Use niche length type for strlen to guarantee `isize::MAX` bound - #162930

Merged

rust-bors[bot] merged 1 commit into

rust-lang:mainfrom

clarfonthey:strlen-is-bounded

Sep 19, 2026

clarfonthey commented Sep 17, 2026 •

edited by rustbot

Loading

Contributor

Alternative to #162912.

r? hanna-kruppe
cc @Darksonn

rustbot assigned hanna-kruppe

rustbot added S-waiting-on-review T-compiler T-libs labels

rustbot commented Sep 17, 2026

Collaborator

hanna-kruppe is currently at their maximum review capacity.
They may take a while to respond.


          Use niche length type for strlen to guarantee isize::MAX bound

2605c8d

clarfonthey force-pushed the strlen-is-bounded branch from ebb05a8 to 2605c8d Compare

September 17, 2026 21:53

clarfonthey commented

View reviewed changes

library/core/src/ffi/c_str.rs

-                          unsafe { strlen(s) }
+                          // SAFETY: Outer caller has provided a pointer to a valid C string,
+                          // and its length is within bounds.
+                          unsafe { UsizeNoHighBitMinusOne::new_unchecked(strlen(s)) }

clarfonthey Sep 17, 2026 •

edited by rustbot

Loading

Contributor Author

Note: I decided to do this (which is just a transmute) instead of making strlen explicitly return this type, since it felt apt to include this as part of this particular method's unsafe precondition instead of trying to assume that would hold for the C version.

View changes since the review

joshtriplett commented Sep 18, 2026

Member

@bors r+ rollup

Seems like a reasonable approach to me. Nice to be able to eliminate the conditions and panics on the basis of our existing requirement for sizes.

rust-bors Bot commented Sep 18, 2026

Contributor

📌 Commit 2605c8d has been approved by joshtriplett

It is now in the queue for this repository.

rust-bors Bot added S-waiting-on-bors and removed S-waiting-on-review labels

Zalathar added a commit to Zalathar/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

Zalathar mentioned this pull request

Rollup of 7 pull requests #162938

Closed

Zalathar added a commit to Zalathar/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

4eeb145

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

Zalathar mentioned this pull request

Rollup of 9 pull requests #162941

Closed

rust-bors Bot pushed a commit that referenced this pull request


          Auto merge of #162941 - Zalathar:rollup-QBSqjxc, r=Zalathar

983fb7d

Rollup of 9 pull requests

Successful merges:

 - #161777 (Add Natvis visualiser and debuginfo tests for `f128`)
 - #162423 (Rename the src install build step to rust-src.)
 - #162824 (link Enzyme and the offload with in-tree lld if possible)
 - #161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - #162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - #162803 (docs(num): add documentation for `NonZero::from_str`)
 - #162906 (Move more `rustdoc-html` tests in the right location)
 - #162922 (An assortment of polonius tweaks)
 - #162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

c23cb45

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

JonathanBrouwer mentioned this pull request

Rollup of 11 pull requests #162943

Closed

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

eae88ac

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

JonathanBrouwer mentioned this pull request

Rollup of 15 pull requests #162951

Closed

rust-bors Bot pushed a commit that referenced this pull request


          Auto merge of #162951 - JonathanBrouwer:rollup-VjD2atF, r=JonathanBro…

0e43331

…uwer

Rollup of 15 pull requests

Successful merges:

 - #160401 (sparc: make ABI consistent with clang)
 - #161777 (Add Natvis visualiser and debuginfo tests for `f128`)
 - #162423 (Rename the src install build step to rust-src.)
 - #162740 (stdarch subtree update)
 - #162824 (link Enzyme and the offload with in-tree lld if possible)
 - #162832 (add `Div` and `Mul` for `Complex<{float}>`)
 - #161005 (fix: unfulfilled nested dead code lint)
 - #161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - #162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - #162661 (simplify `Target::GenericParam`)
 - #162666 (Tidy footnote in `platform-support.md`)
 - #162803 (docs(num): add documentation for `NonZero::from_str`)
 - #162906 (Move more `rustdoc-html` tests in the right location)
 - #162922 (An assortment of polonius tweaks)
 - #162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)

clarfonthey mentioned this pull request

c_str: assert that strlen() returns < isize::MAX #162912

Closed

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

0283f50

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

JonathanBrouwer mentioned this pull request

Rollup of 15 pull requests #162954

Closed

hanna-kruppe assigned joshtriplett and unassigned hanna-kruppe

rust-bors Bot pushed a commit that referenced this pull request


          Auto merge of #162954 - JonathanBrouwer:rollup-bZC29Zk, r=JonathanBro…

2d4550b

…uwer

Rollup of 15 pull requests

Successful merges:

 - #160401 (sparc: make ABI consistent with clang)
 - #161777 (Add Natvis visualiser and debuginfo tests for `f128`)
 - #162423 (Rename the src install build step to rust-src.)
 - #162740 (stdarch subtree update)
 - #162824 (link Enzyme and the offload with in-tree lld if possible)
 - #161005 (fix: unfulfilled nested dead code lint)
 - #161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - #162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - #162661 (simplify `Target::GenericParam`)
 - #162666 (Tidy footnote in `platform-support.md`)
 - #162803 (docs(num): add documentation for `NonZero::from_str`)
 - #162906 (Move more `rustdoc-html` tests in the right location)
 - #162922 (An assortment of polonius tweaks)
 - #162929 (Update unicode_data to Unicode version 18.0.0)
 - #162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

332cb2a

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

JonathanBrouwer mentioned this pull request

Rollup of 14 pull requests #162973

Closed

rust-bors Bot pushed a commit that referenced this pull request


          Auto merge of #162973 - JonathanBrouwer:rollup-YScpzfM, r=JonathanBro…

865de71

…uwer

Rollup of 14 pull requests

Successful merges:

 - #160401 (sparc: make ABI consistent with clang)
 - #161777 (Add Natvis visualiser and debuginfo tests for `f128`)
 - #162740 (stdarch subtree update)
 - #162824 (link Enzyme and the offload with in-tree lld if possible)
 - #161005 (fix: unfulfilled nested dead code lint)
 - #161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - #162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - #162661 (simplify `Target::GenericParam`)
 - #162666 (Tidy footnote in `platform-support.md`)
 - #162803 (docs(num): add documentation for `NonZero::from_str`)
 - #162906 (Move more `rustdoc-html` tests in the right location)
 - #162922 (An assortment of polonius tweaks)
 - #162929 (Update unicode_data to Unicode version 18.0.0)
 - #162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

d542b8e

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

JonathanBrouwer mentioned this pull request

Rollup of 20 pull requests #162980

Closed

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#162930 - clarfonthey:strlen-is-bounded, r=j…

8c95d52

…oshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to rust-lang#162912.

r? hanna-kruppe
cc @Darksonn

JonathanBrouwer mentioned this pull request

Rollup of 20 pull requests #162983

Closed

rust-bors Bot pushed a commit that referenced this pull request


          Auto merge of #162983 - JonathanBrouwer:rollup-rSoJcsN, r=JonathanBro…

a13d050

…uwer

Rollup of 20 pull requests

Successful merges:

 - #160401 (sparc: make ABI consistent with clang)
 - #162715 (don't calculate dtors if the self ty has impossible bounds)
 - #162740 (stdarch subtree update)
 - #162824 (link Enzyme and the offload with in-tree lld if possible)
 - #162946 (Simplify query stack printing)
 - #161005 (fix: unfulfilled nested dead code lint)
 - #161246 (Normalize non-rigid aliases in ty_known_to_outlive)
 - #161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - #162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - #162661 (simplify `Target::GenericParam`)
 - #162666 (Tidy footnote in `platform-support.md`)
 - #162803 (docs(num): add documentation for `NonZero::from_str`)
 - #162879 (use u64 limbs in core::num::bignum)
 - #162903 (PassWrapper: adapt to LLVM reading exception model from module flag)
 - #162905 (c-variadic: add checks for windows i686)
 - #162906 (Move more `rustdoc-html` tests in the right location)
 - #162922 (An assortment of polonius tweaks)
 - #162929 (Update unicode_data to Unicode version 18.0.0)
 - #162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)
 - #162960 (Guard types with unstable `Allocator` params ahead of partial stabilization)

JonathanBrouwer mentioned this pull request

Rollup of 19 pull requests #162989

Merged

rust-bors Bot pushed a commit that referenced this pull request


          Auto merge of #162989 - JonathanBrouwer:rollup-Z3CMn0z, r=JonathanBro…

ef75812

…uwer

Rollup of 19 pull requests

Successful merges:

 - #160401 (sparc: make ABI consistent with clang)
 - #162715 (don't calculate dtors if the self ty has impossible bounds)
 - #162740 (stdarch subtree update)
 - #162946 (Simplify query stack printing)
 - #161005 (fix: unfulfilled nested dead code lint)
 - #161246 (Normalize non-rigid aliases in ty_known_to_outlive)
 - #161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - #162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - #162661 (simplify `Target::GenericParam`)
 - #162666 (Tidy footnote in `platform-support.md`)
 - #162803 (docs(num): add documentation for `NonZero::from_str`)
 - #162879 (use u64 limbs in core::num::bignum)
 - #162903 (PassWrapper: adapt to LLVM reading exception model from module flag)
 - #162905 (c-variadic: add checks for windows i686)
 - #162906 (Move more `rustdoc-html` tests in the right location)
 - #162922 (An assortment of polonius tweaks)
 - #162929 (Update unicode_data to Unicode version 18.0.0)
 - #162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)
 - #162960 (Guard types with unstable `Allocator` params ahead of partial stabilization)

rust-bors Bot pushed a commit that referenced this pull request


          Auto merge of #162989 - JonathanBrouwer:rollup-Z3CMn0z, r=JonathanBro…

971903d

…uwer

Rollup of 19 pull requests

Successful merges:

 - #160401 (sparc: make ABI consistent with clang)
 - #162715 (don't calculate dtors if the self ty has impossible bounds)
 - #162740 (stdarch subtree update)
 - #162946 (Simplify query stack printing)
 - #161005 (fix: unfulfilled nested dead code lint)
 - #161246 (Normalize non-rigid aliases in ty_known_to_outlive)
 - #161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - #162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - #162661 (simplify `Target::GenericParam`)
 - #162666 (Tidy footnote in `platform-support.md`)
 - #162803 (docs(num): add documentation for `NonZero::from_str`)
 - #162879 (use u64 limbs in core::num::bignum)
 - #162903 (PassWrapper: adapt to LLVM reading exception model from module flag)
 - #162905 (c-variadic: add checks for windows i686)
 - #162906 (Move more `rustdoc-html` tests in the right location)
 - #162922 (An assortment of polonius tweaks)
 - #162929 (Update unicode_data to Unicode version 18.0.0)
 - #162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)
 - #162960 (Guard types with unstable `Allocator` params ahead of partial stabilization)

rust-bors Bot merged commit 40f4756 into rust-lang:main

13 checks passed

rustbot added this to the 1.100.0 milestone

rust-bors Bot pushed a commit that referenced this pull request


          Unrolled build for #162930 in rollup 162989

baa60f9

Rollup merge of #162930 - clarfonthey:strlen-is-bounded, r=joshtriplett

Use niche length type for strlen to guarantee `isize::MAX` bound

Alternative to #162912.

r? hanna-kruppe
cc @Darksonn

pull Bot pushed a commit to LeeeeeeM/miri that referenced this pull request


          Auto merge of #162989 - JonathanBrouwer:rollup-Z3CMn0z, r=JonathanBro…

bdcce07

…uwer

Rollup of 19 pull requests

Successful merges:

 - rust-lang/rust#160401 (sparc: make ABI consistent with clang)
 - rust-lang/rust#162715 (don't calculate dtors if the self ty has impossible bounds)
 - rust-lang/rust#162740 (stdarch subtree update)
 - rust-lang/rust#162946 (Simplify query stack printing)
 - rust-lang/rust#161005 (fix: unfulfilled nested dead code lint)
 - rust-lang/rust#161246 (Normalize non-rigid aliases in ty_known_to_outlive)
 - rust-lang/rust#161803 (Fix docs of make_ascii_lowercase/make_ascii_upercase)
 - rust-lang/rust#162256 (Add mentions to sync back `RELEASES.md` to the `main` branch)
 - rust-lang/rust#162661 (simplify `Target::GenericParam`)
 - rust-lang/rust#162666 (Tidy footnote in `platform-support.md`)
 - rust-lang/rust#162803 (docs(num): add documentation for `NonZero::from_str`)
 - rust-lang/rust#162879 (use u64 limbs in core::num::bignum)
 - rust-lang/rust#162903 (PassWrapper: adapt to LLVM reading exception model from module flag)
 - rust-lang/rust#162905 (c-variadic: add checks for windows i686)
 - rust-lang/rust#162906 (Move more `rustdoc-html` tests in the right location)
 - rust-lang/rust#162922 (An assortment of polonius tweaks)
 - rust-lang/rust#162929 (Update unicode_data to Unicode version 18.0.0)
 - rust-lang/rust#162930 (Use niche length type for strlen to guarantee `isize::MAX` bound)
 - rust-lang/rust#162960 (Guard types with unstable `Allocator` params ahead of partial stabilization)

Darksonn mentioned this pull request

Avoid unreachable integer underflow check in CStr::count_bytes() #163005

Merged

Zalathar added a commit to Zalathar/rust that referenced this pull request


          Rollup merge of rust-lang#163005 - Darksonn:cstr-count-bytes, r=Mark-…

6350fd4

…Simulacrum

Avoid unreachable integer underflow check in `CStr::count_bytes()`

Follow up to rust-lang#162930.

cc @clarfonthey, @hanna-kruppe

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#163005 - Darksonn:cstr-count-bytes, r=Mark-…

ad9e00b

…Simulacrum

Avoid unreachable integer underflow check in `CStr::count_bytes()`

Follow up to rust-lang#162930.

cc @clarfonthey, @hanna-kruppe

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request


          Rollup merge of rust-lang#163005 - Darksonn:cstr-count-bytes, r=Mark-…

67974b6

…Simulacrum

Avoid unreachable integer underflow check in `CStr::count_bytes()`

Follow up to rust-lang#162930.

cc @clarfonthey, @hanna-kruppe

rust-bors Bot pushed a commit that referenced this pull request


          Unrolled build for #163005 in rollup 163095

1d704fe

Rollup merge of #163005 - Darksonn:cstr-count-bytes, r=Mark-Simulacrum

Avoid unreachable integer underflow check in `CStr::count_bytes()`

Follow up to #162930.

cc @clarfonthey, @hanna-kruppe

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

S-waiting-on-bors T-compiler T-libs