Security context

Highlights

Memory Safety: 3 prior fixes. Scrutinize any change in this area.

src/format/context.rs: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Memory Safety: FFI helpers drop temporary CString allocations before their pointers are consumed by C functions, causing use-after-free vulnerabilities. Developers must explicitly manage the lifetime of temporary strings passed across the boundary.

Memory Safety: Miscalculating slice lengths by passing raw bytes instead of element counts to slice generators leads to out-of-bounds reads or writes. This underscores the need for strict verification of element boundaries when interacting with raw pointers.

Memory Safety: Incompatible FFI signatures between the Rust wrappers and the underlying C library (e.g. sws_scale) cause memory corruption. Mismatched argument definitions bypass compile-time Rust safety checks.