Repository: tokio-rs/bytes (rust)

Issue:
Maybe `BufMut` trait should be `unsafe`?
I was thinking that it's likely that some `unsafe` code will rely on properties of `BufMut`. More specifically:

* That `remaining_mut` returns correct value
* `bytes_mut` always returns the same slice (apart from `advance()`)
* `has_remaining_mut` returns correct value
* `bytes_vectored` fills the correct data

Thus, I'd suggest making the trait `unsafe` to specify that `unsafe` code might rely on those properties and the implementors must ensure they hold.

Pull request description:
Make BufMut an unsafe trait
Users of `BufMut` are unable to defend against incorrect implementations
of `BufMut`, this makes the trait unsafe to implement.

Fixes #329

cc @kixunil

Patch:
diff --git a/src/buf/buf_mut.rs b/src/buf/buf_mut.rs
index 4f6e47d..026bcad 100644
--- a/src/buf/buf_mut.rs
+++ b/src/buf/buf_mut.rs
@@ -30,7 +30,7 @@ use alloc::{boxed::Box, vec::Vec};
 ///
 /// assert_eq!(buf, b"hello world");
 /// ```
-pub trait BufMut {
+pub unsafe trait BufMut {
     /// Returns the number of bytes that can be written from the current
     /// position until the end of the buffer is reached.
     ///
@@ -992,15 +992,15 @@ macro_rules! deref_forward_bufmut {
     };
 }
 
-impl<T: BufMut + ?Sized> BufMut for &mut T {
+unsafe impl<T: BufMut + ?Sized> BufMut for &mut T {
     deref_forward_bufmut!();
 }
 
-impl<T: BufMut + ?Sized> BufMut for Box<T> {
+unsafe impl<T: BufMut + ?Sized> BufMut for Box<T> {
     deref_forward_bufmut!();
 }
 
-impl BufMut for &mut [u8] {
+unsafe impl BufMut for &mut [u8] {
     #[inline]
     fn remaining_mut(&self) -> usize {
         self.len()
@@ -1020,7 +1020,7 @@ impl BufMut for &mut [u8] {
     }
 }
 
-impl BufMut for Vec<u8> {
+unsafe impl BufMut for Vec<u8> {
     #[inline]
     fn remaining_mut(&self) -> usize {
         usize::MAX - self.len()
diff --git a/src/buf/chain.rs b/src/buf/chain.rs
index 020bf08..cc2c944 100644
--- a/src/buf/chain.rs
+++ b/src/buf/chain.rs
@@ -174,7 +174,7 @@ where
     }
 }
 
-impl<T, U> BufMut for Chain<T, U>
+unsafe impl<T, U> BufMut for Chain<T, U>
 where
     T: BufMut,
     U: BufMut,
diff --git a/src/buf/limit.rs b/src/buf/limit.rs
index a36ecee..c6ed3c7 100644
--- a/src/buf/limit.rs
+++ b/src/buf/limit.rs
@@ -55,7 +55,7 @@ impl<T> Limit<T> {
     }
 }
 
-impl<T: BufMut> BufMut for Limit<T> {
+unsafe impl<T: BufMut> BufMut for Limit<T> {
     fn remaining_mut(&self) -> usize {
         cmp::min(self.inner.remaining_mut(), self.limit)
     }
diff --git a/src/bytes_mut.rs b/src/bytes_mut.rs
index a7a8e57..16cb72c 100644
--- a/src/bytes_mut.rs
+++ b/src/bytes_mut.rs
@@ -966,7 +966,7 @@ impl Buf for BytesMut {
     }
 }
 
-impl BufMut for BytesMut {
+unsafe impl BufMut for BytesMut {
     #[inline]
     fn remaining_mut(&self) -> usize {
         usize::MAX - self.len()


Test patch:
diff --git a/tests/test_buf_mut.rs b/tests/test_buf_mut.rs
index 10c526d..e994883 100644
--- a/tests/test_buf_mut.rs
+++ b/tests/test_buf_mut.rs
@@ -75,7 +75,7 @@ fn test_mut_slice() {
 fn test_deref_bufmut_forwards() {
     struct Special;
 
-    impl BufMut for Special {
+    unsafe impl BufMut for Special {
         fn remaining_mut(&self) -> usize {
             unreachable!("remaining_mut");
         }