mark Code::substitute as unsafe. As it allows passing options.

src/bytes.rs

@@ -610,7 +610,8 @@ impl Regex {
         replacement: &[u8],
         output: &mut Vec<u8>,
     ) -> Result<usize, Error> {
-        self.code.substitute(subject, replacement, output, 0)
+        // Safety: options is 0.
+        unsafe { self.code.substitute(subject, replacement, output, 0) }
     }
     /// Replaces all the matches in `subject` with the `replacement`,
     /// and puts the replaced string in `output`.
@@ -633,12 +634,15 @@ impl Regex {
         replacement: &[u8],
         output: &mut Vec<u8>,
     ) -> Result<usize, Error> {
-        self.code.substitute(
-            subject,
-            replacement,
-            output,
-            pcre2_sys::PCRE2_SUBSTITUTE_GLOBAL,
-        )
+        // Safety: PCRE2_SUBSTITUTE_GLOBAL is not a dangerous option.
+        unsafe {
+            self.code.substitute(
+                subject,
+                replacement,
+                output,
+                pcre2_sys::PCRE2_SUBSTITUTE_GLOBAL,
+            )
+        }
     }
 }
 

src/ffi.rs

@@ -261,7 +261,9 @@ impl Code {
 
     /// Substitute the replacement pattern in subject and put the output in
     /// output vec. Output vec is will be cleared before use.
-    pub(crate) fn substitute(
+    /// Safety: ensure that options field will not cause undefined behavior
+    /// in pcre2-sys.
+    pub(crate) unsafe fn substitute(
         &self,
         subject: &[u8],
         replacement: &[u8],