Skip to content

fix(platform-wallet): check C enum values at the FFI boundary #5741

Open

Description

@xdustinface

Problem

rs-platform-wallet-ffi exports take FFINetwork by value: 30 on v5.1-dev, 36 once #5727 lands. FFINetwork is a #[repr(C)] Rust enum with discriminants 0 to 3. A C caller that passes any other integer creates an invalid Rust enum value on entry, which is undefined behaviour before network.into() runs. The Swift wrappers and the JNI net_from_ord helper only produce valid values today, so this is hardening of the public C boundary, not a failure seen in the shipped wrappers.

#5727 already does this for the mnemonic language: platform_wallet_mnemonic_generate and platform_wallet_mnemonic_word_list take a u32 and convert it with TryFrom<u32> for FFIMnemonicLanguage, returning ErrorInvalidParameter for an unknown value, and cbindgen still exports the enum as the list of valid values.

Proposed direction

Apply the same pattern to every C enum parameter in the crate, starting with the network:

  • Take the network as u32 and convert it with one checked TryFrom<u32>, returning ErrorInvalidParameter on an unknown value.
  • Keep exporting the enum in the header so hosts still have the named values.
  • Update the Swift and Kotlin call sites to pass the raw value.
  • Test an out-of-range integer at each converted entry point without ever building an invalid enum value in Rust.

This changes the C signatures of every affected export, so it belongs in one coordinated change rather than per function. Once #5728 moves FFINetwork into rs-sdk-ffi, the conversion can live next to the type.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions