macOS unsafe refactor

src/tz_macos.rs

@@ -5,27 +5,37 @@ use core_foundation_sys::string::{
 use core_foundation_sys::timezone::{CFTimeZoneCopySystem, CFTimeZoneGetName};
 
 pub(crate) fn get_timezone_inner() -> Result<String, crate::GetTimezoneError> {
-    unsafe { get_timezone().ok_or(crate::GetTimezoneError::OsError) }
+    get_timezone().ok_or(crate::GetTimezoneError::OsError)
 }
 
 #[inline]
-unsafe fn get_timezone() -> Option<String> {
+fn get_timezone() -> Option<String> {
     // The longest name in the IANA time zone database is 25 ASCII characters long.
     const MAX_LEN: usize = 32;
 
     // Get system time zone, and borrow its name.
-    let tz = Dropping::new(CFTimeZoneCopySystem())?;
-    let name = CFTimeZoneGetName(tz.0);
+    let tz = Dropping::new(unsafe { CFTimeZoneCopySystem() })?;
+    let name = unsafe { CFTimeZoneGetName(tz.0) };
     if name.is_null() {
         return None;
     }
 
-    // If the name is encoded in UTF-8, copy it directly.
-    let cstr = CFStringGetCStringPtr(name, kCFStringEncodingUTF8);
-    if !cstr.is_null() {
-        let cstr = std::ffi::CStr::from_ptr(cstr);
-        if let Ok(name) = cstr.to_str() {
-            return Some(name.to_owned());
+    {
+        // New block prevents any variables escaping this scope.
+
+        // If the name is encoded in UTF-8, copy it directly.
+        let cstr_ptr = unsafe { CFStringGetCStringPtr(name, kCFStringEncodingUTF8) };
+        if !cstr_ptr.is_null() {
+            // Safety: 1) `cstr_ptr` must contain valid nul terminator. 2)
+            // `cstr_ptr` must be valid for reads of bytes up to and including
+            // the null terminator. 3) `cstr_ptr` must remain valid for lifetime
+            // of `cstr`. We assume #1 and #2 are true based on the result from
+            // CFStringGetCStringPtr. We ensure #3 by cloning the underlying &str
+            // to a String.
+            let cstr = unsafe { std::ffi::CStr::from_ptr(cstr_ptr) };
+            if let Ok(name) = cstr.to_str() {
+                return Some(name.to_owned());
+            }
         }
     }
 
@@ -34,18 +44,20 @@ unsafe fn get_timezone() -> Option<String> {
     let mut buf_bytes = 0;
     let range = CFRange {
         location: 0,
-        length: CFStringGetLength(name),
+        length: unsafe { CFStringGetLength(name) },
     };
-    if CFStringGetBytes(
-        name,
-        range,
-        kCFStringEncodingUTF8,
-        b'\0',
-        false as Boolean,
-        buf.as_mut_ptr(),
-        buf.len() as isize,
-        &mut buf_bytes,
-    ) != range.length
+    if unsafe {
+        CFStringGetBytes(
+            name,
+            range,
+            kCFStringEncodingUTF8,
+            b'\0',
+            false as Boolean,
+            buf.as_mut_ptr(),
+            buf.len() as isize,
+            &mut buf_bytes,
+        )
+    } != range.length
     {
         // Could not convert the name.
         None
@@ -70,7 +82,7 @@ impl<T> Drop for Dropping<T> {
 
 impl<T> Dropping<T> {
     #[inline]
-    unsafe fn new(v: *const T) -> Option<Self> {
+    fn new(v: *const T) -> Option<Self> {
         if v.is_null() {
             None
         } else {