-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Split large unsafe function slide #2406
base: main
Are you sure you want to change the base?
Conversation
The old slice was doing several things at the same time: demonstrating both external functions as well as unsafe Rust functions. We now treat those two topics separately. In addition, the “Calling Unsafe Functions” heading has become its own slide with a non-crashing example that shows what can go wrong if an argument is misunderstood in a call to an unsafe function. The old example didn’t actually illustrate the danger clearly: it would produce mangled UTF-8 output, which the Playground server refuses to print.
/// | ||
/// # Safety | ||
/// | ||
/// The pointers must be valid and properly aligned. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
..and must not overlap!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oh, because these are u8 it's actually ok to overlap
`abs` is unsafe because it is an external function (FFI). Calling external | ||
functions is usually only a problem when those functions do things with pointers | ||
which might violate Rust's memory model, but in general any C function might | ||
have undefined behaviour under any arbitrary circumstances. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it worth mentioning here that there is no automatic checking of the Rust function signature against that of the target function? For example, in this case the C function might take uint64_t
and this would cause UB.
Co-authored-by: Dustin J. Mitchell <[email protected]>
println!("a = {}, b = {}", a, b); | ||
} | ||
``` | ||
- Foreign functions in `extern "C"` blocks. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since Rust 1.82 (with unsafe extern
) foreign functions aren't necessarily unsafe, so I don't think these are really separate categories. Either way, a function is unsafe if it has some safety prerequisites which must be met to avoid undefined behaviour (or IO safety issues).
We should also update the example to use unsafe extern
.
@@ -0,0 +1,32 @@ | |||
# Unsafe External Functions | |||
|
|||
All functions implemented in a foreign language are considered unsafe in Rust: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is no longer true as of 1.82. We should talk about unsafe extern
here.
The old slice was doing several things at the same time: demonstrating
both external functions as well as unsafe Rust functions.
We now treat those two topics separately. In addition, the “Calling
Unsafe Functions” heading has become its own slide with a non-crashing
example that shows what can go wrong if an argument is misunderstood
in a call to an unsafe function. The old example didn’t actually
illustrate the danger clearly: it would produce mangled UTF-8 output,
which the Playground server refuses to print.
Part of #2445.