u8>(buf, loc);
     Self(b)
   }
 }
@@ -70,21 +68,21 @@ impl<'a> flatbuffers::Follow<'a> for Any {
 impl flatbuffers::Push for Any {
     type Output = Any;
     #[inline]
-    fn push(&self, dst: &mut [u8], _rest: &[u8]) {
-        unsafe { flatbuffers::emplace_scalar::<u8>(dst, self.0); }
+    unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
+        flatbuffers::emplace_scalar::<u8>(dst, self.0);
     }
 }
 
 impl flatbuffers::EndianScalar for Any {
+  type Scalar = u8;
   #[inline]
-  fn to_little_endian(self) -> Self {
-    let b = u8::to_le(self.0);
-    Self(b)
+  fn to_little_endian(self) -> u8 {
+    self.0.to_le()
   }
   #[inline]
   #[allow(clippy::wrong_self_convention)]
-  fn from_little_endian(self) -> Self {
-    let b = u8::from_le(self.0);
+  fn from_little_endian(v: u8) -> Self {
+    let b = u8::from_le(v);
     Self(b)
   }
 }

tests/private_annotation_test/game_generated.rs

@@ -19,8 +19,8 @@ pub(crate) struct Game<'a> {
 impl<'a> flatbuffers::Follow<'a> for Game<'a> {
   type Inner = Game<'a>;
   #[inline]
-  fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
-    Self { _tab: flatbuffers::Table { buf, loc } }
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    Self { _tab: flatbuffers::Table::new(buf, loc) }
   }
 }
 
@@ -32,7 +32,7 @@ impl<'a> Game<'a> {
   }
 
   #[inline]
-  pub fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
+  pub unsafe fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
     Game { _tab: table }
   }
   #[allow(unused_mut)]
@@ -54,7 +54,10 @@ impl<'a> Game<'a> {
 
   #[inline]
   pub fn value(&self) -> i32 {
-    self._tab.get::<i32>(Game::VT_VALUE, Some(0)).unwrap()
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<i32>(Game::VT_VALUE, Some(0)).unwrap()}
   }
 }
 

tests/private_annotation_test/object_generated.rs

@@ -27,39 +27,25 @@ impl core::fmt::Debug for Object {
 }
 
 impl flatbuffers::SimpleToVerifyInSlice for Object {}
-impl flatbuffers::SafeSliceAccess for Object {}
 impl<'a> flatbuffers::Follow<'a> for Object {
   type Inner = &'a Object;
   #[inline]
-  fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
     <&'a Object>::follow(buf, loc)
   }
 }
 impl<'a> flatbuffers::Follow<'a> for &'a Object {
   type Inner = &'a Object;
   #[inline]
-  fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
     flatbuffers::follow_cast_ref::<Object>(buf, loc)
   }
 }
 impl<'b> flatbuffers::Push for Object {
     type Output = Object;
     #[inline]
-    fn push(&self, dst: &mut [u8], _rest: &[u8]) {
-        let src = unsafe {
-            ::core::slice::from_raw_parts(self as *const Object as *const u8, Self::size())
-        };
-        dst.copy_from_slice(src);
-    }
-}
-impl<'b> flatbuffers::Push for &'b Object {
-    type Output = Object;
-
-    #[inline]
-    fn push(&self, dst: &mut [u8], _rest: &[u8]) {
-        let src = unsafe {
-            ::core::slice::from_raw_parts(*self as *const Object as *const u8, Self::size())
-        };
+    unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
+        let src = ::core::slice::from_raw_parts(self as *const Object as *const u8, Self::size());
         dst.copy_from_slice(src);
     }
 }
@@ -89,24 +75,30 @@ impl<'a> Object {
   }
 
   pub fn value(&self) -> i32 {
-    let mut mem = core::mem::MaybeUninit::<i32>::uninit();
-    unsafe {
+    let mut mem = core::mem::MaybeUninit::<<i32 as EndianScalar>::Scalar>::uninit();
+    // Safety:
+    // Created from a valid Table for this object
+    // Which contains a valid value in this slot
+    EndianScalar::from_little_endian(unsafe {
       core::ptr::copy_nonoverlapping(
         self.0[0..].as_ptr(),
         mem.as_mut_ptr() as *mut u8,
-        core::mem::size_of::<i32>(),
+        core::mem::size_of::<<i32 as EndianScalar>::Scalar>(),
       );
       mem.assume_init()
-    }.from_little_endian()
+    })
   }
 
   pub fn set_value(&mut self, x: i32) {
     let x_le = x.to_little_endian();
+    // Safety:
+    // Created from a valid Table for this object
+    // Which contains a valid value in this slot
     unsafe {
       core::ptr::copy_nonoverlapping(
-        &x_le as *const i32 as *const u8,
+        &x_le as *const _ as *const u8,
         self.0[0..].as_mut_ptr(),
-        core::mem::size_of::<i32>(),
+        core::mem::size_of::<<i32 as EndianScalar>::Scalar>(),
       );
     }
   }