util/bytes: document that NULL is allowed in rust_util_bytes
What changed, and why it matters
This commit only updates documentation comments and adds unit tests to clarify that a NULL pointer is acceptable when the length is zero. No code behavior was changed, so there is no security issue.
No action needed; this is a documentation and test-only change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies doc comments for rust_util_bytes and rust_util_bytes_mut to state that buf may be NULL when len == 0, matching the existing implementation in AsRef/AsMut. It also adds two unit tests verifying that null pointers with length 0 produce empty slices. The actual unsafe code remains unchanged.
Changed components
src/rust/util/src/bytes.rsInspect captured patch +19 / −4
diff --git a/src/rust/util/src/bytes.rs b/src/rust/util/src/bytes.rs
index 36bcb56..b6f9eac 100644
--- a/src/rust/util/src/bytes.rs
+++ b/src/rust/util/src/bytes.rs
@@ -94,12 +94,13 @@ impl AsMut<[u8]> for BytesMut {
/// Convert buffer to slice
///
-/// * `buf` - Must be a valid pointer to an array of bytes
+/// * `buf` - Must be a valid pointer to an array of bytes, can be NULL if `len == 0`
/// * `len` - Length of buffer, `buf[len-1]` must be a valid dereference
///
/// # Safety
///
-/// buf must not be NULL and point to a valid memory area of size `len`.
+/// `buf` must point to a valid memory area of size `len`, unless `len == 0`, in which case `buf`
+/// may be NULL.
#[unsafe(no_mangle)]
pub unsafe extern "C" fn rust_util_bytes(buf: *const c_uchar, len: usize) -> Bytes {
Bytes { buf, len }
@@ -107,12 +108,13 @@ pub unsafe extern "C" fn rust_util_bytes(buf: *const c_uchar, len: usize) -> Byt
/// Convert buffer to mutable slice
///
-/// * `buf` - Must be a valid pointer to an array of bytes
+/// * `buf` - Must be a valid pointer to an array of bytes, can be NULL if `len == 0`
/// * `len` - Length of buffer, `buf[len-1]` must be a valid dereference
///
/// # Safety
///
-/// buf must not be NULL and point to a valid memory area of size `len`.
+/// `buf` must point to a valid memory area of size `len`, unless `len == 0`, in which case `buf`
+/// may be NULL.
#[unsafe(no_mangle)]
pub unsafe extern "C" fn rust_util_bytes_mut(buf: *mut c_uchar, len: usize) -> BytesMut {
BytesMut { buf, len }
@@ -138,6 +140,19 @@ mod tests {
(unsafe { rust_util_bytes(core::ptr::null(), 1) }).as_ref();
}
+ #[test]
+ fn create_null_bytes_ref_with_zero_len() {
+ let bytes = unsafe { rust_util_bytes(core::ptr::null(), 0) };
+ assert!(bytes.as_ref().is_empty());
+ }
+
+ #[test]
+ fn create_null_bytes_mut_with_zero_len() {
+ let mut bytes = unsafe { rust_util_bytes_mut(core::ptr::null_mut(), 0) };
+ assert!(bytes.as_ref().is_empty());
+ assert!(bytes.as_mut().is_empty());
+ }
+
#[test]
fn test_uint8_to_hex() {
let buf = [1u8, 2, 3, 14, 15, 255];
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.