Public API of pact_ffi exposes UB to safe code

[dtolnay]

For example, the following safe program leads to pact_ffi performing Undefined Behavior:

// [dependencies]
// log = "0.4"
// pact_ffi = "0.0.2"

fn main() {
    pact_ffi::log::pactffi_logger_attach_sink(
        0xdeadbeefusize as _,
        log::LevelFilter::Off.into(),
    );
}

Segmentation fault (core dumped)

In general it is unsound for a safe API to result in UB.

[mefellows]

Looking at that method definition I think it should be marked as unsafe. I'm not sure why Rust doesn't automatically mark a function as unsafe if it uses an unsafe method, so perhaps i'm wrong about it.

[TimothyJones]

I agree, it would be ideal to have this correctly reported.

In practice, it might not matter, because the ffi methods are an external interface for tooling that isn't in Rust- where rust's concept of safety won't apply anyway.