rust::Span<> two-argument constructor should be marked [[clang::unsafe_buffer_usage]]

Constructing a slice or span from a raw pointer and a size (e.g., Slice(T*, size_t)) is inherently unsafe in C++, as the compiler cannot verify that the pointer actually points to an allocation of at least size elements. This is a common source of Out-of-Bounds (OOB) memory vulnerabilities. Adding [[clang::unsafe_buffer_usage]] tells the compiler to emit a warning (or error) anytime this specific constructor is called directly.

diff --git a/third_party/rust/chromium_crates_io/vendor/cxx-v1/include/cxx.h b/third_party/rust/chromium_crates_io/vendor/cxx-v1/include/cxx.h index 4e261a35536c5..9f6f40b415d38 100644 --- a/third_party/rust/chromium_crates_io/vendor/cxx-v1/include/cxx.h +++ b/third_party/rust/chromium_crates_io/vendor/cxx-v1/include/cxx.h @@ -189,10 +189,19 @@ public: using value_type = T;

Slice() noexcept; +#if defined(clang) && __has_cpp_attribute(clang::unsafe_buffer_usage)

• [[clang::unsafe_buffer_usage]] +#endif Slice(T *, std::size_t count) noexcept;

+#if defined(clang) +#pragma clang unsafe_buffer_usage begin +#endif template explicit Slice(C &c) : Slice(c.data(), c.size()) {} +#if defined(clang) +#pragma clang unsafe_buffer_usage end +#endif