Re: [PATCH v14 2/2] rust: fmt: route {:p} through HashedPtr to prevent address leaks

On Fri, Aug 7, 2026 at 10:15 AM Ke Sun <[email protected]> wrote:
>
> +        // SAFETY: `buf` is a valid, writable 32-byte buffer, sufficient for
> +        // all architectures (max 19 bytes for 64-bit under the default width).
> +        // The format string is null-terminated; `width` (c_int) and pointer
> +        // match the `%*` and `%p` specifiers.
> +        let len = unsafe {
> +            crate::bindings::scnprintf(
> +                buf.as_mut_ptr().cast(),
> +                buf.len(),
> +                c"%#0*p".as_char_ptr(),
> +                width,
> +                self.0.cast::<c_void>(),
> +            )
> +        };

I think Sashiko is right, we probably want to restrict the user width
to as much as the buffer size minus one, e.g. in the `match`:

  w.min(buf.len() - 1)

And we probably want to add a test or two for the boundary cases there.

If someone really needs a longer width, we can always revisit, but I
suspect not.

Ke: do you think you can resubmit with that?

Thanks!

Cheers,
Miguel