From 86d4b36bfa96a66b29a57db7f8313655a72bba99 Mon Sep 17 00:00:00 2001 From: enricobuehler Date: Fri, 31 Jul 2026 17:26:10 +0200 Subject: [PATCH] chore(core): the Apple recv path documents its unsafe blocks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit clippy -D warnings only lints this cfg(target_vendor = "apple") file on a Mac, which CI never does — the three recv/recvmsg_x blocks predate the undocumented_unsafe_blocks sweep and kept every local Apple-side clippy run red. Co-Authored-By: Claude Fable 5 --- crates/punktfunk-core/src/transport/udp/apple.rs | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crates/punktfunk-core/src/transport/udp/apple.rs b/crates/punktfunk-core/src/transport/udp/apple.rs index a01de5bd..c990adef 100644 --- a/crates/punktfunk-core/src/transport/udp/apple.rs +++ b/crates/punktfunk-core/src/transport/udp/apple.rs @@ -105,12 +105,16 @@ fn recv_batch_x( let mut msgs: Vec = iovs .iter_mut() .map(|iov| { + // SAFETY: MsghdrX is a plain-old-data libc-style struct; all-zeroes is its + // documented "no ancillary data, no name" initial state. let mut m: MsghdrX = unsafe { std::mem::zeroed() }; m.msg_iov = iov as *mut libc::iovec; m.msg_iovlen = 1; m }) .collect(); + // SAFETY: `fd` is a live socket owned by `t`; `msgs` holds `n_bufs` initialized headers + // whose iovecs point into `out`'s live buffers — both outlive the call. let n = unsafe { recvmsg_x( fd, @@ -152,6 +156,8 @@ pub(super) fn recv_batch( let mut got = 0usize; while got < n_bufs { let buf = &mut out[got]; + // SAFETY: `fd` is a live socket owned by `t`; `buf` is a live mutable buffer whose + // pointer/len pair is valid for writes for the duration of the call. let r = unsafe { libc::recv( fd,