Socket::recv_from taking a &mut [u8]

[danielrh]

Starting in version 0.4.0 there's no safe way to pass a &mut [u8] into recv_from, since RecvFrom takes &mut [MaybeUninitialized<u8>] and rustc does not understand if the library potentially writes uninitalized bytes to the buffer.

Would it be possible to return the signature of the function to the way it was in 0.3.0 so that we can safely call recv_from? Perhaps a recv_from_uninitialized_with_options would be something useful for hyper-tuned applications.

Currently the only way I can see to interact with recv_from when I have a &mut [u8] is to use transmute, which is very difficult to pass code review with and difficult to reason about.

[Thomasdezeeuw]

Starting in version 0.4.0 there's no safe way to pass a &mut [u8] into recv_from, since RecvFrom takes &mut [MaybeUninitialized<u8>] and rustc does not understand if the library potentially writes uninitalized bytes to the buffer.

Socket2 makes the guarantee that no uninitalized bytes are written to the buffer, but indeed rustc doesn't understand this.

Would it be possible to return the signature of the function to the way it was in 0.3.0 so that we can safely call recv_from? Perhaps a recv_from_uninitialized_with_options would be something useful for hyper-tuned applications.

I'm afraid since socket2 is a low level library we focus on those "hyper-tuned" application. On top of socket2 nicer API can be build, so I won't change it back. However I'm open to additional API that works with &mut [u8], for example Socket already implement io::Read/io::Write which is the recv/send equivalent with &mut [u8].

Currently the only way I can see to interact with recv_from when I have a &mut [u8] is to use transmute, which is very difficult to pass code review with and difficult to reason about.

The following code at least avoids transmute, but still uses unsafe:

socket2/src/socket.rs

Lines 1384 to 1389 in 34a0786

	fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
	// Safety: the `recv` implementation promises not to write uninitialised
	// bytes to the `buf`fer, so this casting is safe.
	let buf = unsafe { &mut *(buf as *mut [u8] as *mut [MaybeUninit<u8>]) };
	self.recv(buf)
	}

[agrover]

The goal of this crate is to create and use a socket using advanced configuration options (those that are not available in the types in the standard library) without using any unsafe code.

Is this no longer the case, then?

EDIT: I guess that's a little unfair, the safe API is just harder to use.

I'd be happy to work on a new equivalent recv_from method that takes &mut [u8], the only question is what to call it. I can't think of anything good.

[Thomasdezeeuw]

The goal of this crate is to create and use a socket using advanced configuration options (those that are not available in the types in the standard library) without using any unsafe code.

Is this no longer the case, then?

EDIT: I guess that's a little unfair, the safe API is just harder to use.

The crate made it a lot easier to work with uninitialised bytes, which is a pain using the sockets from stdlib, but I understand your pain.

[Thomasdezeeuw]

Closing in favour of #366.