From b9ad3eda27ca03708dec843f6c94e5edae2d541d Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwe@microsoft.com>
Date: Wed, 16 Nov 2022 17:28:15 +0000
Subject: [PATCH] vhdx: add some safety comments

Also add some assertions to some places along side the safety comments.

Signed-off-by: Wei Liu <liuwe@microsoft.com>
---
 vhdx/src/vhdx_header.rs   | 5 +++++
 vhdx/src/vhdx_metadata.rs | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/vhdx/src/vhdx_header.rs b/vhdx/src/vhdx_header.rs
index 09697bbc4..4ad7d9371 100644
--- a/vhdx/src/vhdx_header.rs
+++ b/vhdx/src/vhdx_header.rs
@@ -136,6 +136,7 @@ impl Header {
         f.read_exact(&mut buffer)
             .map_err(VhdxHeaderError::ReadHeader)?;
 
+        // SAFETY: buffer is of correct size and has been successfully filled.
         let header = unsafe { *(buffer.as_ptr() as *mut Header) };
         if header.signature != HEADER_SIGN {
             return Err(VhdxHeaderError::InvalidHeaderSign);
@@ -151,6 +152,7 @@ impl Header {
 
     /// Converts the header structure into a buffer
     fn get_header_as_buffer(&self, buffer: &mut [u8; HEADER_SIZE as usize]) {
+        // SAFETY: self is a valid header.
         let reference = unsafe {
             std::slice::from_raw_parts(self as *const Header as *const u8, HEADER_SIZE as usize)
         };
@@ -221,6 +223,7 @@ impl RegionTableHeader {
         f.read_exact(&mut buffer)
             .map_err(VhdxHeaderError::ReadRegionTableHeader)?;
 
+        // SAFETY: buffer is of correct size and has been successfully filled.
         let region_table_header = unsafe { *(buffer.as_ptr() as *mut RegionTableHeader) };
         if region_table_header.signature != REGION_SIGN {
             return Err(VhdxHeaderError::InvalidRegionSign);
@@ -337,6 +340,8 @@ pub struct RegionTableEntry {
 impl RegionTableEntry {
     /// Reads one Region Entry from a Region Table index that starts from 0
     pub fn new(buffer: &[u8]) -> Result<RegionTableEntry> {
+        assert!(buffer.len() == std::mem::size_of::<RegionTableEntry>());
+        // SAFETY: the assertion above makes sure the buffer size is correct.
         let mut region_table_entry = unsafe { *(buffer.as_ptr() as *mut RegionTableEntry) };
 
         let uuid = crate::uuid_from_guid(buffer);
diff --git a/vhdx/src/vhdx_metadata.rs b/vhdx/src/vhdx_metadata.rs
index ea5b632b4..6a5602dbc 100644
--- a/vhdx/src/vhdx_metadata.rs
+++ b/vhdx/src/vhdx_metadata.rs
@@ -270,6 +270,8 @@ struct MetadataTableHeader {
 
 impl MetadataTableHeader {
     pub fn new(buffer: &[u8]) -> Result<MetadataTableHeader> {
+        assert!(buffer.len() == std::mem::size_of::<MetadataTableHeader>());
+        // SAFETY: the assertion above makes sure the buffer size is correct.
         let metadata_table_header = unsafe { *(buffer.as_ptr() as *mut MetadataTableHeader) };
 
         if metadata_table_header.signature != METADATA_SIGN {
@@ -301,6 +303,8 @@ pub struct MetadataTableEntry {
 impl MetadataTableEntry {
     /// Parse one metadata entry from the buffer
     fn new(buffer: &[u8]) -> Result<MetadataTableEntry> {
+        assert!(buffer.len() == std::mem::size_of::<MetadataTableEntry>());
+        // SAFETY: the assertion above makes sure the buffer size is correct.
         let mut metadata_table_entry = unsafe { *(buffer.as_ptr() as *mut MetadataTableEntry) };
 
         let uuid = crate::uuid_from_guid(buffer);