As infrastructure tooling shifts towards Rust for its memory safety and fearless concurrency, teams often encounter a roadblock: critical legacy business logic or specialized protocols are locked inside old C libraries. Rewriting them is too risky and expensive. The solution is leveraging Rust's Foreign Function Interface (FFI) to wrap these unsafe C functions in safe Rust abstractions.

The Problem: Managing Unsafe C Pointers in Rust

Assume we have a proprietary C library for parsing custom network packets. The C header (libparser.h) looks like this:

typedef struct Packet {
    int id;
    char* payload;
} Packet;

// Allocates and parses a packet. Returns NULL on failure.
Packet* parse_packet(const uint8_t* data, size_t len);

// Must be called to prevent memory leaks.
void free_packet(Packet* pkt);

If we call these directly, we burden the Rust user with manual memory management, entirely defeating the purpose of using Rust.

The Safe Rust Wrapper Solution

We use the Drop trait to ensure memory is always freed, and lifetimes to ensure the payload isn't accessed after it's freed.

use std::ffi::CStr;
use std::os::raw::{c_char, c_int, c_uchar};

// Bindings typically generated by bindgen
#[repr(C)]
struct CPacket {
    id: c_int,
    payload: *mut c_char,
}

extern "C" {
    fn parse_packet(data: *const c_uchar, len: usize) -> *mut CPacket;
    fn free_packet(pkt: *mut CPacket);
}

// Our Safe Abstraction
pub struct Packet {
    inner: *mut CPacket,
}

impl Packet {
    pub fn parse(data: &[u8]) -> Result<Self, &'static str> {
        // SAFETY: We pass a valid pointer and length. 
        // We check the return value for NULL.
        let ptr = unsafe { parse_packet(data.as_ptr(), data.len()) };
        if ptr.is_null() {
            Err("Failed to parse packet")
        } else {
            Ok(Packet { inner: ptr })
        }
    }

    pub fn id(&self) -> i32 {
        // SAFETY: inner is guaranteed to be non-null and valid.
        unsafe { (*self.inner).id }
    }

    pub fn payload(&self) -> &str {
        // SAFETY: C strings must be null-terminated. We tie the lifetime
        // of the returned &str to `&self`, ensuring it doesn't outlive the struct.
        unsafe {
            let c_str = CStr::from_ptr((*self.inner).payload);
            c_str.to_str().unwrap_or("Invalid UTF-8")
        }
    }
}

// Implement Drop to automatically free the C memory
impl Drop for Packet {
    fn drop(&mut self) {
        // SAFETY: The pointer is valid and this is only called once.
        unsafe {
            free_packet(self.inner);
        }
    }
}

Code Annotations & Safety Guarantees

• #[repr(C)]: Crucial for ensuring the Rust struct has the exact memory layout as the C struct. Without this, Rust might reorder fields, leading to memory corruption.
• *mut CPacket vs &mut CPacket: FFI boundaries deal in raw pointers (*mut). We encapsulate the raw pointer inside a safe struct (Packet).
• CStr::from_ptr: Converts a C-style null-terminated string into a Rust string slice. The lifetime of the returned &str is implicitly tied to &self through lifetime elision, preventing use-after-free bugs.
• Drop implementation: This is the magic. When a Packet goes out of scope, Rust automatically calls drop, invoking the C free_packet function. The consumer of our library literally cannot cause a memory leak.

By carefully building these safe boundaries around unsafe C code, DevOps teams can migrate critical infrastructure to Rust incrementally, retaining legacy business logic while eliminating entirely classes of memory bugs.