Use niche length type for strlen to guarantee isize::MAX bound

Author: clarfonthey

library/core/src/ffi/c_str.rs

@@ -6,6 +6,7 @@ use crate::ffi::c_char;
 use crate::intrinsics::const_eval_select;
 use crate::iter::FusedIterator;
 use crate::marker::PhantomData;
+use crate::num::niche_types::UsizeNoHighBitMinusOne;
 use crate::ptr::NonNull;
 use crate::slice::memchr;
 use crate::{fmt, ops, range, slice, str};
@@ -262,7 +263,12 @@ impl CStr {
         // means the call to `from_bytes_with_nul_unchecked` is correct.
         //
         // The cast from c_char to u8 is ok because a c_char is always one byte.
-        unsafe { Self::from_bytes_with_nul_unchecked(slice::from_raw_parts(ptr.cast(), len + 1)) }
+        unsafe {
+            Self::from_bytes_with_nul_unchecked(slice::from_raw_parts(
+                ptr.cast(),
+                len.as_inner() + 1,
+            ))
+        }
     }
 
     /// Creates a C string wrapper from a byte slice with any number of nuls.
@@ -750,9 +756,9 @@ const impl AsRef<CStr> for CStr {
 #[inline]
 #[unstable(feature = "cstr_internals", issue = "none")]
 #[rustc_allow_const_fn_unstable(const_eval_select)]
-const unsafe fn strlen(ptr: *const c_char) -> usize {
+const unsafe fn strlen(ptr: *const c_char) -> UsizeNoHighBitMinusOne {
     const_eval_select!(
-        @capture { s: *const c_char = ptr } -> usize:
+        @capture { s: *const c_char = ptr } -> UsizeNoHighBitMinusOne:
         if const {
             let mut len = 0;
 
@@ -761,15 +767,16 @@ const unsafe fn strlen(ptr: *const c_char) -> usize {
                 len += 1;
             }
 
-            len
+            UsizeNoHighBitMinusOne::new(len).unwrap()
         } else {
             unsafe extern "C" {
                 /// Provided by libc or compiler_builtins.
                 fn strlen(s: *const c_char) -> usize;
             }
 
-            // SAFETY: Outer caller has provided a pointer to a valid C string.
-            unsafe { strlen(s) }
+            // SAFETY: Outer caller has provided a pointer to a valid C string,
+            // and its length is within bounds.
+            unsafe { UsizeNoHighBitMinusOne::new_unchecked(strlen(s)) }
         }
     )
 }
@@ -841,7 +848,7 @@ impl Iterator for Bytes<'_> {
     #[inline]
     fn count(self) -> usize {
         // SAFETY: We always hold a valid pointer to a C string
-        unsafe { strlen(self.ptr.as_ptr().cast()) }
+        unsafe { strlen(self.ptr.as_ptr().cast()) }.as_inner()
     }
 }
 

library/core/src/num/niche_types.rs

@@ -111,6 +111,7 @@ const impl Default for Nanoseconds {
 }
 
 const HALF_USIZE: usize = usize::MAX >> 1;
+const HALF_USIZE_MINUS_ONE: usize = HALF_USIZE - 1;
 
 define_valid_range_type! {
     pub struct NonZeroU8Inner(u8 is 1..);
@@ -126,6 +127,7 @@ define_valid_range_type! {
     pub struct NonZeroI128Inner(i128 is ..0 | 1..);
 
     pub struct UsizeNoHighBit(usize is 0..=HALF_USIZE);
+    pub struct UsizeNoHighBitMinusOne(usize is 0..=HALF_USIZE_MINUS_ONE);
     pub struct NonZeroUsizeInner(usize is 1..);
     pub struct NonZeroIsizeInner(isize is ..0 | 1..);
 

tests/codegen-llvm/cstr-len-plus-one.rs

@@ -0,0 +1,15 @@
+//@ compile-flags: -Copt-level=3 -Cpanic=abort
+
+#![crate_type = "lib"]
+#![feature(cstr_bytes)]
+
+use std::ffi::CStr;
+
+// A `CStr`'s length always fits in an isize after the NUL bit is accounted for
+
+// CHECK-LABEL: @cstr_len_plus_one
+#[no_mangle]
+pub fn cstr_len_plus_one(s: &CStr) -> bool {
+    // CHECK: ret i1 true
+    s.bytes().count() + 1 <= isize::MAX as usize
+}