Memory Safety in FFI

In this lesson, you will learn how to bridge Rust’s ownership model with C/C++ memory management to prevent common FFI-induced vulnerabilities.

When you pass data across the Foreign Function Interface (FFI) boundary, Rust’s compiler loses its ability to track lifetimes. If you allocate memory in C and try to manage it in Rust—or vice versa—the Borrow Checker cannot prevent double-frees or use-after-free errors. To maintain safety, we use Rust’s "Smart Pointer" patterns as wrappers for raw pointers.

Bridging Ownership

The most common mistake in FFI is losing track of who "owns" the data. If a C library allocates memory using malloc, Rust’s Box won’t know how to free it, as Box expects memory allocated by the Rust allocator. To fix this, we encapsulate raw pointers within a struct and implement the Drop trait to invoke the specific C cleanup function:

struct CBuffer {
    ptr: *mut u8,
}

impl Drop for CBuffer {
    fn drop(&mut self) {
        unsafe {
            // Tell C to free the memory it allocated
            extern "C" { fn free_buffer(ptr: *mut u8); }
            free_buffer(self.ptr);
        }
    }
}

By placing the raw pointer inside a struct that implements Drop, we force Rust to treat the C-allocated memory as an owned object. This allows us to leverage Rust's scoping rules: when the CBuffer goes out of scope, the drop method executes, ensuring the C library cleans up the memory without manual intervention.

Interior Mutability Considerations

When passing Rust structures into C via FFI, you must be careful with interior mutability. If a C function is allowed to mutate memory that Rust considers "shared" (or immutable), you create a data race. Always wrap objects that need to be mutated by C in an UnsafeCell or Mutex if they are shared across threads, and ensure the Rust side treats these references as raw pointers (*mut T) until the C function returns. This keeps the boundary clearly marked as unsafe and forces the developer to acknowledge the lack of borrow-checker oversight at the edge of the system.

Key Takeaway: Always wrap raw foreign pointers in a struct that implements Drop to enforce ownership and automate memory deallocation, turning manual C-style management into RAII-style Rust safety.