Fix panic in xattr size queries with MaybeUninit buffers

src/buffer.rs

@@ -173,6 +173,8 @@ impl<'a, T> private::Sealed<T> for &'a mut [MaybeUninit<T>] {
 
     #[inline]
     unsafe fn assume_init(self, len: usize) -> Self::Output {
+        // The syscall may report more than the buffer holds, as in an xattr size query.
+        let len = len.min(self.len());
         let (init, uninit) = self.split_at_mut(len);
 
         // SAFETY: The user asserts that the slice is now initialized.
@@ -192,6 +194,8 @@ impl<'a, T, const N: usize> private::Sealed<T> for &'a mut [MaybeUninit<T>; N] {
 
     #[inline]
     unsafe fn assume_init(self, len: usize) -> Self::Output {
+        // The syscall may report more than the buffer holds, as in an xattr size query.
+        let len = len.min(self.len());
         let (init, uninit) = self.split_at_mut(len);
 
         // SAFETY: The user asserts that the slice is now initialized.
@@ -212,6 +216,8 @@ impl<'a, T> private::Sealed<T> for &'a mut Vec<MaybeUninit<T>> {
 
     #[inline]
     unsafe fn assume_init(self, len: usize) -> Self::Output {
+        // The syscall may report more than the buffer holds, as in an xattr size query.
+        let len = len.min(self.len());
         let (init, uninit) = self.split_at_mut(len);
 
         // SAFETY: The user asserts that the slice is now initialized.
@@ -316,7 +322,8 @@ mod private {
         ///
         /// # Safety
         ///
-        /// At least `len` elements of the buffer must now be initialized.
+        /// At least `len` elements of the buffer, or the whole buffer if `len` is
+        /// larger, must now be initialized.
         #[must_use]
         unsafe fn assume_init(self, len: usize) -> Self::Output;
     }

tests/fs/xattr.rs

@@ -131,6 +131,27 @@ fn xattr_basic() {
     );
 }
 
+#[test]
+fn xattr_size_query_uninit() {
+    use rustix::fs::XattrFlags;
+    use std::mem::MaybeUninit;
+
+    let tmp = tempfile::tempdir().unwrap();
+    let path = tmp.path().join("file");
+    std::fs::write(&path, b"").unwrap();
+    rustix::fs::setxattr(&path, "user.test", b"hello", XattrFlags::empty()).unwrap();
+
+    let empty: &mut [MaybeUninit<u8>] = &mut [];
+    let (init, uninit) = rustix::fs::getxattr(&path, "user.test", empty).unwrap();
+    assert!(init.is_empty());
+    assert!(uninit.is_empty());
+
+    let empty: &mut [MaybeUninit<u8>] = &mut [];
+    let (init, uninit) = rustix::fs::listxattr(&path, empty).unwrap();
+    assert!(init.is_empty());
+    assert!(uninit.is_empty());
+}
+
 /// To check the correctness of the tested implementations of *listxattr(), their output can be
 /// compared to an external implementation, in this case listxattr() from the libc crate.
 fn libc_listxattr(path: &str) -> usize {