Rust Unsafe Practice: Raw Pointers, FFI & Unsafe Blocks

Raw pointer operations require an unsafe block. The compiler cannot verify the pointer is valid:

let x = 42;
let ptr: *const i32 = &x;

// WRONG: raw pointer deref outside unsafe
// println!("{}", *ptr);  // error[E0133]: dereference of raw pointer is unsafe

// RIGHT: wrap in unsafe block
// SAFETY: ptr was created from a valid reference and x is still alive
unsafe {
    println!("{}", *ptr);
}

Calling an unsafe fn also requires an unsafe block at the call site:

unsafe fn dangerous(ptr: *const i32) -> i32 {
    // SAFETY: caller guarantees ptr is valid, aligned, and points to initialized i32
    unsafe { *ptr }
}

// WRONG: calling unsafe fn without unsafe block
// dangerous(ptr);  // error[E0133]: call to unsafe function is unsafe

// RIGHT: wrap in unsafe block
// SAFETY: we know ptr points to a live i32 (created from &x above)
let val = unsafe { dangerous(ptr) };

Rust 2024 note: unsafe_op_in_unsafe_fn is now a warning by default. Even inside an unsafe fn, use explicit unsafe { ... } blocks around each unsafe operation. This makes it clear exactly which operations are unsafe and lets you attach a // SAFETY: comment to each one.

Mutable statics are inherently racy — any thread can access them at any time:

static mut COUNTER: u32 = 0;

// WRONG: accessing static mut outside unsafe
// COUNTER += 1;  // error[E0133]: use of mutable static is unsafe

// RIGHT: wrap in unsafe block
// SAFETY: single-threaded context, no concurrent access
unsafe {
    COUNTER += 1;
    println!("{}", COUNTER);
}

Inside an unsafe block you can do exactly five things that safe Rust forbids:

1. Dereference raw pointers — *const T and *mut T can point anywhere. The compiler cannot verify the memory is valid.
2. Call unsafe functions — Functions marked unsafe fn or foreign functions from extern blocks.
3. Access mutable static variables — Global mutable state is inherently racy. You must guarantee no data races.
4. Implement unsafe traits — Traits like Send and Sync where the compiler cannot verify the contract.
5. Access union fields — Unions overlap memory; reading the wrong field is undefined behavior.

Everything else — ownership, borrowing, lifetimes — still applies inside unsafe. The borrow checker does not turn off.

Two changes in Rust 2024 make safety obligations more explicit:

// Rust 2024: extern blocks must be marked unsafe
unsafe extern "C" {
    fn abs(input: i32) -> i32;
}

let result = unsafe { abs(-5) };

// Rust 2024: #[no_mangle] is an unsafe attribute
#[unsafe(no_mangle)]
// SAFETY: symbol name "foo" does not conflict with other exported symbols
pub extern "C" fn foo() -> i32 {
    42
}

The Rust standard library requires a // SAFETY: comment before every unsafe block. Follow this pattern in your own code:

// SAFETY: <state the invariant>.
// - ptr is non-null, aligned, and points to initialized T
// - the pointed-to memory lives at least as long as this use
// - aliasing rules are upheld (no mutable aliasing)
unsafe { *ptr }

Each // SAFETY: comment should explain why the preconditions hold at this call site, not just restate the function's docs.

The idiomatic pattern is to wrap unsafe internals in a safe public API. Callers never touch unsafe directly — they rely on your module to uphold invariants:

pub struct SafeBuffer {
    ptr: *mut u8,
    len: usize,
}

impl SafeBuffer {
    pub fn new(size: usize) -> Self {
        let layout = std::alloc::Layout::array::<u8>(size).unwrap();
        // SAFETY: layout is valid (non-zero size), returns zeroed memory
        let ptr = unsafe { std::alloc::alloc_zeroed(layout) };
        if ptr.is_null() {
            std::alloc::handle_alloc_error(layout);
        }
        SafeBuffer { ptr, len: size }
    }

    pub fn get(&self, index: usize) -> Option<u8> {
        if index < self.len {
            // SAFETY: bounds check above guarantees index < len
            Some(unsafe { *self.ptr.add(index) })
        } else {
            None
        }
    }
}

impl Drop for SafeBuffer {
    fn drop(&mut self) {
        let layout = std::alloc::Layout::array::<u8>(self.len).unwrap();
        // SAFETY: ptr was allocated with this layout in new()
        unsafe { std::alloc::dealloc(self.ptr, layout) };
    }
}

The key rule: unsafe is an implementation detail, not a public interface. Keep unsafe blocks minimal, document the invariant each one relies on, and expose safe functions to the rest of your codebase. The smart pointers guide shows how standard library types like Box, Rc, and Arc use this exact pattern -- safe APIs wrapping unsafe internals.

Three things that burn people in practice:

#[repr(C)] for structs crossing FFI — Rust's default struct layout is unspecified. C expects a specific layout. Always add #[repr(C)] to types shared across the boundary:

#[repr(C)]
struct Point {
    x: f64,
    y: f64,
}

Strings are not NUL-terminated — Rust String and &str are UTF-8 without a trailing NUL byte. Use CString for strings going to C, and CStr for strings coming from C:

use std::ffi::CString;
let c_str = CString::new("hello").unwrap();
unsafe { c_function(c_str.as_ptr()) };

Panics across FFI are undefined behavior — A Rust panic unwinding into C code is UB. Use catch_unwind at FFI boundaries, or mark FFI-exported functions as extern "C-unwind" if both sides handle unwinding. Understanding references and lifetimes is critical for FFI, since raw pointers bypass all lifetime guarantees.

Miri is an interpreter that detects undefined behavior at runtime. Run it on your test suite:

cargo +nightly miri test

Miri catches: use-after-free, out-of-bounds access, invalid alignment, data races, stacked borrows violations. It cannot catch all UB (e.g., logic errors), but it catches many common raw pointer mistakes.

• The Rust Book: Unsafe Rust — the five superpowers, raw pointers, FFI
• The Rustonomicon — the dark arts of unsafe Rust
• Rust Edition Guide: Unsafe extern — Rust 2024 extern block changes
• Rust Edition Guide: Unsafe attributes — #[unsafe(no_mangle)]
• Miri — UB detection tool for unsafe code