Document that CString::new sheds unused capacity from the buffer it's given

[Minoru]

I tried to use std::ffi::CString as an output buffer for libc::snprintf like this (playground):

fn obtain_answer() -> Option<String> {
    let format = "The answer ... is: %llu";

    const BUF_SIZE: usize = 1024;
    let buffer = Vec::<u8>::with_capacity(BUF_SIZE);
    unsafe {
        CString::new(buffer).ok().and_then(|buffer| {
            CString::new(format).ok().and_then(|format| {
                let buffer_ptr = buffer.into_raw();
                libc::snprintf(
                    buffer_ptr,
                    BUF_SIZE as libc::size_t,
                    format.as_ptr() as *const libc::c_char,
                    std::u64::MAX,
                );
                let buffer = CString::from_raw(buffer_ptr);
                buffer.into_string().ok()
            })
        })
    }
}

I thought I'm creating a buffer of 1024 bytes, but in reality, CString::new appends a null byte and calls Vec::into_boxed_slice on my Vec, shrinking it to 1 byte. This leads to memory corruption, since I pass snprintf a pointer to a one-byte buffer but tell it there are 1024 bytes available.

I'm a bit unsure if CString is even a good choice here, but if it is, I think CString's docs should be more explicit on what happens to the buffer. I suggest adding a comment to CString::new doc saying the same as Vec::into_boxed_slice: "Note that this will drop any excess capacity".

[kyrias]

On the other hand, nowhere does it say that it will actually use the same allocation, just the bytes from what you pass in, so you can't make any kind of assumptions as to what happens to the allocation you pass in. And the implementation could for whatever reason be changed not to do that in the future as well.

[Minoru]

Yeah, I'm probably just misusing that CString, and should've used Vec<u8> instead. I feel a bit silly suggesting to add something like "don't pass CString as a mutable buffer to fill, use this or that instead", but that might be better than my previous suggestion.

[Minoru]

I'm a bit unsure if CString is even a good choice here

It's not. I should've used Vec<u8> instead. Closing the issue because I no longer think that CString's doc needs amending.