From 571aad9b46e7b5b68298232b5d2abd34b5eea681 Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Mon, 3 Jun 2024 10:22:34 +0200
Subject: [PATCH] Remove Path::from_bytes_with_nul_unchecked

Path::from_bytes_with_nul_unchecked was a wrapper for
CStr::from_bytes_with_nul_unchecked and Path::from_cstr_unchecked.
Keeping the two methods separate clearly communicates the requirements
and reduces the likelihood of unsound usage.
---
 CHANGELOG.md | 10 +++++++---
 src/path.rs  | 25 +++++++++++--------------
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 942cc9ec..e9735808 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,25 +7,29 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
-## Added
+### Added
 - Added object-safe traits `DynFile`, `DynFilesystem` and `DynStorage` for
   accessing `Storage`, `Filesystem` and `File` implementations for any storage.
 - Added `Filesystem::mount_or_else` function ([#57][])
 - Marked `Path::is_empty`, `Path::from_bytes_with_nul`, `Path::from_cstr`, `Path::from_cstr_unchecked`, `Path::as_str_ref_with_trailing_nul`, `Path::as_str`, and `PathBuf::new` as `const`.
 
-## Fixed
+### Fixed
 
 - Fixed macro hygiene for `path!`.
 - Fixed build error that would occur on Windows systems.
 - Fixed compilation without default features.
 - Added path iteration utilities ([#47][])
 
-## Changed
+### Changed
 
 - Enforced const evaluation for `path!`.
 - Removed `cstr_core` and `cty` dependencies.
 - Updated `littlefs2-sys` dependency to 0.2.0.
 
+### Removed
+
+- Removed `Path::from_bytes_with_nul_unchecked`.  Use `CStr::from_bytes_with_nul_unchecked` and `Path::from_cstr_unchecked` instead.
+
 [#47]: https://github.com/trussed-dev/littlefs2/pull/47
 [#57]: https://github.com/trussed-dev/littlefs2/pull/57
 
diff --git a/src/path.rs b/src/path.rs
index ee9710ba..fb31ee4b 100644
--- a/src/path.rs
+++ b/src/path.rs
@@ -188,7 +188,10 @@ impl Path {
             None | Some((_, "\x00")) => None,
             Some((_, path)) => {
                 debug_assert!(path.ends_with('\x00'));
-                Some(unsafe { Path::from_bytes_with_nul_unchecked(path.as_bytes()) })
+                unsafe {
+                    let cstr = CStr::from_bytes_with_nul_unchecked(path.as_bytes());
+                    Some(Path::from_cstr_unchecked(cstr))
+                }
             }
         }
     }
@@ -243,7 +246,10 @@ impl Path {
         }
         assert!(!bytes.is_empty(), "must not be empty");
         assert!(bytes[i] == 0, "last byte must be null");
-        unsafe { Self::from_bytes_with_nul_unchecked(bytes) }
+        unsafe {
+            let cstr = CStr::from_bytes_with_nul_unchecked(bytes);
+            Self::from_cstr_unchecked(cstr)
+        }
     }
 
     /// Creates a path from a byte buffer
@@ -257,14 +263,6 @@ impl Path {
         }
     }
 
-    /// Unchecked version of `from_bytes_with_nul`
-    ///
-    /// # Safety
-    /// `bytes` must be null terminated string comprised of only ASCII characters
-    pub const unsafe fn from_bytes_with_nul_unchecked(bytes: &[u8]) -> &Self {
-        &*(bytes as *const [u8] as *const Path)
-    }
-
     /// Creates a path from a C string
     ///
     /// The string will be checked to be comprised only of ASCII characters
@@ -546,10 +544,9 @@ impl ops::Deref for PathBuf {
 
     fn deref(&self) -> &Path {
         unsafe {
-            Path::from_bytes_with_nul_unchecked(slice::from_raw_parts(
-                self.buf.as_ptr().cast(),
-                self.len,
-            ))
+            let bytes = slice::from_raw_parts(self.buf.as_ptr().cast(), self.len);
+            let cstr = CStr::from_bytes_with_nul_unchecked(bytes);
+            Path::from_cstr_unchecked(cstr)
         }
     }
 }