Summary
Scanned the errno crate with ffi-guard — a Rust FFI safety auditor. Found 2 errors where str::from_utf8_unchecked() is called on FFI data without bounds verification.
Key findings
$ ffi-guard scan
══ ffi-guard audit report ══
Project: errno (v0.3.14)
2 errors 20 warnings 0 info — 22 total issues
Top issues
| Check |
Count |
Severity |
Description |
ffi-from-raw-parts |
2 |
✗ error |
str::from_utf8_unchecked() on FFI data — UB if C side passes invalid pointer/length |
unsafe-no-safety-doc |
20 |
⚠ warning |
unsafe block missing // SAFETY: comment |
Context
The str::from_utf8_unchecked() calls in unsafe blocks operate on data whose validity is controlled by the C side. A wrong pointer or length causes immediate UB. These need explicit bounds + UTF-8 checks, or at minimum a // SAFETY: comment explaining why the data is trusted.
ffi-guard is a new open-source tool (MIT, v0.1.0) that specifically audits Rust FFI safety.
Repo: https://github.com/ToBeMoreSimple/rust-ffi-guard
Summary
Scanned the
errnocrate with ffi-guard — a Rust FFI safety auditor. Found 2 errors wherestr::from_utf8_unchecked()is called on FFI data without bounds verification.Key findings
Top issues
ffi-from-raw-partsstr::from_utf8_unchecked()on FFI data — UB if C side passes invalid pointer/lengthunsafe-no-safety-doc// SAFETY:commentContext
The
str::from_utf8_unchecked()calls in unsafe blocks operate on data whose validity is controlled by the C side. A wrong pointer or length causes immediate UB. These need explicit bounds + UTF-8 checks, or at minimum a// SAFETY:comment explaining why the data is trusted.ffi-guard is a new open-source tool (MIT, v0.1.0) that specifically audits Rust FFI safety.
Repo: https://github.com/ToBeMoreSimple/rust-ffi-guard