ort::value::Value is unsound since it exposes raw pointers as public fields

[SludgePhD]

The Value type is defined like this:

pub enum Value<'v> {
	RustOwned {
		ptr: *mut sys::OrtValue,
		array: DynArrayRef<'v>,
		memory_info: MemoryInfo
	},
	CppOwned {
		ptr: *mut sys::OrtValue,
		session: Arc<SessionPointerHolder>
	}
}

Enum variants and their fields are public, so downstream code can:

• construct a Value from an arbitrary dangling pointer, or
• construct a valid Value using the API, and then change the contained pointer to point whereever

None of those things require unsafe code, so this API is unsound. It could be fixed by wrapping the enum in another struct type, as a private field.

[SludgePhD]

Oh nevermind, apparently the entire code base is unsound in similar ways, seemingly intentionally. What exactly is the intended way to... interpret this library? Is there a higher-level wrapper around ort that I should be using instead?