Crate storage_ptr_slice 

Safe wrappers for raw pointer byte slices.

This crate provides PtrByteSlice and MutPtrByteSlice, which are designed for use in scenarios involving cross-process shared memory (e.g., communication with driver processes or other untrusted components).

Rationale

In a multi-process system like Fuchsia, processes often share memory via VMOs (Virtual Memory Objects). If a process shares a memory region with another process, that other process (which may be compromised or untrusted) can modify the memory concurrently at any time.

In Rust, creating a standard reference (&[u8] or &mut [u8]) over memory that can be modified concurrently by another party is Undefined Behavior (UB). The Rust compiler assumes that the data behind a shared reference (&T) is immutable and cannot change unexpectedly, allowing it to perform optimizations that assume stability. If the memory changes concurrently, these assumptions are violated.

To avoid UB, we must avoid creating standard Rust references to concurrently-modifiable shared memory. Instead, we must treat the shared memory as raw pointers.

PtrByteSlice and MutPtrByteSlice wrap these raw pointers and provide a safe API to:

1. Copy data out of the shared region into private, allocator-managed memory (e.g., via copy_to_slice or to_vec). Once copied, the private data is safe from concurrent modification and can be safely represented as standard Rust slices.
2. Perform structured access (e.g., via chunks or chunks_mut) only when the underlying types guarantee that arbitrary byte patterns are valid (via FromBytes) and we accept that the values might change (though we must still be careful about Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities).

By removing direct access to the underlying slice (i.e., not providing as_slice or as_mut_slice methods), this crate enforces that helper components must copy data into trusted buffers before operating on it, ensuring both memory safety (no UB) and robustness against concurrent modification.

This crate does nothing to prevent data races; responsibility for handling data races lies elsewhere.

Structs

Chunk

A read-only chunk of a pointer slice.

ChunkMut

A mutable chunk of a pointer slice.

Chunks

An iterator over read-only chunks of a pointer slice.

ChunksMut

An iterator over mutable chunks of a pointer slice.

MutPtrByteSlice

A mutable view of a raw pointer byte slice, providing a safe API.

PtrByteSlice

A read-only view of a raw pointer byte slice, providing a safe API.