{"action":"created","issue":{"url":"https://api.github.com/repos/rust-lang/rust/issues/29257","labels_url":"https://api.github.com/repos/rust-lang/rust/issues/29257/labels{/name}","comments_url":"https://api.github.com/repos/rust-lang/rust/issues/29257/comments","events_url":"https://api.github.com/repos/rust-lang/rust/issues/29257/events","html_url":"https://github.com/rust-lang/rust/issues/29257","id":113081665,"number":29257,"title":"Please warn when safe functions dereference raw pointers","user":{"login":"rillian","id":225102,"avatar_url":"https://avatars.githubusercontent.com/u/225102?v=3","gravatar_id":"","url":"https://api.github.com/users/rillian","html_url":"https://github.com/rillian","followers_url":"https://api.github.com/users/rillian/followers","following_url":"https://api.github.com/users/rillian/following{/other_user}","gists_url":"https://api.github.com/users/rillian/gists{/gist_id}","starred_url":"https://api.github.com/users/rillian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rillian/subscriptions","organizations_url":"https://api.github.com/users/rillian/orgs","repos_url":"https://api.github.com/users/rillian/repos","events_url":"https://api.github.com/users/rillian/events{/privacy}","received_events_url":"https://api.github.com/users/rillian/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-10-23T19:07:15Z","updated_at":"2015-10-23T22:16:17Z","closed_at":null,"body":"Not sure if this should be an RFC, but I think a warning would work if the present behaviour is as desired.\r\n\r\nI'm working on C interface code. People have told me, 'Everything `extern \"C\"` should be unsafe.' I presume this is because C apis inevitably involve raw pointers. But that's not quite true. Otherwise the compiler would require it.\r\n\r\nConsider these two cases:\r\n```rust\r\nfn foo(p: *const u8) {\r\n  println!(\"ptr {:?}\", p);\r\n}\r\n\r\nfn bar(p: *const u8) {\r\n  match p.is_null() {\r\n    true => println!(\"null ptr {:?}\", p),\r\n    false => unsafe { println!(\"non-null ptr {:?}: {:?}\", p, *p) },\r\n  }\r\n}\r\n```\r\nhttps://play.rust-lang.org/?gist=90a9dc04959cb831751b&version=stable\r\n\r\n`foo` is safe, because it never dereferences the pointer, and this can be a useful part of the interface, so we have a counterexample of a function taking a raw pointer which doesn't need to be declared unsafe.\r\n\r\n`bar` might *look* safe, but it's not. It will behave as indended for valid pointers, like you'd get from `slice::as_ptr`. It will also safely handle null pointers like you might get from a C api. But it's perfectly possible to pass an *invalid* pointer, crashing or (worse) yielding garbage. For example, `bar(1 as *const u8)` in the play example above.\r\n\r\nSo `bar` **should** be declared unsafe, but the compiler lets me declare it safe instead. Which means people will get this wrong (as I did) and random library code will have rare crashes. This is not the promise of rust.\r\n\r\nA warning would address the possibility of programmer error here, assuming I'm correct in what the unsafe keyword means in this context. Functions which are declared safe, but take raw pointer arguments, should warn if they dereference that pointer. There needs to be something to tie the interior unsafe block to the function signature."},"comment":{"url":"https://api.github.com/repos/rust-lang/rust/issues/comments/150705421","html_url":"https://github.com/rust-lang/rust/issues/29257#issuecomment-150705421","issue_url":"https://api.github.com/repos/rust-lang/rust/issues/29257","id":150705421,"user":{"login":"sfackler","id":1455697,"avatar_url":"https://avatars.githubusercontent.com/u/1455697?v=3","gravatar_id":"","url":"https://api.github.com/users/sfackler","html_url":"https://github.com/sfackler","followers_url":"https://api.github.com/users/sfackler/followers","following_url":"https://api.github.com/users/sfackler/following{/other_user}","gists_url":"https://api.github.com/users/sfackler/gists{/gist_id}","starred_url":"https://api.github.com/users/sfackler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sfackler/subscriptions","organizations_url":"https://api.github.com/users/sfackler/orgs","repos_url":"https://api.github.com/users/sfackler/repos","events_url":"https://api.github.com/users/sfackler/events{/privacy}","received_events_url":"https://api.github.com/users/sfackler/received_events","type":"User","site_admin":false},"created_at":"2015-10-23T22:16:17Z","updated_at":"2015-10-23T22:16:17Z","body":"The warning already exists, it's called `unsafe_code`. Dereferencing a raw pointer is no more intrinsically sketchy than calling into an `extern \"C\"` function or calling an `unsafe` Rust function. Why should it be singled out with a separate warning?"}}