Re: [PATCH v14 2/2] rust: fmt: route {:p} through HashedPtr to prevent address leaks

On 8/10/26 03:50, Miguel Ojeda wrote:
> On Fri, Aug 7, 2026 at 10:15 AM Ke Sun <[email protected]> wrote:
>> +        // SAFETY: `buf` is a valid, writable 32-byte buffer, sufficient for
>> +        // all architectures (max 19 bytes for 64-bit under the default width).
>> +        // The format string is null-terminated; `width` (c_int) and pointer
>> +        // match the `%*` and `%p` specifiers.
>> +        let len = unsafe {
>> +            crate::bindings::scnprintf(
>> +                buf.as_mut_ptr().cast(),
>> +                buf.len(),
>> +                c"%#0*p".as_char_ptr(),
>> +                width,
>> +                self.0.cast::<c_void>(),
>> +            )
>> +        };
> I think Sashiko is right, we probably want to restrict the user width
> to as much as the buffer size minus one, e.g. in the `match`:
>
>    w.min(buf.len() - 1)
>
> And we probably want to add a test or two for the boundary cases there.
>
> If someone really needs a longer width, we can always revisit, but I
> suspect not.
>
> Ke: do you think you can resubmit with that?

Sure, done — width clamped and a few tests added. Will send once
testing is done.

Best regards,
Ke

>
> Thanks!
>
> Cheers,
> Miguel
>