Support zeroed allocations (e.g `reserve_zeroed`, `with_capacity_zeroed`)

[64]

Looking at instances of unsafe in reqwest, there are two places (1, 2) where uninitialized memory is passed to a Read implementation. This is a bad idea (as per https://github.com/rust-lang/rust/pull/62102/files, https://gankro.github.io/blah/initialize-me-maybe/) and can be fixed by just zeroing the memory beforehand.

Unfortunately bytes doesn't provide a good way of doing this. I imagine the ideal solution would involve something that lowers to alloc_zeroed / calloc internally.

[Shnatsel]

FYI vec![0; len]; lowers into alloc_zeroed() which just requests zeroed memory from the OS, so the allocating it is exactly as fast as requesting an uninitialized slice.

See rust-lang/rust#54628 for more details.

[Lokathor]

The zeroing takes about twice as long, but you should still do it to avoid UB because this is Rust.

[jocutajar]

I love how BytesMut works and would appreciate an initialized flavor as well. Or an interface to fill it from Read / AsyncRead safely. I can live with the initialization overhead if it means dropping unsafe from the code. Working with BytesMut is better than the usual BufReader because BufReader will not read more bytes unless it is completely drained and that doesn't fit well with a streaming parser which will leave incomplete bytes in the buffer.

        loop {
            let reader = match io.as_mut() {
                None => break Poll::Ready(None),
                Some(io) => Pin::new(io),
            };
            break match parser.parse_command(buffer.bytes()) {
                Ok((i, cmd)) => {
                    let consumed = buffer.bytes().len() - i.len();
                    buffer.advance(consumed);
                    Poll::Ready(Some(cmd))
                }
                Err(ParseError::Incomplete) => {
                    if buffer.remaining_mut() == 0 {
                        buffer.reserve(1024);
                    }
                    let buff = buffer.bytes_mut();
                    // This is unsafe because BytesMut does not initialize the buffer.
                    // Malicious reader could get access to random / interesting data!
                    // Accepting unsafe here we assume the reader is not malicious and
                    // only writes, doesn't read
                    // TODO: check clippy::transmute-ptr-to-ptr complaint
                    let buff = unsafe { std::mem::transmute(buff) };
                    match ready!(reader.poll_read(cx, buff)) {
                        Ok(0) => {
                            break Poll::Ready(Some(processing_error(
                                "Incomplete and finished",
                                String::from_utf8_lossy(buffer.bytes()),
                            )));
                        }
                        Ok(len) => {
                            // This is unsafe because badly behaved reader could return a different
                            // len than actually written into the buffer or write at an offset.
                            // This would cause us to receive random data and treat it as SMTP input!
                            // Accepting unsafe here we assume that the reader is well behaved and works correctly.
                            unsafe { buffer.advance_mut(len) };
                            continue;
                        }
                        Err(e) => break Poll::Ready(Some(processing_error("Read failed", e))),
                    }
                }
                Err(e) => Poll::Ready(Some(processing_error("Parsing failed", e))),
            };
        }

[ldm0]

+1 For these methods. This would make creating a big zeroed BytesMut significantly faster.