fix(rs-sdk-ffi): prevent heap corruption from Vec capacity mismatch in FFI

[QuantumExplorer]

Summary

• Fix undefined behavior where Vec::from_raw_parts was called with wrong capacity in FFI free functions
• Use into_boxed_slice() to guarantee capacity == len before crossing FFI boundary

Issue

success_binary() captured Vec's len and pointer via mem::forget() but discarded capacity. The free function reconstructed with Vec::from_raw_parts(ptr, len, len), passing len as capacity. When the original Vec had capacity > len, the allocator received wrong deallocation size (UB).

Test plan

• Test verifies capacity is preserved after fix
• cargo test passes
• cargo clippy clean

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@QuantumExplorer has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 14 minutes and 53 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3ab754bd-fe44-4abb-b929-45c54f14e573

📥 Commits

Reviewing files that changed from the base of the PR and between 658d02d and 47df3a1.

📒 Files selected for processing (7)

• packages/rs-sdk-ffi/src/dpns/queries/contested.rs
• packages/rs-sdk-ffi/src/identity/create_from_addresses.rs
• packages/rs-sdk-ffi/src/identity/keys.rs
• packages/rs-sdk-ffi/src/identity/queries/identities_balances.rs
• packages/rs-sdk-ffi/src/identity/top_up_from_addresses.rs
• packages/rs-sdk-ffi/src/identity/transfer_to_addresses.rs
• packages/rs-sdk-ffi/src/types.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch test/prove-vec-capacity-mismatch

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

✅ DashSDKFFI.xcframework built for this PR.

• Workflow run: https://github.com/dashpay/platform/actions/runs/23107611416
• Artifacts: DashSDKFFI.xcframework (folder), DashSDKFFI.xcframework.zip, xc_checksum.txt

SwiftPM (host the zip at a stable URL, then use):

.binaryTarget(
  name: "DashSDKFFI",
  url: "https://your.cdn.example/DashSDKFFI.xcframework.zip",
  checksum: "43cddd79416f3aa2f45c74767933e77caab4f0710aff7750671936144b66cdbe"
)

Xcode manual integration:

• Download 'DashSDKFFI.xcframework' artifact from the run link above.
• Drag it into your app target (Frameworks, Libraries & Embedded Content) and set Embed & Sign.
• If using the Swift wrapper package, point its binaryTarget to the xcframework location or add the package and place the xcframework at the expected path.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.28%. Comparing base (d82ca97) to head (47df3a1).
⚠️ Report is 8 commits behind head on v3.1-dev.

Additional details and impacted files

@@             Coverage Diff              @@
##           v3.1-dev    #3289      +/-   ##
============================================
- Coverage     70.42%   68.28%   -2.15%     
============================================
  Files          3293     3293              
  Lines        262598   262598              
============================================
- Hits         184935   179310    -5625     
- Misses        77663    83288    +5625     

Components	Coverage Δ
dpp	56.61% <ø> (-1.82%)	⬇️
drive	74.76% <ø> (-3.44%)	⬇️
drive-abci	81.44% <ø> (-1.49%)	⬇️
sdk	30.34% <ø> (-0.91%)	⬇️
dapi-client	39.08% <ø> (ø)
platform-version	∅ <ø> (∅)
platform-value	39.35% <ø> (ø)
platform-wallet	60.40% <ø> (ø)
drive-proof-verifier	∅ <ø> (∅)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.