CString::from_raw should be document that changing the length of a string is UB

[KamilaBorowska]

Consider the following code:

use std::ffi::CString;

fn main() {
    let c = CString::new(&b"Hello, world"[..]).unwrap();
    let ptr = c.into_raw();
    unsafe {
        *ptr = 0;
        CString::from_raw(ptr); // UB
    }
}

Shortening the string from CString::into_raw and then passing it to CString::from_raw will cause UB, but this is not documented in safety section of the documentation.

[Mark-Simulacrum]

Hm, why do you think this causes UB? AFAICT, CString::from_raw explicitly notes that it will recalculate the length from the pointer.

[Lokathor]

This is a clever find. Well done.

Mark: The UB is that the length of the CString is recomputed from scratch, and also it's not the same, which means that the new CString is length 0, and so when it drops the reconstructed inner Box will pass a Layout value to the allocator's free function that doesn't match the Layout used to allocate that memory to begin with.

[Mark-Simulacrum]

Ah, I see. So the reasoning is that we require "layout must be the same layout that was used to allocate that block of memory," on GlobalAlloc::dealloc. That makes sense.

I don't think there's anything we can do here (given the existing API) other than document this precondition.

Interestingly, we could imagine an API that would work when the underlying size would have changed (via realloc), but that requires us to know the prior Layout...