Use raw pointers instead of typed pointers.

In general, it is better to use raw pointers instead of typed pointers
whenever those pointers are provided to you by external users. The
reason for this is that Swift requires that each pointer be bound to one
and only one data type at any point in the program execution. If you are
vended a raw pointer (e.g. from a Data), your program does not
unequivocally know what the type of that pointer may be, and so to
assume that it is bound to UInt8 or Int8 is to risk violating Swift's
pointer aliasing rules.

We've learned lessons in the past that violating the pointer aliasing
rules in programming languages can lead to disaster. In our case, we
can avoid the majority of this trouble by electing to use raw pointers
instead of typed pointers. This also helps us by removing tricky pointer
management code.

This patch contains essentially no function change: wherever possible I
made straightforward, targeted refactors. I think once or twice I turned
a pointer into a buffer pointer, but I generally resisted getting too
frisky with changes.

Author: Lukasa

Sources/SwiftProtobuf/AnyMessageStorage.swift

@@ -67,11 +67,8 @@ fileprivate func unpack(contentJSON: Data,
 
   var value = String()
   try contentJSON.withUnsafeBytes { (body: UnsafeRawBufferPointer) in
-    if let baseAddress = body.baseAddress, body.count > 0 {
-      let bytes = baseAddress.assumingMemoryBound(to: UInt8.self)
-
-      let buffer = UnsafeBufferPointer(start: bytes, count: body.count)
-      var scanner = JSONScanner(source: buffer,
+    if body.count > 0 {
+      var scanner = JSONScanner(source: body,
                                 messageDepthLimit: options.messageDepthLimit,
                                 ignoreUnknownFields: options.ignoreUnknownFields)
       let key = try scanner.nextQuotedString()

Sources/SwiftProtobuf/BinaryDecoder.swift

@@ -19,13 +19,13 @@ import Foundation
 
 internal struct BinaryDecoder: Decoder {
     // Current position
-    private var p : UnsafePointer<UInt8>
+    private var p : UnsafeRawPointer
     // Remaining bytes in input.
     private var available : Int
     // Position of start of field currently being parsed
-    private var fieldStartP : UnsafePointer<UInt8>
+    private var fieldStartP : UnsafeRawPointer
     // Position of end of field currently being parsed, nil if we don't know.
-    private var fieldEndP : UnsafePointer<UInt8>?
+    private var fieldEndP : UnsafeRawPointer?
     // Whether or not the field value  has actually been parsed
     private var consumed = true
     // Wire format for last-examined field
@@ -51,7 +51,7 @@ internal struct BinaryDecoder: Decoder {
     private var complete: Bool {return available == 0}
 
     internal init(
-      forReadingFrom pointer: UnsafePointer<UInt8>,
+      forReadingFrom pointer: UnsafeRawPointer,
       count: Int,
       options: BinaryDecodingOptions,
       extensions: ExtensionMap? = nil
@@ -66,7 +66,7 @@ internal struct BinaryDecoder: Decoder {
     }
 
     internal init(
-      forReadingFrom pointer: UnsafePointer<UInt8>,
+      forReadingFrom pointer: UnsafeRawPointer,
       count: Int,
       parent: BinaryDecoder
     ) {
@@ -878,8 +878,7 @@ internal struct BinaryDecoder: Decoder {
                 var field = Data(count: fieldSize)
                 field.withUnsafeMutableBytes { (body: UnsafeMutableRawBufferPointer) in
                   if let baseAddress = body.baseAddress, body.count > 0 {
-                    let pointer = baseAddress.assumingMemoryBound(to: UInt8.self)
-                    var encoder = BinaryEncoder(forWritingInto: pointer)
+                    var encoder = BinaryEncoder(forWritingInto: baseAddress)
                     encoder.startField(tag: fieldTag)
                     encoder.putVarInt(value: Int64(bodySize))
                     for v in extras {
@@ -1209,8 +1208,7 @@ internal struct BinaryDecoder: Decoder {
                     var wasDecoded = false
                     try data.withUnsafeBytes { (body: UnsafeRawBufferPointer) in
                       if let baseAddress = body.baseAddress, body.count > 0 {
-                        let pointer = baseAddress.assumingMemoryBound(to: UInt8.self)
-                        var extDecoder = BinaryDecoder(forReadingFrom: pointer,
+                        var extDecoder = BinaryDecoder(forReadingFrom: baseAddress,
                                                        count: body.count,
                                                        parent: self)
                         // Prime the decode to be correct.
@@ -1253,8 +1251,7 @@ internal struct BinaryDecoder: Decoder {
                         var payload = Data(count: payloadSize)
                         payload.withUnsafeMutableBytes { (body: UnsafeMutableRawBufferPointer) in
                           if let baseAddress = body.baseAddress, body.count > 0 {
-                            let pointer = baseAddress.assumingMemoryBound(to: UInt8.self)
-                            var encoder = BinaryEncoder(forWritingInto: pointer)
+                            var encoder = BinaryEncoder(forWritingInto: baseAddress)
                             encoder.putBytesValue(value: data)
                           }
                         }
@@ -1297,14 +1294,14 @@ internal struct BinaryDecoder: Decoder {
             if available < 1 {
                 throw BinaryDecodingError.truncated
             }
-            var c = p[0]
+            var c = p.load(fromByteOffset: 0, as: UInt8.self)
             while (c & 0x80) != 0 {
                 p += 1
                 available -= 1
                 if available < 1 {
                     throw BinaryDecodingError.truncated
                 }
-                c = p[0]
+                c = p.load(fromByteOffset: 0, as: UInt8.self)
             }
             p += 1
             available -= 1
@@ -1382,7 +1379,7 @@ internal struct BinaryDecoder: Decoder {
         }
         var start = p
         var length = available
-        var c = start[0]
+        var c = start.load(fromByteOffset: 0, as: UInt8.self)
         start += 1
         length -= 1
         if c & 0x80 == 0 {
@@ -1396,7 +1393,7 @@ internal struct BinaryDecoder: Decoder {
             if length < 1 || shift > 63 {
                 throw BinaryDecodingError.malformedProtobuf
             }
-            c = start[0]
+            c = start.load(fromByteOffset: 0, as: UInt8.self)
             start += 1
             length -= 1
             value |= UInt64(c & 0x7f) << shift
@@ -1448,10 +1445,8 @@ internal struct BinaryDecoder: Decoder {
     /// helper handles all four-byte number types.
     private mutating func decodeFourByteNumber<T>(value: inout T) throws {
         guard available >= 4 else {throw BinaryDecodingError.truncated}
-        withUnsafeMutablePointer(to: &value) { ip -> Void in
-            let dest = UnsafeMutableRawPointer(ip).assumingMemoryBound(to: UInt8.self)
-            let src = UnsafeRawPointer(p).assumingMemoryBound(to: UInt8.self)
-            dest.initialize(from: src, count: 4)
+        withUnsafeMutableBytes(of: &value) { dest -> Void in
+            dest.copyMemory(from: UnsafeRawBufferPointer(start: p, count: 4))
         }
         consume(length: 4)
     }
@@ -1460,10 +1455,8 @@ internal struct BinaryDecoder: Decoder {
     /// helper handles all eight-byte number types.
     private mutating func decodeEightByteNumber<T>(value: inout T) throws {
         guard available >= 8 else {throw BinaryDecodingError.truncated}
-        withUnsafeMutablePointer(to: &value) { ip -> Void in
-            let dest = UnsafeMutableRawPointer(ip).assumingMemoryBound(to: UInt8.self)
-            let src = UnsafeRawPointer(p).assumingMemoryBound(to: UInt8.self)
-            dest.initialize(from: src, count: 8)
+        withUnsafeMutableBytes(of: &value) { dest -> Void in
+            dest.copyMemory(from: UnsafeRawBufferPointer(start: p, count: 8))
         }
         consume(length: 8)
     }
@@ -1490,7 +1483,7 @@ internal struct BinaryDecoder: Decoder {
 
     /// Private: Get the start and length for the body of
     // a length-delimited field.
-    private mutating func getFieldBodyBytes(count: inout Int) throws -> UnsafePointer<UInt8> {
+    private mutating func getFieldBodyBytes(count: inout Int) throws -> UnsafeRawPointer {
         let length = try decodeVarint()
         if length <= UInt64(available) {
             count = Int(length)

Sources/SwiftProtobuf/BinaryDelimited.swift

@@ -57,15 +57,17 @@ public enum BinaryDelimited {
     var data = Data(count: totalSize)
     data.withUnsafeMutableBytes { (body: UnsafeMutableRawBufferPointer) in
       if let baseAddress = body.baseAddress, body.count > 0 {
-        let pointer = baseAddress.assumingMemoryBound(to: UInt8.self)
-        var encoder = BinaryEncoder(forWritingInto: pointer)
+        var encoder = BinaryEncoder(forWritingInto: baseAddress)
         encoder.putBytesValue(value: serialized)
       }
     }
 
     var written: Int = 0
     data.withUnsafeBytes { (body: UnsafeRawBufferPointer) in
       if let baseAddress = body.baseAddress, body.count > 0 {
+        // This assumingMemoryBound is technically unsafe, but without SR-11078
+        // (https://bugs.swift.org/browse/SR-11087) we don't have another option.
+        // It should be "safe enough".
         let pointer = baseAddress.assumingMemoryBound(to: UInt8.self)
         written = stream.write(pointer, maxLength: totalSize)
       }
@@ -162,6 +164,9 @@ public enum BinaryDelimited {
     var bytesRead: Int = 0
     data.withUnsafeMutableBytes { (body: UnsafeMutableRawBufferPointer) in
       if let baseAddress = body.baseAddress, body.count > 0 {
+        // This assumingMemoryBound is technically unsafe, but without SR-11078
+        // (https://bugs.swift.org/browse/SR-11087) we don't have another option.
+        // It should be "safe enough".
         let pointer = baseAddress.assumingMemoryBound(to: UInt8.self)
         bytesRead = stream.read(pointer, maxLength: length)
       }

Sources/SwiftProtobuf/BinaryEncoder.swift

@@ -19,30 +19,35 @@ import Foundation
  * Encoder for Binary Protocol Buffer format
  */
 internal struct BinaryEncoder {
-    private var pointer: UnsafeMutablePointer<UInt8>
+    private var pointer: UnsafeMutableRawPointer
 
-    init(forWritingInto pointer: UnsafeMutablePointer<UInt8>) {
+    init(forWritingInto pointer: UnsafeMutableRawPointer) {
         self.pointer = pointer
     }
 
     private mutating func append(_ byte: UInt8) {
-        pointer.pointee = byte
-        pointer = pointer.successor()
+        pointer.storeBytes(of: byte, as: UInt8.self)
+        pointer = pointer.advanced(by: 1)
     }
 
     private mutating func append(contentsOf data: Data) {
-        let count = data.count
-        data.copyBytes(to: pointer, count: count)
-        pointer = pointer.advanced(by: count)
+        data.withUnsafeBytes { dataPointer in
+            if let baseAddress = dataPointer.baseAddress, dataPointer.count > 0 {
+                pointer.copyMemory(from: baseAddress, byteCount: dataPointer.count)
+                pointer = pointer.advanced(by: dataPointer.count)
+            }
+        }
     }
 
-    private mutating func append(contentsOf bufferPointer: UnsafeBufferPointer<UInt8>) {
+    private mutating func append(contentsOf bufferPointer: UnsafeRawBufferPointer) {
         let count = bufferPointer.count
-        pointer.assign(from: bufferPointer.baseAddress!, count: count)
+        if let baseAddress = bufferPointer.baseAddress, count > 0 {
+            memcpy(pointer, baseAddress, count)
+        }
         pointer = pointer.advanced(by: count)
     }
 
-    func distance(pointer: UnsafeMutablePointer<UInt8>) -> Int {
+    func distance(pointer: UnsafeMutableRawPointer) -> Int {
         return pointer.distance(to: self.pointer)
     }
 
@@ -123,8 +128,8 @@ internal struct BinaryEncoder {
         let count = value.utf8.count
         putVarInt(value: count)
         for b in value.utf8 {
-            pointer.pointee = b
-            pointer = pointer.successor()
+            pointer.storeBytes(of: b, as: UInt8.self)
+            pointer = pointer.advanced(by: 1)
         }
     }
 

Sources/SwiftProtobuf/BinaryEncodingVisitor.swift

@@ -26,7 +26,7 @@ internal struct BinaryEncodingVisitor: Visitor {
   /// - Precondition: `pointer` must point to an allocated block of memory that
   ///   is large enough to hold the entire encoded message. For performance
   ///   reasons, the encoder does not make any attempts to verify this.
-  init(forWritingInto pointer: UnsafeMutablePointer<UInt8>) {
+  init(forWritingInto pointer: UnsafeMutableRawPointer) {
     encoder = BinaryEncoder(forWritingInto: pointer)
   }
 

Sources/SwiftProtobuf/DoubleParser.swift

@@ -21,46 +21,39 @@ internal class DoubleParser {
     // In theory, JSON writers should be able to represent any IEEE Double
     // in at most 25 bytes, but many writers will emit more digits than
     // necessary, so we size this generously.
-    #if swift(>=4.1)
-      private var work =
-          UnsafeMutableRawBufferPointer.allocate(byteCount: 128,
-                                                 alignment: MemoryLayout<UInt8>.alignment)
-    #else
-      private var work = UnsafeMutableRawBufferPointer.allocate(count: 128)
-    #endif
+    private var work = 
+      UnsafeMutableBufferPointer<Int8>.allocate(capacity: 128)
 
     deinit {
         work.deallocate()
     }
 
-    func utf8ToDouble(bytes: UnsafeBufferPointer<UInt8>,
-                      start: UnsafeBufferPointer<UInt8>.Index,
-                      end: UnsafeBufferPointer<UInt8>.Index) -> Double? {
-        return utf8ToDouble(bytes: bytes.baseAddress! + start, count: end - start)
+    func utf8ToDouble(bytes: UnsafeRawBufferPointer,
+                      start: UnsafeRawBufferPointer.Index,
+                      end: UnsafeRawBufferPointer.Index) -> Double? {
+        return utf8ToDouble(bytes: UnsafeRawBufferPointer(rebasing: bytes[start..<end]))
     }
 
-    func utf8ToDouble(bytes: UnsafePointer<UInt8>, count: Int) -> Double? {
+    func utf8ToDouble(bytes: UnsafeRawBufferPointer) -> Double? {
         // Reject unreasonably long or short UTF8 number
-        if work.count <= count || count < 1 {
+        if work.count <= bytes.count || bytes.count < 1 {
             return nil
         }
-        // Copy it to the work buffer and null-terminate it
-        let source = UnsafeRawBufferPointer(start: bytes, count: count)
+
         #if swift(>=4.1)
-          work.copyMemory(from:source)
+          UnsafeMutableRawBufferPointer(work).copyMemory(from: bytes)
         #else
-          work.copyBytes(from:source)
+          UnsafeMutableRawBufferPointer(work).copyBytes(from: bytes)
         #endif
-        work[count] = 0
+        work[bytes.count] = 0
 
         // Use C library strtod() to parse it
-        let start = work.baseAddress!.assumingMemoryBound(to: Int8.self)
-        var e: UnsafeMutablePointer<Int8>? = start
-        let d = strtod(start, &e)
+        var e: UnsafeMutablePointer<Int8>? = work.baseAddress
+        let d = strtod(work.baseAddress!, &e)
 
         // Fail if strtod() did not consume everything we expected
         // or if strtod() thought the number was out of range.
-        if e != start + count || !d.isFinite {
+        if e != work.baseAddress! + bytes.count || !d.isFinite {
             return nil
         }
         return d

Sources/SwiftProtobuf/Enum.swift

@@ -83,7 +83,7 @@ extension Enum {
   /// to distinguish them.
   ///
   /// - Parameter name: Buffer holding the UTF-8 bytes of the desired name.
-  internal init?(rawUTF8: UnsafeBufferPointer<UInt8>) {
+  internal init?(rawUTF8: UnsafeRawBufferPointer) {
     guard let nameProviding = Self.self as? _ProtoNameProviding.Type,
       let number = nameProviding._protobuf_nameMap.number(forJSONName: rawUTF8) else {
       return nil

Sources/SwiftProtobuf/Google_Protobuf_Any+Extensions.swift

@@ -68,11 +68,9 @@ extension Google_Protobuf_Any {
       if let data = textFormatString.data(using: String.Encoding.utf8) {
         try data.withUnsafeBytes { (body: UnsafeRawBufferPointer) in
           if let baseAddress = body.baseAddress, body.count > 0 {
-            let bytes = baseAddress.assumingMemoryBound(to: UInt8.self)
-
             var textDecoder = try TextFormatDecoder(
               messageType: Google_Protobuf_Any.self,
-              utf8Pointer: bytes,
+              utf8Pointer: baseAddress,
               count: body.count,
               extensions: extensions)
             try decodeTextFormat(decoder: &textDecoder)

Sources/SwiftProtobuf/JSONDecoder.swift

@@ -25,7 +25,7 @@ internal struct JSONDecoder: Decoder {
     throw JSONDecodingError.conflictingOneOf
   }
 
-  internal init(source: UnsafeBufferPointer<UInt8>, options: JSONDecodingOptions) {
+  internal init(source: UnsafeRawBufferPointer, options: JSONDecodingOptions) {
     self.options = options
     self.scanner = JSONScanner(source: source,
                                messageDepthLimit: self.options.messageDepthLimit,

Sources/SwiftProtobuf/JSONEncoder.swift

@@ -323,9 +323,7 @@ internal struct JSONEncoder {
         data.append(asciiDoubleQuote)
         if value.count > 0 {
             value.withUnsafeBytes { (body: UnsafeRawBufferPointer) in
-              if let baseAddress = body.baseAddress, body.count > 0 {
-                let p = baseAddress.assumingMemoryBound(to: UInt8.self)
-
+              if let p = body.baseAddress, body.count > 0 {
                 var t: Int = 0
                 var bytesInGroup: Int = 0
                 for i in 0..<body.count {