soundness for capsule reference and name #5474
Conversation
src/types/capsule.rs
Outdated
| /// This method returns `*const c_char` instead of `&CStr` because it's possible for | ||
| /// arbitrary Python code to change the capsule name. Callers can use `NonNull::from_ptr()` | ||
| /// to get a `&CStr` if they want to, however they should beware the fact that the pointer | ||
| /// may become invalid after arbitrary Python code has run. | ||
| fn name(&self) -> PyResult<*const c_char>; |
There was a problem hiding this comment.
I changed this because the &CStr had the same problematic lifetime as .reference(). Also CStr::from_ptr is linear complexity so this is potentially more efficient depending on what the user is doing with it.
There was a problem hiding this comment.
Maybe we can use Option<NonNull<c_char>> here, to enforce the check for the null pointer?
There was a problem hiding this comment.
I played around with this just now but the NonNull doesn't carry the const-ness of the value. It's also a fairly nested type, overall it just didn't feel that good.
One option is we could have a type CapsuleName which has an unsafe .as_cstr() method. (unsafe because it's legal for callers to change the capsule name later.)
There was a problem hiding this comment.
(So -> PyResult<Option<CapsuleName>>)
|
I wonder if the new names should be introduced as |
|
Thanks for taking over and extending the PR :) As a user of PyO3 I'd prefer the I think it would be best to eventually rename By the way, thanks for all the work that you put into this excellent crate! |
|
I took another pass at this file. I added Possibly in the future it might be correct to use |
| /// This method returns a `NonNull<CStr>` instead of `&CStr` because it's possible for | ||
| /// arbitrary Python code to change the capsule name. Callers can use [`.as_ref()`][NonNull::as_ref] | ||
| /// to get a `&CStr` when needed, however they should beware the fact that the pointer | ||
| /// may become invalid after arbitrary Python code has run. | ||
| fn name(&self) -> PyResult<Option<CapsuleName>>; |
There was a problem hiding this comment.
Nitpick: this method now returns an Option<CapsuleName>, not NonNull<CStr> as written in the comment.
| /// This is a thin wrapper around `*const c_char`, which can be accessed with the [`as_ptr`][Self::as_ptr] | ||
| /// method. The [`as_cstr`][Self::as_cstr] method can be used as a convenience to access the name as a `&CStr`. | ||
| #[derive(Clone, Copy)] | ||
| pub struct CapsuleName { |
There was a problem hiding this comment.
We probably want to reexport this type in src/types/mod.rs, to make sure that it appears in the docs and that users of the crate can name this type.
3 participants
Extension of #5229
I could not push to that PR.
I'm too tired to continue tonight, will most likely revisit this tomorrow evening.