Repository: tokio-rs/tokio
File: tokio/src/io/util/read_to_end.rs (Rust)

Code before:
/// The length of the buffer is increased by the number of bytes read.
///
/// SAFETY: Before first calling this method, the unused capacity must have been
/// prepared for use with the provided AsyncRead. This can be done using the
/// `prepare_buffer` function later in this file.
unsafe fn poll_read_to_end<R: AsyncRead + ?Sized>(
    buf: &mut Vec<u8>,
    read: Pin<&mut R>,
    cx: &mut Context<'_>,
) -> Poll<io::Result<usize>> {
    // This uses an adaptive system to extend the vector when it fills. We want to
    // avoid paying to allocate and zero a huge chunk of memory if the reader only
    // has 4 bytes while still making large reads if the reader does have a ton
    // of data to return. Simply tacking on an extra DEFAULT_BUF_SIZE space every
    // time is 4,500 times (!) slower than this if the reader has a very small
    // amount of data to return.
    reserve(buf, &*read, 32);

    let unused_capacity: &mut [MaybeUninit<u8>] = get_unused_capacity(buf);

    // safety: The buffer has been prepared for use with the AsyncRead before
    // calling this function.
    let slice: &mut [u8] = {
        let ptr = unused_capacity.as_mut_ptr().cast::<u8>();
        let len = unused_capacity.len();
        std::slice::from_raw_parts_mut(ptr, len)
    };

    let res = ready!(read.poll_read(cx, slice));
    if let Ok(num) = res {
        // safety: There are two situations:
        //
        // 1. The AsyncRead has not overriden `prepare_uninitialized_buffer`.
        //
        // In this situation, the default implementation of that method will have
        // zeroed the unused capacity. This means that setting the length will
        // never expose uninitialized memory in the vector.
        //
        // Note that the assert! below ensures that we don't set the length to
        // something larger than the capacity, which malicious implementors might
        // try to have us do.
        //
        // 2. The AsyncRead has overriden `prepare_uninitialized_buffer`.
        //
        // In this case, the safety of the `set_len` call below relies on this
        // guarantee from the documentation on `prepare_uninitialized_buffer`:
        //
        // > This function isn't actually unsafe to call but unsafe to implement.
        // > The implementer must ensure that either the whole buf has been zeroed
        // > or poll_read() overwrites the buffer without reading it and returns
        // > correct value.

Review comment (suggestion):
nit: maybe 
```suggestion
    // safety: The caller ensures that the buffer has been prepared for use
    // with the AsyncRead before calling this function.
```

Code after:
/// Tries to read from the provided AsyncRead.
///
/// The length of the buffer is increased by the number of bytes read.
///
/// # Safety
///
/// The caller ensures that the buffer has been prepared for use with the
/// AsyncRead before calling this function. This can be done using the
/// `prepare_buffer` function later in this file.
unsafe fn poll_read_to_end<R: AsyncRead + ?Sized>(
    buf: &mut Vec<u8>,
    read: Pin<&mut R>,
    cx: &mut Context<'_>,
) -> Poll<io::Result<usize>> {
    // This uses an adaptive system to extend the vector when it fills. We want to
    // avoid paying to allocate and zero a huge chunk of memory if the reader only
    // has 4 bytes while still making large reads if the reader does have a ton
    // of data to return. Simply tacking on an extra DEFAULT_BUF_SIZE space every
    // time is 4,500 times (!) slower than this if the reader has a very small
    // amount of data to return.
    reserve(buf, &*read, 32);

    let unused_capacity: &mut [MaybeUninit<u8>] = get_unused_capacity(buf);

    // safety: The buffer has been prepared for use with the AsyncRead before
    // calling this function.
    let slice: &mut [u8] = &mut *(unused_capacity as *mut [MaybeUninit<u8>] as *mut [u8]);

    let res = ready!(read.poll_read(cx, slice));
    if let Ok(num) = res {
        // safety: There are two situations:
        //
        // 1. The AsyncRead has not overriden `prepare_uninitialized_buffer`.
        //
        // In this situation, the default implementation of that method will have
        // zeroed the unused capacity. This means that setting the length will
        // never expose uninitialized memory in the vector.
        //
        // Note that the assert! below ensures that we don't set the length to
        // something larger than the capacity, which malicious implementors might
        // try to have us do.
        //
        // 2. The AsyncRead has overriden `prepare_uninitialized_buffer`.
        //
        // In this case, the safety of the `set_len` call below relies on this
        // guarantee from the documentation on `prepare_uninitialized_buffer`:
        //
        // > This function isn't actually unsafe to call but unsafe to implement.
        // > The implementer must ensure that either the whole buf has been zeroed
        // > or poll_read() overwrites the buffer without reading it and returns
        // > correct value.